Vulnerabilities > CVE-2018-3693

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.

Vulnerable Configurations

Part	Description	Count
Hardware	Intel Intel Atom C C3308 Intel Atom C C3338 Intel Atom C C3508 Intel Atom C C3538 Intel Atom C C3558 Intel Atom C C3708 Intel Atom C C3808 Intel Atom C C3850 Intel Atom C C3950 Intel Atom C C2718 Intel Atom C C3830 Intel Atom C C3858 Intel Atom C C3750 Intel Atom C C3758 Intel Atom C C2738 Intel Atom C C2758 Intel Atom C C3955 Intel Atom C C3958 Intel Atom C C2308 Intel Atom C C2338 Intel Atom C C2538 Intel Atom C C2558 Intel Atom C C2316 Intel Atom C C2350 Intel Atom C C2550 Intel Atom C C2358 Intel Atom C C2508 Intel Atom C C2516 Intel Atom C C2518 Intel Atom C C2530 Intel Atom C C2730 Intel Atom C C2750 Intel Atom E E3845 Intel Atom E E3827 Intel Atom E E3826 Intel Atom E E3825 Intel Atom E E3815 Intel Atom E E3805 Intel Atom X3 C3445 Intel Atom X3 C3405 Intel Atom X3 C3265Rk Intel Atom X3 C3295Rk Intel Atom X3 C3235Rk Intel Atom X3 C3230Rk Intel Atom X3 C3205Rk Intel Atom X3 C3130 Intel Atom X3 C3200Rk Intel Atom Z Z3795 Intel Atom Z Z3785 Intel Atom Z Z3775D Intel Atom Z Z3775 Intel Atom Z Z3770D Intel Atom Z Z3770 Intel Atom Z Z3590 Intel Atom Z Z3735E Intel Atom Z Z3745 Intel Atom Z Z3735F Intel Atom Z Z3735G Intel Atom Z Z3736F Intel Atom Z Z3736G Intel Atom Z Z3740 Intel Atom Z Z3580 Intel Atom Z Z3735D Intel Atom Z Z3740D Intel Atom Z Z3745D Intel Atom Z Z2560 Intel Atom Z Z2760 Intel Atom Z Z3480 Intel Atom Z Z3530 Intel Atom Z Z3560 Intel Atom Z Z3570 Intel Atom Z Z2420 Intel Atom Z Z2460 Intel Atom Z Z2480 Intel Atom Z Z2520 Intel Atom Z Z2580 Intel Atom Z Z3460 Intel Celeron J J4105 Intel Celeron J J4005 Intel Celeron J J3455 Intel Celeron J J3355 Intel Celeron J J3160 Intel Celeron J J3060 Intel Celeron J J1800 Intel Celeron J J1850 Intel Celeron J J1900 Intel Celeron J J1750 Intel Celeron N N4100 Intel Celeron N N4000 Intel Celeron N N3000 Intel Celeron N N3010 Intel Celeron N N3050 Intel Celeron N N3060 Intel Celeron N N2815 Intel Celeron N N2830 Intel Celeron N N2940 Intel Celeron N N3150 Intel Celeron N N3160 Intel Celeron N N3350 Intel Celeron N N2840 Intel Celeron N N2910 Intel Celeron N N2920 Intel Celeron N N2930 Intel Celeron N N2820 Intel Celeron N N3450 Intel Celeron N N2805 Intel Celeron N N2806 Intel Celeron N N2807 Intel Celeron N N2808 Intel Celeron N N2810 Intel Core I3 4330 Intel Core I3 4330T Intel Core I3 4330Te Intel Core I3 4340 Intel Core I3 4340Te Intel Core I3 4350 Intel Core I3 4100M Intel Core I3 4102E Intel Core I3 4370 Intel Core I3 4110E Intel Core I3 4110M Intel Core I3 4112E Intel Core I3 4350T Intel Core I3 4360 Intel Core I3 4100E Intel Core I3 4100U Intel Core I3 4360T Intel Core I3 4370T Intel Core I3 4005U Intel Core I3 4010Y Intel Core I3 4150 Intel Core I3 4158U Intel Core I3 6300 Intel Core I3 4000M Intel Core I3 4120U Intel Core I3 4130 Intel Core I3 4020Y Intel Core I3 4025U Intel Core I3 4030U Intel Core I3 4030Y Intel Core I3 4160 Intel Core I3 4160T Intel Core I3 4170 Intel Core I3 4170T Intel Core I3 6320 Intel Core I3 8100 Intel Core I3 8350K Intel Core I3 4010U Intel Core I3 4012Y Intel Core I3 4130T Intel Core I3 4150T Intel Core I3 6300T Intel Core I3 2312M Intel Core I3 2330E Intel Core I3 2357M Intel Core I3 2367M Intel Core I3 3120Me Intel Core I3 3210 Intel Core I3 3225 Intel Core I3 3229Y Intel Core I3 3240T Intel Core I3 5005U Intel Core I3 6100 Intel Core I3 6100H Intel Core I3 6157U Intel Core I3 2375M Intel Core I3 2377M Intel Core I3 3110M Intel Core I3 3115C Intel Core I3 3245 Intel Core I3 3250 Intel Core I3 3250T Intel Core I3 2330M Intel Core I3 2340Ue Intel Core I3 2348M Intel Core I3 2350M Intel Core I3 3217U Intel Core I3 3217Ue Intel Core I3 3220 Intel Core I3 3220T Intel Core I3 5010U Intel Core I3 6100T Intel Core I3 6100Te Intel Core I3 6100U Intel Core I3 6102E Intel Core I3 5157U Intel Core I3 6006U Intel Core I3 5015U Intel Core I3 5020U Intel Core I3 2310M Intel Core I3 2328M Intel Core I3 2365M Intel Core I3 2370M Intel Core I3 3120M Intel Core I3 3130M Intel Core I3 3227U Intel Core I3 3240 Intel Core I3 6098P Intel Core I3 6100E Intel Core I3 6167U Intel Core I3 380M Intel Core I3 390M Intel Core I3 2102 Intel Core I3 2115C Intel Core I3 2310E Intel Core I3 330E Intel Core I3 330M Intel Core I3 330Um Intel Core I3 350M Intel Core I3 370M Intel Core I3 2120 Intel Core I3 2120T Intel Core I3 2125 Intel Core I3 2130 Intel Core I3 540 Intel Core I3 550 Intel Core I3 560 Intel Core I3 2100 Intel Core I3 380Um Intel Core I3 530 Intel Core I3 2100T Intel Core I3 2105 Intel Core I5 4670 Intel Core I5 4670K Intel Core I5 4670R Intel Core I5 4670S Intel Core I5 4670T Intel Core I5 4690 Intel Core I5 4690K Intel Core I5 4690S Intel Core I5 4690T Intel Core I5 4570 Intel Core I5 4570R Intel Core I5 4570S Intel Core I5 4570T Intel Core I5 4570Te Intel Core I5 4590 Intel Core I5 4590S Intel Core I5 4590T Intel Core I5 4422E Intel Core I5 4410E Intel Core I5 4402Ec Intel Core I5 4402E Intel Core I5 4400E Intel Core I5 4460T Intel Core I5 4460S Intel Core I5 4460 Intel Core I5 4440S Intel Core I5 4440 Intel Core I5 4430S Intel Core I5 4430 Intel Core I5 4300M Intel Core I5 4300U Intel Core I5 4300Y Intel Core I5 4302Y Intel Core I5 4308U Intel Core I5 4310M Intel Core I5 4310U Intel Core I5 4330M Intel Core I5 4340M Intel Core I5 4350U Intel Core I5 4360U Intel Core I5 4200H Intel Core I5 4200M Intel Core I5 4200U Intel Core I5 4200Y Intel Core I5 4202Y Intel Core I5 4210H Intel Core I5 4210M Intel Core I5 4210U Intel Core I5 4210Y Intel Core I5 4220Y Intel Core I5 4250U Intel Core I5 4258U Intel Core I5 4260U Intel Core I5 4278U Intel Core I5 4288U Intel Core I5 8350U Intel Core I5 8250U Intel Core I5 8400 Intel Core I5 8600K Intel Core I5 6600 Intel Core I5 6685R Intel Core I5 6600K Intel Core I5 6600T Intel Core I5 6585R Intel Core I5 6500 Intel Core I5 6500T Intel Core I5 6500Te Intel Core I5 6402P Intel Core I5 6400 Intel Core I5 6400T Intel Core I5 6440Eq Intel Core I5 6440Hq Intel Core I5 6442Eq Intel Core I5 6360U Intel Core I5 6350Hq Intel Core I5 6300Hq Intel Core I5 6300U Intel Core I5 6200U Intel Core I5 6260U Intel Core I5 6267U Intel Core I5 6287U Intel Core I5 5675R Intel Core I5 5675C Intel Core I5 5575R Intel Core I5 5350U Intel Core I5 5350H Intel Core I5 5300U Intel Core I5 5287U Intel Core I5 5257U Intel Core I5 5250U Intel Core I5 5200U Intel Core I5 3610Me Intel Core I5 3570S Intel Core I5 3570T Intel Core I5 3570K Intel Core I5 3570 Intel Core I5 3550S Intel Core I5 3550 Intel Core I5 3475S Intel Core I5 3470T Intel Core I5 3470S Intel Core I5 3470 Intel Core I5 3450S Intel Core I5 3450 Intel Core I5 3439Y Intel Core I5 3437U Intel Core I5 3427U Intel Core I5 3380M Intel Core I5 3360M Intel Core I5 3350P Intel Core I5 3340S Intel Core I5 3340M Intel Core I5 3340 Intel Core I5 3339Y Intel Core I5 3337U Intel Core I5 3330S Intel Core I5 3330 Intel Core I5 3320M Intel Core I5 3210M Intel Core I5 3317U Intel Core I5 3230M Intel Core I5 2557M Intel Core I5 2550K Intel Core I5 2540M Intel Core I5 2537M Intel Core I5 2520M Intel Core I5 2515E Intel Core I5 2510E Intel Core I5 2500T Intel Core I5 2500S Intel Core I5 2500K Intel Core I5 2500 Intel Core I5 2467M Intel Core I5 2450P Intel Core I5 2450M Intel Core I5 2435M Intel Core I5 2430M Intel Core I5 2410M Intel Core I5 2405S Intel Core I5 2400S Intel Core I5 2400 Intel Core I5 2390T Intel Core I5 2380P Intel Core I5 2320 Intel Core I5 2310 Intel Core I5 2300 Intel Core I5 680 Intel Core I5 480M Intel Core I5 760 Intel Core I5 750S Intel Core I5 750 Intel Core I5 670 Intel Core I5 661 Intel Core I5 660 Intel Core I5 655K Intel Core I5 650 Intel Core I5 580M Intel Core I5 560Um Intel Core I5 560M Intel Core I5 540Um Intel Core I5 540M Intel Core I5 520Um Intel Core I5 520M Intel Core I5 520E Intel Core I5 470Um Intel Core I5 460M Intel Core I5 450M Intel Core I5 430Um Intel Core I5 430M Intel Core I7 4900Mq Intel Core I7 4910Mq Intel Core I7 4950Hq Intel Core I7 4960Hq Intel Core I7 4980Hq Intel Core I7 4800Mq Intel Core I7 4810Mq Intel Core I7 4850Hq Intel Core I7 4860Hq Intel Core I7 4870Hq Intel Core I7 4700Ec Intel Core I7 4700Eq Intel Core I7 4700Hq Intel Core I7 4700Mq Intel Core I7 4702Ec Intel Core I7 4702Hq Intel Core I7 4702Mq Intel Core I7 4710Hq Intel Core I7 4600M Intel Core I7 4610M Intel Core I7 4720Hq Intel Core I7 4750Hq Intel Core I7 4770S Intel Core I7 4770Te Intel Core I7 4710Mq Intel Core I7 4712Hq Intel Core I7 4712Mq Intel Core I7 4785T Intel Core I7 4790 Intel Core I7 4790K Intel Core I7 4790S Intel Core I7 4600U Intel Core I7 4722Hq Intel Core I7 4760Hq Intel Core I7 4770R Intel Core I7 4770T Intel Core I7 4771 Intel Core I7 4790T Intel Core I7 4765T Intel Core I7 4770 Intel Core I7 4770Hq Intel Core I7 4770K Intel Core I7 5600U Intel Core I7 5650U Intel Core I7 7700 Intel Core I7 7700Hq Intel Core I7 7700K Intel Core I7 7700T Intel Core I7 920Xm Intel Core I7 2960Xm Intel Core I7 3820Qm Intel Core I7 5700Hq Intel Core I7 5775C Intel Core I7 7567U Intel Core I7 7660U Intel Core I7 7820Eq Intel Core I7 7820Hq Intel Core I7 990X Intel Core I7 4500U Intel Core I7 4510U Intel Core I7 4550U Intel Core I7 4558U Intel Core I7 5550U Intel Core I7 5557U Intel Core I7 940Xm Intel Core I7 980X Intel Core I7 7Y75 Intel Core I7 2920Xm Intel Core I7 3840Qm Intel Core I7 4578U Intel Core I7 5500U Intel Core I7 5700Eq Intel Core I7 5750Hq Intel Core I7 5775R Intel Core I7 7560U Intel Core I7 7600U Intel Core I7 7820Hk Intel Core I7 7920Hq Intel Core I7 4610Y Intel Core I7 4650U Intel Core I7 5850Eq Intel Core I7 5850Hq Intel Core I7 5950Hq Intel Core I7 7500U Intel Core I7 8550U Intel Core I7 8650U Intel Core I7 8700 Intel Core I7 8700K Intel Core I7 965 Intel Core I7 975 Intel Core I7 620Um Intel Core I7 640Lm Intel Core I7 640M Intel Core I7 640Um Intel Core I7 875K Intel Core I7 880 Intel Core I7 920 Intel Core I7 930 Intel Core I7 2600S Intel Core I7 2610Ue Intel Core I7 2617M Intel Core I7 2620M Intel Core I7 2635Qm Intel Core I7 2637M Intel Core I7 2670Qm Intel Core I7 2677M Intel Core I7 2710Qe Intel Core I7 2860Qm Intel Core I7 3610Qe Intel Core I7 3612Qe Intel Core I7 3667U Intel Core I7 3689Y Intel Core I7 3770S Intel Core I7 620Le Intel Core I7 620M Intel Core I7 660Ue Intel Core I7 680Um Intel Core I7 860 Intel Core I7 870 Intel Core I7 940 Intel Core I7 950 Intel Core I7 2600K Intel Core I7 2629M Intel Core I7 2715Qe Intel Core I7 2720Qm Intel Core I7 2760Qm Intel Core I7 2820Qm Intel Core I7 3612Qm Intel Core I7 3615Qe Intel Core I7 3615Qm Intel Core I7 3630Qm Intel Core I7 3632Qm Intel Core I7 660Lm Intel Core I7 660Um Intel Core I7 860S Intel Core I7 870S Intel Core I7 960 Intel Core I7 2600 Intel Core I7 2630Qm Intel Core I7 2675Qm Intel Core I7 2700K Intel Core I7 3517U Intel Core I7 3555Le Intel Core I7 3610Qm Intel Core I7 3635Qm Intel Core I7 3687U Intel Core I7 3770T Intel Core I7 610E Intel Core I7 620Lm Intel Core I7 620Ue Intel Core I7 2640M Intel Core I7 2649M Intel Core I7 2655Le Intel Core I7 2657M Intel Core I7 3517Ue Intel Core I7 3520M Intel Core I7 3537U Intel Core I7 3540M Intel Core I7 3720Qm Intel Core I7 3740Qm Intel Core I7 3770 Intel Core I7 3770K Intel Core I7 720Qm Intel Core I7 740Qm Intel Core I7 820Qm Intel Core I7 840Qm Intel Core I7 970 Intel Core I7 980 Intel Core M 5Y71 Intel Core M 5Y70 Intel Core M 5Y51 Intel Core M 5Y31 Intel Core M 5Y10C Intel Core M 5Y10A Intel Core M 5Y10 Intel Core M3 7Y32 Intel Core M3 7Y30 Intel Core M3 6Y30 Intel Core M5 6Y54 Intel Core M5 6Y57 Intel Core M7 6Y75 Intel Pentium J J4205 Intel Pentium J J3710 Intel Pentium J J2900 Intel Pentium J J2850 Intel Pentium N N4200 Intel Pentium N N3540 Intel Pentium N N3530 Intel Pentium N N3520 Intel Pentium N N3510 Intel Pentium N N3700 Intel Pentium N N3710 Intel Xeon X3480 Intel Xeon X3470 Intel Xeon X3460 Intel Xeon X3450 Intel Xeon X3440 Intel Xeon X3430 Intel Xeon L3426 Intel Xeon L3406 Intel Xeon W3690 Intel Xeon W3680 Intel Xeon W3670 Intel Xeon X5570 Intel Xeon Lc5528 Intel Xeon X5560 Intel Xeon Lc5518 Intel Xeon X5550 Intel Xeon Ec5549 Intel Xeon W5590 Intel Xeon Ec5539 Intel Xeon W5580 Intel Xeon Ec5509 Intel Xeon L5530 Intel Xeon L5520 Intel Xeon L5518 Intel Xeon L5508 Intel Xeon L5506 Intel Xeon E5540 Intel Xeon E5530 Intel Xeon E5520 Intel Xeon E5507 Intel Xeon E5506 Intel Xeon E5504 Intel Xeon E5503 Intel Xeon E5502 Intel Xeon X5690 Intel Xeon X5687 Intel Xeon X5680 Intel Xeon X5677 Intel Xeon X5675 Intel Xeon X5672 Intel Xeon X5670 Intel Xeon X5667 Intel Xeon X5660 Intel Xeon X5650 Intel Xeon X5647 Intel Xeon L5640 Intel Xeon L5638 Intel Xeon L5630 Intel Xeon L5618 Intel Xeon L5609 Intel Xeon E5649 Intel Xeon E5645 Intel Xeon E5640 Intel Xeon E5630 Intel Xeon E5620 Intel Xeon E5607 Intel Xeon E5606 Intel Xeon E5603 Intel Xeon X6550 Intel Xeon E6540 Intel Xeon E6510 Intel Xeon X7560 Intel Xeon X7550 Intel Xeon X7542 Intel Xeon L7555 Intel Xeon L7545 Intel Xeon E7540 Intel Xeon E7530 Intel Xeon E7520 Intel Xeon Bronze 3106 - Intel Xeon Bronze 3104 - Intel Xeon E3 1535M_V6 Intel Xeon E3 1505M_V6 Intel Xeon E3 1585_V5 Intel Xeon E3 1585L_V5 Intel Xeon E3 1578L_V5 Intel Xeon E3 1575M_V5 Intel Xeon E3 1565L_V5 Intel Xeon E3 1558L_V5 Intel Xeon E3 1545M_V5 Intel Xeon E3 1535M_V5 Intel Xeon E3 1515M_V5 Intel Xeon E 1105C - Intel Xeon E3 1105C V2 - Intel Xeon E3 1125C - Intel Xeon E3 1125C V2 - Intel Xeon E3 1220 - Intel Xeon E3 1220 V2 - Intel Xeon E3 1220 V3 - Intel Xeon E3 1220 V5 - Intel Xeon E3 1220 V6 - Intel Xeon E3 12201 - Intel Xeon E3 12201 V2 - Intel Xeon E3 1220L V3 - Intel Xeon E3 1225 - Intel Xeon E3 1225 V2 - Intel Xeon E3 1225 V3 - Intel Xeon E3 1225 V5 - Intel Xeon E3 1225 V6 - Intel Xeon E3 1226 V3 - Intel Xeon E3 1230 - Intel Xeon E3 1230 V2 - Intel Xeon E3 1230 V3 - Intel Xeon E3 1230 V5 - Intel Xeon E3 1230 V6 - Intel Xeon E3 1230L V3 - Intel Xeon E3 1231 V3 - Intel Xeon E3 1235 - Intel Xeon E3 1235L V5 - Intel Xeon E3 1240 - Intel Xeon E3 1240 V2 - Intel Xeon E3 1240 V3 - Intel Xeon E3 1240 V5 - Intel Xeon E3 1240 V6 - Intel Xeon E3 1240L V3 - Intel Xeon E3 1240L V5 - Intel Xeon E3 1241 V3 - Intel Xeon E3 1245 - Intel Xeon E3 1245 V2 - Intel Xeon E3 1245 V3 - Intel Xeon E3 1245 V5 - Intel Xeon E3 1245 V6 - Intel Xeon E3 1246 V3 - Intel Xeon E3 1258L V4 - Intel Xeon E3 1260L - Intel Xeon E3 1260L V5 - Intel Xeon E3 1265L V2 - Intel Xeon E3 1265L V3 - Intel Xeon E3 1265L V4 - Intel Xeon E3 1268L V3 - Intel Xeon E3 1268L V5 - Intel Xeon E3 1270 - Intel Xeon E3 1270 V2 - Intel Xeon E3 1270 V3 - Intel Xeon E3 1270 V5 - Intel Xeon E3 1270 V6 - Intel Xeon E3 1271 V3 - Intel Xeon E3 1275 - Intel Xeon E3 1275 V2 - Intel Xeon E3 1275 V3 - Intel Xeon E3 1275 V5 - Intel Xeon E3 1275 V6 - Intel Xeon E3 1275L V3 - Intel Xeon E3 1276 V3 - Intel Xeon E3 1278L V4 - Intel Xeon E3 1280 - Intel Xeon E3 1280 V2 - Intel Xeon E3 1280 V3 - Intel Xeon E3 1280 V5 - Intel Xeon E3 1280 V6 - Intel Xeon E3 1281 V3 - Intel Xeon E3 1285 V3 - Intel Xeon E3 1285 V4 - Intel Xeon E3 1285 V6 - Intel Xeon E3 1285L V3 - Intel Xeon E3 1285L V4 - Intel Xeon E3 1286 V3 - Intel Xeon E3 1286L V3 - Intel Xeon E3 1290 - Intel Xeon E3 1290 V2 - Intel Xeon E3 1501L V6 - Intel Xeon E3 1501M V6 - Intel Xeon E3 1505L V5 - Intel Xeon E3 1505L V6 - Intel Xeon E3 1505M V5 - Intel Xeon E5 4669_V4 Intel Xeon E5 4667_V4 Intel Xeon E5 4660_V4 Intel Xeon E5 4655_V4 Intel Xeon E5 4650_V4 Intel Xeon E5 4640_V4 Intel Xeon E5 4628L_V4 Intel Xeon E5 4627_V4 Intel Xeon E5 4620_V4 Intel Xeon E5 4610_V4 Intel Xeon E5 2699A_V4 Intel Xeon E5 2699R_V4 Intel Xeon E5 2699_V4 Intel Xeon E5 2698_V4 Intel Xeon E5 2697_V4 Intel Xeon E5 2697A_V4 Intel Xeon E5 2695_V4 Intel Xeon E5 2690_V4 Intel Xeon E5 2687W_V4 Intel Xeon E5 2683_V4 Intel Xeon E5 2680_V4 Intel Xeon E5 2667_V4 Intel Xeon E5 2660_V4 Intel Xeon E5 2658_V4 Intel Xeon E5 2650L_V4 Intel Xeon E5 2699_V3 Intel Xeon E5 4669_V3 Intel Xeon E5 4667_V3 Intel Xeon E5 4660_V3 Intel Xeon E5 2698_V3 Intel Xeon E5 4655_V3 Intel Xeon E5 2697_V3 Intel Xeon E5 4650_V3 Intel Xeon E5 4648_V3 Intel Xeon E5 2695_V3 Intel Xeon E5 4640_V3 Intel Xeon E5 2690_V3 Intel Xeon E5 4627_V3 Intel Xeon E5 2687W_V3 Intel Xeon E5 4620_V3 Intel Xeon E5 4610_V3 Intel Xeon E5 2683_V3 Intel Xeon E5 2680_V3 Intel Xeon E5 2670_V3 Intel Xeon E5 2667_V3 Intel Xeon E5 2660_V3 Intel Xeon E5 2658A_V3 Intel Xeon E5 2658_V3 Intel Xeon E5 4603_V2 Intel Xeon E5 4607_V2 Intel Xeon E5 4610_V2 Intel Xeon E5 4620_V2 Intel Xeon E5 4624L_V2 Intel Xeon E5 4627_V2 Intel Xeon E5 4640_V2 Intel Xeon E5 4650_V2 Intel Xeon E5 4657L_V2 Intel Xeon E5 2658_V2 Intel Xeon E5 2660_V2 Intel Xeon E5 2667_V2 Intel Xeon E5 2670_V2 Intel Xeon E5 2680_V2 Intel Xeon E5 2687W_V2 Intel Xeon E5 2690_V2 Intel Xeon E5 2695_V2 Intel Xeon E5 2697_V2 Intel Xeon E5 4603 Intel Xeon E5 4607 Intel Xeon E5 4610 Intel Xeon E5 4617 Intel Xeon E5 4620 Intel Xeon E5 4640 Intel Xeon E5 4650 Intel Xeon E5 4650L Intel Xeon E5 2658 Intel Xeon E5 2660 Intel Xeon E5 2665 Intel Xeon E5 2667 Intel Xeon E5 2670 Intel Xeon E5 2680 Intel Xeon E5 2687W Intel Xeon E5 2690 Intel Xeon E5 1428L - Intel Xeon E5 1428L V2 - Intel Xeon E5 1428L V3 - Intel Xeon E5 1620 - Intel Xeon E5 1620 V2 - Intel Xeon E5 1620 V3 - Intel Xeon E5 1620 V4 - Intel Xeon E5 1630 V3 - Intel Xeon E5 1630 V4 - Intel Xeon E5 1650 - Intel Xeon E5 1650 V2 - Intel Xeon E5 1650 V3 - Intel Xeon E5 1650 V4 - Intel Xeon E5 1660 - Intel Xeon E5 1660 V2 - Intel Xeon E5 1660 V3 - Intel Xeon E5 1660 V4 - Intel Xeon E5 1680 V3 - Intel Xeon E5 1680 V4 - Intel Xeon E5 2403 - Intel Xeon E5 2403 V2 - Intel Xeon E5 2407 - Intel Xeon E5 2407 V2 - Intel Xeon E5 2408L V3 - Intel Xeon E5 2418L - Intel Xeon E5 2418L V2 - Intel Xeon E5 2418L V3 - Intel Xeon E5 2420 - Intel Xeon E5 2420 V2 - Intel Xeon E5 2428L - Intel Xeon E5 2428L V2 - Intel Xeon E5 2428L V3 - Intel Xeon E5 2430 - Intel Xeon E5 2430 V2 - Intel Xeon E5 2430L - Intel Xeon E5 2430L V2 - Intel Xeon E5 2438L V3 - Intel Xeon E5 2440 - Intel Xeon E5 2440 V2 - Intel Xeon E5 2448L - Intel Xeon E5 2448L V2 - Intel Xeon E5 2450 - Intel Xeon E5 2450 V2 - Intel Xeon E5 2450L - Intel Xeon E5 2450L V2 - Intel Xeon E5 2470 - Intel Xeon E5 2470 V2 - Intel Xeon E5 2603 - Intel Xeon E5 2603 V2 - Intel Xeon E5 2603 V3 - Intel Xeon E5 2603 V4 - Intel Xeon E5 2608L V3 - Intel Xeon E5 2608L V4 - Intel Xeon E5 2609 - Intel Xeon E5 2609 V2 - Intel Xeon E5 2609 V3 - Intel Xeon E5 2609 V4 - Intel Xeon E5 2618L V2 - Intel Xeon E5 2618L V3 - Intel Xeon E5 2618L V4 - Intel Xeon E5 2620 - Intel Xeon E5 2620 V2 - Intel Xeon E5 2620 V3 - Intel Xeon E5 2620 V4 - Intel Xeon E5 2623 V3 - Intel Xeon E5 2623 V4 - Intel Xeon E5 2628L V2 - Intel Xeon E5 2628L V3 - Intel Xeon E5 2628L V4 - Intel Xeon E5 2630 - Intel Xeon E5 2630 V2 - Intel Xeon E5 2630 V3 - Intel Xeon E5 2630 V4 - Intel Xeon E5 2630L - Intel Xeon E5 2630L V2 - Intel Xeon E5 2630L V3 - Intel Xeon E5 2630L V4 - Intel Xeon E5 2637 - Intel Xeon E5 2637 V2 - Intel Xeon E5 2637 V3 - Intel Xeon E5 2637 V4 - Intel Xeon E5 2640 - Intel Xeon E5 2640 V2 - Intel Xeon E5 2640 V3 - Intel Xeon E5 2640 V4 - Intel Xeon E5 2643 - Intel Xeon E5 2643 V2 - Intel Xeon E5 2643 V3 - Intel Xeon E5 2643 V4 - Intel Xeon E5 2648L - Intel Xeon E5 2648L V2 - Intel Xeon E5 2648L V3 - Intel Xeon E5 2648L V4 - Intel Xeon E5 2650 - Intel Xeon E5 2650 V2 - Intel Xeon E5 2650 V3 - Intel Xeon E5 2650 V4 - Intel Xeon E5 2650L - Intel Xeon E5 2650L V2 - Intel Xeon E5 2650L V3 - Intel Xeon E7 8870 Intel Xeon E7 8867L Intel Xeon E7 8860 Intel Xeon E7 8850 Intel Xeon E7 8837 Intel Xeon E7 8830 Intel Xeon E7 4870 Intel Xeon E7 4860 Intel Xeon E7 4850 Intel Xeon E7 4830 Intel Xeon E7 4820 Intel Xeon E7 4807 Intel Xeon E7 2870 Intel Xeon E7 2860 Intel Xeon E7 2850 Intel Xeon E7 2830 Intel Xeon E7 2820 Intel Xeon E7 2803 Intel Xeon E7 8894_V4 Intel Xeon E7 8893_V4 Intel Xeon E7 8891_V4 Intel Xeon E7 8890_V4 Intel Xeon E7 8880_V4 Intel Xeon E7 8870_V4 Intel Xeon E7 8867_V4 Intel Xeon E7 8860_V4 Intel Xeon E7 4850_V4 Intel Xeon E7 4830_V4 Intel Xeon E7 4820_V4 Intel Xeon E7 4809_V4 Intel Xeon E7 8893_V3 Intel Xeon E7 8891_V3 Intel Xeon E7 8890_V3 Intel Xeon E7 8880L_V3 Intel Xeon E7 8880_V3 Intel Xeon E7 8870_V3 Intel Xeon E7 8867_V3 Intel Xeon E7 8860_V3 Intel Xeon E7 4850_V3 Intel Xeon E7 4830_V3 Intel Xeon E7 4820_V3 Intel Xeon E7 4809_V3 Intel Xeon E7 8850_V2 Intel Xeon E7 8857_V2 Intel Xeon E7 8870_V2 Intel Xeon E7 8880_V2 Intel Xeon E7 8880L_V2 Intel Xeon E7 8890_V2 Intel Xeon E7 8891_V2 Intel Xeon E7 8893_V2 Intel Xeon E7 4890_V2 Intel Xeon E7 4880_V2 Intel Xeon E7 4870_V2 Intel Xeon E7 4860_V2 Intel Xeon E7 4850_V2 Intel Xeon E7 4830_V2 Intel Xeon E7 4820_V2 Intel Xeon E7 4809_V2 Intel Xeon E7 2890_V2 Intel Xeon E7 2880_V2 Intel Xeon E7 2870_V2 Intel Xeon E7 2850_V2 Intel Xeon Gold 6154 Intel Xeon Gold 6152 Intel Xeon Gold 6150 Intel Xeon Gold 6148F Intel Xeon Gold 6148 Intel Xeon Gold 6146 Intel Xeon Gold 6144 Intel Xeon Gold 6142M Intel Xeon Gold 6142F Intel Xeon Gold 6142 Intel Xeon Gold 6140M Intel Xeon Gold 6140 Intel Xeon Gold 6138T Intel Xeon Gold 6138F Intel Xeon Gold 6138 Intel Xeon Gold 6136 Intel Xeon Gold 6134M Intel Xeon Gold 6134 Intel Xeon Gold 6132 Intel Xeon Gold 6130T Intel Xeon Gold 6130F Intel Xeon Gold 6130 Intel Xeon Gold 6128 Intel Xeon Gold 6126T Intel Xeon Gold 6126F Intel Xeon Gold 6126 Intel Xeon Gold 5122 Intel Xeon Gold 5120T Intel Xeon Gold 5120 Intel Xeon Gold 5119T Intel Xeon Gold 5118 Intel Xeon Gold 5115 Intel Xeon PHI 7290F Intel Xeon PHI 7290 Intel Xeon PHI 7250F Intel Xeon PHI 7250 Intel Xeon PHI 7230F Intel Xeon PHI 7230 Intel Xeon PHI 7210F Intel Xeon PHI 7210 Intel Xeon PHI 7235 Intel Xeon PHI 7285 Intel Xeon PHI 7295 Intel Xeon Platinum 8180 Intel Xeon Platinum 8176M Intel Xeon Platinum 8176F Intel Xeon Platinum 8176 Intel Xeon Platinum 8170M Intel Xeon Platinum 8170 Intel Xeon Platinum 8168 Intel Xeon Platinum 8164 Intel Xeon Platinum 8160T Intel Xeon Platinum 8160M Intel Xeon Platinum 8160F Intel Xeon Platinum 8160 Intel Xeon Platinum 8158 Intel Xeon Platinum 8156 Intel Xeon Platinum 8153 Intel Xeon Silver 4116T Intel Xeon Silver 4116 Intel Xeon Silver 4114T Intel Xeon Silver 4114 Intel Xeon Silver 4112 Intel Xeon Silver 4110 Intel Xeon Silver 4109T Intel Xeon Silver 4108	1058
Hardware	Arm ARM Cortex A 9 ARM Cortex A 15 ARM Cortex A 17 ARM Cortex A 57 ARM Cortex A 72 ARM Cortex A 73 ARM Cortex A 75 ARM Cortex A 76 ARM Cortex A 12 ARM Cortex A 8 ARM Cortex R 7 ARM Cortex R 8	12
Hardware	Fujitsu Fujitsu M12 1 - Fujitsu M12 2 - Fujitsu M12 2S -	3
Application	Oracle Oracle Communications Eagle Application Processor 16.2.0 Oracle Communications Eagle Application Processor 16.1.0 Oracle Communications Lsms 13.1 Oracle Communications Lsms 13.2 Oracle Communications Lsms 13.3	5
Application	Schneider-Electric Schneider Electric Struxureware Data Center Expert 7.6.0	1
Application	Netapp Netapp Solidfire Element OS Management Node -	1
OS	Redhat Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux Desktop 6.0 Redhat Enterprise Linux Workstation 7.0 Redhat Enterprise Linux Workstation 6.0 Redhat Enterprise Linux 7.0 Redhat Enterprise Linux Server 7.0 Redhat Enterprise Linux Server 6.0 Redhat Enterprise Linux Server AUS 7.4 Redhat Enterprise Linux Server AUS 7.6 Redhat Enterprise Linux Server TUS 7.4 Redhat Enterprise Linux Server TUS 7.6 Redhat Enterprise Linux Server EUS 7.5 Redhat Enterprise Linux Server EUS 7.6 Redhat Enterprise Linux EUS 7.4	14
OS	Fujitsu Fujitsu M12 1 Firmware - Fujitsu M12 1 Firmware Xcp2361 Fujitsu M12 1 Firmware Xcp2400 Fujitsu M12 1 Firmware Xcp2410 Fujitsu M12 1 Firmware Xcp3070 Fujitsu M12 2 Firmware - Fujitsu M12 2 Firmware Xcp2361 Fujitsu M12 2 Firmware Xcp2400 Fujitsu M12 2 Firmware Xcp2410 Fujitsu M12 2 Firmware Xcp3070 Fujitsu M12 2S Firmware - Fujitsu M12 2S Firmware Xcp2361 Fujitsu M12 2S Firmware Xcp2400 Fujitsu M12 2S Firmware Xcp2410 Fujitsu M12 2S Firmware Xcp3070	15

Nessus

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20180814_KERNEL_ON_SL7_X.NASL
description	Security Fix(es) : - Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-03-18
modified	2018-08-16
plugin id	111778
published	2018-08-16
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111778
title	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180814) (Foreshadow)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text is (C) Scientific Linux. # include("compat.inc"); if (description) { script_id(111778); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24"); script_cve_id("CVE-2017-13215", "CVE-2018-10675", "CVE-2018-3620", "CVE-2018-3646", "CVE-2018-3693", "CVE-2018-5390", "CVE-2018-7566"); script_name(english:"Scientific Linux Security Update : kernel on SL7.x x86_64 (20180814) (Foreshadow)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Scientific Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Security Fix(es) : - Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to influence speculative execution and/or read privileged memory by conducting targeted cache side- channel attacks. (CVE-2018-3693) - A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390) - kernel: crypto: privilege escalation in skcipher_recvmsg function (CVE-2017-13215) - kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact (CVE-2018-10675) - kernel: race condition in snd_seq_write() may lead to UAF or OOB access (CVE-2018-7566)" ); # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1808&L=scientific-linux-errata&F=&S=&P=847 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?e6645d58" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-abi-whitelists"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-debug-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-debug-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-debuginfo-common-x86_64"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-headers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-tools-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-tools-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:kernel-tools-libs-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:perf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:perf-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:python-perf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:python-perf-debuginfo"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/12"); script_set_attribute(attribute:"patch_publication_date", value:"2018/08/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/16"); script_set_attribute(attribute:"in_the_news", value:"true"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Scientific Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux"); os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu); flag = 0; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", reference:"kernel-abi-whitelists-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-debug-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-debug-debuginfo-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-debug-devel-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-debuginfo-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-debuginfo-common-x86_64-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-devel-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", reference:"kernel-doc-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-headers-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-tools-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-tools-debuginfo-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-tools-libs-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"kernel-tools-libs-devel-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"perf-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"perf-debuginfo-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"python-perf-3.10.0-862.11.6.el7")) flag++; if (rpm_check(release:"SL7", cpu:"x86_64", reference:"python-perf-debuginfo-3.10.0-862.11.6.el7")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-abi-whitelists / kernel-debug / etc"); }

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2020-0174.NASL
description	An update for kernel-alt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-alt packages provide the Linux kernel version 4.x. Security Fix(es) : * Kernel: speculative bounds check bypass store (CVE-2018-3693) * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559) * kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c (CVE-2019-3846) * kernel: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (CVE-2019-8912) * kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net /wireless/marvell/mwifiex/ie.c (CVE-2019-10126) * kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487) * kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver (CVE-2019-14816) * kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/ wext-sme.c (CVE-2019-17133) * kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS (CVE-2019-14814) * kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS (CVE-2019-14815) * kernel: (powerpc) incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * Kernel panic on job cleanup, related to SyS_getdents64 (BZ#1702057) * Kernel modules generated incorrectly when system is localized to non-English language (BZ#1705285) * RHEL-Alt-7.6 - Fixup tlbie vs store ordering issue on POWER9 (BZ#1756270)
last seen	2020-06-01
modified	2020-06-02
plugin id	133162
published	2020-01-22
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133162
title	RHEL 7 : kernel-alt (RHSA-2020:0174)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2020:0174. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(133162); script_version("1.2"); script_cvs_date("Date: 2020/01/24"); script_cve_id("CVE-2018-18559", "CVE-2018-3693", "CVE-2019-10126", "CVE-2019-11487", "CVE-2019-14814", "CVE-2019-14815", "CVE-2019-14816", "CVE-2019-17133", "CVE-2019-18660", "CVE-2019-3846", "CVE-2019-8912"); script_xref(name:"RHSA", value:"2020:0174"); script_name(english:"RHEL 7 : kernel-alt (RHSA-2020:0174)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update for kernel-alt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-alt packages provide the Linux kernel version 4.x. Security Fix(es) : * Kernel: speculative bounds check bypass store (CVE-2018-3693) * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559) * kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c (CVE-2019-3846) * kernel: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (CVE-2019-8912) * kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net /wireless/marvell/mwifiex/ie.c (CVE-2019-10126) * kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487) * kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver (CVE-2019-14816) * kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/ wext-sme.c (CVE-2019-17133) * kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS (CVE-2019-14814) * kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS (CVE-2019-14815) * kernel: (powerpc) incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * Kernel panic on job cleanup, related to SyS_getdents64 (BZ#1702057) * Kernel modules generated incorrectly when system is localized to non-English language (BZ#1705285) * RHEL-Alt-7.6 - Fixup tlbie vs store ordering issue on POWER9 (BZ#1756270)" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/solutions/3523601" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:0174" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-3693" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-18559" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3846" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-8912" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-10126" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-11487" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-14814" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-14815" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-14816" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-17133" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-18660" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3846"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-s390x"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-headers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perf-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-perf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-perf-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/10"); script_set_attribute(attribute:"patch_publication_date", value:"2020/01/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/01/22"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); include("ksplice.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); if (get_one_kb_item("Host/ksplice/kernel-cves")) { rm_kb_item(name:"Host/uptrack-uname-r"); cve_list = make_list("CVE-2018-18559", "CVE-2018-3693", "CVE-2019-10126", "CVE-2019-11487", "CVE-2019-14814", "CVE-2019-14815", "CVE-2019-14816", "CVE-2019-17133", "CVE-2019-18660", "CVE-2019-3846", "CVE-2019-8912"); if (ksplice_cves_check(cve_list)) { audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for RHSA-2020:0174"); } else { __rpm_report = ksplice_reporting_text(); } } yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2020:0174"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", reference:"kernel-abi-whitelists-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-debug-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-debug-debuginfo-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-debug-devel-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-debuginfo-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-debuginfo-common-s390x-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-devel-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", reference:"kernel-doc-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-headers-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-kdump-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-kdump-debuginfo-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"kernel-kdump-devel-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"perf-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"perf-debuginfo-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"python-perf-4.14.0-115.17.1.el7a")) flag++; if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"python-perf-debuginfo-4.14.0-115.17.1.el7a")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-abi-whitelists / kernel-debug / etc"); } }

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1946.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	127633
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127633
title	RHEL 7 : kernel (RHSA-2019:1946)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0143_KERNEL.NASL
description	The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities: - A flaw was found in the Linux kernel
last seen	2020-03-18
modified	2019-08-12
plugin id	127408
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127408
title	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0143)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2018-2390.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 16th August 2018] The original errata text was missing reference to CVE-2018-5390 fix. We have updated the errata text to correct this issue. No changes have been made to the packages. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111704
published	2018-08-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111704
title	CentOS 6 : kernel (CESA-2018:2390) (Foreshadow)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0044_KERNEL.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - A buffer overflow vulnerability due to a lack of input filtering of incoming fragmented datagrams was found in the IP-over-1394 driver [firewire-net] in a fragment handling code in the Linux kernel. The vulnerability exists since firewire supported IPv4, i.e. since version 2.6.31 (year 2009) till version v4.9-rc4. A maliciously formed fragment with a respectively large datagram offset would cause a memcpy() past the datagram buffer, which would cause a system panic or possible arbitrary code execution. The flaw requires [firewire-net] module to be loaded and is remotely exploitable from connected firewire devices, but not over a local network. (CVE-2016-8633) - A bug in the 32-bit compatibility layer of the ioctl handling code of the v4l2 video driver in the Linux kernel has been found. A memory protection mechanism ensuring that user-provided buffers always point to a userspace memory were disabled, allowing destination address to be in a kernel space. This flaw could be exploited by an attacker to overwrite a kernel memory from an unprivileged userspace process, leading to privilege escalation. (CVE-2017-13166) - The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel doesn
last seen	2020-06-01
modified	2020-06-02
plugin id	127222
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127222
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0044)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-2384.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111727
published	2018-08-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111727
title	RHEL 7 : kernel (RHSA-2018:2384) (Foreshadow)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1514.NASL
description	According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.(CVE-2018-19985) - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue.(CVE-2017-5754) - A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary.(CVE-2017-15121) - A flaw was found in the Linux kernel when attempting to
last seen	2020-06-01
modified	2020-06-02
plugin id	124835
published	2019-05-13
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124835
title	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1514)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-2390.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 16th August 2018] The original errata text was missing reference to CVE-2018-5390 fix. We have updated the errata text to correct this issue. No changes have been made to the packages. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111731
published	2018-08-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111731
title	RHEL 6 : kernel (RHSA-2018:2390) (Foreshadow)

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL54252492.NASL
description	Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis. (CVE-2018-3693 also known as Spectre or Spectre-NG Variant 1.1) Bounds checking bypass - store Impact For products with None in the Versions known to be vulnerable column, there is no impact. F5 continues to investigate the impact of the Spectre-NG1.1 vulnerability on our products.F5 is also monitoring developments about Spectre-NG 1.2 and awaiting evaluation by hardware vendors. F5 is focused onproviding patched releases as soon as we have fully tested and verified fixes. F5 will update this article with the most current information as soon as it is confirmed. BIG-IP First and foremost, there is no exposure on BIG-IP products by way ofthe data plane. All exposure is limited to the control plane (also known as the management plane). Furthermore, on the control plane, the vulnerability is exploitable only by four authorized, authenticated account roles: Administrator, Resource Administrator, Manager, and iRules Manager. You must be authorized to access the system in one of these roles to even attempt to exploit the vulnerability. This vulnerability requires an attacker who can provideand runbinary code of their choosing on the BIG-IP platform. These conditions severely restrict the exposure risk of BIG-IP products. For single-tenancy products, such as astandalone BIG-IP appliance, the risk is limited to a local, authorized user using this vulnerability to read information from memory that they would not normally be able to access, exceeding their privileges. Effectively, the risk in a single-tenancy situation is that a user may be able to access kernel-space memory, instead of being limited to their own user-space. For multi-tenancy environments, such as cloud, VE, and Virtual Clustered Multiprocessing (vCMP), the same local risk applies as with single-tenancy environments local kernel memory access. Additionally, the risk of attacks across guests exists, or attacks against the hypervisor/host. In cloud and VE environments, preventing these new attacks falls on the hypervisor/host platform, outside the scope of F5
last seen	2020-06-01
modified	2020-06-02
plugin id	125482
published	2019-05-29
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125482
title	F5 Networks BIG-IP : Side-channel processor vulnerability (K54252492)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20180814_KERNEL_ON_SL6_X.NASL
description	Security Fix(es) : - Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-03-18
modified	2018-08-16
plugin id	111777
published	2018-08-16
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111777
title	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180814) (Foreshadow)

NASL family	Junos Local Security Checks
NASL id	JUNIPER_SPACE_JSA10917_184R1.NASL
description	According to its self-reported version number, the remote Junos Space version is 18.4.x prior to 18.4R1. It is, therefore, affected by multiple vulnerabilities : - An integer overflow issue exists in procps-ng. This is related to CVE-2018-1124. (CVE-2018-1126) - A directory traversal issue exits in reposync, a part of yum-utils.tory configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. (CVE-2018-10897) - An integer overflow flaw was found in the Linux kernel
last seen	2020-06-01
modified	2020-06-02
plugin id	121068
published	2019-01-10
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121068
title	Juniper Junos Space 18.4.x < 18.4R1 Multiple Vulnerabilities (JSA10917)

NASL family	Virtuozzo Local Security Checks
NASL id	VIRTUOZZO_VZA-2018-055.NASL
description	According to the versions of the cpupools / cpupools-features / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	112018
published	2018-08-20
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/112018
title	Virtuozzo 6 : cpupools / cpupools-features / etc (VZA-2018-055)

NASL family	Amazon Linux Local Security Checks
NASL id	AL2_ALAS-2018-1038.NASL
description	An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	110455
published	2018-06-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110455
title	Amazon Linux 2 : kernel (ALAS-2018-1038) (Spectre)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-2395.NASL
description	An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111736
published	2018-08-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111736
title	RHEL 7 : kernel-rt (RHSA-2018:2395) (Foreshadow)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2018-1038.NASL
description	An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	110461
published	2018-06-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110461
title	Amazon Linux AMI : kernel (ALAS-2018-1038) (Spectre)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2018-2384.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111703
published	2018-08-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111703
title	CentOS 7 : kernel (CESA-2018:2384) (Foreshadow)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-2353.NASL
description	According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.Security Fix(es):The yam_ioctl function in drivers et/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.(CVE-2014-1446)The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.(CVE-2015-1350)A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.(CVE-2015-3332)The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.(CVE-2015-8816)In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.(CVE-2015-9289)The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2184)The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2185)The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2186)The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2187)Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.(CVE-2016-2384)The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.(CVE-2016-2782)The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.(CVE-2016-3138)The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-3139)The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-3140)The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.(CVE-2016-3689)The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.(CVE-2016-4569)sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.(CVE-2016-4578)The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.(CVE-2016-4580)The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.(CVE-2016-7425)The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.(CVE-2017-1000379)In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes(CVE-2017-11089)An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993.(CVE-2017-13167)In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-66954097.(CVE-2017-13216)A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974.(CVE-2017-13305)An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.(CVE-2017-14051)The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.(CVE-2017-18232)An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.(CVE-2017-18509)An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.(CVE-2017-18551)An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c.(CVE-2017-18595)The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device.(CVE-2017-7261)The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.(CVE-2017-7472)The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.(CVE-2018-10087)The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.(CVE-2018-10124)The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.(CVE-2018-10322)The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.(CVE-2018-10323)The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.(CVE-2018-10675)Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.(CVE-2018-10880)An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls.(CVE-2018-12896)An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents.(CVE-2018-17972)An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.(CVE-2018-18710 )An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers et/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.(CVE-2018-20511)An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.(CVE-2018-20856)An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.(CVE-2018-20976)Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.(CVE-2018-3693)In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.(CVE-2018-6412)In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-73083945.(CVE-2018-9518 )Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.(CVE-2019-0136)A vulnerability was found in Linux kernel
last seen	2020-05-08
modified	2019-12-10
plugin id	131845
published	2019-12-10
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/131845
title	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-2353)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0049_KERNEL-RT.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities: - A buffer overflow vulnerability due to a lack of input filtering of incoming fragmented datagrams was found in the IP-over-1394 driver [firewire-net] in a fragment handling code in the Linux kernel. The vulnerability exists since firewire supported IPv4, i.e. since version 2.6.31 (year 2009) till version v4.9-rc4. A maliciously formed fragment with a respectively large datagram offset would cause a memcpy() past the datagram buffer, which would cause a system panic or possible arbitrary code execution. The flaw requires [firewire-net] module to be loaded and is remotely exploitable from connected firewire devices, but not over a local network. (CVE-2016-8633) - The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIMIT_INFINITY, but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. (CVE-2017-1000365) - A bug in the 32-bit compatibility layer of the ioctl handling code of the v4l2 video driver in the Linux kernel has been found. A memory protection mechanism ensuring that user-provided buffers always point to a userspace memory were disabled, allowing destination address to be in a kernel space. This flaw could be exploited by an attacker to overwrite a kernel memory from an unprivileged userspace process, leading to privilege escalation. (CVE-2017-13166) - The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel doesn
last seen	2020-06-01
modified	2020-06-02
plugin id	127233
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127233
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0049)

NASL family	Virtuozzo Local Security Checks
NASL id	VIRTUOZZO_VZA-2018-063.NASL
description	According to the versions of the OVMF / crit / criu / criu-devel / ksm-vz / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Linux kernel
last seen	2020-06-01
modified	2020-06-02
plugin id	112206
published	2018-08-31
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/112206
title	Virtuozzo 7 : OVMF / crit / criu / criu-devel / ksm-vz / etc (VZA-2018-063)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-2384.NASL
description	From Red Hat Security Advisory 2018:2384 : An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111723
published	2018-08-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111723
title	Oracle Linux 7 : kernel (ELSA-2018-2384) (Foreshadow)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-2390.NASL
description	From Red Hat Security Advisory 2018:2390 : An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 16th August 2018] The original errata text was missing reference to CVE-2018-5390 fix. We have updated the errata text to correct this issue. No changes have been made to the packages. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111724
published	2018-08-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111724
title	Oracle Linux 6 : kernel (ELSA-2018-2390) (Foreshadow)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1539.NASL
description	According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	124992
published	2019-05-14
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124992
title	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1539)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-2274.NASL
description	According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.Security Fix(es):Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.(CVE-2017-5754)The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.(CVE-2017-5897)The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device.(CVE-2017-7261)The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.(CVE-2017-7472)A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.(CVE-2017-7518)The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.(CVE-2018-10124)The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.(CVE-2018-10323)The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.(CVE-2018-1066)The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.(CVE-2018-10675)An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.(CVE-2018-13094)An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.(CVE-2018-20976)Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.(CVE-2018-3693)In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.(CVE-2018-6412)Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck directory. NOTE: a third party has indicated that this report is not security relevant.(CVE-2018-7995)In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.(CVE-2018-9363)In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-73083945.(CVE-2018-9518)A vulnerability was found in Linux kernel
last seen	2020-05-08
modified	2019-11-08
plugin id	130736
published	2019-11-08
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/130736
title	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-2274)

Redhat

advisories

rhsa
id RHSA-2018:2384
rhsa
id RHSA-2018:2390
rhsa
id RHSA-2018:2395
rhsa
id RHSA-2019:1946
rhsa
id RHSA-2020:0174

rpms

kernel-0:3.10.0-862.11.6.el7
kernel-abi-whitelists-0:3.10.0-862.11.6.el7
kernel-bootwrapper-0:3.10.0-862.11.6.el7
kernel-debug-0:3.10.0-862.11.6.el7
kernel-debug-debuginfo-0:3.10.0-862.11.6.el7
kernel-debug-devel-0:3.10.0-862.11.6.el7
kernel-debuginfo-0:3.10.0-862.11.6.el7
kernel-debuginfo-common-ppc64-0:3.10.0-862.11.6.el7
kernel-debuginfo-common-ppc64le-0:3.10.0-862.11.6.el7
kernel-debuginfo-common-s390x-0:3.10.0-862.11.6.el7
kernel-debuginfo-common-x86_64-0:3.10.0-862.11.6.el7
kernel-devel-0:3.10.0-862.11.6.el7
kernel-doc-0:3.10.0-862.11.6.el7
kernel-headers-0:3.10.0-862.11.6.el7
kernel-kdump-0:3.10.0-862.11.6.el7
kernel-kdump-debuginfo-0:3.10.0-862.11.6.el7
kernel-kdump-devel-0:3.10.0-862.11.6.el7
kernel-tools-0:3.10.0-862.11.6.el7
kernel-tools-debuginfo-0:3.10.0-862.11.6.el7
kernel-tools-libs-0:3.10.0-862.11.6.el7
kernel-tools-libs-devel-0:3.10.0-862.11.6.el7
perf-0:3.10.0-862.11.6.el7
perf-debuginfo-0:3.10.0-862.11.6.el7
python-perf-0:3.10.0-862.11.6.el7
python-perf-debuginfo-0:3.10.0-862.11.6.el7
kernel-0:2.6.32-754.3.5.el6
kernel-abi-whitelists-0:2.6.32-754.3.5.el6
kernel-bootwrapper-0:2.6.32-754.3.5.el6
kernel-debug-0:2.6.32-754.3.5.el6
kernel-debug-debuginfo-0:2.6.32-754.3.5.el6
kernel-debug-devel-0:2.6.32-754.3.5.el6
kernel-debuginfo-0:2.6.32-754.3.5.el6
kernel-debuginfo-common-i686-0:2.6.32-754.3.5.el6
kernel-debuginfo-common-ppc64-0:2.6.32-754.3.5.el6
kernel-debuginfo-common-s390x-0:2.6.32-754.3.5.el6
kernel-debuginfo-common-x86_64-0:2.6.32-754.3.5.el6
kernel-devel-0:2.6.32-754.3.5.el6
kernel-doc-0:2.6.32-754.3.5.el6
kernel-firmware-0:2.6.32-754.3.5.el6
kernel-headers-0:2.6.32-754.3.5.el6
kernel-kdump-0:2.6.32-754.3.5.el6
kernel-kdump-debuginfo-0:2.6.32-754.3.5.el6
kernel-kdump-devel-0:2.6.32-754.3.5.el6
perf-0:2.6.32-754.3.5.el6
perf-debuginfo-0:2.6.32-754.3.5.el6
python-perf-0:2.6.32-754.3.5.el6
python-perf-debuginfo-0:2.6.32-754.3.5.el6
kernel-rt-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-debug-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-debug-debuginfo-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-debug-devel-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-debug-kvm-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-debug-kvm-debuginfo-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-debuginfo-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-debuginfo-common-x86_64-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-devel-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-doc-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-kvm-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-kvm-debuginfo-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-trace-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-trace-debuginfo-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-trace-devel-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-trace-kvm-0:3.10.0-862.11.6.rt56.819.el7
kernel-rt-trace-kvm-debuginfo-0:3.10.0-862.11.6.rt56.819.el7
kernel-0:3.10.0-693.55.1.el7
kernel-abi-whitelists-0:3.10.0-693.55.1.el7
kernel-bootwrapper-0:3.10.0-693.55.1.el7
kernel-debug-0:3.10.0-693.55.1.el7
kernel-debug-debuginfo-0:3.10.0-693.55.1.el7
kernel-debug-devel-0:3.10.0-693.55.1.el7
kernel-debuginfo-0:3.10.0-693.55.1.el7
kernel-debuginfo-common-ppc64-0:3.10.0-693.55.1.el7
kernel-debuginfo-common-ppc64le-0:3.10.0-693.55.1.el7
kernel-debuginfo-common-s390x-0:3.10.0-693.55.1.el7
kernel-debuginfo-common-x86_64-0:3.10.0-693.55.1.el7
kernel-devel-0:3.10.0-693.55.1.el7
kernel-doc-0:3.10.0-693.55.1.el7
kernel-headers-0:3.10.0-693.55.1.el7
kernel-kdump-0:3.10.0-693.55.1.el7
kernel-kdump-debuginfo-0:3.10.0-693.55.1.el7
kernel-kdump-devel-0:3.10.0-693.55.1.el7
kernel-tools-0:3.10.0-693.55.1.el7
kernel-tools-debuginfo-0:3.10.0-693.55.1.el7
kernel-tools-libs-0:3.10.0-693.55.1.el7
kernel-tools-libs-devel-0:3.10.0-693.55.1.el7
perf-0:3.10.0-693.55.1.el7
perf-debuginfo-0:3.10.0-693.55.1.el7
python-perf-0:3.10.0-693.55.1.el7
python-perf-debuginfo-0:3.10.0-693.55.1.el7
kernel-0:4.14.0-115.17.1.el7a
kernel-abi-whitelists-0:4.14.0-115.17.1.el7a
kernel-bootwrapper-0:4.14.0-115.17.1.el7a
kernel-debug-0:4.14.0-115.17.1.el7a
kernel-debug-debuginfo-0:4.14.0-115.17.1.el7a
kernel-debug-devel-0:4.14.0-115.17.1.el7a
kernel-debuginfo-0:4.14.0-115.17.1.el7a
kernel-debuginfo-common-aarch64-0:4.14.0-115.17.1.el7a
kernel-debuginfo-common-ppc64le-0:4.14.0-115.17.1.el7a
kernel-debuginfo-common-s390x-0:4.14.0-115.17.1.el7a
kernel-devel-0:4.14.0-115.17.1.el7a
kernel-doc-0:4.14.0-115.17.1.el7a
kernel-headers-0:4.14.0-115.17.1.el7a
kernel-kdump-0:4.14.0-115.17.1.el7a
kernel-kdump-debuginfo-0:4.14.0-115.17.1.el7a
kernel-kdump-devel-0:4.14.0-115.17.1.el7a
kernel-tools-0:4.14.0-115.17.1.el7a
kernel-tools-debuginfo-0:4.14.0-115.17.1.el7a
kernel-tools-libs-0:4.14.0-115.17.1.el7a
kernel-tools-libs-devel-0:4.14.0-115.17.1.el7a
perf-0:4.14.0-115.17.1.el7a
perf-debuginfo-0:4.14.0-115.17.1.el7a
python-perf-0:4.14.0-115.17.1.el7a
python-perf-debuginfo-0:4.14.0-115.17.1.el7a

The Hacker News

id	THN:71C19B8F2C6EDB0AFDA5AA0280A20C00
last seen	2018-07-11
modified	2018-07-11
published	2018-07-11
reporter	The Hacker News
source	https://thehackernews.com/2018/07/intel-spectre-vulnerability.html
title	Two New Spectre-Class CPU Flaws Discovered—Intel Pays $100K Bounty

Vulnerabilities > CVE-2018-3693 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2018-3693"}]}

Summary

Vulnerable Configurations

Nessus

Redhat

The Hacker News

Related news

References

Vulnerabilities > CVE-2018-3693