{"id": "ANDROID:2018-04-01", "vendorId": null, "type": "androidsecurity", "bulletinFamily": "software", "title": "Pixel / Nexus Security Bulletin\u2014April 2018", "description": "The Pixel&hairsp;/&hairsp;Nexus Security Bulletin contains details of security vulnerabilities and functional improvements affecting [supported Google Pixel and Nexus devices](<https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices>) (Google devices). For Google devices, security patch levels of 2018-04-05 or later address all issues in this bulletin and all issues in the April 2018 Android Security Bulletin. To learn how to check a device's security patch level, see [Check and update your Android version](<https://support.google.com/pixelphone/answer/4457705>).\n\nAll supported Google devices will receive an update to the 2018-04-05 patch level. We encourage all customers to accept these updates to their devices. \n\n**Note:** The Google device firmware images are available on the [Google Developer site](<https://developers.google.com/android/nexus/images>). \n\n## Announcements\n\nIn addition to the security vulnerabilities described in the April 2018 Android Security Bulletin, Google devices also contain patches for the security vulnerabilities described below. Partners were notified of these issues at least a month ago and may choose to incorporate them as part of their device updates.\n\n## Security patches\n\nVulnerabilities are grouped under the component that they affect. There is a description of the issue and a table with the CVE, associated references, type of vulnerability, severity, and updated Android Open Source Project (AOSP) versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID. \n\n### Framework\n\nCVE | References | Type | Severity | Updated AOSP versions \n---|---|---|---|--- \nCVE-2017-13294 | [A-71814449](<https://android.googlesource.com/platform/packages/apps/Email/+/c3e0aba2a604ce7c3807d65df1e6a2b848287019>) [[2](<https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/e00598532bbfc8618b7c051cbf6bd15491f61f27>)] | ID | Moderate | 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 \nCVE-2017-13295 | [A-62537081](<https://android.googlesource.com/platform/frameworks/base/+/a2a36541f0b3603335e74da0a8d2b6a9d5bcec3f>) | DoS | Moderate | 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 \n \n### Media framework\n\nCVE | References | Type | Severity | Updated AOSP versions \n---|---|---|---|--- \nCVE-2017-13300 | A-71567394* | DoS | High | 6.0, 6.0.1 \nCVE-2017-13296 | [A-70897454](<https://android.googlesource.com/platform/external/libavc/+/3e3e81ede5229c5a9c6b7bf6a63844ecf07ae3ae>) | ID | Moderate | 7.0, 7.1.1, 7.1.2, 8.0, 8.1 \nDoS | High | 6.0, 6.0.1 \nCVE-2017-13297 | [A-71766721](<https://android.googlesource.com/platform/external/libhevc/+/daaece3e79db33f6c473bb54a39933d387a9bf95>) | ID | Moderate | 7.0, 7.1.1, 7.1.2, 8.0, 8.1 \nDoS | High | 6.0, 6.0.1 \nCVE-2017-13298 | [A-72117051](<https://android.googlesource.com/platform/frameworks/av/+/12e25a753f4b6f0aa935e54bae66023bd8321598>) | ID | Moderate | 7.0, 7.1.1, 7.1.2, 8.0, 8.1 \nDoS | High | 6.0, 6.0.1 \nCVE-2017-13299 | [A-70897394](<https://android.googlesource.com/platform/external/libavc/+/d849abf312a365553ce68aec32dea93230036abe>) | NSI | NSI | 7.0, 7.1.1, 7.1.2, 8.0, 8.1 \nDoS | High | 6.0, 6.0.1 \n \n### System\n\nCVE | References | Type | Severity | Updated AOSP versions \n---|---|---|---|--- \nCVE-2017-13301 | [A-66498711](<https://android.googlesource.com/platform/frameworks/base/+/384689934d293acf532e3fea3e72ef78df4f2d1e>) [[2](<https://android.googlesource.com/platform/frameworks/base/+/d52b215f82e464705373d794748325298f0a1f9a>)] | DoS | Moderate | 8.0 \nCVE-2017-13302 | [A-69969749](<https://android.googlesource.com/platform/frameworks/base/+/e54ad58aea33860fbb36bf828684e3df6393f602>) | DoS | Moderate | 8.0 \n \n### Broadcom components\n\nCVE | References | Type | Severity | Component \n---|---|---|---|--- \nCVE-2017-13303 | A-71359108* B-V2018010501 | ID | Moderate | bcmdhd driver \n \n### Kernel components\n\nCVE | References | Type | Severity | Component \n---|---|---|---|--- \nCVE-2017-13304 | A-70576999* | ID | Moderate | mnh_sm driver \nCVE-2017-13305 | A-70526974* | ID | Moderate | encrypted-keys \nCVE-2017-17449 | A-70980949 [Upstream kernel](<https://lkml.org/lkml/2017/12/5/950>) | ID | Moderate | netlink tap \nCVE-2017-13306 | A-70295063* | EoP | Moderate | mnh driver \nCVE-2017-13307 | A-69128924* | EoP | Moderate | pci sysfs \nCVE-2017-17712 | A-71500434 [ Upstream kernel](<http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f659a03a0ba9289b9aeb9b4470e6fb263d6f483>) | EoP | Moderate | net ipv4 \nCVE-2017-15115 | A-70217214 [ Upstream kernel](<http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=df80cd9b28b9ebaa284a41df611dbf3a2d05ca74>) | EoP | Moderate | sctp \n \n### Qualcomm components\n\nCVE | References | Type | Severity | Component \n---|---|---|---|--- \nCVE-2018-3598 | A-71501698 [ QC-CR#1097390](<https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=bfd8ffc65e6e82de2adceba58bd67137fb3b2024>) | ID | Moderate | camera_v2 driver \nCVE-2018-5826 | A-69128800* QC-CR#2157283 | ID | Moderate | qcacld-3.0 hdd driver \nCVE-2017-15853 | A-65853393* QC-CR#2116517 QC-CR#2125577 | ID | Moderate | WLAN \nCVE-2018-3584 | A-64610600* QC-CR#2142046 | ID | Moderate | rmnet_usb \nCVE-2017-8269 | A-33967002* QC-CR#2013145 QC-CR#2114278 | ID | Moderate | IPA driver \nCVE-2017-15837 | A-64403015* QC-CR#2116387 | ID | Moderate | NL80211 driver \nCVE-2018-5823 | A-72957335 [ QC-CR#2139436](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=fc5bbedd4ab9fd5239be8618afe714d39dd8de49>) | EoP | Moderate | WLAN \nCVE-2018-5825 | A-72957269 [QC-CR#2151146](<https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=5ae227670444cf8ea7b8a8d98eab41404a03332f>) [[2](<https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=cf0f031ffbb6a8e08e517f653045c3f81d7f2663>)] [[3](<https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=09a34b7878a732187f9138900667d8abb2b1c39c>)] | EoP | Moderate | IPA driver \nCVE-2018-5824 | A-72957235 [QC-CR#2149399](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=b34f6f3afe229e32a32418f75889279f6e00d157>) [[2](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d3a92a1656a3ee2fc44d4ff98614a4f5b70f1893>)] | EoP | Moderate | WLAN \nCVE-2018-5827 | A-72956920 [ QC-CR#2161977](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=53e6d889ac29336ba212a0d4a987455a85736fa8>) | EoP | Moderate | WLAN \nCVE-2018-5822 | A-71501692 [ QC-CR#2115221](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=edc42ce371b6831dc55a15bc2624175bd538aa37>) | EoP | Moderate | QC WLAN \nCVE-2018-5821 | A-71501687 [ QC-CR#2114363](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=08ab943766abe845a8fae21689bae18dd74e9b20>) | EoP | Moderate | modem driver \nCVE-2018-5820 | A-71501686 [ QC-CR#2114336](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a4a8475ea650c16705a3eaa011524820dc5ffd44>) | EoP | Moderate | Modem driver \nCVE-2018-3599 | A-71501666 [ QC-CR#2047235](<https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=cf2702c1a77d2a164a3be03597eff7e6fe5f967e>) | EoP | Moderate | Qualcomm Core Services \nCVE-2018-3596 | A-35263529* QC-CR#640898 | EoP | Moderate | WLAN \nCVE-2018-3568 | A-72957136 [ QC-CR#2152824](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=70cd30a5c1fdd02af19cf0e34c41842cce89a82d>) | EoP | Moderate | WLAN \nCVE-2018-3567 | A-72956997 [QC-CR#2147119](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=f2627fca43bc4403a445c2b84481383ac0249364>) [[2](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=25c131e8a807894e04f95bdeb1cbd0376eda3bea>)] | EoP | Moderate | WLAN \nCVE-2017-15855 | A-72957336 [ QC-CR#2149501](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=75c0ea8622bb07716d2a82247e6dd1597980f223>) | EoP | Moderate | WLAN \nCVE-2018-5828 | A-71501691 [ QC-CR#2115207](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6299a6bf166a60a47e9108ae2119027e787432d0>) | EoP | Moderate | QC WLAN \nCVE-2017-15836 | A-71501693 [ QC-CR#2119887](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=058e1eef2b1422bc0dd70f73832f1ac8a3dbe806>) | EoP | Moderate | QC WLAN \nCVE-2017-14890 | A-71501695 [ QC-CR#2120751](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=234e14add09a1ba4a1b1d81d474ac3978dc94fd6>) | EoP | Moderate | QC WLAN \nCVE-2017-14894 | A-71501694 [ QC-CR#2120424](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=dfca3d8173c1548a97e558cb8abd1ffd2483f8b7>) | EoP | Moderate | QC WLAN \nCVE-2017-14880 | A-68992477 [ QC-CR#2078734](<https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=cbf3702ae1c5e2cacd6f15a5eb7a799e2f1ed96f>) [[2](<https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=d72e444dce0b9d20fdcdc4daeb6227e3536eebf7>)] | EoP | Moderate | IPA WAN driver \nCVE-2017-11075 | A-70237705 [ QC-CR#2098332](<https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=7a07165c62926e899b710e1fed31532f31797dd5>) | EoP | Moderate | Audio DSP driver \n \n## Functional updates\n\nThese updates are included for affected Pixel devices to address functionality issues not related to the security of Pixel devices. The table includes associated references; the affected category, such as Bluetooth or mobile data; improvements; and affected devices. \n\nReferences | Category | Improvements | Devices \n---|---|---|--- \nA-35963245 | Performance | Enable Assisted Dialing support | Pixel 2, Pixel 2 XL \nA-37681923 A-68215016 | Logging | Improve anomaly detection metrics | All \nA-63908720 | Logging | Improve diskstats logging | All \nA-64101451 | Performance | Improve handover from VoLTE to VoWi-Fi during Emergency calls on certain carriers | Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-64586126 | Camera | Improve microvideo performance in Google Camera | Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-64610438 | Performance | Reduce delays upon opening specific apps | Pixel 2, Pixel 2 XL \nA-65175134 | Video | Improve decoding of certain video streams | Pixel, Pixel XL \nA-65347520 | Performance | Improve fingerprint and keyboard latency in certain situations | Pixel 2, Pixel 2 XL \nA-65490850 | UI | Adjust notifications when entering or exiting Wi-Fi coverage during a video call | Pixel 2, Pixel 2 XL \nA-65509134 | Connectivity | Enable IMS911 on certain networks | Pixel 2, Pixel 2 XL, Pixel, Pixel XL \nA-66951771 | Logging | Detect Wi-Fi Passport statistics for developers | All \nA-66957450 | Performance | Improve lock screen performance | All \nA-67094673 | Logging | Improve start time logging | All \nA-67589241 | Performance | Improve magnetic sensor performance on Pixel 2/Pixel 2 XL | Pixel 2, Pixel 2 XL \nA-67593274 | Battery | Reduce battery drain after modem issues | Pixel 2, Pixel 2 XL \nA-67634615 | Stability | Improve modem stability on Pixel and Pixel 2 phones | Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-67750231 | UI | Adjust Call Forwarding UI | Nexus 5X, Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-67774904 | Connectivity | Improve multi-calling performance over Wi-Fi | Pixel, Pixel XL \nA-67777512 | Connectivity | Improve data connectivity for T-Mobile users in parts of Australia | Pixel, Pixel XL \nA-67882977 | Certification | Update certification | Pixel, Pixel XL \nA-68150449 A-68059359 A-69797741 A-69378640 A-68824279 | Stability | Improve Wi-Fi stability on Pixel 2 phones | Pixel 2, Pixel 2 XL \nA-68217064 | Performance | Improve handover to Wi-Fi Calling in low-coverage areas | Pixel 2, Pixel 2 XL \nA-68398312 | Performance | Improve conference call performance over Wifi | Pixel 2, Pixel 2 XL \nA-68671462 | Connectivity | Improve VoLTE performance for some carriers | Nexus 5X, Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-68841424 | Connectivity | Adjust APN updating behavior | All \nA-68863351 | UI | Improve settings app icons | All \nA-68923696 A-68922470 A-68940490 | Certification | Upgrade certificates to ensure continued service. | Nexus 5X, Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-68931709 | Developer | Add methods to PeerHandle API for developers | All \nA-68959671 | Connectivity | Update Verizon Service APK for Pixel phones | Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-69003183 | Logging | Improve Wi-Fi and RPM logging | Pixel 2, Pixel 2 XL \nA-69017578 A-68138080 A-68205105 A-70731000 A-69574837 A-68474108 A-70406781 | Connectivity, Performance | Improve connectivity and performance on certain carrier networks | Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-69064494 | Performance | Improve notification listening apps | All \nA-69152057 | Connectivity | Address call forwarding issue. | All \nA-69209000 | Connectivity | Improve internet connectivity on Pixel 2 on certain WiFi networks | Pixel 2 \nA-69238007 A-68202289 A-69334308 | Connectivity | Adjust APN settings | Nexus 5X, Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-69261367 A-70512352 | Messaging | Improve MMS messaging performance on certain carriers | Nexus 5X, Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-69275204 | Battery | Adjust battery learned capacity increment and decrement limits | Pixel 2, Pixel 2 XL \nA-69334266 | Connectivity | Change voice domain to CS for certain carriers | Pixel XL \nA-69475609 | Performance | Adjust timeouts for Phone App | All \nA-69672417 | Stability | Improve stability for Pixel 2 devices in certain parts of Canada | Pixel 2, Pixel 2 XL \nA-69848394 A-68275646 | Performance | Improve instant Apps performance | All \nA-69870527 | UI | Improve indicators for emergency call connectivity | Pixel 2, Pixel 2 XL \nA-70045970 | Battery | Optimize search logic to improve battery performance. | Pixel 2, Pixel 2 XL \nA-70094083 A-70094701 | Battery | Improve battery logging for Pixel 2 and Pixel 2 XL | Pixel 2, Pixel 2 XL \nA-70214869 | GPS | Improve GPS Time performance on Pixel 2 XL | Pixel 2 XL \nA-70338906 | Audio | Improve audio speaker performance during phone calls | All \nA-70398372 | UI | Adjust advanced calling settings for Verizon | Nexus 5X, Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-70576351 | Connectivity | Change to prioritize certain bands | Nexus 5X, Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-70580873 A-70912923 A-71497259 | Connectivity | Improve in-call performance for some carriers | Pixel, Pixel XL, Pixel 2, Pixel 2 XL \nA-70815434 | Connectivity | Improve network performance on Simyo carrier | Nexus 5X \nA-71708302 | Logging | Improve connectivity metrics | All \nA-71983424 | Performance | Improve experience switching between LTE and Wifi | Pixel 2 XL \nA-72119809 | Connectivity | Improve data performance for devices with certain SIM cards | All \nA-72175011 | Logging | Improve autofill logging | All \nA-72797728 A-71599119 | Logging | Improve internal troubleshooting tools | All \nA-72871435 | Logging | Improve network performance when both VPN and Wi-Fi are enabled | All \n \n## Common questions and answers\n\nThis section answers common questions that may occur after reading this bulletin. \n\n**1\\. How do I determine if my device is updated to address these issues? **\n\nSecurity patch levels of 2018-04-05 or later address all issues associated with the 2018-04-05 security patch level and all previous patch levels. To learn how to check a device's security patch level, read the instructions on the [Pixel and Nexus update schedule](<https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices>). \n\n**2\\. What do the entries in the _Type_ column mean?**\n\nEntries in the _Type_ column of the vulnerability details table reference the classification of the security vulnerability. \n\nAbbreviation | Definition \n---|--- \nRCE | Remote code execution \nEoP | Elevation of privilege \nID | Information disclosure \nDoS | Denial of service \nN/A | Classification not available \n \n**3\\. What do the entries in the _References_ column mean?**\n\nEntries under the _References_ column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs. \n\nPrefix | Reference \n---|--- \nA- | Android bug ID \nQC- | Qualcomm reference number \nM- | MediaTek reference number \nN- | NVIDIA reference number \nB- | Broadcom reference number \n \n**4\\. What does a * next to the Android bug ID in the _References_ column mean?**\n\nIssues that are not publicly available have a * next to the Android bug ID in the _References_ column. The update for that issue is generally contained in the latest binary drivers for Nexus devices available from the [Google Developer site](<https://developers.google.com/android/nexus/drivers>). \n\n**5\\. Why are security vulnerabilities split between this bulletin and the Android Security Bulletins?**\n\nSecurity vulnerabilities that are documented in the Android Security Bulletins are required in order to declare the latest security patch level on Android devices. Additional security vulnerabilities, such as those documented in this bulletin, are not required for declaring a security patch level. \n\n## Versions\n\nVersion | Date | Notes \n---|---|--- \n1.0 | April 2, 2018 | Bulletin published. \n1.1 | April 4, 2018 | Bulletin revised to include AOSP links. \n1.2 | April 10, 2018 | Bulletin revised to update description for A-72871435.\n", "published": "2018-04-02T00:00:00", "modified": "2018-04-10T00:00:00", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8}, "severity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.9, "acInsufInfo": true, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://source.android.com/docs/security/bulletin/pixel/2018-04-01", "reporter": "Android Open Source Project", "references": [], "cvelist": ["CVE-2017-11075", "CVE-2017-13294", "CVE-2017-13295", "CVE-2017-13296", "CVE-2017-13297", "CVE-2017-13298", "CVE-2017-13299", "CVE-2017-13300", "CVE-2017-13301", "CVE-2017-13302", "CVE-2017-13303", "CVE-2017-13304", "CVE-2017-13305", "CVE-2017-13306", "CVE-2017-13307", "CVE-2017-14880", "CVE-2017-14890", "CVE-2017-14894", "CVE-2017-15115", "CVE-2017-15836", "CVE-2017-15837", "CVE-2017-15853", "CVE-2017-15855", "CVE-2017-17449", "CVE-2017-17712", "CVE-2017-8269", "CVE-2018-3567", "CVE-2018-3568", "CVE-2018-3584", "CVE-2018-3596", "CVE-2018-3598", "CVE-2018-3599", "CVE-2018-5820", "CVE-2018-5821", "CVE-2018-5822", "CVE-2018-5823", "CVE-2018-5824", "CVE-2018-5825", "CVE-2018-5826", "CVE-2018-5827", "CVE-2018-5828"], "immutableFields": [], "lastseen": "2023-03-21T06:20:18", "viewCount": 73, "enchantments": {"dependencies": {"references": [{"type": "amazon", "idList": ["ALAS-2017-937", "ALAS-2018-944"]}, {"type": "androidsecurity", "idList": ["ANDROID:2017-07-01", "ANDROID:2018-03-01", "ANDROID:2018-08-01"]}, {"type": "archlinux", "idList": ["ASA-201801-1", "ASA-201801-2", "ASA-201801-3", "ASA-201801-4"]}, {"type": "centos", "idList": ["CESA-2018:1062"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:4DDEEFC6D5CE0AA12B5BF627FFC8D2F4", "CFOUNDRY:6F9C2520DC97ECE6CB22CC0C19CA28F6", "CFOUNDRY:E36E8558D6E84664F9D34B4A9E5179AC"]}, {"type": "cve", "idList": ["CVE-2017-11075", "CVE-2017-13294", "CVE-2017-13295", "CVE-2017-13296", "CVE-2017-13297", "CVE-2017-13298", "CVE-2017-13299", "CVE-2017-13300", "CVE-2017-13301", "CVE-2017-13302", "CVE-2017-13303", "CVE-2017-13304", "CVE-2017-13305", "CVE-2017-13306", "CVE-2017-13307", "CVE-2017-14880", "CVE-2017-14890", "CVE-2017-14894", "CVE-2017-15115", "CVE-2017-15836", "CVE-2017-15837", "CVE-2017-15853", "CVE-2017-15855", "CVE-2017-17449", "CVE-2017-17712", "CVE-2017-8269", "CVE-2018-3567", "CVE-2018-3568", "CVE-2018-3584", "CVE-2018-3596", "CVE-2018-3598", "CVE-2018-3599", "CVE-2018-5820", "CVE-2018-5821", "CVE-2018-5822", "CVE-2018-5823", "CVE-2018-5824", "CVE-2018-5825", "CVE-2018-5826", "CVE-2018-5827", "CVE-2018-5828"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1200-1:A0B61", "DEBIAN:DLA-1731-1:D19BD", "DEBIAN:DLA-1731-2:E6E1E", "DEBIAN:DSA-4073-1:79398", "DEBIAN:DSA-4082-1:57979", "DEBIAN:DSA-4082-1:58978"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-13305", "DEBIANCVE:CVE-2017-15115", "DEBIANCVE:CVE-2017-17449", "DEBIANCVE:CVE-2017-17712"]}, {"type": "f5", "idList": ["F5:K43339432"]}, {"type": "fedora", "idList": ["FEDORA:08D3760E6566", "FEDORA:10F7D6255145", "FEDORA:18A9B6075B22", "FEDORA:23E0D6075B51", "FEDORA:25BDD6190ECF", "FEDORA:29049600CFF3", "FEDORA:29FCE65ECD33", "FEDORA:44065605602A", "FEDORA:4832F6079717", "FEDORA:4B78C604AF8C", "FEDORA:5D742610B071", "FEDORA:5DBFE6017112", "FEDORA:648496077DD1", "FEDORA:6EC6360BEA04", "FEDORA:6F1BC604D0C1", "FEDORA:74245604D4DA", "FEDORA:7640C641CB61", "FEDORA:77A6E60A34FB", "FEDORA:7F8C960BC98D", "FEDORA:87BD56087904", "FEDORA:8F974604E846", "FEDORA:909D360491BF", "FEDORA:AB52460321C9", "FEDORA:B395E6087A9D", "FEDORA:B54D264CBCAC", "FEDORA:D6F86601E6D9", "FEDORA:DF5176048167", "FEDORA:E1D7E6031252", "FEDORA:E6F08605DCE7"]}, {"type": "ibm", "idList": ["0C9BE2F3A245999460BB6BC497E21EC27992E79FB4C1D769E6D1CF729AB33300", "1EAA33360D6A7077DA78A614D83BA795F9BC0FC37BCEE994A81654BB9F3E8CEB", "4E3B1B3FD8D96C587F38B91ADDD56E2309955DC55D7174893660272DD9A6563E", "689304B1FA4CCC449774866428819EB86EAAEA84A0E45F124A364853805E6AE4", "75F4CE8201FAA026B444CA3308E12CA9B1FBD302D6BDA963D3635F7318CA3ADB", "CD9B5BF488F3327F1A5D08B8A25E9EF90D7304376F44A16FB3F05E06566E80FF", "FF196C203FBE7855B209E778D969F9CB477E5AC6AB3BD028DDAA44EFCD8D3685"]}, {"type": "lenovo", "idList": ["LENOVO:PS500321-NOSID"]}, {"type": "mageia", "idList": ["MGASA-2017-0463", "MGASA-2017-0466", "MGASA-2017-0467", "MGASA-2018-0062", "MGASA-2018-0063", "MGASA-2018-0064"]}, {"type": "nessus", "idList": ["ALA_ALAS-2017-937.NASL", "ALA_ALAS-2018-944.NASL", "CENTOS_RHSA-2018-1062.NASL", "DEBIAN_DLA-1200.NASL", "DEBIAN_DLA-1731.NASL", "DEBIAN_DSA-4073.NASL", "DEBIAN_DSA-4082.NASL", "EULEROS_SA-2017-1318.NASL", "EULEROS_SA-2017-1342.NASL", "EULEROS_SA-2018-1026.NASL", "EULEROS_SA-2018-1031.NASL", "EULEROS_SA-2019-1499.NASL", "EULEROS_SA-2019-1501.NASL", "EULEROS_SA-2019-1514.NASL", "EULEROS_SA-2019-1519.NASL", "EULEROS_SA-2019-1528.NASL", "EULEROS_SA-2019-1537.NASL", "EULEROS_SA-2019-2353.NASL", "EULEROS_SA-2021-1808.NASL", "FEDORA_2017-129969AA8A.NASL", "FEDORA_2017-1B4D140781.NASL", "FEDORA_2017-62E3A94F2A.NASL", "FEDORA_2017-7810B7C59F.NASL", "FEDORA_2017-BA6B6E71F7.NASL", "FEDORA_2017-F73D3F1FC4.NASL", "FEDORA_2017-F7CB245861.NASL", "NEWSTART_CGSL_NS-SA-2019-0070_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2019-0074_KERNEL-RT.NASL", "OPENSUSE-2017-1390.NASL", "OPENSUSE-2017-1391.NASL", "OPENSUSE-2018-153.NASL", "OPENSUSE-2018-656.NASL", "ORACLELINUX_ELSA-2018-1062.NASL", "ORACLELINUX_ELSA-2018-4025.NASL", "ORACLELINUX_ELSA-2018-4071.NASL", "ORACLELINUX_ELSA-2018-4089.NASL", "ORACLELINUX_ELSA-2018-4108.NASL", "ORACLELINUX_ELSA-2018-4109.NASL", "ORACLELINUX_ELSA-2019-4619.NASL", "ORACLELINUX_ELSA-2019-4644.NASL", "ORACLEVM_OVMSA-2018-0017.NASL", "ORACLEVM_OVMSA-2018-0035.NASL", "ORACLEVM_OVMSA-2018-0041.NASL", "ORACLEVM_OVMSA-2019-0015.NASL", "PHOTONOS_PHSA-2017-0051.NASL", "PHOTONOS_PHSA-2017-0051_LINUX.NASL", "PHOTONOS_PHSA-2017-0052.NASL", "REDHAT-RHSA-2018-0654.NASL", "REDHAT-RHSA-2018-0676.NASL", "REDHAT-RHSA-2018-1062.NASL", "REDHAT-RHSA-2018-1130.NASL", "REDHAT-RHSA-2018-1170.NASL", "REDHAT-RHSA-2018-2165.NASL", "SL_20180410_KERNEL_ON_SL7_X.NASL", "SUSE_SU-2017-3398-1.NASL", "SUSE_SU-2017-3410-1.NASL", "SUSE_SU-2018-0011-1.NASL", "SUSE_SU-2018-0031-1.NASL", "SUSE_SU-2018-0040-1.NASL", "SUSE_SU-2018-0115-1.NASL", "SUSE_SU-2018-0383-1.NASL", "SUSE_SU-2018-0416-1.NASL", "SUSE_SU-2018-1761-1.NASL", "SUSE_SU-2018-1762-1.NASL", "SUSE_SU-2018-1855-1.NASL", "SUSE_SU-2018-1855-2.NASL", "SUSE_SU-2018-2332-1.NASL", "SUSE_SU-2018-2366-1.NASL", "UBUNTU_USN-3581-1.NASL", "UBUNTU_USN-3581-2.NASL", "UBUNTU_USN-3581-3.NASL", "UBUNTU_USN-3582-1.NASL", "UBUNTU_USN-3582-2.NASL", "UBUNTU_USN-3583-1.NASL", "UBUNTU_USN-3619-1.NASL", "UBUNTU_USN-3619-2.NASL", "UBUNTU_USN-3631-1.NASL", "UBUNTU_USN-3631-2.NASL", "UBUNTU_USN-3653-1.NASL", "UBUNTU_USN-3653-2.NASL", "UBUNTU_USN-3655-1.NASL", "UBUNTU_USN-3657-1.NASL", "VIRTUOZZO_VZA-2017-120.NASL", "VIRTUOZZO_VZA-2018-024.NASL", "VIRTUOZZO_VZA-2018-025.NASL", "VIRTUOZZO_VZA-2018-026.NASL", "VIRTUOZZO_VZA-2018-038.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704073", "OPENVAS:1361412562310704082", "OPENVAS:1361412562310843455", "OPENVAS:1361412562310843457", "OPENVAS:1361412562310843458", "OPENVAS:1361412562310843459", "OPENVAS:1361412562310843460", "OPENVAS:1361412562310843461", "OPENVAS:1361412562310843496", "OPENVAS:1361412562310843497", "OPENVAS:1361412562310843506", "OPENVAS:1361412562310843511", "OPENVAS:1361412562310843528", "OPENVAS:1361412562310843529", "OPENVAS:1361412562310843532", "OPENVAS:1361412562310843534", "OPENVAS:1361412562310851666", "OPENVAS:1361412562310851667", "OPENVAS:1361412562310851698", "OPENVAS:1361412562310851795", "OPENVAS:1361412562310873597", "OPENVAS:1361412562310873601", "OPENVAS:1361412562310873730", "OPENVAS:1361412562310873926", "OPENVAS:1361412562310873930", "OPENVAS:1361412562310873945", "OPENVAS:1361412562310873947", "OPENVAS:1361412562310874365", "OPENVAS:1361412562310874366", "OPENVAS:1361412562310874400", "OPENVAS:1361412562310874427", "OPENVAS:1361412562310874606", "OPENVAS:1361412562310874619", "OPENVAS:1361412562310874623", "OPENVAS:1361412562310874647", "OPENVAS:1361412562310874695", "OPENVAS:1361412562310874721", "OPENVAS:1361412562310874751", "OPENVAS:1361412562310874761", "OPENVAS:1361412562310874813", "OPENVAS:1361412562310874890", "OPENVAS:1361412562310874919", "OPENVAS:1361412562310874964", "OPENVAS:1361412562310874998", "OPENVAS:1361412562310875099", "OPENVAS:1361412562310875128", "OPENVAS:1361412562310875170", "OPENVAS:1361412562310875201", "OPENVAS:1361412562310875334", "OPENVAS:1361412562310891731", "OPENVAS:1361412562311220171318", "OPENVAS:1361412562311220171342", "OPENVAS:1361412562311220181026", "OPENVAS:1361412562311220181031", "OPENVAS:1361412562311220191499", "OPENVAS:1361412562311220191501", "OPENVAS:1361412562311220191514", "OPENVAS:1361412562311220191519", "OPENVAS:1361412562311220191528", "OPENVAS:1361412562311220191537", "OPENVAS:1361412562311220192353"]}, {"type": "oraclelinux", "idList": ["ELSA-2018-1062", "ELSA-2018-4025", "ELSA-2018-4071", "ELSA-2018-4089", "ELSA-2018-4108", "ELSA-2018-4109", "ELSA-2019-4619", "ELSA-2019-4644"]}, {"type": "osv", "idList": ["OSV:DLA-1200-1", "OSV:DLA-1731-1", "OSV:DSA-4073-1", "OSV:DSA-4082-1"]}, {"type": "photon", "idList": ["PHSA-2017-0005", "PHSA-2017-0091", "PHSA-2018-0009", "PHSA-2018-0031", "PHSA-2018-0150"]}, {"type": "redhat", "idList": ["RHSA-2018:0502", "RHSA-2018:0654", "RHSA-2018:0676", "RHSA-2018:1062", "RHSA-2018:1130", "RHSA-2018:1170", "RHSA-2018:2165"]}, {"type": "redhatcve", "idList": ["RH:CVE-2017-15115", "RH:CVE-2017-17449", "RH:CVE-2017-17712"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2017:3358-1", "OPENSUSE-SU-2017:3359-1", "OPENSUSE-SU-2018:0408-1", "OPENSUSE-SU-2018:1773-1", "SUSE-SU-2017:3398-1", "SUSE-SU-2017:3410-1", "SUSE-SU-2018:0011-1", "SUSE-SU-2018:0031-1", "SUSE-SU-2018:0040-1", "SUSE-SU-2018:0115-1", "SUSE-SU-2018:0180-1", "SUSE-SU-2018:0213-1", "SUSE-SU-2018:0269-1", "SUSE-SU-2018:0272-1", "SUSE-SU-2018:0273-1", "SUSE-SU-2018:0277-1", "SUSE-SU-2018:0278-1", "SUSE-SU-2018:0280-1", "SUSE-SU-2018:0281-1", "SUSE-SU-2018:0282-1", "SUSE-SU-2018:0294-1", "SUSE-SU-2018:0296-1", "SUSE-SU-2018:0297-1", "SUSE-SU-2018:0298-1", "SUSE-SU-2018:0301-1", "SUSE-SU-2018:0340-1", "SUSE-SU-2018:0345-1", "SUSE-SU-2018:0346-1", "SUSE-SU-2018:0347-1", "SUSE-SU-2018:0383-1", "SUSE-SU-2018:0416-1", "SUSE-SU-2018:0431-1", "SUSE-SU-2018:0433-1", "SUSE-SU-2018:0436-1", "SUSE-SU-2018:0482-1", "SUSE-SU-2018:0986-1"]}, {"type": "ubuntu", "idList": ["USN-3581-1", "USN-3581-2", "USN-3581-3", "USN-3582-1", "USN-3582-2", "USN-3583-1", "USN-3583-2", "USN-3619-1", "USN-3619-2", "USN-3631-1", "USN-3631-2", "USN-3653-1", "USN-3653-2", "USN-3655-1", "USN-3655-2", "USN-3657-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-13304", "UB:CVE-2017-13305", "UB:CVE-2017-13306", "UB:CVE-2017-13307", "UB:CVE-2017-15115", "UB:CVE-2017-17449", "UB:CVE-2017-17712"]}, {"type": "virtuozzo", "idList": ["VZA-2017-120", "VZA-2018-024", "VZA-2018-025", "VZA-2018-026", "VZA-2018-038"]}]}, "score": {"value": 1.1, "vector": "NONE"}, "backreferences": {"references": [{"type": "aix", "idList": ["SPECTRE_MELTDOWN_ADVISORY.ASC"]}, {"type": "amazon", "idList": ["ALAS-2018-939"]}, {"type": "android", "idList": ["ANDROID:CVE-2014-9996", "ANDROID:CVE-2017-13267", "ANDROID:CVE-2017-13276", "ANDROID:CVE-2017-13277", "ANDROID:CVE-2017-13281", "ANDROID:CVE-2017-13282", "ANDROID:CVE-2017-13283", "ANDROID:CVE-2017-13284", "ANDROID:CVE-2017-13292", "ANDROID:CVE-2017-15822", "ANDROID:CVE-2017-18071", "ANDROID:CVE-2017-18128", "ANDROID:CVE-2017-18146", "ANDROID:CVE-2017-8274", "ANDROID:CVE-2018-3591", "ANDROID:CVE-2018-3592"]}, {"type": "androidsecurity", "idList": ["ANDROID:2017-11-01", "ANDROID:2018-05-01", "ANDROID:2018-06-01", "ANDROID:2018-08-01", "ANDROID:2018-09-01", "ANDROID:2018-10-01", "ANDROID:2018-12-01"]}, {"type": "apple", "idList": ["APPLE:076A5029E1D9073AD8A212C272CBA098", "APPLE:121C0C2C932F899F870D9D5665610ED0", "APPLE:31324259F2722EDCDF4BD19554187E7A", "APPLE:3CD8680715FC8DF4A758CC6012471868", "APPLE:718D8AEEB116992EF0FD8052E050FE9A", "APPLE:A906ED60E2875C343BE4CB7524339858", "APPLE:B7AA5B9368DE4BD135A602B017EB0259", "APPLE:B8F16B37FC64788E8894EE9818D392DA", "APPLE:CE1834F14896537612441EAFB62595C9", "APPLE:F6306C158D7B30BA0A0EDD411C414BFE", "APPLE:FAC8B05FC20C773432450AA689A274D6", "APPLE:HT208219", "APPLE:HT208220", "APPLE:HT208222", "APPLE:HT208258", "APPLE:HT208325", "APPLE:HT208327", "APPLE:HT208331", "APPLE:HT208334", "APPLE:HT208354", "APPLE:HT208465", "APPLE:HT208847"]}, {"type": "archlinux", "idList": ["ASA-201710-22", "ASA-201710-23", "ASA-201801-1", "ASA-201801-4", "ASA-201801-6"]}, {"type": "centos", "idList": ["CESA-2017:2907", "CESA-2018:0007", "CESA-2018:0008", "CESA-2018:1319"]}, {"type": "cert", "idList": ["VU:228519", "VU:584653"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2018-0011"]}, {"type": "chrome", "idList": ["GCSA-3243422487019122956"]}, {"type": "cisco", "idList": ["CISCO-SA-20171016-WPA", "CISCO-SA-20180104-CPUSIDECHANNEL"]}, {"type": "citrix", "idList": ["CTX231390", "CTX234679"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:07A2C5122ECAB467878EC7E35D5937B4", "CFOUNDRY:08639CF3E8D6C946D02AFEE0F4B5B0A0", "CFOUNDRY:86B5C35F8F0E334D1CCCDAF1214EDFEF", "CFOUNDRY:8730FEC9F4689F70DBBC5917AC5BF0C6"]}, {"type": "cve", "idList": ["CVE-2014-10039", "CVE-2014-10043", "CVE-2014-10044", "CVE-2014-10045", "CVE-2014-10046", "CVE-2014-10047", "CVE-2014-10048", "CVE-2014-10050", "CVE-2014-10051", "CVE-2014-10052", "CVE-2014-10053", "CVE-2014-10054", "CVE-2014-10055", "CVE-2014-10056", "CVE-2014-10057", "CVE-2014-10058", "CVE-2014-10059", "CVE-2014-10062", "CVE-2014-10063", "CVE-2014-9971", "CVE-2014-9972", "CVE-2014-9976", "CVE-2014-9981", "CVE-2014-9985", "CVE-2014-9986", "CVE-2014-9987", "CVE-2014-9988", "CVE-2014-9989", "CVE-2014-9990", "CVE-2014-9991", "CVE-2014-9993", "CVE-2014-9994", "CVE-2014-9995", "CVE-2014-9996", "CVE-2014-9997", "CVE-2014-9998", "CVE-2015-0574", "CVE-2015-0576", "CVE-2015-8593", "CVE-2015-8594", "CVE-2015-9063", "CVE-2015-9064", "CVE-2015-9065", "CVE-2015-9066", "CVE-2015-9108", "CVE-2015-9109", "CVE-2015-9110", "CVE-2015-9111", "CVE-2015-9112", "CVE-2015-9113", "CVE-2015-9114", "CVE-2015-9115", "CVE-2015-9116", "CVE-2015-9118", "CVE-2015-9119", "CVE-2015-9120", "CVE-2015-9122", "CVE-2015-9123", "CVE-2015-9124", "CVE-2015-9126", "CVE-2015-9127", "CVE-2015-9128", "CVE-2015-9129", "CVE-2015-9130", "CVE-2015-9131", "CVE-2015-9132", "CVE-2015-9133", "CVE-2015-9134", "CVE-2015-9135", "CVE-2015-9136", "CVE-2015-9137", "CVE-2015-9138", "CVE-2015-9139", "CVE-2015-9140", "CVE-2015-9141", "CVE-2015-9142", "CVE-2015-9143", "CVE-2015-9144", "CVE-2015-9145", "CVE-2015-9146", "CVE-2015-9147", "CVE-2015-9148", "CVE-2015-9149", "CVE-2015-9150", "CVE-2015-9151", "CVE-2015-9152", "CVE-2015-9153", "CVE-2015-9156", "CVE-2015-9157", "CVE-2015-9158", "CVE-2015-9159", "CVE-2015-9160", "CVE-2015-9161", "CVE-2015-9162", "CVE-2015-9163", "CVE-2015-9164", "CVE-2015-9165", "CVE-2015-9166", "CVE-2015-9167", "CVE-2015-9169", "CVE-2015-9170", "CVE-2015-9171", "CVE-2015-9172", "CVE-2015-9173", "CVE-2015-9174", "CVE-2015-9175", "CVE-2015-9176", "CVE-2015-9177", "CVE-2015-9178", "CVE-2015-9179", "CVE-2015-9180", "CVE-2015-9181", "CVE-2015-9182", "CVE-2015-9183", "CVE-2015-9184", "CVE-2015-9185", "CVE-2015-9186", "CVE-2015-9187", "CVE-2015-9188", "CVE-2015-9189", "CVE-2015-9190", "CVE-2015-9191", "CVE-2015-9192", "CVE-2015-9193", "CVE-2015-9194", "CVE-2015-9195", "CVE-2015-9196", "CVE-2015-9197", "CVE-2015-9198", "CVE-2015-9199", "CVE-2015-9200", "CVE-2015-9201", "CVE-2015-9202", "CVE-2015-9203", "CVE-2015-9204", "CVE-2015-9205", "CVE-2015-9206", "CVE-2015-9207", "CVE-2015-9208", "CVE-2015-9209", "CVE-2015-9210", "CVE-2015-9211", "CVE-2015-9212", "CVE-2015-9213", "CVE-2015-9215", "CVE-2015-9216", "CVE-2015-9217", "CVE-2015-9218", "CVE-2015-9219", "CVE-2015-9220", "CVE-2015-9221", "CVE-2015-9222", "CVE-2015-9223", "CVE-2015-9224", "CVE-2016-10380", "CVE-2016-10381", "CVE-2016-10384", "CVE-2016-10385", "CVE-2016-10386", "CVE-2016-10387", "CVE-2016-10390", "CVE-2016-10392", "CVE-2016-10406", "CVE-2016-10407", "CVE-2016-10409", "CVE-2016-10410", "CVE-2016-10411", "CVE-2016-10412", "CVE-2016-10414", "CVE-2016-10415", "CVE-2016-10416", "CVE-2016-10417", "CVE-2016-10418", "CVE-2016-10419", "CVE-2016-10420", "CVE-2016-10421", "CVE-2016-10422", "CVE-2016-10423", "CVE-2016-10424", "CVE-2016-10425", "CVE-2016-10426", "CVE-2016-10427", "CVE-2016-10428", "CVE-2016-10429", "CVE-2016-10430", "CVE-2016-10431", "CVE-2016-10432", "CVE-2016-10433", "CVE-2016-10434", "CVE-2016-10435", "CVE-2016-10436", "CVE-2016-10437", "CVE-2016-10438", "CVE-2016-10439", "CVE-2016-10440", "CVE-2016-10441", "CVE-2016-10442", "CVE-2016-10443", "CVE-2016-10444", "CVE-2016-10445", "CVE-2016-10446", "CVE-2016-10447", "CVE-2016-10448", "CVE-2016-10449", "CVE-2016-10450", "CVE-2016-10451", "CVE-2016-10452", "CVE-2016-10454", "CVE-2016-10455", "CVE-2016-10456", "CVE-2016-10457", "CVE-2016-10458", "CVE-2016-10459", "CVE-2016-10460", "CVE-2016-10461", "CVE-2016-10462", "CVE-2016-10464", "CVE-2016-10466", "CVE-2016-10467", "CVE-2016-10469", "CVE-2016-10471", "CVE-2016-10472", "CVE-2016-10473", "CVE-2016-10474", "CVE-2016-10475", "CVE-2016-10476", "CVE-2016-10477", "CVE-2016-10478", "CVE-2016-10479", "CVE-2016-10480", "CVE-2016-10481", "CVE-2016-10482", "CVE-2016-10483", "CVE-2016-10484", "CVE-2016-10485", "CVE-2016-10486", "CVE-2016-10487", "CVE-2016-10489", "CVE-2016-10490", "CVE-2016-10491", "CVE-2016-10492", "CVE-2016-10493", "CVE-2016-10494", "CVE-2016-10495", "CVE-2016-10496", "CVE-2016-10497", "CVE-2016-10498", "CVE-2016-10499", "CVE-2016-10501", "CVE-2017-13077", "CVE-2017-5754", "CVE-2019-10488", "CVE-2019-10491", "CVE-2019-10495", "CVE-2019-10496", "CVE-2019-10502", "CVE-2019-10504", "CVE-2019-10505", "CVE-2019-10512", "CVE-2019-10515", "CVE-2019-10522", "CVE-2019-10524", "CVE-2019-10528", "CVE-2019-10529", "CVE-2019-10531", "CVE-2019-10533", "CVE-2019-10534", "CVE-2019-10541", "CVE-2019-10542", "CVE-2019-2246", "CVE-2019-2249", "CVE-2019-2258", "CVE-2019-2283", "CVE-2019-2285", "CVE-2019-2323", "CVE-2019-2324", "CVE-2019-2325", "CVE-2019-2331", "CVE-2019-2332"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1150-1:A6833", "DEBIAN:DLA-1232-1:15F37", "DEBIAN:DSA-3999-1:C5D5F", "DEBIAN:DSA-4078-1:83863", "DEBIAN:DSA-4082-1:57979", "DEBIAN:DSA-4120-1:7BEB7"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-13077"]}, {"type": "exploitdb", "idList": ["EDB-ID:40502"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:89C56EE43F8AD0ADF2E4C2C440E23086"]}, {"type": "f5", "idList": ["F5:K23642330", "F5:K91229003"]}, {"type": "fedora", "idList": ["FEDORA:0CCFB604C905", "FEDORA:0DD9C604DD0F", "FEDORA:1714A6074A50", "FEDORA:6384860875B6", "FEDORA:6D2216047E58", "FEDORA:AA0BE60A8642"]}, {"type": "fortinet", "idList": ["FG-IR-17-196", "FG-IR-18-002"]}, {"type": "freebsd", "idList": ["D670A953-B2A1-11E7-A633-009C02A2AB30"]}, {"type": "gentoo", "idList": ["GLSA-201711-03"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:42FBA08807698DC5CD34486014AC8332"]}, {"type": "hackerone", "idList": ["H1:286740"]}, {"type": "hp", "idList": ["HP:C05843704", "HP:C05869091", "HP:C05872536", "HP:C05876244"]}, {"type": "huawei", "idList": ["HUAWEI-SA-20171117-01-WPA", "HUAWEI-SA-20180106-01-CPU"]}, {"type": "ibm", "idList": ["A594E3179D9A187B5EAE777411B4109CB85600F1AEC96905951B67E4F825EC64"]}, {"type": "ics", "idList": ["ICSA-17-318-01C", "ICSA-17-318-02"]}, {"type": "kitploit", "idList": ["KITPLOIT:8752367943592764867", "KITPLOIT:8917740741292426205"]}, {"type": "lenovo", "idList": ["LENOVO:PS500143-NOSID", "LENOVO:PS500151-NOSID"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:3DDE32E41BE8356C194673EE3ED7FDBE", "MALWAREBYTES:C47D8F4321BF60FB315B6C46B47DF46F"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/CENTOS_LINUX-CVE-2017-13077/"]}, {"type": "mscve", "idList": ["MS:ADV180002", "MS:ADV180018"]}, {"type": "mskb", "idList": ["KB4467708", "KB4493448"]}, {"type": "myhack58", "idList": ["MYHACK58:62201789609"]}, {"type": "nessus", "idList": ["AIX_IJ03029.NASL", "AIX_IJ03030.NASL", "AIX_IJ03032.NASL", "AIX_IJ03033.NASL", "AIX_IJ03034.NASL", "AIX_IJ03035.NASL", "AIX_IJ03036.NASL", "AL2_ALAS-2018-939.NASL", "ALA_ALAS-2018-939.NASL", "ARUBAOS_KRACK.NASL", "CENTOS_RHSA-2018-0007.NASL", "CENTOS_RHSA-2018-0008.NASL", "CENTOS_RHSA-2018-1319.NASL", "CISCO-SA-20171016-WPA-ASA_WITH_FIREPOWER_SERVICES.NASL", "CITRIX_XENSERVER_CTX231390.NASL", "CITRIX_XENSERVER_CTX234679.NASL", "DEBIAN_DLA-1232.NASL", "DEBIAN_DSA-3999.NASL", "DEBIAN_DSA-4078.NASL", "DEBIAN_DSA-4082.NASL", "DEBIAN_DSA-4120.NASL", "EULEROS_SA-2017-1241.NASL", "EULEROS_SA-2017-1242.NASL", "EULEROS_SA-2018-1001.NASL", "EULEROS_SA-2018-1002.NASL", "FEDORA_2017-45044B6B33.NASL", "FEDORA_2017-CFB950D8F4.NASL", "FEDORA_2017-F45E844A85.NASL", "FEDORA_2017-FC21E3856B.NASL", "FORTIOS_FG-IR-17-196.NASL", "FREEBSD_PKG_D670A953B2A111E7A633009C02A2AB30.NASL", "GENTOO_GLSA-201711-03.NASL", "JUNIPER_JSA10827_KRACK.NASL", "MACOSX_SECUPD2018-001.NASL", "NEWSTART_CGSL_NS-SA-2019-0143_KERNEL.NASL", "NVIDIA_UNIX_CVE_2017_5753.NASL", "NVIDIA_WIN_CVE_2017_5753.NASL", "OPENSUSE-2018-118.NASL", "OPENSUSE-2018-169.NASL", "OPENSUSE-2018-2.NASL", "OPENSUSE-2018-3.NASL", "OPENSUSE-2018-454.NASL", "OPENSUSE-2019-418.NASL", "ORACLELINUX_ELSA-2018-0007.NASL", "ORACLELINUX_ELSA-2018-0008.NASL", "ORACLELINUX_ELSA-2018-1319.NASL", "ORACLELINUX_ELSA-2018-4006.NASL", "ORACLELINUX_ELSA-2018-4011.NASL", "ORACLELINUX_ELSA-2018-4025.NASL", "ORACLELINUX_ELSA-2018-4071.NASL", "ORACLEVM_OVMSA-2018-0005.NASL", "ORACLEVM_OVMSA-2018-0006.NASL", "ORACLEVM_OVMSA-2018-0008.NASL", "ORACLEVM_OVMSA-2018-0010.NASL", "ORACLEVM_OVMSA-2018-0015.NASL", "ORACLEVM_OVMSA-2018-0017.NASL", "ORACLEVM_OVMSA-2018-0035.NASL", "REDHAT-RHSA-2018-0007.NASL", "REDHAT-RHSA-2018-0008.NASL", "REDHAT-RHSA-2018-0009.NASL", "REDHAT-RHSA-2018-0010.NASL", "REDHAT-RHSA-2018-0011.NASL", "REDHAT-RHSA-2018-0016.NASL", "REDHAT-RHSA-2018-0017.NASL", "REDHAT-RHSA-2018-0018.NASL", "REDHAT-RHSA-2018-0020.NASL", "REDHAT-RHSA-2018-0021.NASL", "REDHAT-RHSA-2018-0022.NASL", "REDHAT-RHSA-2018-0044.NASL", "REDHAT-RHSA-2018-0045.NASL", "REDHAT-RHSA-2018-0046.NASL", "REDHAT-RHSA-2018-0047.NASL", "REDHAT-RHSA-2018-0182.NASL", "REDHAT-RHSA-2018-0292.NASL", "REDHAT-RHSA-2018-1129.NASL", "REDHAT-RHSA-2018-1319.NASL", "REDHAT-RHSA-2018-1346.NASL", "SCREENOS_JSA10827_KRACK.NASL", "SLACKWARE_SSA_2018-016-01.NASL", "SL_20180103_KERNEL_ON_SL6_X.NASL", "SL_20180103_KERNEL_ON_SL7_X.NASL", "SL_20180508_KERNEL_ON_SL6_X.NASL", "SUSE_SU-2018-0010-1.NASL", "SUSE_SU-2018-0011-1.NASL", "SUSE_SU-2018-0012-1.NASL", "SUSE_SU-2018-0031-1.NASL", "SUSE_SU-2018-0040-1.NASL", "SUSE_SU-2018-0069-1.NASL", "SUSE_SU-2018-0113-1.NASL", "SUSE_SU-2018-0114-1.NASL", "SUSE_SU-2018-0115-1.NASL", "SUSE_SU-2018-0131-1.NASL", "SUSE_SU-2018-0171-1.NASL", "SUSE_SU-2018-0219-1.NASL", "SUSE_SU-2018-0438-1.NASL", "SUSE_SU-2018-0472-1.NASL", "SUSE_SU-2018-0555-1.NASL", "SUSE_SU-2018-1177-1.NASL", "SUSE_SU-2018-1181-1.NASL", "SUSE_SU-2018-1184-1.NASL", "SUSE_SU-2018-1202-1.NASL", "SUSE_SU-2018-1203-1.NASL", "SUSE_SU-2018-1216-1.NASL", "UBUNTU_USN-3516-1.NASL", "UBUNTU_USN-3522-1.NASL", "UBUNTU_USN-3522-2.NASL", "UBUNTU_USN-3522-3.NASL", "UBUNTU_USN-3522-4.NASL", "UBUNTU_USN-3523-1.NASL", "UBUNTU_USN-3523-2.NASL", "UBUNTU_USN-3524-1.NASL", "UBUNTU_USN-3540-1.NASL", "UBUNTU_USN-3540-2.NASL", "UBUNTU_USN-3541-1.NASL", "UBUNTU_USN-3541-2.NASL", "UBUNTU_USN-3583-1.NASL", "VIRTUOZZO_VZA-2018-002.NASL", "VIRTUOZZO_VZA-2018-003.NASL", "VIRTUOZZO_VZA-2018-006.NASL", "VIRTUOZZO_VZA-2018-029.NASL", "VIRTUOZZO_VZLSA-2017-2907.NASL", "VMWARE_VCENTER_VMSA-2018-0007.NASL", "XEN_SERVER_XSA-254.NASL"]}, {"type": "nvidia", "idList": ["NVIDIA:4601", "NVIDIA:4610", "NVIDIA:4611", "NVIDIA:4613", "NVIDIA:4614", "NVIDIA:4616", "NVIDIA:4617"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310140432", "OPENVAS:1361412562310703999", "OPENVAS:1361412562310704078", "OPENVAS:1361412562310704082", "OPENVAS:1361412562310704120", "OPENVAS:1361412562310811959", "OPENVAS:1361412562310812289", "OPENVAS:1361412562310812290", "OPENVAS:1361412562310812291", "OPENVAS:1361412562310812292", "OPENVAS:1361412562310812293", "OPENVAS:1361412562310812294", "OPENVAS:1361412562310812295", "OPENVAS:1361412562310812296", "OPENVAS:1361412562310812384", "OPENVAS:1361412562310812386", "OPENVAS:1361412562310812397", "OPENVAS:1361412562310812398", "OPENVAS:1361412562310812662", "OPENVAS:1361412562310812740", "OPENVAS:1361412562310843405", "OPENVAS:1361412562310843409", "OPENVAS:1361412562310843410", "OPENVAS:1361412562310843412", "OPENVAS:1361412562310843413", "OPENVAS:1361412562310843414", "OPENVAS:1361412562310843415", "OPENVAS:1361412562310843418", "OPENVAS:1361412562310843423", "OPENVAS:1361412562310843424", "OPENVAS:1361412562310843427", "OPENVAS:1361412562310843429", "OPENVAS:1361412562310843461", "OPENVAS:1361412562310851677", "OPENVAS:1361412562310851678", "OPENVAS:1361412562310851693", "OPENVAS:1361412562310851704", "OPENVAS:1361412562310851742", "OPENVAS:1361412562310882822", "OPENVAS:1361412562310891150", "OPENVAS:1361412562310891232"]}, {"type": "oracle", "idList": ["ORACLE:CPUAPR2018-3678067"]}, {"type": "oraclelinux", "idList": ["ELSA-2017-2907", "ELSA-2018-0007", "ELSA-2018-0008", "ELSA-2018-0169", "ELSA-2018-0292", "ELSA-2018-1319", "ELSA-2018-4006", "ELSA-2018-4011", "ELSA-2018-4012", "ELSA-2018-4021", "ELSA-2018-4025", "ELSA-2018-4071", "ELSA-2018-4109"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:136831"]}, {"type": "paloalto", "idList": ["PAN-SA-2018-0001"]}, {"type": "photon", "idList": ["PHSA-2017-0001", "PHSA-2018-0010", "PHSA-2018-1.0-0097"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:02EAB5AF6104A4960F7E3B105CD50FA1", "QUALYSBLOG:3ACE52E54FF5FE3EF1B0FC328181FA66", "QUALYSBLOG:832B33D45F45271E91CA6542BC9CFD59", "QUALYSBLOG:C9F2432F760D960CF69CDC55D87263A8", "QUALYSBLOG:D893D4DFB7141FDAD0BE869440074392", "QUALYSBLOG:E761CF659F35F9F5C29FB50D76B98C3E", "QUALYSBLOG:F7C32BA5E6651A8CE3584BB84A88A0C0", "QUALYSBLOG:F8AA5B21D90BCDD30391A24D6FD47892"]}, {"type": "redhat", "idList": ["RHSA-2017:2911", "RHSA-2018:0044"]}, {"type": "redhatcve", "idList": ["RH:CVE-2017-5754", "RH:CVE-2018-19965"]}, {"type": "securelist", "idList": ["SECURELIST:7CF4DDEB1B5407DAA24EC25BAA7A9654"]}, {"type": "seebug", "idList": ["SSV:97059"]}, {"type": "slackware", "idList": ["SSA-2017-291-02", "SSA-2018-016-01"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2018:0022-1", "OPENSUSE-SU-2018:0023-1", "OPENSUSE-SU-2018:0326-1", "OPENSUSE-SU-2018:0459-1", "OPENSUSE-SU-2018:1274-1", "SUSE-SU-2018:0010-1", "SUSE-SU-2018:0011-1", "SUSE-SU-2018:0012-1", "SUSE-SU-2018:0031-1", "SUSE-SU-2018:0040-1", "SUSE-SU-2018:0069-1", "SUSE-SU-2018:0113-1", "SUSE-SU-2018:0114-1", "SUSE-SU-2018:0115-1", "SUSE-SU-2018:0131-1", "SUSE-SU-2018:0171-1", "SUSE-SU-2018:0180-1", "SUSE-SU-2018:0213-1", "SUSE-SU-2018:0219-1", "SUSE-SU-2018:0438-1", "SUSE-SU-2018:0472-1", "SUSE-SU-2018:0555-1", "SUSE-SU-2018:1177-1", "SUSE-SU-2018:1181-1", "SUSE-SU-2018:1184-1", "SUSE-SU-2018:1202-1", "SUSE-SU-2018:1203-1", "SUSE-SU-2018:1216-1"]}, {"type": "symantec", "idList": ["SMNTC-1426"]}, {"type": "talosblog", "idList": ["TALOSBLOG:6AF8BBB020A686E442B50095CA9B7A36"]}, {"type": "taosecurity", "idList": ["TAOSECURITY:37F5AF86E0886FC0FBDCCE15A1236586"]}, {"type": "thn", "idList": ["THN:29EC2E0BD61CF15B2E756ECA04EDFF50", "THN:58CFE19533148E77597FE0AC59963145", "THN:788E9312DDA39D9A09855DF379A0FD4D"]}, {"type": "threatpost", "idList": ["THREATPOST:0F9EDE9A622A021B9B79C50214D7E8AD", "THREATPOST:6C364316788D445329E5596C5108A157", "THREATPOST:7458AE86ECA810D873D5D35916A93D9F", "THREATPOST:AA978905C3A80A92A79B21CD0D963099", "THREATPOST:BCF6C41D0F09CB08AAE1465217B58B59", "THREATPOST:CE89F855271AB3AE3CE8B5B0C141CDC2", "THREATPOST:DB0542CFA474B0D9C91032709EDE296D", "THREATPOST:E454192F36C2E44BAE14AB9B62BE28DB"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:6A0454A8A4891A1004496709868EC034"]}, {"type": "ubuntu", "idList": ["USN-3485-1", "USN-3485-2", "USN-3487-1", "USN-3516-1", "USN-3522-1", "USN-3522-4", "USN-3523-2", "USN-3524-1", "USN-3524-2", "USN-3541-2", "USN-3597-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-13077", "UB:CVE-2017-16534", "UB:CVE-2017-5754"]}, {"type": "virtuozzo", "idList": ["VZA-2018-001", "VZA-2018-002", "VZA-2018-003", "VZA-2018-006", "VZA-2018-028", "VZA-2018-029"]}, {"type": "vmware", "idList": ["VMSA-2018-0007.6"]}, {"type": "xen", "idList": ["XSA-254"]}, {"type": "zdt", "idList": ["1337DAY-ID-25483", "1337DAY-ID-25493"]}]}, "exploitation": null, "affected_software": {"major_version": []}, "epss": [{"cve": "CVE-2017-11075", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13294", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13295", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13296", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13297", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13298", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13299", "epss": "0.000820000", "percentile": "0.332850000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13300", "epss": "0.000820000", "percentile": "0.332850000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13301", "epss": "0.000820000", "percentile": "0.332850000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13302", "epss": "0.000820000", "percentile": "0.332850000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13303", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13304", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13305", "epss": "0.000450000", "percentile": "0.120000000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13306", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2017-13307", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2017-14880", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2017-14890", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2017-14894", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2017-15115", "epss": "0.000440000", "percentile": "0.081790000", "modified": "2023-03-20"}, {"cve": "CVE-2017-15836", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2017-15837", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-15853", "epss": "0.000660000", "percentile": "0.271270000", "modified": "2023-03-20"}, {"cve": "CVE-2017-15855", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2017-17449", "epss": "0.000440000", "percentile": "0.081790000", "modified": "2023-03-20"}, {"cve": "CVE-2017-17712", "epss": "0.000420000", "percentile": "0.056330000", "modified": "2023-03-20"}, {"cve": "CVE-2017-8269", "epss": "0.000790000", "percentile": "0.322800000", "modified": "2023-03-20"}, {"cve": "CVE-2018-3567", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2018-3568", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2018-3584", "epss": "0.000800000", "percentile": "0.327590000", "modified": "2023-03-20"}, {"cve": "CVE-2018-3596", "epss": "0.001060000", "percentile": "0.414800000", "modified": "2023-03-20"}, {"cve": "CVE-2018-3598", "epss": "0.000800000", "percentile": "0.327590000", "modified": "2023-03-20"}, {"cve": "CVE-2018-3599", "epss": "0.001060000", "percentile": "0.414800000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5820", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5821", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5822", "epss": "0.000730000", "percentile": "0.296880000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5823", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5824", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5825", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5826", "epss": "0.000800000", "percentile": "0.327590000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5827", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}, {"cve": "CVE-2018-5828", "epss": "0.000440000", "percentile": "0.102060000", "modified": "2023-03-20"}], "vulnersScore": 1.1}, "_state": {"dependencies": 1679379792, "score": 0, "affected_software_major_version": 0, "epss": 1679379883}, "_internal": {"score_hash": "72bd4b4293ba3d1a24b89df31236b287"}, "affectedSoftware": []}
{"ubuntu": [{"lastseen": "2023-01-26T13:10:31", "description": "## Releases\n\n * Ubuntu 17.10 \n\n## Packages\n\n * linux-raspi2 \\- Linux kernel for Raspberry Pi 2\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in the \nLinux kernel contained a race condition leading to uninitialized pointer \nusage. A local attacker could use this to cause a denial of service or \npossibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the \nSCTP protocol implementation in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP \nprotocol implementation in the Linux kernel. A local attacker could use \nthis to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-8824)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-23T00:00:00", "type": "ubuntu", "title": "Linux kernel (Raspberry Pi 2) vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115", "CVE-2017-17712", "CVE-2017-8824"], "modified": "2018-02-23T00:00:00", "id": "USN-3581-3", "href": "https://ubuntu.com/security/notices/USN-3581-3", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:10:33", "description": "## Releases\n\n * Ubuntu 17.10 \n\n## Packages\n\n * linux \\- Linux kernel\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in the \nLinux kernel contained a race condition leading to uninitialized pointer \nusage. A local attacker could use this to cause a denial of service or \npossibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed \nin the SCTP protocol implementation in the Linux kernel. A local \nattacker could use this to cause a denial of service (system crash) \nor possibly execute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP \nprotocol implementation in the Linux kernel. A local attacker could use \nthis to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-8824)\n\nUSN-3541-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the \namd64 architecture in Ubuntu 17.10. This update provides the \ncompiler-based retpoline kernel mitigation for the amd64 and i386 \narchitectures. Original advisory details:\n\nJann Horn discovered that microprocessors utilizing speculative execution \nand branch prediction may allow unauthorized memory reads via sidechannel \nattacks. This flaw is known as Spectre. A local attacker could use this to \nexpose sensitive information, including kernel memory. (CVE-2017-5715)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-22T00:00:00", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2018-02-22T00:00:00", "id": "USN-3581-1", "href": "https://ubuntu.com/security/notices/USN-3581-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:10:31", "description": "## Releases\n\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * linux-azure \\- Linux kernel for Microsoft Azure Cloud systems\n * linux-gcp \\- Linux kernel for Google Cloud Platform (GCP) systems\n * linux-hwe \\- Linux hardware enablement (HWE) kernel\n * linux-oem \\- Linux kernel for OEM processors\n\nUSN-3581-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. \nThis update provides the corresponding updates for the Linux Hardware \nEnablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS.\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in the \nLinux kernel contained a race condition leading to uninitialized pointer \nusage. A local attacker could use this to cause a denial of service or \npossibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed \nin the SCTP protocol implementation in the Linux kernel. A local \nattacker could use this to cause a denial of service (system crash) \nor possibly execute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP \nprotocol implementation in the Linux kernel. A local attacker could use \nthis to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-8824)\n\nUSN-3541-2 mitigated CVE-2017-5715 (Spectre Variant 2) for the \namd64 architecture in Ubuntu 16.04 LTS. This update provides the \ncompiler-based retpoline kernel mitigation for the amd64 and i386 \narchitectures. Original advisory details:\n\nJann Horn discovered that microprocessors utilizing speculative execution \nand branch prediction may allow unauthorized memory reads via sidechannel \nattacks. This flaw is known as Spectre. A local attacker could use this to \nexpose sensitive information, including kernel memory. (CVE-2017-5715)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-22T00:00:00", "type": "ubuntu", "title": "Linux kernel (HWE) vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2018-02-22T00:00:00", "id": "USN-3581-2", "href": "https://ubuntu.com/security/notices/USN-3581-2", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:10:30", "description": "## Releases\n\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * linux \\- Linux kernel\n * linux-aws \\- Linux kernel for Amazon Web Services (AWS) systems\n * linux-kvm \\- Linux kernel for cloud environments\n * linux-raspi2 \\- Linux kernel for Raspberry Pi 2\n * linux-snapdragon \\- Linux kernel for Snapdragon processors\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in the \nLinux kernel contained a race condition leading to uninitialized pointer \nusage. A local attacker could use this to cause a denial of service or \npossibly execute arbitrary code. (CVE-2017-17712)\n\nLaurent Guerby discovered that the mbcache feature in the ext2 and ext4 \nfilesystems in the Linux kernel improperly handled xattr block caching. A \nlocal attacker could use this to cause a denial of service. (CVE-2015-8952)\n\nVitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel \ndid not properly track reference counts when merging buffers. A local \nattacker could use this to cause a denial of service (memory exhaustion). \n(CVE-2017-12190)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the \nSCTP protocol implementation in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP \nprotocol implementation in the Linux kernel. A local attacker could use \nthis to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-8824)\n\nUSN-3540-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the \namd64 architecture in Ubuntu 16.04 LTS. This update provides the \ncompiler-based retpoline kernel mitigation for the amd64 and i386 \narchitectures. Original advisory details:\n\nJann Horn discovered that microprocessors utilizing speculative execution \nand branch prediction may allow unauthorized memory reads via sidechannel \nattacks. This flaw is known as Spectre. A local attacker could use this to \nexpose sensitive information, including kernel memory. (CVE-2017-5715)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-22T00:00:00", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8952", "CVE-2017-12190", "CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2018-02-22T00:00:00", "id": "USN-3582-1", "href": "https://ubuntu.com/security/notices/USN-3582-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:10:27", "description": "## Releases\n\n * Ubuntu 14.04 ESM\n\n## Packages\n\n * linux-aws \\- Linux kernel for Amazon Web Services (AWS) systems\n * linux-lts-xenial \\- Linux hardware enablement kernel from Xenial for Trusty\n\nUSN-3582-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 \nLTS. This update provides the corresponding updates for the Linux \nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu \n14.04 LTS.\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in the \nLinux kernel contained a race condition leading to uninitialized pointer \nusage. A local attacker could use this to cause a denial of service or \npossibly execute arbitrary code. (CVE-2017-17712)\n\nLaurent Guerby discovered that the mbcache feature in the ext2 and ext4 \nfilesystems in the Linux kernel improperly handled xattr block caching. A \nlocal attacker could use this to cause a denial of service. (CVE-2015-8952)\n\nVitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel \ndid not properly track reference counts when merging buffers. A local \nattacker could use this to cause a denial of service (memory exhaustion). \n(CVE-2017-12190)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the \nSCTP protocol implementation in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP \nprotocol implementation in the Linux kernel. A local attacker could use \nthis to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-8824)\n\nUSN-3540-2 mitigated CVE-2017-5715 (Spectre Variant 2) for the \namd64 architecture in Ubuntu 14.04 LTS. This update provides the \ncompiler-based retpoline kernel mitigation for the amd64 and i386 \narchitectures. Original advisory details:\n\nJann Horn discovered that microprocessors utilizing speculative execution \nand branch prediction may allow unauthorized memory reads via sidechannel \nattacks. This flaw is known as Spectre. A local attacker could use this to \nexpose sensitive information, including kernel memory. (CVE-2017-5715)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-22T00:00:00", "type": "ubuntu", "title": "Linux kernel (Xenial HWE) vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8952", "CVE-2017-12190", "CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2018-02-22T00:00:00", "id": "USN-3582-2", "href": "https://ubuntu.com/security/notices/USN-3582-2", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:08:25", "description": "## Releases\n\n * Ubuntu 12.04 \n\n## Packages\n\n * linux-lts-trusty \\- Linux hardware enablement kernel from Trusty for Precise ESM\n\nUSN-3655-1 fixed vulnerabilities and added mitigations in the Linux \nkernel for Ubuntu 14.04 LTS. This update provides the corresponding \nupdates for the Linux Hardware Enablement (HWE) kernel from Ubuntu \n14.04 LTS for Ubuntu 12.04 ESM.\n\nJann Horn and Ken Johnson discovered that microprocessors utilizing \nspeculative execution of a memory read may allow unauthorized memory \nreads via a sidechannel attack. This flaw is known as Spectre \nVariant 4. A local attacker could use this to expose sensitive \ninformation, including kernel memory. (CVE-2018-3639)\n\nJan H. Sch\u00f6nherr discovered that the Xen subsystem did not properly handle \nblock IO merges correctly in some situations. An attacker in a guest vm \ncould use this to cause a denial of service (host crash) or possibly gain \nadministrative privileges in the host. (CVE-2017-12134)\n\nIt was discovered that the Bluetooth HIP Protocol implementation in the \nLinux kernel did not properly validate HID connection setup information. An \nattacker could use this to cause a denial of service (system crash) or \npossibly execute arbitrary code. (CVE-2017-13220)\n\nIt was discovered that a buffer overread vulnerability existed in the \nkeyring subsystem of the Linux kernel. A local attacker could possibly use \nthis to expose sensitive information (kernel memory). (CVE-2017-13305)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not \nproperly restrict observations of netlink messages to the appropriate net \nnamespace. A local attacker could use this to expose sensitive information \n(kernel netlink traffic). (CVE-2017-17449)\n\nIt was discovered that a race condition existed in the i8042 serial device \ndriver implementation in the Linux kernel. A physically proximate attacker \ncould use this to cause a denial of service (system crash) or possibly \nexecute arbitrary code. (CVE-2017-18079)\n\nIt was discovered that a race condition existed in the Device Mapper \ncomponent of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that a race condition existed in the OCFS2 file system \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service (kernel deadlock). (CVE-2017-18204)\n\nIt was discovered that an infinite loop could occur in the madvise(2) \nimplementation in the Linux kernel in certain circumstances. A local \nattacker could use this to cause a denial of service (system hang). \n(CVE-2017-18208)\n\nKefeng Wang discovered that a race condition existed in the memory locking \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service. (CVE-2017-18221)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS \nimplementation in the Linux kernel. A remote attacker controlling a \nmalicious NCPFS server could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2018-8822)\n", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2018-05-22T00:00:00", "type": "ubuntu", "title": "Linux kernel (Trusty HWE) vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-12134", "CVE-2017-13220", "CVE-2017-13305", "CVE-2017-17449", "CVE-2017-18079", "CVE-2017-18203", "CVE-2017-18204", "CVE-2017-18208", "CVE-2017-18221", "CVE-2018-3639", "CVE-2018-8822"], "modified": "2018-05-22T00:00:00", "id": "USN-3655-2", "href": "https://ubuntu.com/security/notices/USN-3655-2", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:08:24", "description": "## Releases\n\n * Ubuntu 14.04 ESM\n\n## Packages\n\n * linux \\- Linux kernel\n\nJann Horn and Ken Johnson discovered that microprocessors utilizing \nspeculative execution of a memory read may allow unauthorized memory \nreads via a sidechannel attack. This flaw is known as Spectre \nVariant 4. A local attacker could use this to expose sensitive \ninformation, including kernel memory. (CVE-2018-3639)\n\nJan H. Sch\u00f6nherr discovered that the Xen subsystem did not properly handle \nblock IO merges correctly in some situations. An attacker in a guest vm \ncould use this to cause a denial of service (host crash) or possibly gain \nadministrative privileges in the host. (CVE-2017-12134)\n\nIt was discovered that the Bluetooth HIP Protocol implementation in the \nLinux kernel did not properly validate HID connection setup information. An \nattacker could use this to cause a denial of service (system crash) or \npossibly execute arbitrary code. (CVE-2017-13220)\n\nIt was discovered that a buffer overread vulnerability existed in the \nkeyring subsystem of the Linux kernel. A local attacker could possibly use \nthis to expose sensitive information (kernel memory). (CVE-2017-13305)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not \nproperly restrict observations of netlink messages to the appropriate net \nnamespace. A local attacker could use this to expose sensitive information \n(kernel netlink traffic). (CVE-2017-17449)\n\nIt was discovered that a race condition existed in the i8042 serial device \ndriver implementation in the Linux kernel. A physically proximate attacker \ncould use this to cause a denial of service (system crash) or possibly \nexecute arbitrary code. (CVE-2017-18079)\n\nIt was discovered that a race condition existed in the Device Mapper \ncomponent of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that a race condition existed in the OCFS2 file system \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service (kernel deadlock). (CVE-2017-18204)\n\nIt was discovered that an infinite loop could occur in the madvise(2) \nimplementation in the Linux kernel in certain circumstances. A local \nattacker could use this to cause a denial of service (system hang). \n(CVE-2017-18208)\n\nKefeng Wang discovered that a race condition existed in the memory locking \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service. (CVE-2017-18221)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS \nimplementation in the Linux kernel. A remote attacker controlling a \nmalicious NCPFS server could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2018-8822)\n", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2018-05-22T00:00:00", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-12134", "CVE-2017-13220", "CVE-2017-13305", "CVE-2017-17449", "CVE-2017-18079", "CVE-2017-18203", "CVE-2017-18204", "CVE-2017-18208", "CVE-2017-18221", "CVE-2018-3639", "CVE-2018-8822"], "modified": "2018-05-22T00:00:00", "id": "USN-3655-1", "href": "https://ubuntu.com/security/notices/USN-3655-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:09:09", "description": "## Releases\n\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * linux \\- Linux kernel\n * linux-aws \\- Linux kernel for Amazon Web Services (AWS) systems\n * linux-kvm \\- Linux kernel for cloud environments\n * linux-raspi2 \\- Linux kernel for Raspberry Pi 2\n * linux-snapdragon \\- Linux kernel for Snapdragon processors\n\nIt was discovered that a buffer overread vulnerability existed in the \nkeyring subsystem of the Linux kernel. A local attacker could possibly use \nthis to expose sensitive information (kernel memory). (CVE-2017-13305)\n\nIt was discovered that the DM04/QQBOX USB driver in the Linux kernel did \nnot properly handle device attachment and warm-start. A physically \nproximate attacker could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2017-16538)\n\nLuo Quan and Wei Yang discovered that a race condition existed in the \nAdvanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when \nhandling ioctl()s. A local attacker could use this to cause a denial of \nservice (system deadlock). (CVE-2018-1000004)\n\nWang Qize discovered that an information disclosure vulnerability existed \nin the SMBus driver for ACPI Embedded Controllers in the Linux kernel. A \nlocal attacker could use this to expose sensitive information (kernel \npointer addresses). (CVE-2018-5750)\n\n\u8303\u9f99\u98de discovered that a race condition existed in the Advanced Linux \nSound Architecture (ALSA) subsystem of the Linux kernel that could lead to \na use-after-free or an out-of-bounds buffer access. A local attacker with \naccess to /dev/snd/seq could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2018-7566)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-04-24T00:00:00", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-13305", "CVE-2017-16538", "CVE-2018-1000004", "CVE-2018-5750", "CVE-2018-7566"], "modified": "2018-04-24T00:00:00", "id": "USN-3631-1", "href": "https://ubuntu.com/security/notices/USN-3631-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-26T13:09:08", "description": "## Releases\n\n * Ubuntu 14.04 ESM\n\n## Packages\n\n * linux-aws \\- Linux kernel for Amazon Web Services (AWS) systems\n * linux-lts-xenial \\- Linux hardware enablement kernel from Xenial for Trusty\n\nUSN-3631-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 \nLTS. This update provides the corresponding updates for the Linux \nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu \n14.04 LTS.\n\nIt was discovered that a buffer overread vulnerability existed in the \nkeyring subsystem of the Linux kernel. A local attacker could possibly use \nthis to expose sensitive information (kernel memory). (CVE-2017-13305)\n\nIt was discovered that the DM04/QQBOX USB driver in the Linux kernel did \nnot properly handle device attachment and warm-start. A physically \nproximate attacker could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2017-16538)\n\nLuo Quan and Wei Yang discovered that a race condition existed in the \nAdvanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when \nhandling ioctl()s. A local attacker could use this to cause a denial of \nservice (system deadlock). (CVE-2018-1000004)\n\nWang Qize discovered that an information disclosure vulnerability existed \nin the SMBus driver for ACPI Embedded Controllers in the Linux kernel. A \nlocal attacker could use this to expose sensitive information (kernel \npointer addresses). (CVE-2018-5750)\n\n\u8303\u9f99\u98de discovered that a race condition existed in the Advanced Linux \nSound Architecture (ALSA) subsystem of the Linux kernel that could lead to \na use-after-free or an out-of-bounds buffer access. A local attacker with \naccess to /dev/snd/seq could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2018-7566)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-04-24T00:00:00", "type": "ubuntu", "title": "Linux kernel (Xenial HWE) vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-13305", "CVE-2017-16538", "CVE-2018-1000004", "CVE-2018-5750", "CVE-2018-7566"], "modified": "2018-04-24T00:00:00", "id": "USN-3631-2", "href": "https://ubuntu.com/security/notices/USN-3631-2", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-03T18:58:09", "description": "## Releases\n\n * Ubuntu 17.10 \n\n## Packages\n\n * linux-raspi2 \\- Linux kernel for Raspberry Pi 2\n\nIt was discovered that the netlink subsystem in the Linux kernel did not \nproperly restrict observations of netlink messages to the appropriate net \nnamespace. A local attacker could use this to expose sensitive information \n(kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007 \ndriver of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash) or possibly execute arbitrary code. \n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper \ncomponent of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2) \nimplementation in the Linux kernel in certain circumstances. A local \nattacker could use this to cause a denial of service (system hang). \n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS \nimplementation in the Linux kernel. A remote attacker controlling a \nmalicious NCPFS server could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2018-8822)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-22T00:00:00", "type": "ubuntu", "title": "Linux kernel (Raspberry Pi 2) vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17449", "CVE-2017-17975", "CVE-2017-18203", "CVE-2017-18208", "CVE-2018-8822"], "modified": "2018-05-22T00:00:00", "id": "USN-3657-1", "href": "https://ubuntu.com/security/notices/USN-3657-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-03T18:58:13", "description": "## Releases\n\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * linux-azure \\- Linux kernel for Microsoft Azure Cloud systems\n * linux-gcp \\- Linux kernel for Google Cloud Platform (GCP) systems\n * linux-hwe \\- Linux hardware enablement (HWE) kernel\n * linux-oem \\- Linux kernel for OEM processors\n\nUSN-3653-1 fixed vulnerabilities and added mitigations in the Linux \nkernel for Ubuntu 17.10. This update provides the corresponding \nupdates for the Linux Hardware Enablement (HWE) kernel from Ubuntu \n17.10 for Ubuntu 16.04 LTS.\n\nJann Horn and Ken Johnson discovered that microprocessors utilizing \nspeculative execution of a memory read may allow unauthorized memory \nreads via a sidechannel attack. This flaw is known as Spectre \nVariant 4. A local attacker could use this to expose sensitive \ninformation, including kernel memory. (CVE-2018-3639)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not \nproperly restrict observations of netlink messages to the appropriate net \nnamespace. A local attacker could use this to expose sensitive information \n(kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007 \ndriver of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash) or possibly execute arbitrary code. \n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper \ncomponent of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2) \nimplementation in the Linux kernel in certain circumstances. A local \nattacker could use this to cause a denial of service (system hang). \n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS \nimplementation in the Linux kernel. A remote attacker controlling a \nmalicious NCPFS server could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2018-8822)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-22T00:00:00", "type": "ubuntu", "title": "Linux kernel (HWE) vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17449", "CVE-2017-17975", "CVE-2017-18203", "CVE-2017-18208", "CVE-2018-3639", "CVE-2018-8822"], "modified": "2018-05-22T00:00:00", "id": "USN-3653-2", "href": "https://ubuntu.com/security/notices/USN-3653-2", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-03T18:58:12", "description": "## Releases\n\n * Ubuntu 17.10 \n\n## Packages\n\n * linux \\- Linux kernel\n\nJann Horn and Ken Johnson discovered that microprocessors utilizing \nspeculative execution of a memory read may allow unauthorized memory \nreads via a sidechannel attack. This flaw is known as Spectre \nVariant 4. A local attacker could use this to expose sensitive \ninformation, including kernel memory. (CVE-2018-3639)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not \nproperly restrict observations of netlink messages to the appropriate net \nnamespace. A local attacker could use this to expose sensitive information \n(kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007 \ndriver of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash) or possibly execute arbitrary code. \n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper \ncomponent of the Linux kernel. A local attacker could use this to cause a \ndenial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2) \nimplementation in the Linux kernel in certain circumstances. A local \nattacker could use this to cause a denial of service (system hang). \n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS \nimplementation in the Linux kernel. A remote attacker controlling a \nmalicious NCPFS server could use this to cause a denial of service (system \ncrash) or possibly execute arbitrary code. (CVE-2018-8822)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-22T00:00:00", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17449", "CVE-2017-17975", "CVE-2017-18203", "CVE-2017-18208", "CVE-2018-3639", "CVE-2018-8822"], "modified": "2018-05-22T00:00:00", "id": "USN-3653-1", "href": "https://ubuntu.com/security/notices/USN-3653-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2023-01-20T14:17:04", "description": "Mohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8824).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-23T00:00:00", "type": "nessus", "title": "Ubuntu 17.10 : linux-raspi2 vulnerabilities (USN-3581-3)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115", "CVE-2017-17712", "CVE-2017-8824"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "cpe:/o:canonical:ubuntu_linux:17.10"], "id": "UBUNTU_USN-3581-3.NASL", "href": "https://www.tenable.com/plugins/nessus/106971", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3581-3. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106971);\n script_version(\"3.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-8824\");\n script_xref(name:\"USN\", value:\"3581-3\");\n\n script_name(english:\"Ubuntu 17.10 : linux-raspi2 vulnerabilities (USN-3581-3)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Mohamed Ghannam discovered that the IPv4 raw socket implementation in\nthe Linux kernel contained a race condition leading to uninitialized\npointer usage. A local attacker could use this to cause a denial of\nservice or possibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in\nthe SCTP protocol implementation in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP\nprotocol implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-8824).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3581-3/\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Update the affected linux-image-4.13-raspi2 and / or\nlinux-image-raspi2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:17.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(17\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 17.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-8824\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3581-3\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-1014-raspi2\", pkgver:\"4.13.0-1014.15\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-raspi2\", pkgver:\"4.13.0.1014.12\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.13-raspi2 / linux-image-raspi2\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T14:17:15", "description": "USN-3581-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10.\nThis update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS.\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8824)\n\nUSN-3541-2 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64 architecture in Ubuntu 16.04 LTS. This update provides the compiler-based retpoline kernel mitigation for the amd64 and i386 architectures. \n\nJann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-23T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities (USN-3581-2) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-oem", "p-cpe:/a:canonical:ubuntu_linux:linux-image-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oem", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3581-2.NASL", "href": "https://www.tenable.com/plugins/nessus/106970", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3581-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106970);\n script_version(\"3.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n script_xref(name:\"USN\", value:\"3581-2\");\n script_xref(name:\"IAVA\", value:\"2018-A-0020\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities (USN-3581-2) (Spectre)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3581-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS.\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in\nthe Linux kernel contained a race condition leading to uninitialized\npointer usage. A local attacker could use this to cause a denial of\nservice or possibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in\nthe SCTP protocol implementation in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP\nprotocol implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-8824)\n\nUSN-3541-2 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64\narchitecture in Ubuntu 16.04 LTS. This update provides the\ncompiler-based retpoline kernel mitigation for the amd64 and i386\narchitectures. \n\nJann Horn discovered that microprocessors utilizing speculative\nexecution and branch prediction may allow unauthorized memory reads\nvia sidechannel attacks. This flaw is known as Spectre. A local\nattacker could use this to expose sensitive information, including\nkernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3581-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-oem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oem\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/23\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3581-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-1011-azure\", pkgver:\"4.13.0-1011.14\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-1011-gcp\", pkgver:\"4.13.0-1011.15\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-1021-oem\", pkgver:\"4.13.0-1021.23\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-36-generic\", pkgver:\"4.13.0-36.40~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-36-generic-lpae\", pkgver:\"4.13.0-36.40~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-36-lowlatency\", pkgver:\"4.13.0-36.40~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-azure\", pkgver:\"4.13.0.1011.12\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gcp\", pkgver:\"4.13.0.1011.13\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-hwe-16.04\", pkgver:\"4.13.0.36.55\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae-hwe-16.04\", pkgver:\"4.13.0.36.55\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gke\", pkgver:\"4.13.0.1011.13\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency-hwe-16.04\", pkgver:\"4.13.0.36.55\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oem\", pkgver:\"4.13.0.1021.25\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.13-azure / linux-image-4.13-gcp / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T14:17:03", "description": "Mohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8824)\n\nUSN-3541-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64 architecture in Ubuntu 17.10. This update provides the compiler-based retpoline kernel mitigation for the amd64 and i386 architectures. \n\nJann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-23T00:00:00", "type": "nessus", "title": "Ubuntu 17.10 : linux vulnerabilities (USN-3581-1) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "cpe:/o:canonical:ubuntu_linux:17.10"], "id": "UBUNTU_USN-3581-1.NASL", "href": "https://www.tenable.com/plugins/nessus/106969", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3581-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106969);\n script_version(\"3.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n script_xref(name:\"USN\", value:\"3581-1\");\n script_xref(name:\"IAVA\", value:\"2018-A-0020\");\n\n script_name(english:\"Ubuntu 17.10 : linux vulnerabilities (USN-3581-1) (Spectre)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Mohamed Ghannam discovered that the IPv4 raw socket implementation in\nthe Linux kernel contained a race condition leading to uninitialized\npointer usage. A local attacker could use this to cause a denial of\nservice or possibly execute arbitrary code. (CVE-2017-17712)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in\nthe SCTP protocol implementation in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP\nprotocol implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-8824)\n\nUSN-3541-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64\narchitecture in Ubuntu 17.10. This update provides the compiler-based\nretpoline kernel mitigation for the amd64 and i386 architectures. \n\nJann Horn discovered that microprocessors utilizing speculative\nexecution and branch prediction may allow unauthorized memory reads\nvia sidechannel attacks. This flaw is known as Spectre. A local\nattacker could use this to expose sensitive information, including\nkernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3581-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:17.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/23\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(17\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 17.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3581-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-36-generic\", pkgver:\"4.13.0-36.40\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-36-generic-lpae\", pkgver:\"4.13.0-36.40\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-36-lowlatency\", pkgver:\"4.13.0-36.40\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-generic\", pkgver:\"4.13.0.36.38\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.13.0.36.38\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.13.0.36.38\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.13-generic / linux-image-4.13-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:53:27", "description": "The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4619 advisory.\n\n - A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions:\n Android kernel. Android ID: A-70526974. (CVE-2017-13305)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 7.1, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2019-04-23T00:00:00", "type": "nessus", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4619)", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 3.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-13305"], "modified": "2021-09-08T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek-firmware"], "id": "ORACLELINUX_ELSA-2019-4619.NASL", "href": "https://www.tenable.com/plugins/nessus/124231", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2019-4619.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(124231);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/09/08\");\n\n script_cve_id(\"CVE-2017-13305\");\n\n script_name(english:\"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4619)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the\nELSA-2019-4619 advisory.\n\n - A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions:\n Android kernel. Android ID: A-70526974. (CVE-2017-13305)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2019-4619.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-13305\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/23\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-firmware\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 6 / 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.1.12-124.26.10.el6uek', '4.1.12-124.26.10.el7uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2019-4619');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.1';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-4.1.12-124.26.10.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-124.26.10.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-124.26.10.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-124.26.10.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-124.26.10.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-124.26.10.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'},\n {'reference':'kernel-uek-4.1.12-124.26.10.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-124.26.10.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-124.26.10.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-124.26.10.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-124.26.10.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-124.26.10.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-debug / kernel-uek-debug-devel / etc');\n}\n", "cvss": {"score": 3.6, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"}}, {"lastseen": "2021-08-19T12:27:05", "description": "The remote OracleVM system is missing necessary patches to address critical security updates :\n\n - x86/apic: Make arch_setup_hwirq NUMA node aware (Henry Willard) [Orabug: 29534769]\n\n - KEYS: encrypted: fix buffer overread in valid_master_desc (Eric Biggers) [Orabug: 29591025] (CVE-2017-13305)\n\n - scsi: target: remove hardcoded T10 Vendor ID in INQUIRY response (Alan Adamson) [Orabug: 29344862]\n\n - scsi: target: add device vendor id, product id and revision configfs attributes (Alan Adamson) [Orabug:\n 29344862]\n\n - scsi: target: consistently null-terminate t10_wwn strings (David Disseldorp) [Orabug: 29344862]\n\n - scsi: target: use consistent left-aligned ASCII INQUIRY data (David Disseldorp) [Orabug: 29344862]\n\n - ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner) [Orabug: 29553371]\n\n - swiotlb: checking whether swiotlb buffer is full with io_tlb_used (Dongli Zhang) [Orabug: 29582587]\n\n - swiotlb: add debugfs to track swiotlb buffer usage (Dongli Zhang) [Orabug: 29582587]\n\n - swiotlb: fix comment on swiotlb_bounce (Dongli Zhang) [Orabug: 29582587]\n\n - NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success. (NeilBrown) [Orabug: 29617508]", "cvss3": {}, "published": "2019-05-06T00:00:00", "type": "nessus", "title": "OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0015)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-13305"], "modified": "2020-01-21T00:00:00", "cpe": ["p-cpe:/a:oracle:vm:kernel-uek", "p-cpe:/a:oracle:vm:kernel-uek-firmware", "cpe:/o:oracle:vm_server:3.4"], "id": "ORACLEVM_OVMSA-2019-0015.NASL", "href": "https://www.tenable.com/plugins/nessus/124638", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2019-0015.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(124638);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2020/01/21\");\n\n script_cve_id(\"CVE-2017-13305\");\n\n script_name(english:\"OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0015)\");\n script_summary(english:\"Checks the RPM output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - x86/apic: Make arch_setup_hwirq NUMA node aware (Henry\n Willard) [Orabug: 29534769]\n\n - KEYS: encrypted: fix buffer overread in\n valid_master_desc (Eric Biggers) [Orabug: 29591025]\n (CVE-2017-13305)\n\n - scsi: target: remove hardcoded T10 Vendor ID in INQUIRY\n response (Alan Adamson) [Orabug: 29344862]\n\n - scsi: target: add device vendor id, product id and\n revision configfs attributes (Alan Adamson) [Orabug:\n 29344862]\n\n - scsi: target: consistently null-terminate t10_wwn\n strings (David Disseldorp) [Orabug: 29344862]\n\n - scsi: target: use consistent left-aligned ASCII INQUIRY\n data (David Disseldorp) [Orabug: 29344862]\n\n - ext4: fix data corruption caused by unaligned direct AIO\n (Lukas Czerner) [Orabug: 29553371]\n\n - swiotlb: checking whether swiotlb buffer is full with\n io_tlb_used (Dongli Zhang) [Orabug: 29582587]\n\n - swiotlb: add debugfs to track swiotlb buffer usage\n (Dongli Zhang) [Orabug: 29582587]\n\n - swiotlb: fix comment on swiotlb_bounce (Dongli Zhang)\n [Orabug: 29582587]\n\n - NFSv4.1: nfs4_fl_prepare_ds must be careful about\n reporting success. (NeilBrown) [Orabug: 29617508]\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/oraclevm-errata/2019-May/000937.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel-uek / kernel-uek-firmware packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.4\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.4\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-4.1.12-124.26.10.el6uek\")) flag++;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-firmware-4.1.12-124.26.10.el6uek\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-uek / kernel-uek-firmware\");\n}\n", "cvss": {"score": 3.6, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"}}, {"lastseen": "2023-03-12T14:11:00", "description": "The 4.14.7 stable kernel update contains a number of important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.0, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-15T00:00:00", "type": "nessus", "title": "Fedora 27 : kernel (2017-f7cb245861)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17712"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2017-F7CB245861.NASL", "href": "https://www.tenable.com/plugins/nessus/106010", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-f7cb245861.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(106010);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-17712\");\n script_xref(name:\"FEDORA\", value:\"2017-f7cb245861\");\n\n script_name(english:\"Fedora 27 : kernel (2017-f7cb245861)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.14.7 stable kernel update contains a number of important fixes\nacross the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-f7cb245861\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-17712\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-f7cb245861\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"kernel-4.14.7-300.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T14:18:33", "description": "An update of the linux package has been released.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-02-07T00:00:00", "type": "nessus", "title": "Photon OS 2.0: Linux PHSA-2017-0051", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115"], "modified": "2022-05-24T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:linux", "cpe:/o:vmware:photonos:2.0"], "id": "PHOTONOS_PHSA-2017-0051_LINUX.NASL", "href": "https://www.tenable.com/plugins/nessus/121771", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2017-0051. The text\n# itself is copyright (C) VMware, Inc.\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(121771);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/24\");\n\n script_cve_id(\"CVE-2017-15115\");\n\n script_name(english:\"Photon OS 2.0: Linux PHSA-2017-0051\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the linux package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-2-5.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15115\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/PhotonOS/release\");\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, \"PhotonOS\");\nif (release !~ \"^VMware Photon (?:Linux|OS) 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"PhotonOS 2.0\");\n\nif (!get_kb_item(\"Host/PhotonOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"PhotonOS\", cpu);\n\nflag = 0;\n\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-4.9.66-2.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-api-headers-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-debuginfo-4.9.66-2.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-devel-4.9.66-2.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-docs-4.9.66-2.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-drivers-gpu-4.9.66-2.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-esx-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-esx-debuginfo-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-esx-devel-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-esx-docs-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-oprofile-4.9.66-2.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-secure-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-secure-debuginfo-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-secure-devel-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-secure-docs-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-secure-lkcm-4.9.66-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-sound-4.9.66-2.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"linux-tools-4.9.66-2.ph2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T14:14:50", "description": "The 4.13.13 update contains a number of important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-15T00:00:00", "type": "nessus", "title": "Fedora 27 : kernel (2017-f73d3f1fc4)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2017-F73D3F1FC4.NASL", "href": "https://www.tenable.com/plugins/nessus/106008", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-f73d3f1fc4.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(106008);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15115\");\n script_xref(name:\"FEDORA\", value:\"2017-f73d3f1fc4\");\n\n script_name(english:\"Fedora 27 : kernel (2017-f73d3f1fc4)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.13.13 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-f73d3f1fc4\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-15115\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-f73d3f1fc4\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"kernel-4.13.13-300.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T15:12:42", "description": "The 4.13.13 update contains a number of important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-11-20T00:00:00", "type": "nessus", "title": "Fedora 26 : kernel (2017-62e3a94f2a)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-62E3A94F2A.NASL", "href": "https://www.tenable.com/plugins/nessus/104689", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-62e3a94f2a.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(104689);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15115\");\n script_xref(name:\"FEDORA\", value:\"2017-62e3a94f2a\");\n\n script_name(english:\"Fedora 26 : kernel (2017-62e3a94f2a)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.13.13 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-62e3a94f2a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/11/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-15115\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-62e3a94f2a\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"kernel-4.13.13-200.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T15:11:59", "description": "The 4.13.13 update contains a number of important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-11-21T00:00:00", "type": "nessus", "title": "Fedora 25 : kernel (2017-1b4d140781)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:25"], "id": "FEDORA_2017-1B4D140781.NASL", "href": "https://www.tenable.com/plugins/nessus/104710", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-1b4d140781.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(104710);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2017-15115\");\n script_xref(name:\"FEDORA\", value:\"2017-1b4d140781\");\n\n script_name(english:\"Fedora 25 : kernel (2017-1b4d140781)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.13.13 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-1b4d140781\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:25\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/11/21\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^25([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 25\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-15115\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-1b4d140781\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC25\", reference:\"kernel-4.13.13-100.fc25\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T15:13:28", "description": "According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :\n\n - The sctp_do_peeloff() function in the Linux kernel before 4.14 did not check whether the intended netns was used in a peel-off action, which allowed local users to cause a denial of service (use-after-free in sctp_cmp_addr_exact() resulting in system crash) or possibly have unspecified other impact via crafted system calls.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-28T00:00:00", "type": "nessus", "title": "Virtuozzo 7 : readykernel-patch (VZA-2017-120)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15115"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:virtuozzo:virtuozzo:readykernel", "cpe:/o:virtuozzo:virtuozzo:7"], "id": "VIRTUOZZO_VZA-2017-120.NASL", "href": "https://www.tenable.com/plugins/nessus/105464", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105464);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\n \"CVE-2017-15115\"\n );\n\n script_name(english:\"Virtuozzo 7 : readykernel-patch (VZA-2017-120)\");\n script_summary(english:\"Checks the readykernel output for the updated patch.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Virtuozzo host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerability :\n\n - The sctp_do_peeloff() function in the Linux kernel\n before 4.14 did not check whether the intended netns\n was used in a peel-off action, which allowed local\n users to cause a denial of service (use-after-free in\n sctp_cmp_addr_exact() resulting in system crash) or\n possibly have unspecified other impact via crafted\n system calls.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://help.virtuozzo.com/customer/portal/articles/2912489\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-30.10-41.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e526b6e1\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-30.15-41.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?52a7138b\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-33.22-41.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?74d1347f\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-37.30-41.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b88eb898\");\n script_set_attribute(attribute:\"solution\", value:\"Update the readykernel patch.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:virtuozzo:virtuozzo:readykernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:virtuozzo:virtuozzo:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Virtuozzo Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Virtuozzo/release\", \"Host/Virtuozzo/rpm-list\", \"Host/readykernel-info\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"readykernel.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/Virtuozzo/release\");\nif (isnull(release) || \"Virtuozzo\" >!< release) audit(AUDIT_OS_NOT, \"Virtuozzo\");\nos_ver = pregmatch(pattern: \"Virtuozzo Linux release ([0-9]+\\.[0-9])(\\D|$)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Virtuozzo 7.x\", \"Virtuozzo \" + os_ver);\n\nif (!get_kb_item(\"Host/Virtuozzo/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Virtuozzo\", cpu);\n\nrk_info = get_kb_item(\"Host/readykernel-info\");\nif (empty_or_null(rk_info)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\n\nchecks = make_list2(\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.16.1.vz7.30.10\",\n \"patch\",\"readykernel-patch-30.10-41.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.16.1.vz7.30.15\",\n \"patch\",\"readykernel-patch-30.15-41.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.26.1.vz7.33.22\",\n \"patch\",\"readykernel-patch-33.22-41.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-693.1.1.vz7.37.30\",\n \"patch\",\"readykernel-patch-37.30-41.1-1.vl7\"\n )\n);\nreadykernel_execute_checks(checks:checks, severity:SECURITY_HOLE, release:\"Virtuozzo-7\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T14:16:53", "description": "Mohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-17712)\n\nLaurent Guerby discovered that the mbcache feature in the ext2 and ext4 filesystems in the Linux kernel improperly handled xattr block caching. A local attacker could use this to cause a denial of service.\n(CVE-2015-8952)\n\nVitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel did not properly track reference counts when merging buffers. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2017-12190)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8824)\n\nUSN-3540-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64 architecture in Ubuntu 16.04 LTS. This update provides the compiler-based retpoline kernel mitigation for the amd64 and i386 architectures. \n\nJann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-23T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3582-1) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8952", "CVE-2017-12190", "CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3582-1.NASL", "href": "https://www.tenable.com/plugins/nessus/106972", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3582-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106972);\n script_version(\"3.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2015-8952\", \"CVE-2017-12190\", \"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n script_xref(name:\"USN\", value:\"3582-1\");\n script_xref(name:\"IAVA\", value:\"2018-A-0020\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3582-1) (Spectre)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Mohamed Ghannam discovered that the IPv4 raw socket implementation in\nthe Linux kernel contained a race condition leading to uninitialized\npointer usage. A local attacker could use this to cause a denial of\nservice or possibly execute arbitrary code. (CVE-2017-17712)\n\nLaurent Guerby discovered that the mbcache feature in the ext2 and\next4 filesystems in the Linux kernel improperly handled xattr block\ncaching. A local attacker could use this to cause a denial of service.\n(CVE-2015-8952)\n\nVitaly Mayatskikh discovered that the SCSI subsystem in the Linux\nkernel did not properly track reference counts when merging buffers. A\nlocal attacker could use this to cause a denial of service (memory\nexhaustion). (CVE-2017-12190)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in\nthe SCTP protocol implementation in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP\nprotocol implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-8824)\n\nUSN-3540-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64\narchitecture in Ubuntu 16.04 LTS. This update provides the\ncompiler-based retpoline kernel mitigation for the amd64 and i386\narchitectures. \n\nJann Horn discovered that microprocessors utilizing speculative\nexecution and branch prediction may allow unauthorized memory reads\nvia sidechannel attacks. This flaw is known as Spectre. A local\nattacker could use this to expose sensitive information, including\nkernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3582-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/23\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2015-8952\", \"CVE-2017-12190\", \"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3582-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1019-kvm\", pkgver:\"4.4.0-1019.24\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1052-aws\", pkgver:\"4.4.0-1052.61\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1085-raspi2\", pkgver:\"4.4.0-1085.93\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1087-snapdragon\", pkgver:\"4.4.0-1087.92\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-116-generic\", pkgver:\"4.4.0-116.140\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-116-generic-lpae\", pkgver:\"4.4.0-116.140\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-116-lowlatency\", pkgver:\"4.4.0-116.140\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1052.54\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.116.122\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.116.122\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.4.0.1019.18\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.116.122\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1085.85\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.4.0.1087.79\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T14:17:15", "description": "USN-3582-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-17712)\n\nLaurent Guerby discovered that the mbcache feature in the ext2 and ext4 filesystems in the Linux kernel improperly handled xattr block caching. A local attacker could use this to cause a denial of service.\n(CVE-2015-8952)\n\nVitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel did not properly track reference counts when merging buffers. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2017-12190)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8824)\n\nUSN-3540-2 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64 architecture in Ubuntu 14.04 LTS. This update provides the compiler-based retpoline kernel mitigation for the amd64 and i386 architectures. \n\nJann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-23T00:00:00", "type": "nessus", "title": "Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3582-2) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8952", "CVE-2017-12190", "CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5715", "CVE-2017-8824"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3582-2.NASL", "href": "https://www.tenable.com/plugins/nessus/106973", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3582-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106973);\n script_version(\"3.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2015-8952\", \"CVE-2017-12190\", \"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n script_xref(name:\"USN\", value:\"3582-2\");\n script_xref(name:\"IAVA\", value:\"2018-A-0020\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3582-2) (Spectre)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3582-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nMohamed Ghannam discovered that the IPv4 raw socket implementation in\nthe Linux kernel contained a race condition leading to uninitialized\npointer usage. A local attacker could use this to cause a denial of\nservice or possibly execute arbitrary code. (CVE-2017-17712)\n\nLaurent Guerby discovered that the mbcache feature in the ext2 and\next4 filesystems in the Linux kernel improperly handled xattr block\ncaching. A local attacker could use this to cause a denial of service.\n(CVE-2015-8952)\n\nVitaly Mayatskikh discovered that the SCSI subsystem in the Linux\nkernel did not properly track reference counts when merging buffers. A\nlocal attacker could use this to cause a denial of service (memory\nexhaustion). (CVE-2017-12190)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in\nthe SCTP protocol implementation in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code, (CVE-2017-15115)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP\nprotocol implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-8824)\n\nUSN-3540-2 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64\narchitecture in Ubuntu 14.04 LTS. This update provides the\ncompiler-based retpoline kernel mitigation for the amd64 and i386\narchitectures. \n\nJann Horn discovered that microprocessors utilizing speculative\nexecution and branch prediction may allow unauthorized memory reads\nvia sidechannel attacks. This flaw is known as Spectre. A local\nattacker could use this to expose sensitive information, including\nkernel memory. (CVE-2017-5715).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3582-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/23\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2015-8952\", \"CVE-2017-12190\", \"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5715\", \"CVE-2017-8824\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3582-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-1014-aws\", pkgver:\"4.4.0-1014.14\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-116-generic\", pkgver:\"4.4.0-116.140~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-116-generic-lpae\", pkgver:\"4.4.0-116.140~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-116-lowlatency\", pkgver:\"4.4.0-116.140~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1014.14\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae-lts-xenial\", pkgver:\"4.4.0.116.98\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lts-xenial\", pkgver:\"4.4.0.116.98\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency-lts-xenial\", pkgver:\"4.4.0.116.98\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-31T14:14:04", "description": "The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4025 advisory.\n\n - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. (CVE-2017-5754)\n\n - The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations. (CVE-2017-12193)\n\n - The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state. (CVE-2017-8824)\n\n - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors. (CVE-2017-0861)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.\n (CVE-2017-15115)\n\n - The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges. (CVE-2017-17712)\n\n - The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR. (CVE-2017-14140)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-08T00:00:00", "type": "nessus", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4025)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-0861", "CVE-2017-12193", "CVE-2017-14140", "CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5754", "CVE-2017-8824"], "modified": "2021-09-08T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek-firmware"], "id": "ORACLELINUX_ELSA-2018-4025.NASL", "href": "https://www.tenable.com/plugins/nessus/106670", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2018-4025.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(106670);\n script_version(\"3.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/09/08\");\n\n script_cve_id(\n \"CVE-2017-0861\",\n \"CVE-2017-5754\",\n \"CVE-2017-8824\",\n \"CVE-2017-12193\",\n \"CVE-2017-14140\",\n \"CVE-2017-15115\",\n \"CVE-2017-17712\"\n );\n script_xref(name:\"IAVA\", value:\"2018-A-0019\");\n script_xref(name:\"IAVA\", value:\"2018-A-0022-S\");\n script_xref(name:\"IAVA\", value:\"2018-A-0017\");\n\n script_name(english:\"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4025)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe ELSA-2018-4025 advisory.\n\n - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow\n unauthorized disclosure of information to an attacker with local user access via a side-channel analysis\n of the data cache. (CVE-2017-5754)\n\n - The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11\n mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference\n and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link\n creation operations. (CVE-2017-12193)\n\n - The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to\n gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during\n the DCCP_LISTEN state. (CVE-2017-8824)\n\n - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows\n attackers to gain privileges via unspecified vectors. (CVE-2017-0861)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether\n the intended netns is used in a peel-off action, which allows local users to cause a denial of service\n (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.\n (CVE-2017-15115)\n\n - The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in\n inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code\n and gain privileges. (CVE-2017-17712)\n\n - The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective\n uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable\n despite ASLR. (CVE-2017-14140)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2018-4025.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-8824\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-firmware\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 6 / 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['4.1.12-112.14.14.el6uek', '4.1.12-112.14.14.el7uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2018-4025');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '4.1';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'kernel-uek-4.1.12-112.14.14.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-112.14.14.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-112.14.14.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-112.14.14.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-112.14.14.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-112.14.14.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'},\n {'reference':'kernel-uek-4.1.12-112.14.14.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-4.1.12'},\n {'reference':'kernel-uek-debug-4.1.12-112.14.14.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-4.1.12'},\n {'reference':'kernel-uek-debug-devel-4.1.12-112.14.14.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-4.1.12'},\n {'reference':'kernel-uek-devel-4.1.12-112.14.14.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-4.1.12'},\n {'reference':'kernel-uek-doc-4.1.12-112.14.14.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-4.1.12'},\n {'reference':'kernel-uek-firmware-4.1.12-112.14.14.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-4.1.12'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-debug / kernel-uek-debug-devel / etc');\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-30T14:43:48", "description": "The remote OracleVM system is missing necessary patches to address critical security updates :\n\n - drivers/char/mem.c: deny access in open operation when securelevel is set (Ethan Zhao) [Orabug: 27234850] [Orabug: 27234850]\n\n - hugetlb: fix nr_pmds accounting with shared page tables (Kirill A. Shutemov) [Orabug: 26988581]\n\n - x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky) [Orabug: 27416198]\n\n - x86/IBRS: Don't try to change IBRS mode if IBRS is not available (Boris Ostrovsky) [Orabug: 27416198]\n\n - x86/IBRS: Remove support for IBRS_ENABLED_USER mode (Boris Ostrovsky) \n\n - x86: Include linux/device.h in bugs_64.c (Boris Ostrovsky) [Orabug: 27418896]\n\n - x86/spectre: Drop the warning about ibrs being obsolete.\n (Konrad Rzeszutek Wilk)\n\n - x86/spec: Don't print the Missing arguments for option spectre_v2. (Konrad Rzeszutek Wilk)\n\n - x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk)\n\n - x86/IBPB: Provide debugfs interface for changing IBPB mode (Boris Ostrovsky) [Orabug: 27449065]\n\n - xen: Make PV Dom0 Linux kernel NUMA aware (Elena Ufimtseva)\n\n - net/rds: Fix incorrect error handling (Hå kon Bugge) [Orabug: 26848729]\n\n - net/rds: use multiple sge than buddy allocation in congestion code (Wei Lin Guay) [Orabug: 26848729]\n\n - Revert 'RDS: fix the sg allocation based on actual message size' (Wei Lin Guay) [Orabug: 26848729]\n\n - Revert 'RDS: avoid large pages for sg allocation for TCP transport' (Wei Lin Guay) [Orabug: 26848729]\n\n - Revert 'net/rds: Reduce memory footprint in rds_sendmsg' (Wei Lin Guay) [Orabug: 26848729]\n\n - net/rds: reduce memory footprint during ib_post_recv in IB transport (Wei Lin Guay) [Orabug: 26848729]\n\n - net/rds: reduce memory footprint during rds_sendmsg with IB transport (Wei Lin Guay) [Orabug: 26848729]\n\n - net/rds: set the rds_ib_init_frag based on supported sge (Wei Lin Guay) [Orabug: 26848729]\n\n - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response. (Michael Chan) [Orabug: 27199588]\n\n - x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122]\n\n - x86, efi, kasan: Fix build failure on !KASAN && KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122]\n\n - x86, efi, kasan: #undef memset/memcpy/memmove per arch (Andrey Ryabinin) [Orabug: 27255122]\n\n - Revert 'Makefile: Build with -Werror=date-time if the compiler supports it' (Gayatri Vasudevan) [Orabug:\n 27255122]\n\n - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam) [Orabug: 27290300] (CVE-2017-8824)\n\n - x86/efi: Initialize and display UEFI secure boot state a bit later during init (Daniel Kiper) [Orabug: 27309477]\n\n - x86/espfix: Init espfix on the boot CPU side (Zhu Guihua) [Orabug: 27344552]\n\n - x86/espfix: Add 'cpu' parameter to init_espfix_ap (Zhu Guihua) \n\n - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser) [Orabug: 27344841] (CVE-2017-0861) (CVE-2017-0861)\n\n - fs/ocfs2: remove page cache for converted direct write (Wengang Wang)\n\n - Revert 'ocfs2: code clean up for direct io' (Wengang Wang)\n\n - assoc_array: Fix a buggy node-splitting case (David Howells) [Orabug: 27364592] (CVE-2017-12193) (CVE-2017-12193)\n\n - Sanitize 'move_pages' permission checks (Linus Torvalds) [Orabug: 27364690] (CVE-2017-14140)\n\n - pti: compile fix for when PTI is disabled (Pavel Tatashin) [Orabug: 27383147] (CVE-2017-5754)\n\n - sctp: do not peel off an assoc from one netns to another one (Xin Long) [Orabug: 27386999] (CVE-2017-15115)\n\n - net: ipv4: fix for a race condition in raw_sendmsg (Mohamed Ghannam) [Orabug: 27390682] (CVE-2017-17712)\n\n - mlx4: add mstflint secure boot access kernel support (Qing Huang) \n\n - x86: Move STUFF_RSB in to the idt macro (Konrad Rzeszutek Wilk)\n\n - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad Rzeszutek Wilk)\n\n - x86: Move ENABLE_IBRS in the interrupt macro. (Konrad Rzeszutek Wilk)", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-02-09T00:00:00", "type": "nessus", "title": "OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0017) (Meltdown)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-0861", "CVE-2017-12193", "CVE-2017-14140", "CVE-2017-15115", "CVE-2017-17712", "CVE-2017-5754", "CVE-2017-8824"], "modified": "2019-09-27T00:00:00", "cpe": ["p-cpe:/a:oracle:vm:kernel-uek", "p-cpe:/a:oracle:vm:kernel-uek-firmware", "cpe:/o:oracle:vm_server:3.4"], "id": "ORACLEVM_OVMSA-2018-0017.NASL", "href": "https://www.tenable.com/plugins/nessus/106706", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2018-0017.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106706);\n script_version(\"3.4\");\n script_cvs_date(\"Date: 2019/09/27 13:00:35\");\n\n script_cve_id(\"CVE-2017-0861\", \"CVE-2017-12193\", \"CVE-2017-14140\", \"CVE-2017-15115\", \"CVE-2017-17712\", \"CVE-2017-5754\", \"CVE-2017-8824\");\n script_xref(name:\"IAVA\", value:\"2018-A-0019\");\n\n script_name(english:\"OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0017) (Meltdown)\");\n script_summary(english:\"Checks the RPM output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates :\n\n - drivers/char/mem.c: deny access in open operation when\n securelevel is set (Ethan Zhao) [Orabug: 27234850]\n [Orabug: 27234850]\n\n - hugetlb: fix nr_pmds accounting with shared page tables\n (Kirill A. Shutemov) [Orabug: 26988581]\n\n - x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky)\n [Orabug: 27416198]\n\n - x86/IBRS: Don't try to change IBRS mode if IBRS is not\n available (Boris Ostrovsky) [Orabug: 27416198]\n\n - x86/IBRS: Remove support for IBRS_ENABLED_USER mode\n (Boris Ostrovsky) \n\n - x86: Include linux/device.h in bugs_64.c (Boris\n Ostrovsky) [Orabug: 27418896]\n\n - x86/spectre: Drop the warning about ibrs being obsolete.\n (Konrad Rzeszutek Wilk)\n\n - x86/spec: Don't print the Missing arguments for option\n spectre_v2. (Konrad Rzeszutek Wilk)\n\n - x86/spec: Also print IBRS if IBPB is disabled. (Konrad\n Rzeszutek Wilk)\n\n - x86/IBPB: Provide debugfs interface for changing IBPB\n mode (Boris Ostrovsky) [Orabug: 27449065]\n\n - xen: Make PV Dom0 Linux kernel NUMA aware (Elena\n Ufimtseva)\n\n - net/rds: Fix incorrect error handling (Hå kon\n Bugge) [Orabug: 26848729]\n\n - net/rds: use multiple sge than buddy allocation in\n congestion code (Wei Lin Guay) [Orabug: 26848729]\n\n - Revert 'RDS: fix the sg allocation based on actual\n message size' (Wei Lin Guay) [Orabug: 26848729]\n\n - Revert 'RDS: avoid large pages for sg allocation for TCP\n transport' (Wei Lin Guay) [Orabug: 26848729]\n\n - Revert 'net/rds: Reduce memory footprint in rds_sendmsg'\n (Wei Lin Guay) [Orabug: 26848729]\n\n - net/rds: reduce memory footprint during ib_post_recv in\n IB transport (Wei Lin Guay) [Orabug: 26848729]\n\n - net/rds: reduce memory footprint during rds_sendmsg with\n IB transport (Wei Lin Guay) [Orabug: 26848729]\n\n - net/rds: set the rds_ib_init_frag based on supported sge\n (Wei Lin Guay) [Orabug: 26848729]\n\n - bnxt_en: Fix possible corrupted NVRAM parameters from\n firmware response. (Michael Chan) [Orabug: 27199588]\n\n - x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y\n kernels (Andrey Ryabinin) [Orabug: 27255122]\n\n - x86, efi, kasan: Fix build failure on !KASAN &&\n KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122]\n\n - x86, efi, kasan: #undef memset/memcpy/memmove per arch\n (Andrey Ryabinin) [Orabug: 27255122]\n\n - Revert 'Makefile: Build with -Werror=date-time if the\n compiler supports it' (Gayatri Vasudevan) [Orabug:\n 27255122]\n\n - dccp: CVE-2017-8824: use-after-free in DCCP code\n (Mohamed Ghannam) [Orabug: 27290300] (CVE-2017-8824)\n\n - x86/efi: Initialize and display UEFI secure boot state a\n bit later during init (Daniel Kiper) [Orabug: 27309477]\n\n - x86/espfix: Init espfix on the boot CPU side (Zhu\n Guihua) [Orabug: 27344552]\n\n - x86/espfix: Add 'cpu' parameter to init_espfix_ap (Zhu\n Guihua) \n\n - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)\n [Orabug: 27344841] (CVE-2017-0861) (CVE-2017-0861)\n\n - fs/ocfs2: remove page cache for converted direct write\n (Wengang Wang)\n\n - Revert 'ocfs2: code clean up for direct io' (Wengang\n Wang)\n\n - assoc_array: Fix a buggy node-splitting case (David\n Howells) [Orabug: 27364592] (CVE-2017-12193)\n (CVE-2017-12193)\n\n - Sanitize 'move_pages' permission checks (Linus Torvalds)\n [Orabug: 27364690] (CVE-2017-14140)\n\n - pti: compile fix for when PTI is disabled (Pavel\n Tatashin) [Orabug: 27383147] (CVE-2017-5754)\n\n - sctp: do not peel off an assoc from one netns to another\n one (Xin Long) [Orabug: 27386999] (CVE-2017-15115)\n\n - net: ipv4: fix for a race condition in raw_sendmsg\n (Mohamed Ghannam) [Orabug: 27390682] (CVE-2017-17712)\n\n - mlx4: add mstflint secure boot access kernel support\n (Qing Huang) \n\n - x86: Move STUFF_RSB in to the idt macro (Konrad\n Rzeszutek Wilk)\n\n - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad\n Rzeszutek Wilk)\n\n - x86: Move ENABLE_IBRS in the interrupt macro. (Konrad\n Rzeszutek Wilk)\"\n );\n # https://oss.oracle.com/pipermail/oraclevm-errata/2018-February/000828.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f9702f90\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel-uek / kernel-uek-firmware packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:kernel-uek-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/09\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.4\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.4\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-4.1.12-112.14.14.el6uek\")) flag++;\nif (rpm_check(release:\"OVS3.4\", reference:\"kernel-uek-firmware-4.1.12-112.14.14.el6uek\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-uek / kernel-uek-firmware\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-30T14:53:13", "description": "Updated kernel-rt packages that fix two security issues and add one enhancement are now available for Red Hat Enterprise MRG 2.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es) :\n\n* kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker (CVE-2017-13305)\n\n* Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting CVE-2018-3665.\n\nEnhancement(s) :\n\n* The kernel-rt packages have been upgraded to version 3.10.0-693.35.1.rt56.623, which provides a number of bug fixes over the previous version. (BZ#1579972)\n\nUsers of kernel-rt are advised to upgrade to these updated packages, which add this enhancement.\n\nThe system must be rebooted for this update to take effect.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 7.1, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2018-07-12T00:00:00", "type": "nessus", "title": "RHEL 6 : MRG (RHSA-2018:2165)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.7, "vectorString": "AV:L/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-13305", "CVE-2018-3665"], "modified": "2019-10-24T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:kernel-rt", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-debuginfo", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debuginfo", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-debuginfo-common-x86_64", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-doc", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-firmware", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-debuginfo", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla-debuginfo", "p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla-devel", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2018-2165.NASL", "href": "https://www.tenable.com/plugins/nessus/111029", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2018:2165. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(111029);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2019/10/24 15:35:45\");\n\n script_cve_id(\"CVE-2017-13305\", \"CVE-2018-3665\");\n script_xref(name:\"RHSA\", value:\"2018:2165\");\n\n script_name(english:\"RHEL 6 : MRG (RHSA-2018:2165)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated kernel-rt packages that fix two security issues and add one\nenhancement are now available for Red Hat Enterprise MRG 2.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Moderate. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe kernel-rt packages provide the Real Time Linux Kernel, which\nenables fine-tuning for systems with extremely high determinism\nrequirements.\n\nSecurity Fix(es) :\n\n* kernel: Buffer over-read in keyring subsystem allows exposing\npotentially sensitive information to local attacker (CVE-2017-13305)\n\n* Kernel: FPU state information leakage via lazy FPU restore\n(CVE-2018-3665)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\n\nRed Hat would like to thank Julian Stecklina (Amazon.de), Thomas\nPrescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for\nreporting CVE-2018-3665.\n\nEnhancement(s) :\n\n* The kernel-rt packages have been upgraded to version\n3.10.0-693.35.1.rt56.623, which provides a number of bug fixes over\nthe previous version. (BZ#1579972)\n\nUsers of kernel-rt are advised to upgrade to these updated packages,\nwhich add this enhancement.\n\nThe system must be rebooted for this update to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2018:2165\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-13305\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2018-3665\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-firmware\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-rt-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/07/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-13305\", \"CVE-2018-3665\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for RHSA-2018:2165\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2018:2165\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL6\", rpm:\"mrg-release\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"MRG\");\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-debug-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-debug-debuginfo-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-debug-devel-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-debuginfo-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-debuginfo-common-x86_64-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-devel-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"kernel-rt-doc-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", reference:\"kernel-rt-firmware-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-trace-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-trace-debuginfo-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-trace-devel-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-vanilla-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-vanilla-debuginfo-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"kernel-rt-vanilla-devel-3.10.0-693.35.1.rt56.625.el6\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-rt / kernel-rt-debug / kernel-rt-debug-debuginfo / etc\");\n }\n}\n", "cvss": {"score": 4.7, "vector": "AV:L/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-03-12T14:36:14", "description": "The 4.14.8 stable kernel update contains a number of important fixes across the tree.\n\n----\n\nThe 4.14.7 stable kernel update contains a number of important fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.0, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-26T00:00:00", "type": "nessus", "title": "Fedora 26 : kernel (2017-7810b7c59f)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 6.9, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17712", "CVE-2017-17741"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-7810B7C59F.NASL", "href": "https://www.tenable.com/plugins/nessus/105447", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-7810b7c59f.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105447);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-17712\", \"CVE-2017-17741\");\n script_xref(name:\"FEDORA\", value:\"2017-7810b7c59f\");\n\n script_name(english:\"Fedora 26 : kernel (2017-7810b7c59f)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.14.8 stable kernel update contains a number of important fixes\nacross the tree.\n\n----\n\nThe 4.14.7 stable kernel update contains a number of important fixes\nacross the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-7810b7c59f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-17712\", \"CVE-2017-17741\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-7810b7c59f\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"kernel-4.14.8-200.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T15:13:19", "description": "According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.(CVE-2017-15102)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.(CVE-2017-15115)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-18T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1342)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15102", "CVE-2017-15115"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-debug", "p-cpe:/a:huawei:euleros:kernel-debug-devel", "p-cpe:/a:huawei:euleros:kernel-debuginfo", "p-cpe:/a:huawei:euleros:kernel-debuginfo-common-x86_64", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2017-1342.NASL", "href": "https://www.tenable.com/plugins/nessus/105323", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105323);\n script_version(\"3.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2017-15102\",\n \"CVE-2017-15115\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1342)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - The tower_probe function in\n drivers/usb/misc/legousbtower.c in the Linux kernel\n before 4.8.1 allows local users (who are physically\n proximate for inserting a crafted USB device) to gain\n privileges by leveraging a write-what-where condition\n that occurs after a race condition and a NULL pointer\n dereference.(CVE-2017-15102)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in\n the Linux kernel before 4.14 does not check whether the\n intended netns is used in a peel-off action, which\n allows local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system\n calls.(CVE-2017-15115)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1342\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3bdfb846\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/18\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-327.59.59.46.h38\",\n \"kernel-debug-3.10.0-327.59.59.46.h38\",\n \"kernel-debug-devel-3.10.0-327.59.59.46.h38\",\n \"kernel-debuginfo-3.10.0-327.59.59.46.h38\",\n \"kernel-debuginfo-common-x86_64-3.10.0-327.59.59.46.h38\",\n \"kernel-devel-3.10.0-327.59.59.46.h38\",\n \"kernel-headers-3.10.0-327.59.59.46.h38\",\n \"kernel-tools-3.10.0-327.59.59.46.h38\",\n \"kernel-tools-libs-3.10.0-327.59.59.46.h38\",\n \"perf-3.10.0-327.59.59.46.h38\",\n \"python-perf-3.10.0-327.59.59.46.h38\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-04T14:43:54", "description": "Jann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2018-3639)\n\nJan H. Schonherr discovered that the Xen subsystem did not properly handle block IO merges correctly in some situations. An attacker in a guest vm could use this to cause a denial of service (host crash) or possibly gain administrative privileges in the host. (CVE-2017-12134)\n\nIt was discovered that the Bluetooth HIP Protocol implementation in the Linux kernel did not properly validate HID connection setup information. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-13220)\n\nIt was discovered that a buffer overread vulnerability existed in the keyring subsystem of the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory).\n(CVE-2017-13305)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of netlink messages to the appropriate net namespace. A local attacker could use this to expose sensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nIt was discovered that a race condition existed in the i8042 serial device driver implementation in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-18079)\n\nIt was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that a race condition existed in the OCFS2 file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)\n\nIt was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel in certain circumstances. A local attacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nKefeng Wang discovered that a race condition existed in the memory locking implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18221)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.0, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2018-05-23T00:00:00", "type": "nessus", "title": "Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3655-1) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-12134", "CVE-2017-13220", "CVE-2017-13305", "CVE-2017-17449", "CVE-2017-18079", "CVE-2017-18203", "CVE-2017-18204", "CVE-2017-18208", "CVE-2017-18221", "CVE-2018-3639", "CVE-2018-8822"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3655-1.NASL", "href": "https://www.tenable.com/plugins/nessus/110050", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3655-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(110050);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-12134\", \"CVE-2017-13220\", \"CVE-2017-13305\", \"CVE-2017-17449\", \"CVE-2017-18079\", \"CVE-2017-18203\", \"CVE-2017-18204\", \"CVE-2017-18208\", \"CVE-2017-18221\", \"CVE-2018-3639\", \"CVE-2018-8822\");\n script_xref(name:\"USN\", value:\"3655-1\");\n\n script_name(english:\"Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3655-1) (Spectre)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Jann Horn and Ken Johnson discovered that microprocessors utilizing\nspeculative execution of a memory read may allow unauthorized memory\nreads via a sidechannel attack. This flaw is known as Spectre Variant\n4. A local attacker could use this to expose sensitive information,\nincluding kernel memory. (CVE-2018-3639)\n\nJan H. Schonherr discovered that the Xen subsystem did not properly\nhandle block IO merges correctly in some situations. An attacker in a\nguest vm could use this to cause a denial of service (host crash) or\npossibly gain administrative privileges in the host. (CVE-2017-12134)\n\nIt was discovered that the Bluetooth HIP Protocol implementation in\nthe Linux kernel did not properly validate HID connection setup\ninformation. An attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2017-13220)\n\nIt was discovered that a buffer overread vulnerability existed in the\nkeyring subsystem of the Linux kernel. A local attacker could possibly\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-13305)\n\nIt was discovered that the netlink subsystem in the Linux kernel did\nnot properly restrict observations of netlink messages to the\nappropriate net namespace. A local attacker could use this to expose\nsensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nIt was discovered that a race condition existed in the i8042 serial\ndevice driver implementation in the Linux kernel. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-18079)\n\nIt was discovered that a race condition existed in the Device Mapper\ncomponent of the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that a race condition existed in the OCFS2 file\nsystem implementation in the Linux kernel. A local attacker could use\nthis to cause a denial of service (kernel deadlock). (CVE-2017-18204)\n\nIt was discovered that an infinite loop could occur in the madvise(2)\nimplementation in the Linux kernel in certain circumstances. A local\nattacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nKefeng Wang discovered that a race condition existed in the memory\nlocking implementation in the Linux kernel. A local attacker could use\nthis to cause a denial of service. (CVE-2017-18221)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS\nimplementation in the Linux kernel. A remote attacker controlling a\nmalicious NCPFS server could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3655-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/08/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/23\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-12134\", \"CVE-2017-13220\", \"CVE-2017-13305\", \"CVE-2017-17449\", \"CVE-2017-18079\", \"CVE-2017-18203\", \"CVE-2017-18204\", \"CVE-2017-18208\", \"CVE-2017-18221\", \"CVE-2018-3639\", \"CVE-2018-8822\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3655-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-3.13.0-149-generic\", pkgver:\"3.13.0-149.199\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-3.13.0-149-generic-lpae\", pkgver:\"3.13.0-149.199\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-3.13.0-149-lowlatency\", pkgver:\"3.13.0-149.199\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic\", pkgver:\"3.13.0.149.159\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"3.13.0.149.159\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"3.13.0.149.159\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-3.13-generic / linux-image-3.13-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:46:37", "description": "According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :\n\n - It was discovered that nfnl_cthelper_list structure was accessible to any user with CAP_NET_ADMIN capability in a network namespace. An unprivileged local user could exploit that to affect netfilter conntrack helpers on the host.\n\n - It was discovered that a nlmon link inside a child network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to monitor system-wide netlink activity.\n\n - It was discovered that xt_osf_fingers data structure was accessible from any network namespace. This allowed unprivileged local users to bypass intended access restrictions and modify the system-wide OS fingerprint list used by specific iptables rules.\n\n - The KEYS subsystem omitted an access-control check when writing a key to the default keyring of the current task, allowing a local user to bypass security checks for the keyring. This compromised the validity of the keyring for those who relied on it.\n\n - If 'dccp_ipv6' module was loaded on the host, a local unprivileged user could trigger a kernel crash in dccp_write_xmit() or inet_csk_get_port() using a specially crafted sequence of system calls.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-09T00:00:00", "type": "nessus", "title": "Virtuozzo 7 : readykernel-patch (VZA-2018-024)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17807"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:virtuozzo:virtuozzo:readykernel", "cpe:/o:virtuozzo:virtuozzo:7"], "id": "VIRTUOZZO_VZA-2018-024.NASL", "href": "https://www.tenable.com/plugins/nessus/109621", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(109621);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\n \"CVE-2017-17448\",\n \"CVE-2017-17449\",\n \"CVE-2017-17450\",\n \"CVE-2017-17807\"\n );\n\n script_name(english:\"Virtuozzo 7 : readykernel-patch (VZA-2018-024)\");\n script_summary(english:\"Checks the readykernel output for the updated patch.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Virtuozzo host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerabilities :\n\n - It was discovered that nfnl_cthelper_list structure was\n accessible to any user with CAP_NET_ADMIN capability in\n a network namespace. An unprivileged local user could\n exploit that to affect netfilter conntrack helpers on\n the host.\n\n - It was discovered that a nlmon link inside a child\n network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to\n monitor system-wide netlink activity.\n\n - It was discovered that xt_osf_fingers data structure\n was accessible from any network namespace. This allowed\n unprivileged local users to bypass intended access\n restrictions and modify the system-wide OS fingerprint\n list used by specific iptables rules.\n\n - The KEYS subsystem omitted an access-control check when\n writing a key to the default keyring of the current\n task, allowing a local user to bypass security checks\n for the keyring. This compromised the validity of the\n keyring for those who relied on it.\n\n - If 'dccp_ipv6' module was loaded on the host, a local\n unprivileged user could trigger a kernel crash in\n dccp_write_xmit() or inet_csk_get_port() using a\n specially crafted sequence of system calls.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://help.virtuozzo.com/customer/portal/articles/2938220\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17448\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17450\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17807\");\n # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67f93df79aeefc3add4e4b31a752600f834236e2\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0d23d0fb\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-18.7-49.0-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3aa84d91\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-20.18-49.0-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?32340c78\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-33.22-49.0-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?30295d07\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-37.30-49.0-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c3022f85\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-40.4-49.0-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f5a96032\");\n script_set_attribute(attribute:\"solution\", value:\"Update the readykernel patch.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:virtuozzo:virtuozzo:readykernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:virtuozzo:virtuozzo:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Virtuozzo Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Virtuozzo/release\", \"Host/Virtuozzo/rpm-list\", \"Host/readykernel-info\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"readykernel.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/Virtuozzo/release\");\nif (isnull(release) || \"Virtuozzo\" >!< release) audit(AUDIT_OS_NOT, \"Virtuozzo\");\nos_ver = pregmatch(pattern: \"Virtuozzo Linux release ([0-9]+\\.[0-9])(\\D|$)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Virtuozzo 7.x\", \"Virtuozzo \" + os_ver);\n\nif (!get_kb_item(\"Host/Virtuozzo/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Virtuozzo\", cpu);\n\nrk_info = get_kb_item(\"Host/readykernel-info\");\nif (empty_or_null(rk_info)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\n\nchecks = make_list2(\n make_array(\n \"kernel\",\"vzkernel-3.10.0-327.47.0.vz7.18.7\",\n \"patch\",\"readykernel-patch-18.7-49.0-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-327.47.0.vz7.20.18\",\n \"patch\",\"readykernel-patch-20.18-49.0-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.26.1.vz7.33.22\",\n \"patch\",\"readykernel-patch-33.22-49.0-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-693.1.1.vz7.37.30\",\n \"patch\",\"readykernel-patch-37.30-49.0-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-693.11.6.vz7.40.4\",\n \"patch\",\"readykernel-patch-40.4-49.0-1.vl7\"\n )\n);\nreadykernel_execute_checks(checks:checks, severity:SECURITY_WARNING, release:\"Virtuozzo-7\");\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:45:34", "description": "According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :\n\n - It was discovered that nfnl_cthelper_list structure was accessible to any user with CAP_NET_ADMIN capability in a network namespace. An unprivileged local user could exploit that to affect netfilter conntrack helpers on the host.\n\n - It was discovered that a nlmon link inside a child network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to monitor system-wide netlink activity.\n\n - It was discovered that xt_osf_fingers data structure was accessible from any network namespace. This allowed unprivileged local users to bypass intended access restrictions and modify the system-wide OS fingerprint list used by specific iptables rules.\n\n - The KEYS subsystem omitted an access-control check when writing a key to the default keyring of the current task, allowing a local user to bypass security checks for the keyring. This compromised the validity of the keyring for those who relied on it.\n\n - If 'dccp_ipv6' module was loaded on the host, a local unprivileged user could trigger a kernel crash in dccp_write_xmit() or inet_csk_get_port() using a specially crafted sequence of system calls.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-09T00:00:00", "type": "nessus", "title": "Virtuozzo 7 : readykernel-patch (VZA-2018-026)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17807"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:virtuozzo:virtuozzo:readykernel", "cpe:/o:virtuozzo:virtuozzo:7"], "id": "VIRTUOZZO_VZA-2018-026.NASL", "href": "https://www.tenable.com/plugins/nessus/109623", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(109623);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\n \"CVE-2017-17448\",\n \"CVE-2017-17449\",\n \"CVE-2017-17450\",\n \"CVE-2017-17807\"\n );\n\n script_name(english:\"Virtuozzo 7 : readykernel-patch (VZA-2018-026)\");\n script_summary(english:\"Checks the readykernel output for the updated patch.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Virtuozzo host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerabilities :\n\n - It was discovered that nfnl_cthelper_list structure was\n accessible to any user with CAP_NET_ADMIN capability in\n a network namespace. An unprivileged local user could\n exploit that to affect netfilter conntrack helpers on\n the host.\n\n - It was discovered that a nlmon link inside a child\n network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to\n monitor system-wide netlink activity.\n\n - It was discovered that xt_osf_fingers data structure\n was accessible from any network namespace. This allowed\n unprivileged local users to bypass intended access\n restrictions and modify the system-wide OS fingerprint\n list used by specific iptables rules.\n\n - The KEYS subsystem omitted an access-control check when\n writing a key to the default keyring of the current\n task, allowing a local user to bypass security checks\n for the keyring. This compromised the validity of the\n keyring for those who relied on it.\n\n - If 'dccp_ipv6' module was loaded on the host, a local\n unprivileged user could trigger a kernel crash in\n dccp_write_xmit() or inet_csk_get_port() using a\n specially crafted sequence of system calls.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://help.virtuozzo.com/customer/portal/articles/2938222\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17448\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17450\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17807\");\n # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67f93df79aeefc3add4e4b31a752600f834236e2\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0d23d0fb\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-30.10-49.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2abd43b5\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-30.15-49.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?13a03aa7\");\n script_set_attribute(attribute:\"solution\", value:\"Update the readykernel patch.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:virtuozzo:virtuozzo:readykernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:virtuozzo:virtuozzo:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Virtuozzo Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Virtuozzo/release\", \"Host/Virtuozzo/rpm-list\", \"Host/readykernel-info\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"readykernel.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/Virtuozzo/release\");\nif (isnull(release) || \"Virtuozzo\" >!< release) audit(AUDIT_OS_NOT, \"Virtuozzo\");\nos_ver = pregmatch(pattern: \"Virtuozzo Linux release ([0-9]+\\.[0-9])(\\D|$)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Virtuozzo 7.x\", \"Virtuozzo \" + os_ver);\n\nif (!get_kb_item(\"Host/Virtuozzo/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Virtuozzo\", cpu);\n\nrk_info = get_kb_item(\"Host/readykernel-info\");\nif (empty_or_null(rk_info)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\n\nchecks = make_list2(\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.16.1.vz7.30.10\",\n \"patch\",\"readykernel-patch-30.10-49.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.16.1.vz7.30.15\",\n \"patch\",\"readykernel-patch-30.15-49.1-1.vl7\"\n )\n);\nreadykernel_execute_checks(checks:checks, severity:SECURITY_WARNING, release:\"Virtuozzo-7\");\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:46:14", "description": "According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :\n\n - It was discovered that nfnl_cthelper_list structure was accessible to any user with CAP_NET_ADMIN capability in a network namespace. An unprivileged local user could exploit that to affect netfilter conntrack helpers on the host.\n\n - It was discovered that a nlmon link inside a child network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to monitor system-wide netlink activity.\n\n - It was discovered that xt_osf_fingers data structure was accessible from any network namespace. This allowed unprivileged local users to bypass intended access restrictions and modify the system-wide OS fingerprint list used by specific iptables rules.\n\n - The KEYS subsystem omitted an access-control check when writing a key to the default keyring of the current task, allowing a local user to bypass security checks for the keyring. This compromised the validity of the keyring for those who relied on it.\n\n - If 'dccp_ipv6' module was loaded on the host, a local unprivileged user could trigger a kernel crash in dccp_write_xmit() or inet_csk_get_port() using a specially crafted sequence of system calls.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-09T00:00:00", "type": "nessus", "title": "Virtuozzo 7 : readykernel-patch (VZA-2018-025)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17807"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:virtuozzo:virtuozzo:readykernel", "cpe:/o:virtuozzo:virtuozzo:7"], "id": "VIRTUOZZO_VZA-2018-025.NASL", "href": "https://www.tenable.com/plugins/nessus/109622", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(109622);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\n \"CVE-2017-17448\",\n \"CVE-2017-17449\",\n \"CVE-2017-17450\",\n \"CVE-2017-17807\"\n );\n\n script_name(english:\"Virtuozzo 7 : readykernel-patch (VZA-2018-025)\");\n script_summary(english:\"Checks the readykernel output for the updated patch.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Virtuozzo host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerabilities :\n\n - It was discovered that nfnl_cthelper_list structure was\n accessible to any user with CAP_NET_ADMIN capability in\n a network namespace. An unprivileged local user could\n exploit that to affect netfilter conntrack helpers on\n the host.\n\n - It was discovered that a nlmon link inside a child\n network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to\n monitor system-wide netlink activity.\n\n - It was discovered that xt_osf_fingers data structure\n was accessible from any network namespace. This allowed\n unprivileged local users to bypass intended access\n restrictions and modify the system-wide OS fingerprint\n list used by specific iptables rules.\n\n - The KEYS subsystem omitted an access-control check when\n writing a key to the default keyring of the current\n task, allowing a local user to bypass security checks\n for the keyring. This compromised the validity of the\n keyring for those who relied on it.\n\n - If 'dccp_ipv6' module was loaded on the host, a local\n unprivileged user could trigger a kernel crash in\n dccp_write_xmit() or inet_csk_get_port() using a\n specially crafted sequence of system calls.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://help.virtuozzo.com/customer/portal/articles/2938221\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17448\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17450\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17807\");\n # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67f93df79aeefc3add4e4b31a752600f834236e2\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0d23d0fb\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-43.10-49.0-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dde14ef2\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-46.7-49.0-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e7fb595f\");\n script_set_attribute(attribute:\"solution\", value:\"Update the readykernel patch.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:virtuozzo:virtuozzo:readykernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:virtuozzo:virtuozzo:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Virtuozzo Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Virtuozzo/release\", \"Host/Virtuozzo/rpm-list\", \"Host/readykernel-info\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"readykernel.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/Virtuozzo/release\");\nif (isnull(release) || \"Virtuozzo\" >!< release) audit(AUDIT_OS_NOT, \"Virtuozzo\");\nos_ver = pregmatch(pattern: \"Virtuozzo Linux release ([0-9]+\\.[0-9])(\\D|$)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Virtuozzo 7.x\", \"Virtuozzo \" + os_ver);\n\nif (!get_kb_item(\"Host/Virtuozzo/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Virtuozzo\", cpu);\n\nrk_info = get_kb_item(\"Host/readykernel-info\");\nif (empty_or_null(rk_info)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\n\nchecks = make_list2(\n make_array(\n \"kernel\",\"vzkernel-3.10.0-693.17.1.vz7.43.10\",\n \"patch\",\"readykernel-patch-43.10-49.0-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-693.21.1.vz7.46.7\",\n \"patch\",\"readykernel-patch-46.7-49.0-1.vl7\"\n )\n);\nreadykernel_execute_checks(checks:checks, severity:SECURITY_WARNING, release:\"Virtuozzo-7\");\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-12T15:00:51", "description": "It was discovered that a buffer overread vulnerability existed in the keyring subsystem of the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory).\n(CVE-2017-13305)\n\nIt was discovered that the DM04/QQBOX USB driver in the Linux kernel did not properly handle device attachment and warm-start. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16538)\n\nLuo Quan and Wei Yang discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when handling ioctl()s. A local attacker could use this to cause a denial of service (system deadlock). (CVE-2018-1000004)\n\nWang Qize discovered that an information disclosure vulnerability existed in the SMBus driver for ACPI Embedded Controllers in the Linux kernel. A local attacker could use this to expose sensitive information (kernel pointer addresses). (CVE-2018-5750)\n\nFan Long Fei discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel that could lead to a use-after-free or an out-of-bounds buffer access. A local attacker with access to /dev/snd/seq could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2018-7566).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-04-24T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3631-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-13305", "CVE-2017-16538", "CVE-2018-1000004", "CVE-2018-5750", "CVE-2018-7566"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3631-1.NASL", "href": "https://www.tenable.com/plugins/nessus/109314", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3631-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109314);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-13305\", \"CVE-2017-16538\", \"CVE-2018-1000004\", \"CVE-2018-5750\", \"CVE-2018-7566\");\n script_xref(name:\"USN\", value:\"3631-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3631-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that a buffer overread vulnerability existed in the\nkeyring subsystem of the Linux kernel. A local attacker could possibly\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-13305)\n\nIt was discovered that the DM04/QQBOX USB driver in the Linux kernel\ndid not properly handle device attachment and warm-start. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-16538)\n\nLuo Quan and Wei Yang discovered that a race condition existed in the\nAdvanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel\nwhen handling ioctl()s. A local attacker could use this to cause a\ndenial of service (system deadlock). (CVE-2018-1000004)\n\nWang Qize discovered that an information disclosure vulnerability\nexisted in the SMBus driver for ACPI Embedded Controllers in the Linux\nkernel. A local attacker could use this to expose sensitive\ninformation (kernel pointer addresses). (CVE-2018-5750)\n\nFan Long Fei discovered that a race condition existed in the Advanced\nLinux Sound Architecture (ALSA) subsystem of the Linux kernel that\ncould lead to a use-after-free or an out-of-bounds buffer access. A\nlocal attacker with access to /dev/snd/seq could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2018-7566).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3631-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/04/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-13305\", \"CVE-2017-16538\", \"CVE-2018-1000004\", \"CVE-2018-5750\", \"CVE-2018-7566\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3631-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1021-kvm\", pkgver:\"4.4.0-1021.26\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1055-aws\", pkgver:\"4.4.0-1055.64\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1087-raspi2\", pkgver:\"4.4.0-1087.95\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1090-snapdragon\", pkgver:\"4.4.0-1090.95\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-121-generic\", pkgver:\"4.4.0-121.145\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-121-generic-lpae\", pkgver:\"4.4.0-121.145\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-121-lowlatency\", pkgver:\"4.4.0-121.145\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1055.57\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.121.127\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.121.127\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.4.0.1021.20\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.121.127\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1087.87\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.4.0.1090.82\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-13T14:42:39", "description": "USN-3631-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nIt was discovered that a buffer overread vulnerability existed in the keyring subsystem of the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory).\n(CVE-2017-13305)\n\nIt was discovered that the DM04/QQBOX USB driver in the Linux kernel did not properly handle device attachment and warm-start. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16538)\n\nLuo Quan and Wei Yang discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when handling ioctl()s. A local attacker could use this to cause a denial of service (system deadlock). (CVE-2018-1000004)\n\nWang Qize discovered that an information disclosure vulnerability existed in the SMBus driver for ACPI Embedded Controllers in the Linux kernel. A local attacker could use this to expose sensitive information (kernel pointer addresses). (CVE-2018-5750)\n\nFan Long Fei discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel that could lead to a use-after-free or an out-of-bounds buffer access. A local attacker with access to /dev/snd/seq could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2018-7566).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-04-24T00:00:00", "type": "nessus", "title": "Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3631-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-13305", "CVE-2017-16538", "CVE-2018-1000004", "CVE-2018-5750", "CVE-2018-7566"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3631-2.NASL", "href": "https://www.tenable.com/plugins/nessus/109315", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3631-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109315);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-13305\", \"CVE-2017-16538\", \"CVE-2018-1000004\", \"CVE-2018-5750\", \"CVE-2018-7566\");\n script_xref(name:\"USN\", value:\"3631-2\");\n\n script_name(english:\"Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3631-2)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3631-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that a buffer overread vulnerability existed in the\nkeyring subsystem of the Linux kernel. A local attacker could possibly\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-13305)\n\nIt was discovered that the DM04/QQBOX USB driver in the Linux kernel\ndid not properly handle device attachment and warm-start. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-16538)\n\nLuo Quan and Wei Yang discovered that a race condition existed in the\nAdvanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel\nwhen handling ioctl()s. A local attacker could use this to cause a\ndenial of service (system deadlock). (CVE-2018-1000004)\n\nWang Qize discovered that an information disclosure vulnerability\nexisted in the SMBus driver for ACPI Embedded Controllers in the Linux\nkernel. A local attacker could use this to expose sensitive\ninformation (kernel pointer addresses). (CVE-2018-5750)\n\nFan Long Fei discovered that a race condition existed in the Advanced\nLinux Sound Architecture (ALSA) subsystem of the Linux kernel that\ncould lead to a use-after-free or an out-of-bounds buffer access. A\nlocal attacker with access to /dev/snd/seq could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2018-7566).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3631-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/04/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-13305\", \"CVE-2017-16538\", \"CVE-2018-1000004\", \"CVE-2018-5750\", \"CVE-2018-7566\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3631-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-1017-aws\", pkgver:\"4.4.0-1017.17\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-121-generic\", pkgver:\"4.4.0-121.145~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-121-generic-lpae\", pkgver:\"4.4.0-121.145~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-121-lowlatency\", pkgver:\"4.4.0-121.145~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1017.17\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae-lts-xenial\", pkgver:\"4.4.0.121.102\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lts-xenial\", pkgver:\"4.4.0.121.102\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency-lts-xenial\", pkgver:\"4.4.0.121.102\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:38:32", "description": "Race condition in raw_sendmsg function allows denial-of-service or kernel addresses leak\n\nA flaw was found in the Linux kernel's implementation of raw_sendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. (CVE-2017-17712)\n\nUse-after-free vulnerability in DCCP socket\n\nA use-after-free vulnerability was found in DCCP socket code affecting the Linux kernel since 2.6.16. This vulnerability could allow an attacker to their escalate privileges. (CVE-2017-8824)\n\nStack-based out-of-bounds read via vmcall instruction\n\nLinux kernel compiled with the KVM virtualization (CONFIG_KVM) support is vulnerable to an out-of-bounds read access issue. It could occur when emulating vmcall instructions invoked by a guest. A guest user/process could use this flaw to disclose kernel memory bytes.\n(CVE-2017-17741)\n\nUnchecked capabilities in net/netfilter/xt_osf.c allows for unprivileged modification to systemwide fingerprint list\n\nnet/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces. (CVE-2017-17450)\n\nMissing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure\n\nnet/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. (CVE-2017-17448)", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-19T00:00:00", "type": "nessus", "title": "Amazon Linux AMI : kernel (ALAS-2018-944)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17448", "CVE-2017-17450", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-8824"], "modified": "2019-04-05T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:kernel", "p-cpe:/a:amazon:linux:kernel-debuginfo", "p-cpe:/a:amazon:linux:kernel-debuginfo-common-i686", "p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64", "p-cpe:/a:amazon:linux:kernel-devel", "p-cpe:/a:amazon:linux:kernel-doc", "p-cpe:/a:amazon:linux:kernel-headers", "p-cpe:/a:amazon:linux:kernel-tools", "p-cpe:/a:amazon:linux:kernel-tools-debuginfo", "p-cpe:/a:amazon:linux:kernel-tools-devel", "p-cpe:/a:amazon:linux:perf", "p-cpe:/a:amazon:linux:perf-debuginfo", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2018-944.NASL", "href": "https://www.tenable.com/plugins/nessus/106171", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2018-944.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106171);\n script_version(\"3.4\");\n script_cvs_date(\"Date: 2019/04/05 23:25:05\");\n\n script_cve_id(\"CVE-2017-17448\", \"CVE-2017-17450\", \"CVE-2017-17712\", \"CVE-2017-17741\", \"CVE-2017-8824\");\n script_xref(name:\"ALAS\", value:\"2018-944\");\n\n script_name(english:\"Amazon Linux AMI : kernel (ALAS-2018-944)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Race condition in raw_sendmsg function allows denial-of-service or\nkernel addresses leak\n\nA flaw was found in the Linux kernel's implementation of raw_sendmsg\nallowing a local attacker to panic the kernel or possibly leak kernel\naddresses. A local attacker, with the privilege of creating raw\nsockets, can abuse a possible race condition when setting the socket\noption to allow the kernel to automatically create ip header values\nand thus potentially escalate their privileges. (CVE-2017-17712)\n\nUse-after-free vulnerability in DCCP socket\n\nA use-after-free vulnerability was found in DCCP socket code affecting\nthe Linux kernel since 2.6.16. This vulnerability could allow an\nattacker to their escalate privileges. (CVE-2017-8824)\n\nStack-based out-of-bounds read via vmcall instruction\n\nLinux kernel compiled with the KVM virtualization (CONFIG_KVM) support\nis vulnerable to an out-of-bounds read access issue. It could occur\nwhen emulating vmcall instructions invoked by a guest. A guest\nuser/process could use this flaw to disclose kernel memory bytes.\n(CVE-2017-17741)\n\nUnchecked capabilities in net/netfilter/xt_osf.c allows for\nunprivileged modification to systemwide fingerprint list\n\nnet/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not\nrequire the CAP_NET_ADMIN capability for add_callback and\nremove_callback operations, which allows local users to bypass\nintended access restrictions because the xt_osf_fingers data structure\nis shared across all net namespaces. (CVE-2017-17450)\n\nMissing capabilities check in net/netfilter/nfnetlink_cthelper.c\nallows for unprivileged access to systemwide nfnl_cthelper_list\nstructure\n\nnet/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4\ndoes not require the CAP_NET_ADMIN capability for new, get, and del\noperations, which allows local users to bypass intended access\nrestrictions because the nfnl_cthelper_list data structure is shared\nacross all net namespaces. (CVE-2017-17448)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2018-944.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Run 'yum update kernel' to update your system. You will need to reboot\nyour system in order for the new kernel to be running.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-debuginfo-common-i686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:kernel-tools-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:perf-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"kernel-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"kernel-debuginfo-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", cpu:\"i686\", reference:\"kernel-debuginfo-common-i686-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", cpu:\"x86_64\", reference:\"kernel-debuginfo-common-x86_64-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"kernel-devel-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"kernel-doc-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"kernel-headers-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"kernel-tools-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"kernel-tools-debuginfo-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"kernel-tools-devel-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"perf-4.9.77-31.58.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"perf-debuginfo-4.9.77-31.58.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-debuginfo / kernel-debuginfo-common-i686 / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:38:39", "description": "The 4.14.6 update contains various fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-15T00:00:00", "type": "nessus", "title": "Fedora 27 : kernel (2017-129969aa8a)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-8824"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2017-129969AA8A.NASL", "href": "https://www.tenable.com/plugins/nessus/105819", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-129969aa8a.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105819);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-17558\", \"CVE-2017-8824\");\n script_xref(name:\"FEDORA\", value:\"2017-129969aa8a\");\n\n script_name(english:\"Fedora 27 : kernel (2017-129969aa8a)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.14.6 update contains various fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-129969aa8a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-17558\", \"CVE-2017-8824\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-129969aa8a\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"kernel-4.14.6-300.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:41:07", "description": "The 4.14.6 update contains various fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-20T00:00:00", "type": "nessus", "title": "Fedora 26 : kernel (2017-ba6b6e71f7)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-8824"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-BA6B6E71F7.NASL", "href": "https://www.tenable.com/plugins/nessus/105383", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-ba6b6e71f7.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105383);\n script_version(\"3.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-17558\", \"CVE-2017-8824\");\n script_xref(name:\"FEDORA\", value:\"2017-ba6b6e71f7\");\n\n script_name(english:\"Fedora 26 : kernel (2017-ba6b6e71f7)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.14.6 update contains various fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-ba6b6e71f7\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-17558\", \"CVE-2017-8824\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-ba6b6e71f7\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"kernel-4.14.6-200.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-04T16:21:45", "description": "It was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of netlink messages to the appropriate net namespace. A local attacker could use this to expose sensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel in certain circumstances. A local attacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-23T00:00:00", "type": "nessus", "title": "Ubuntu 17.10 : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3657-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17449", "CVE-2017-17975", "CVE-2017-18203", "CVE-2017-18208", "CVE-2018-8822"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "cpe:/o:canonical:ubuntu_linux:17.10"], "id": "UBUNTU_USN-3657-1.NASL", "href": "https://www.tenable.com/plugins/nessus/110052", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3657-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(110052);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-17449\", \"CVE-2017-17975\", \"CVE-2017-18203\", \"CVE-2017-18208\", \"CVE-2018-8822\");\n script_xref(name:\"USN\", value:\"3657-1\");\n\n script_name(english:\"Ubuntu 17.10 : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3657-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that the netlink subsystem in the Linux kernel did\nnot properly restrict observations of netlink messages to the\nappropriate net namespace. A local attacker could use this to expose\nsensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007\ndriver of the Linux kernel. A local attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper\ncomponent of the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2)\nimplementation in the Linux kernel in certain circumstances. A local\nattacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS\nimplementation in the Linux kernel. A remote attacker controlling a\nmalicious NCPFS server could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3657-1/\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Update the affected linux-image-4.13-raspi2 and / or\nlinux-image-raspi2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:17.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(17\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 17.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-17449\", \"CVE-2017-17975\", \"CVE-2017-18203\", \"CVE-2017-18208\", \"CVE-2018-8822\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3657-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-1020-raspi2\", pkgver:\"4.13.0-1020.21\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-raspi2\", pkgver:\"4.13.0.1020.18\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.13-raspi2 / linux-image-raspi2\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:48:24", "description": "An update of [rsync,linux,openssh,procmail,python2,libvirt] packages for PhotonOS has been released.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-08-17T00:00:00", "type": "nessus", "title": "Photon OS 2.0: Libvirt / Linux / Openssh / Procmail / Python2 / Rsync PHSA-2017-0051 (deprecated)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000158", "CVE-2017-15115", "CVE-2017-15906", "CVE-2017-16548", "CVE-2017-16844"], "modified": "2019-02-07T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:libvirt", "p-cpe:/a:vmware:photonos:linux", "p-cpe:/a:vmware:photonos:openssh", "p-cpe:/a:vmware:photonos:procmail", "p-cpe:/a:vmware:photonos:python2", "p-cpe:/a:vmware:photonos:rsync", "cpe:/o:vmware:photonos:2.0"], "id": "PHOTONOS_PHSA-2017-0051.NASL", "href": "https://www.tenable.com/plugins/nessus/111900", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# @DEPRECATED@\n#\n# Disabled on 2/7/2019\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2017-0051. The text\n# itself is copyright (C) VMware, Inc.\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(111900);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/02/07 18:59:50\");\n\n script_cve_id(\n \"CVE-2017-15115\",\n \"CVE-2017-15906\",\n \"CVE-2017-16548\",\n \"CVE-2017-16844\",\n \"CVE-2017-1000158\"\n );\n\n script_name(english:\"Photon OS 2.0: Libvirt / Linux / Openssh / Procmail / Python2 / Rsync PHSA-2017-0051 (deprecated)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"This plugin has been deprecated.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of [rsync,linux,openssh,procmail,python2,libvirt] packages\nfor PhotonOS has been released.\");\n # https://github.com/vmware/photon/wiki/Security-Updates-2-5\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?aca85090\");\n script_set_attribute(attribute:\"solution\", value:\"n/a.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-16844\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/17\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:libvirt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:linux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:openssh\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:procmail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:python2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:rsync\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\nexit(0, \"This plugin has been deprecated.\");\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/PhotonOS/release\");\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, \"PhotonOS\");\nif (release !~ \"^VMware Photon (?:Linux|OS) 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"PhotonOS 2.0\");\n\nif (!get_kb_item(\"Host/PhotonOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"PhotonOS\", cpu);\n\nflag = 0;\n\npkgs = [\n \"libvirt-3.2.0-3.ph2\",\n \"libvirt-debuginfo-3.2.0-3.ph2\",\n \"libvirt-devel-3.2.0-3.ph2\",\n \"libvirt-docs-3.2.0-3.ph2\",\n \"linux-4.9.66-2.ph2\",\n \"linux-api-headers-4.9.66-1.ph2\",\n \"linux-debuginfo-4.9.66-2.ph2\",\n \"linux-devel-4.9.66-2.ph2\",\n \"linux-docs-4.9.66-2.ph2\",\n \"linux-drivers-gpu-4.9.66-2.ph2\",\n \"linux-esx-4.9.66-1.ph2\",\n \"linux-esx-debuginfo-4.9.66-1.ph2\",\n \"linux-esx-devel-4.9.66-1.ph2\",\n \"linux-esx-docs-4.9.66-1.ph2\",\n \"linux-oprofile-4.9.66-2.ph2\",\n \"linux-secure-4.9.66-1.ph2\",\n \"linux-secure-debuginfo-4.9.66-1.ph2\",\n \"linux-secure-devel-4.9.66-1.ph2\",\n \"linux-secure-docs-4.9.66-1.ph2\",\n \"linux-secure-lkcm-4.9.66-1.ph2\",\n \"linux-sound-4.9.66-2.ph2\",\n \"linux-tools-4.9.66-2.ph2\",\n \"openssh-7.5p1-10.ph2\",\n \"openssh-clients-7.5p1-10.ph2\",\n \"openssh-debuginfo-7.5p1-10.ph2\",\n \"openssh-server-7.5p1-10.ph2\",\n \"procmail-3.22-5.ph2\",\n \"procmail-debuginfo-3.22-5.ph2\",\n \"python2-2.7.13-11.ph2\",\n \"python2-debuginfo-2.7.13-11.ph2\",\n \"python2-devel-2.7.13-11.ph2\",\n \"python2-libs-2.7.13-11.ph2\",\n \"python2-test-2.7.13-11.ph2\",\n \"python2-tools-2.7.13-11.ph2\",\n \"rsync-3.1.2-4.ph2\",\n \"rsync-debuginfo-3.1.2-4.ph2\"\n];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"PhotonOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libvirt / linux / openssh / procmail / python2 / rsync\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-20T15:13:12", "description": "According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in the processing of incoming L2CAP bluetooth commands. Uninitialized stack variables can be sent to an attacker leaking data in kernel address space.(CVE-2017-1000410)\n\n - The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.(CVE-2017-12193)\n\n - The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.(CVE-2017-12190)\n\n - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.(CVE-2017-15102)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.(CVE-2017-15115)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-07T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1318)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000410", "CVE-2017-12190", "CVE-2017-12193", "CVE-2017-15102", "CVE-2017-15115"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-debug", "p-cpe:/a:huawei:euleros:kernel-debuginfo", "p-cpe:/a:huawei:euleros:kernel-debuginfo-common-x86_64", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2017-1318.NASL", "href": "https://www.tenable.com/plugins/nessus/105046", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105046);\n script_version(\"3.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2017-1000410\",\n \"CVE-2017-12190\",\n \"CVE-2017-12193\",\n \"CVE-2017-15102\",\n \"CVE-2017-15115\"\n );\n\n script_name(english:\"EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1318)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in the processing of incoming L2CAP\n bluetooth commands. Uninitialized stack variables can\n be sent to an attacker leaking data in kernel address\n space.(CVE-2017-1000410)\n\n - The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel before 4.13.11\n mishandles node splitting, which allows local users to\n cause a denial of service (NULL pointer dereference and\n panic) via a crafted application, as demonstrated by\n the keyring key type, and key addition and link\n creation operations.(CVE-2017-12193)\n\n - The bio_map_user_iov and bio_unmap_user functions in\n block/bio.c in the Linux kernel before 4.13.8 do\n unbalanced refcounting when a SCSI I/O vector has small\n consecutive buffers belonging to the same page. The\n bio_add_pc_page function merges them into one, but the\n page reference is never dropped. This causes a memory\n leak and possible system lockup (exploitable against\n the host OS by a guest OS user, if a SCSI disk is\n passed through to a virtual machine) due to an\n out-of-memory condition.(CVE-2017-12190)\n\n - The tower_probe function in\n drivers/usb/misc/legousbtower.c in the Linux kernel\n before 4.8.1 allows local users (who are physically\n proximate for inserting a crafted USB device) to gain\n privileges by leveraging a write-what-where condition\n that occurs after a race condition and a NULL pointer\n dereference.(CVE-2017-15102)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in\n the Linux kernel before 4.14 does not check whether the\n intended netns is used in a peel-off action, which\n allows local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system\n calls.(CVE-2017-15115)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1318\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e1964858\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(1)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-229.49.1.157\",\n \"kernel-debug-3.10.0-229.49.1.157\",\n \"kernel-debuginfo-3.10.0-229.49.1.157\",\n \"kernel-debuginfo-common-x86_64-3.10.0-229.49.1.157\",\n \"kernel-devel-3.10.0-229.49.1.157\",\n \"kernel-headers-3.10.0-229.49.1.157\",\n \"kernel-tools-3.10.0-229.49.1.157\",\n \"kernel-tools-libs-3.10.0-229.49.1.157\",\n \"perf-3.10.0-229.49.1.157\",\n \"python-perf-3.10.0-229.49.1.157\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"1\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:37:12", "description": "The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).\n\n - CVE-2017-5753 / 'SpectreAttack': Local attackers on systems with modern CPUs featuring deep instruction pipelining could use attacker controllable speculative execution over code patterns in the Linux Kernel to leak content from otherwise not readable memory in the same address space, allowing retrieval of passwords, cryptographic keys and other secrets. This problem is mitigated by adding speculative fencing on affected code paths throughout the Linux kernel. This issue is addressed for the x86_64, the IBM Power and IBM zSeries architecture.\n\n - CVE-2017-5715 / 'SpectreAttack': Local attackers on systems with modern CPUs featuring branch prediction could use mispredicted branches to speculatively execute code patterns that in turn could be made to leak other non-readable content in the same address space, an attack similar to CVE-2017-5753. This problem is mitigated by disabling predictive branches, depending on CPU architecture either by firmware updates and/or fixes in the user-kernel privilege boundaries. This is done with help of Linux Kernel fixes on the Intel/AMD x86_64 and IBM zSeries architectures. On x86_64, this requires also updates of the CPU microcode packages, delivered in separate updates. For IBM Power and zSeries the required firmware updates are supplied over regular channels by IBM. As this feature can have a performance impact, it can be disabled using the 'nospec' kernel commandline option.\n\n - CVE-2017-5754 / 'MeltdownAttack': Local attackers on systems with modern CPUs featuring deep instruction pipelining could use code patterns in userspace to speculative executive code that would read otherwise read protected memory, an attack similar to CVE-2017-5753. This problem is mitigated by unmapping the Linux Kernel from the user address space during user code execution, following a approach called 'KAISER'.\n The terms used here are 'KAISER' / 'Kernel Address Isolation' and 'PTI' / 'Page Table Isolation'. This update does this on the x86_64 architecture, it is not required on the IBM zSeries architecture. This feature can be enabled / disabled by the 'pti=[on|off|auto]' or 'nopti' commandline options. The following security bugs were fixed :\n\n - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470).\n\n - CVE-2017-13167: An elevation of privilege vulnerability in the kernel sound timer. (bnc#1072876).\n\n - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569).\n\n - CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693).\n\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n\n - CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-17T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0115-1) (Meltdown) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11600", "CVE-2017-13167", "CVE-2017-15115", "CVE-2017-15868", "CVE-2017-16534", "CVE-2017-16538", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-5715", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-8824"], "modified": "2019-09-10T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kernel-xen", "p-cpe:/a:novell:suse_linux:kernel-xen-base", "p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debugsource", "p-cpe:/a:novell:suse_linux:kernel-xen-devel", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2018-0115-1.NASL", "href": "https://www.tenable.com/plugins/nessus/106095", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:0115-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106095);\n script_version(\"3.9\");\n script_cvs_date(\"Date: 2019/09/10 13:51:46\");\n\n script_cve_id(\"CVE-2017-11600\", \"CVE-2017-13167\", \"CVE-2017-15115\", \"CVE-2017-15868\", \"CVE-2017-16534\", \"CVE-2017-16538\", \"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-17558\", \"CVE-2017-5715\", \"CVE-2017-5753\", \"CVE-2017-5754\", \"CVE-2017-8824\");\n script_xref(name:\"IAVA\", value:\"2018-A-0019\");\n script_xref(name:\"IAVA\", value:\"2018-A-0020\");\n\n script_name(english:\"SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0115-1) (Meltdown) (Spectre)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive\nvarious security and bugfixes. This update adds mitigations for\nvarious side channel attacks against modern CPUs that could disclose\ncontent of otherwise unreadable memory (bnc#1068032).\n\n - CVE-2017-5753 / 'SpectreAttack': Local attackers on\n systems with modern CPUs featuring deep instruction\n pipelining could use attacker controllable speculative\n execution over code patterns in the Linux Kernel to leak\n content from otherwise not readable memory in the same\n address space, allowing retrieval of passwords,\n cryptographic keys and other secrets. This problem is\n mitigated by adding speculative fencing on affected code\n paths throughout the Linux kernel. This issue is\n addressed for the x86_64, the IBM Power and IBM zSeries\n architecture.\n\n - CVE-2017-5715 / 'SpectreAttack': Local attackers on\n systems with modern CPUs featuring branch prediction\n could use mispredicted branches to speculatively execute\n code patterns that in turn could be made to leak other\n non-readable content in the same address space, an\n attack similar to CVE-2017-5753. This problem is\n mitigated by disabling predictive branches, depending on\n CPU architecture either by firmware updates and/or fixes\n in the user-kernel privilege boundaries. This is done\n with help of Linux Kernel fixes on the Intel/AMD x86_64\n and IBM zSeries architectures. On x86_64, this requires\n also updates of the CPU microcode packages, delivered in\n separate updates. For IBM Power and zSeries the required\n firmware updates are supplied over regular channels by\n IBM. As this feature can have a performance impact, it\n can be disabled using the 'nospec' kernel commandline\n option.\n\n - CVE-2017-5754 / 'MeltdownAttack': Local attackers on\n systems with modern CPUs featuring deep instruction\n pipelining could use code patterns in userspace to\n speculative executive code that would read otherwise\n read protected memory, an attack similar to\n CVE-2017-5753. This problem is mitigated by unmapping\n the Linux Kernel from the user address space during user\n code execution, following a approach called 'KAISER'.\n The terms used here are 'KAISER' / 'Kernel Address\n Isolation' and 'PTI' / 'Page Table Isolation'. This\n update does this on the x86_64 architecture, it is not\n required on the IBM zSeries architecture. This feature\n can be enabled / disabled by the 'pti=[on|off|auto]' or\n 'nopti' commandline options. The following security bugs\n were fixed :\n\n - CVE-2017-15868: The bnep_add_connection function in\n net/bluetooth/bnep/core.c in the Linux kernel did not\n ensure that an l2cap socket is available, which allowed\n local users to gain privileges via a crafted application\n (bnc#1071470).\n\n - CVE-2017-13167: An elevation of privilege vulnerability\n in the kernel sound timer. (bnc#1072876).\n\n - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c\n in the Linux kernel allowed local users to cause a\n denial of service (general protection fault and system\n crash) or possibly have unspecified other impact via a\n crafted USB device, related to a missing warm-start\n check and incorrect attach timing\n (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)\n (bnc#1066569).\n\n - CVE-2017-17558: The usb_destroy_configuration function\n in drivers/usb/core/config.c in the USB core subsystem\n in the Linux kernel did not consider the maximum number\n of configurations and interfaces before attempting to\n release resources, which allowed local users to cause a\n denial of service (out-of-bounds write access) or\n possibly have unspecified other impact via a crafted USB\n device (bnc#1072561).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux\n kernel did not require the CAP_NET_ADMIN capability for\n add_callback and remove_callback operations, which\n allowed local users to bypass intended access\n restrictions because the xt_osf_fingers data structure\n is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function\n in net/netlink/af_netlink.c in the Linux kernel through\n 4.14.4, when CONFIG_NLMON is enabled, did not restrict\n observations of Netlink messages to a single net\n namespace, which allowed local users to obtain sensitive\n information by leveraging the CAP_NET_ADMIN capability\n to sniff an nlmon interface for all Netlink activity on\n the system (bnc#1071694).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in\n the Linux kernel did not require the CAP_NET_ADMIN\n capability for new, get, and del operations, which\n allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data\n structure is shared across all net namespaces\n (bnc#1071693).\n\n - CVE-2017-8824: The dccp_disconnect function in\n net/dccp/proto.c in the Linux kernel allowed local users\n to gain privileges or cause a denial of service\n (use-after-free) via an AF_UNSPEC connect system call\n during the DCCP_LISTEN state (bnc#1070771).\n\n - CVE-2017-15115: The sctp_do_peeloff function in\n net/sctp/socket.c in the Linux kernel did not check\n whether the intended netns is used in a peel-off action,\n which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system calls\n (bnc#1068671).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux\n kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is\n enabled, did not ensure that the dir value of\n xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which\n allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified\n other impact via an XFRM_MSG_MIGRATE xfrm Netlink\n message (bnc#1050231).\n\n - CVE-2017-16534: The cdc_parse_cdc_header function in\n drivers/usb/core/message.c in the Linux kernel allowed\n local users to cause a denial of service (out-of-bounds\n read and system crash) or possibly have unspecified\n other impact via a crafted USB device (bnc#1066693).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1045205\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066569\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068032\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068671\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070781\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071074\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071694\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1072561\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1072876\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-11600/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-13167/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15115/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15868/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16534/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17448/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17449/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17450/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5715/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5753/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5754/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-8824/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20180115-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?756b3f42\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2018-83=1\n\nSUSE Linux Enterprise Module for Public Cloud 12:zypper in -t patch\nSUSE-SLE-Module-Public-Cloud-12-2018-83=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/07/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/17\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-base-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-base-debuginfo-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-debuginfo-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-debugsource-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-devel-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-default-man-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-base-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-base-debuginfo-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-debuginfo-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-debugsource-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-devel-3.12.61-52.111.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-syms-3.12.61-52.111.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:38:09", "description": "The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).\n\n - CVE-2017-5753 / 'SpectreAttack': Local attackers on systems with modern CPUs featuring deep instruction pipelining could use attacker controllable speculative execution over code patterns in the Linux Kernel to leak content from otherwise not readable memory in the same address space, allowing retrieval of passwords, cryptographic keys and other secrets. This problem is mitigated by adding speculative fencing on affected code paths throughout the Linux kernel. This issue is addressed for the x86_64, IBM Power and IBM zSeries architecture.\n\n - CVE-2017-5715 / 'SpectreAttack': Local attackers on systems with modern CPUs featuring branch prediction could use mispredicted branches to speculatively execute code patterns that in turn could be made to leak other non-readable content in the same address space, an attack similar to CVE-2017-5753. This problem is mitigated by disabling predictive branches, depending on CPU architecture either by firmware updates and/or fixes in the user-kernel privilege boundaries. This is done with help of Linux Kernel fixes on the Intel/AMD x86_64 and IBM zSeries architectures. On x86_64, this requires also updates of the CPU microcode packages, delivered in separate updates. For IBM Power and zSeries the required firmware updates are supplied over regular channels by IBM. As this feature can have a performance impact, it can be disabled using the 'nospec' kernel commandline option.\n\n - CVE-2017-5754 / 'MeltdownAttack': Local attackers on systems with modern CPUs featuring deep instruction pipelining could use code patterns in userspace to speculative executive code that would read otherwise read protected memory, an attack similar to CVE-2017-5753. This problem is mitigated by unmapping the Linux Kernel from the user address space during user code execution, following a approach called 'KAISER'.\n The terms used here are 'KAISER' / 'Kernel Address Isolation' and 'PTI' / 'Page Table Isolation'. This update does this on the x86_64 architecture, it is not required on the IBM zSeries architecture. This feature can be enabled / disabled by the 'pti=[on|off|auto]' or 'nopti' commandline options. The following security bugs were fixed :\n\n - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470).\n\n - CVE-2017-13167: An elevation of privilege vulnerability in the kernel sound timer. (bnc#1072876).\n\n - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569).\n\n - CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693).\n\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n\n - CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-08T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0031-1) (Meltdown) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11600", "CVE-2017-13167", "CVE-2017-15115", "CVE-2017-15868", "CVE-2017-16534", "CVE-2017-16538", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-5715", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-8824"], "modified": "2019-09-10T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kernel-xen", "p-cpe:/a:novell:suse_linux:kernel-xen-base", "p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debugsource", "p-cpe:/a:novell:suse_linux:kernel-xen-devel", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_69-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_69-xen", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2018-0031-1.NASL", "href": "https://www.tenable.com/plugins/nessus/105647", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:0031-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105647);\n script_version(\"3.9\");\n script_cvs_date(\"Date: 2019/09/10 13:51:46\");\n\n script_cve_id(\"CVE-2017-11600\", \"CVE-2017-13167\", \"CVE-2017-15115\", \"CVE-2017-15868\", \"CVE-2017-16534\", \"CVE-2017-16538\", \"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-17558\", \"CVE-2017-5715\", \"CVE-2017-5753\", \"CVE-2017-5754\", \"CVE-2017-8824\");\n script_xref(name:\"IAVA\", value:\"2018-A-0019\");\n script_xref(name:\"IAVA\", value:\"2018-A-0020\");\n\n script_name(english:\"SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0031-1) (Meltdown) (Spectre)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive\nvarious security and bugfixes. This update adds mitigations for\nvarious side channel attacks against modern CPUs that could disclose\ncontent of otherwise unreadable memory (bnc#1068032).\n\n - CVE-2017-5753 / 'SpectreAttack': Local attackers on\n systems with modern CPUs featuring deep instruction\n pipelining could use attacker controllable speculative\n execution over code patterns in the Linux Kernel to leak\n content from otherwise not readable memory in the same\n address space, allowing retrieval of passwords,\n cryptographic keys and other secrets. This problem is\n mitigated by adding speculative fencing on affected code\n paths throughout the Linux kernel. This issue is\n addressed for the x86_64, IBM Power and IBM zSeries\n architecture.\n\n - CVE-2017-5715 / 'SpectreAttack': Local attackers on\n systems with modern CPUs featuring branch prediction\n could use mispredicted branches to speculatively execute\n code patterns that in turn could be made to leak other\n non-readable content in the same address space, an\n attack similar to CVE-2017-5753. This problem is\n mitigated by disabling predictive branches, depending on\n CPU architecture either by firmware updates and/or fixes\n in the user-kernel privilege boundaries. This is done\n with help of Linux Kernel fixes on the Intel/AMD x86_64\n and IBM zSeries architectures. On x86_64, this requires\n also updates of the CPU microcode packages, delivered in\n separate updates. For IBM Power and zSeries the required\n firmware updates are supplied over regular channels by\n IBM. As this feature can have a performance impact, it\n can be disabled using the 'nospec' kernel commandline\n option.\n\n - CVE-2017-5754 / 'MeltdownAttack': Local attackers on\n systems with modern CPUs featuring deep instruction\n pipelining could use code patterns in userspace to\n speculative executive code that would read otherwise\n read protected memory, an attack similar to\n CVE-2017-5753. This problem is mitigated by unmapping\n the Linux Kernel from the user address space during user\n code execution, following a approach called 'KAISER'.\n The terms used here are 'KAISER' / 'Kernel Address\n Isolation' and 'PTI' / 'Page Table Isolation'. This\n update does this on the x86_64 architecture, it is not\n required on the IBM zSeries architecture. This feature\n can be enabled / disabled by the 'pti=[on|off|auto]' or\n 'nopti' commandline options. The following security bugs\n were fixed :\n\n - CVE-2017-15868: The bnep_add_connection function in\n net/bluetooth/bnep/core.c in the Linux kernel did not\n ensure that an l2cap socket is available, which allowed\n local users to gain privileges via a crafted application\n (bnc#1071470).\n\n - CVE-2017-13167: An elevation of privilege vulnerability\n in the kernel sound timer. (bnc#1072876).\n\n - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c\n in the Linux kernel allowed local users to cause a\n denial of service (general protection fault and system\n crash) or possibly have unspecified other impact via a\n crafted USB device, related to a missing warm-start\n check and incorrect attach timing\n (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)\n (bnc#1066569).\n\n - CVE-2017-17558: The usb_destroy_configuration function\n in drivers/usb/core/config.c in the USB core subsystem\n in the Linux kernel did not consider the maximum number\n of configurations and interfaces before attempting to\n release resources, which allowed local users to cause a\n denial of service (out-of-bounds write access) or\n possibly have unspecified other impact via a crafted USB\n device (bnc#1072561).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux\n kernel did not require the CAP_NET_ADMIN capability for\n add_callback and remove_callback operations, which\n allowed local users to bypass intended access\n restrictions because the xt_osf_fingers data structure\n is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function\n in net/netlink/af_netlink.c in the Linux kernel through\n 4.14.4, when CONFIG_NLMON is enabled, did not restrict\n observations of Netlink messages to a single net\n namespace, which allowed local users to obtain sensitive\n information by leveraging the CAP_NET_ADMIN capability\n to sniff an nlmon interface for all Netlink activity on\n the system (bnc#1071694).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in\n the Linux kernel did not require the CAP_NET_ADMIN\n capability for new, get, and del operations, which\n allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data\n structure is shared across all net namespaces\n (bnc#1071693).\n\n - CVE-2017-8824: The dccp_disconnect function in\n net/dccp/proto.c in the Linux kernel allowed local users\n to gain privileges or cause a denial of service\n (use-after-free) via an AF_UNSPEC connect system call\n during the DCCP_LISTEN state (bnc#1070771).\n\n - CVE-2017-15115: The sctp_do_peeloff function in\n net/sctp/socket.c in the Linux kernel did not check\n whether the intended netns is used in a peel-off action,\n which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system calls\n (bnc#1068671).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux\n kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is\n enabled, did not ensure that the dir value of\n xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which\n allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified\n other impact via an XFRM_MSG_MIGRATE xfrm Netlink\n message (bnc#1050231).\n\n - CVE-2017-16534: The cdc_parse_cdc_header function in\n drivers/usb/core/message.c in the Linux kernel allowed\n local users to cause a denial of service (out-of-bounds\n read and system crash) or possibly have unspecified\n other impact via a crafted USB device (bnc#1066693).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012422\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1045205\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066569\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067678\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068032\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068671\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070781\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071074\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071694\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1072561\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1072876\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-11600/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-13167/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15115/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15868/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16534/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16538/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17448/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17449/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17450/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17558/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5715/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5753/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5754/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-8824/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20180031-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?31b5dbbf\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud 6:zypper in -t patch\nSUSE-OpenStack-Cloud-6-2018-24=1\n\nSUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch\nSUSE-SLE-SAP-12-SP1-2018-24=1\n\nSUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2018-24=1\n\nSUSE Linux Enterprise Module for Public Cloud 12:zypper in -t patch\nSUSE-SLE-Module-Public-Cloud-12-2018-24=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_69-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_69-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/07/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/08\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-base-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-base-debuginfo-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-debuginfo-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-debugsource-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-devel-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_69-default-1-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_69-xen-1-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-default-man-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-base-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-base-debuginfo-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-debuginfo-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-debugsource-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-devel-3.12.74-60.64.69.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-syms-3.12.74-60.64.69.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-05T14:39:16", "description": "The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.103 to receive various security and bugfixes. The following security bugs were fixed :\n\n - CVE-2017-1000410: The Linux kernel was affected by an information lea that lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. (bnc#1070535).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192).\n\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629).\n\n - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606).\n\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573).\n\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132).\n\n - CVE-2017-16646:\n drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105).\n\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107).\n\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-26T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3398-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000410", "CVE-2017-11600", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16528", "CVE-2017-16536", "CVE-2017-16537", "CVE-2017-16645", "CVE-2017-16646", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-7482", "CVE-2017-8824"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-extra", "p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2017-3398-1.NASL", "href": "https://www.tenable.com/plugins/nessus/105460", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:3398-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105460);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000410\", \"CVE-2017-11600\", \"CVE-2017-12193\", \"CVE-2017-15115\", \"CVE-2017-16528\", \"CVE-2017-16536\", \"CVE-2017-16537\", \"CVE-2017-16645\", \"CVE-2017-16646\", \"CVE-2017-16994\", \"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-7482\", \"CVE-2017-8824\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3398-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.103 to\nreceive various security and bugfixes. The following security bugs\nwere fixed :\n\n - CVE-2017-1000410: The Linux kernel was affected by an\n information lea that lies in the processing of incoming\n L2CAP commands - ConfigRequest, and ConfigResponse\n messages. (bnc#1070535).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux\n kernel did not ensure that the dir value of\n xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which\n allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified\n other impact via an XFRM_MSG_MIGRATE xfrm Netlink\n message (bnc#1050231).\n\n - CVE-2017-12193: The\n assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node\n splitting, which allowed local users to cause a denial\n of service (NULL pointer dereference and panic) via a\n crafted application, as demonstrated by the keyring key\n type, and key addition and link creation operations\n (bnc#1066192).\n\n - CVE-2017-15115: The sctp_do_peeloff function in\n net/sctp/socket.c in the Linux kernel did not check\n whether the intended netns is used in a peel-off action,\n which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system calls\n (bnc#1068671).\n\n - CVE-2017-16528: sound/core/seq_device.c in the Linux\n kernel allowed local users to cause a denial of service\n (snd_rawmidi_dev_seq_free use-after-free and system\n crash) or possibly have unspecified other impact via a\n crafted USB device (bnc#1066629).\n\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux\n kernel allowed local users to cause a denial of service\n (NULL pointer dereference and system crash) or possibly\n have unspecified other impact via a crafted USB device\n (bnc#1066606).\n\n - CVE-2017-16537: The imon_probe function in\n drivers/media/rc/imon.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer\n dereference and system crash) or possibly have\n unspecified other impact via a crafted USB device\n (bnc#1066573).\n\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function\n in drivers/input/misc/ims-pcu.c in the Linux kernel\n allowed local users to cause a denial of service\n (ims_pcu_parse_cdc_data out-of-bounds read and system\n crash) or possibly have unspecified other impact via a\n crafted USB device (bnc#1067132).\n\n - CVE-2017-16646:\n drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service\n (BUG and system crash) or possibly have unspecified\n other impact via a crafted USB device (bnc#1067105).\n\n - CVE-2017-16994: The walk_hugetlb_range function in\n mm/pagewalk.c in the Linux kernel mishandled holes in\n hugetlb ranges, which allowed local users to obtain\n sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call\n (bnc#1069996).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in\n the Linux kernel did not require the CAP_NET_ADMIN\n capability for new, get, and del operations, which\n allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data\n structure is shared across all net namespaces\n (bnc#1071693).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function\n in net/netlink/af_netlink.c in the Linux kernel did not\n restrict observations of Netlink messages to a single\n net namespace, which allowed local users to obtain\n sensitive information by leveraging the CAP_NET_ADMIN\n capability to sniff an nlmon interface for all Netlink\n activity on the system (bnc#1071694).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux\n kernel did not require the CAP_NET_ADMIN capability for\n add_callback and remove_callback operations, which\n allowed local users to bypass intended access\n restrictions because the xt_osf_fingers data structure\n is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-7482: Fixed an overflow when decoding a krb5\n principal. (bnc#1046107).\n\n - CVE-2017-8824: The dccp_disconnect function in\n net/dccp/proto.c in the Linux kernel allowed local users\n to gain privileges or cause a denial of service\n (use-after-free) via an AF_UNSPEC connect system call\n during the DCCP_LISTEN state (bnc#1070771).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1010201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012523\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015336\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015337\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015340\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015342\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015343\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1019675\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1020412\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1020645\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022595\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022607\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024346\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024376\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024412\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032150\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1036489\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1036800\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1037404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1037838\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1038299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1039542\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1040073\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1041873\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1042268\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1042957\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1042977\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1042978\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1043017\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1045404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046054\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046107\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1047901\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1047989\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1048317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1048327\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1048356\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051406\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051635\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051987\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1052384\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1053309\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1053919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1055272\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056365\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056427\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056587\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056596\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056979\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1057079\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1057199\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1057820\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1058413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1059639\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1060333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1061756\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1062496\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1062835\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1062941\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063026\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063349\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063516\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064206\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064591\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064597\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064606\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064701\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064926\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065180\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065639\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065692\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065866\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065959\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066045\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066175\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066192\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066213\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066223\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066285\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066471\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066472\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066573\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066606\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066629\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066660\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066696\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066767\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066812\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066974\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067105\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067225\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067494\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067734\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067735\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067888\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067906\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068671\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068978\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068980\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068982\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069152\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069250\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069270\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069277\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069484\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069583\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069721\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069793\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069879\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069916\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069942\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069996\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070001\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070006\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070145\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070169\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070404\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070535\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070767\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070825\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070964\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071694\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071833\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1072589\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=744692\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=789311\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964944\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966170\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966172\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=979928\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989261\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=996376\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-1000410/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-11600/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-12193/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15115/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16528/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16536/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16537/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16645/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16646/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16994/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17448/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17449/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17450/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7482/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-8824/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20173398-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?02380b93\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch\nSUSE-SLE-WE-12-SP3-2017-2129=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t\npatch SUSE-SLE-SDK-12-SP3-2017-2129=1\n\nSUSE Linux Enterprise Server 12-SP3:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2017-2129=1\n\nSUSE Linux Enterprise Live Patching 12-SP3:zypper in -t patch\nSUSE-SLE-Live-Patching-12-SP3-2017-2129=1\n\nSUSE Linux Enterprise High Availability 12-SP3:zypper in -t patch\nSUSE-SLE-HA-12-SP3-2017-2129=1\n\nSUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP3-2017-2129=1\n\nSUSE Container as a Service Platform ALL:zypper in -t patch\nSUSE-CAASP-ALL-2017-2129=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/07/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP3\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"s390x\", reference:\"kernel-default-man-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-base-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-base-debuginfo-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-debuginfo-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-debugsource-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-default-devel-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"kernel-syms-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"kernel-default-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"kernel-default-debuginfo-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"kernel-default-debugsource-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"kernel-default-devel-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"kernel-default-extra-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"kernel-default-extra-debuginfo-4.4.103-6.33.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"kernel-syms-4.4.103-6.33.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-02-19T13:50:01", "description": "The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4644 advisory.\n\n - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)\n\n - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16650)\n\n - A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions:\n Android kernel. Android ID: A-70526974. (CVE-2017-13305)\n\n - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space. (CVE-2018-19985)\n\n - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. (CVE-2019-11190)\n\n - The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor. (CVE-2016-3139)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2019-05-17T00:00:00", "type": "nessus", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4644)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1583", "CVE-2016-3139", "CVE-2017-13305", "CVE-2017-16650", "CVE-2018-19985", "CVE-2019-11190"], "modified": "2021-09-08T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.34.1.el6uek", "p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.34.1.el7uek", "p-cpe:/a:oracle:linux:kernel-uek", "p-cpe:/a:oracle:linux:kernel-uek-debug", "p-cpe:/a:oracle:linux:kernel-uek-debug-devel", "p-cpe:/a:oracle:linux:kernel-uek-devel", "p-cpe:/a:oracle:linux:kernel-uek-doc", "p-cpe:/a:oracle:linux:kernel-uek-firmware"], "id": "ORACLELINUX_ELSA-2019-4644.NASL", "href": "https://www.tenable.com/plugins/nessus/125237", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2019-4644.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(125237);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/09/08\");\n\n script_cve_id(\n \"CVE-2016-1583\",\n \"CVE-2016-3139\",\n \"CVE-2017-13305\",\n \"CVE-2017-16650\",\n \"CVE-2018-19985\",\n \"CVE-2019-11190\"\n );\n\n script_name(english:\"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4644)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe ELSA-2019-4644 advisory.\n\n - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows\n local users to gain privileges or cause a denial of service (stack memory consumption) via vectors\n involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)\n\n - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local\n users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified\n other impact via a crafted USB device. (CVE-2017-16650)\n\n - A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions:\n Android kernel. Android ID: A-70526974. (CVE-2017-13305)\n\n - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num\n from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds\n (OOB) read that potentially allows arbitrary read in the kernel address space. (CVE-2018-19985)\n\n - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because\n install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the\n ptrace_may_access() check has a race condition when reading /proc/pid/stat. (CVE-2019-11190)\n\n - The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows\n physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)\n via a crafted endpoints value in a USB device descriptor. (CVE-2016-3139)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2019-4644.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-16650\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/03/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/17\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.34.1.el6uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.34.1.el7uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:kernel-uek-firmware\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"linux_alt_patch_detect.nasl\", \"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('ksplice.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^(6|7)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 6 / 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\nvar machine_uptrack_level = get_one_kb_item('Host/uptrack-uname-r');\nif (machine_uptrack_level)\n{\n var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:\"\\.(x86_64|i[3-6]86|aarch64)$\", replace:'');\n var fixed_uptrack_levels = ['3.8.13-118.34.1.el6uek', '3.8.13-118.34.1.el7uek'];\n foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {\n if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for ELSA-2019-4644');\n }\n }\n __rpm_report = 'Running KSplice level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\\n\\n';\n}\n\nvar kernel_major_minor = get_kb_item('Host/uname/major_minor');\nif (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');\nvar expected_kernel_major_minor = '3.8';\nif (kernel_major_minor != expected_kernel_major_minor)\n audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);\n\nvar pkgs = [\n {'reference':'dtrace-modules-3.8.13-118.34.1.el6uek-0.4.5-3.el6', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-uek-3.8.13-118.34.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-3.8.13'},\n {'reference':'kernel-uek-debug-3.8.13-118.34.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-3.8.13'},\n {'reference':'kernel-uek-debug-devel-3.8.13-118.34.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-3.8.13'},\n {'reference':'kernel-uek-devel-3.8.13-118.34.1.el6uek', 'cpu':'x86_64', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-3.8.13'},\n {'reference':'kernel-uek-doc-3.8.13-118.34.1.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-3.8.13'},\n {'reference':'kernel-uek-firmware-3.8.13-118.34.1.el6uek', 'release':'6', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-3.8.13'},\n {'reference':'dtrace-modules-3.8.13-118.34.1.el7uek-0.4.5-3.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'kernel-uek-3.8.13-118.34.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-3.8.13'},\n {'reference':'kernel-uek-debug-3.8.13-118.34.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-3.8.13'},\n {'reference':'kernel-uek-debug-devel-3.8.13-118.34.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-3.8.13'},\n {'reference':'kernel-uek-devel-3.8.13-118.34.1.el7uek', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-3.8.13'},\n {'reference':'kernel-uek-doc-3.8.13-118.34.1.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-3.8.13'},\n {'reference':'kernel-uek-firmware-3.8.13-118.34.1.el7uek', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-firmware-3.8.13'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release) {\n if (exists_check) {\n if (rpm_exists(release:release, rpm:exists_check) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'dtrace-modules-3.8.13-118.34.1.el6uek / dtrace-modules-3.8.13-118.34.1.el7uek / kernel-uek / etc');\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-04T16:21:59", "description": "USN-3653-1 fixed vulnerabilities and added mitigations in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS.\n\nJann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2018-3639)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of netlink messages to the appropriate net namespace. A local attacker could use this to expose sensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel in certain circumstances. A local attacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-23T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3653-2) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17449", "CVE-2017-17975", "CVE-2017-18203", "CVE-2017-18208", "CVE-2018-3639", "CVE-2018-8822"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-oem", "p-cpe:/a:canonical:ubuntu_linux:linux-image-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oem", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3653-2.NASL", "href": "https://www.tenable.com/plugins/nessus/110047", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3653-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(110047);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-17449\", \"CVE-2017-17975\", \"CVE-2017-18203\", \"CVE-2017-18208\", \"CVE-2018-3639\", \"CVE-2018-8822\");\n script_xref(name:\"USN\", value:\"3653-2\");\n\n script_name(english:\"Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3653-2) (Spectre)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3653-1 fixed vulnerabilities and added mitigations in the Linux\nkernel for Ubuntu 17.10. This update provides the corresponding\nupdates for the Linux Hardware Enablement (HWE) kernel from Ubuntu\n17.10 for Ubuntu 16.04 LTS.\n\nJann Horn and Ken Johnson discovered that microprocessors utilizing\nspeculative execution of a memory read may allow unauthorized memory\nreads via a sidechannel attack. This flaw is known as Spectre Variant\n4. A local attacker could use this to expose sensitive information,\nincluding kernel memory. (CVE-2018-3639)\n\nIt was discovered that the netlink subsystem in the Linux kernel did\nnot properly restrict observations of netlink messages to the\nappropriate net namespace. A local attacker could use this to expose\nsensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007\ndriver of the Linux kernel. A local attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper\ncomponent of the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2)\nimplementation in the Linux kernel in certain circumstances. A local\nattacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS\nimplementation in the Linux kernel. A remote attacker controlling a\nmalicious NCPFS server could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3653-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-oem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oem\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/23\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-17449\", \"CVE-2017-17975\", \"CVE-2017-18203\", \"CVE-2017-18208\", \"CVE-2018-3639\", \"CVE-2018-8822\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3653-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-1017-gcp\", pkgver:\"4.13.0-1017.21\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-1018-azure\", pkgver:\"4.13.0-1018.21\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-1028-oem\", pkgver:\"4.13.0-1028.31\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-43-generic\", pkgver:\"4.13.0-43.48~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-43-generic-lpae\", pkgver:\"4.13.0-43.48~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.13.0-43-lowlatency\", pkgver:\"4.13.0-43.48~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-azure\", pkgver:\"4.13.0.1018.19\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gcp\", pkgver:\"4.13.0.1017.19\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-hwe-16.04\", pkgver:\"4.13.0.43.62\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae-hwe-16.04\", pkgver:\"4.13.0.43.62\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gke\", pkgver:\"4.13.0.1017.19\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency-hwe-16.04\", pkgver:\"4.13.0.43.62\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oem\", pkgver:\"4.13.0.1028.33\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.13-azure / linux-image-4.13-gcp / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-04T16:21:58", "description": "Jann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2018-3639)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of netlink messages to the appropriate net namespace. A local attacker could use this to expose sensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel in certain circumstances. A local attacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-05-23T00:00:00", "type": "nessus", "title": "Ubuntu 17.10 : Linux kernel vulnerabilities (USN-3653-1) (Spectre)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17449", "CVE-2017-17975", "CVE-2017-18203", "CVE-2017-18208", "CVE-2018-3639", "CVE-2018-8822"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "cpe:/o:canonical:ubuntu_linux:17.10"], "id": "UBUNTU_USN-3653-1.NASL", "href": "https://www.tenable.com/plugins/nessus/110046", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3653-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(110046);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-17449\", \"CVE-2017-17975\", \"CVE-2017-18203\", \"CVE-2017-18208\", \"CVE-2018-3639\", \"CVE-2018-8822\");\n script_xref(name:\"USN\", value:\"3653-1\");\n\n script_name(english:\"Ubuntu 17.10 : Linux kernel vulnerabilities (USN-3653-1) (Spectre)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Jann Horn and Ken Johnson discovered that microprocessors utilizing\nspeculative execution of a memory read may allow unauthorized memory\nreads via a sidechannel attack. This flaw is known as Spectre Variant\n4. A local attacker could use this to expose sensitive information,\nincluding kernel memory. (CVE-2018-3639)\n\nIt was discovered that the netlink subsystem in the Linux kernel did\nnot properly restrict observations of netlink messages to the\nappropriate net namespace. A local attacker could use this to expose\nsensitive information (kernel netlink traffic). (CVE-2017-17449)\n\nTuba Yavuz discovered that a double-free error existed in the USBTV007\ndriver of the Linux kernel. A local attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-17975)\n\nIt was discovered that a race condition existed in the Device Mapper\ncomponent of the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that an infinite loop could occur in the madvise(2)\nimplementation in the Linux kernel in certain circumstances. A local\nattacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS\nimplementation in the Linux kernel. A remote attacker controlling a\nmalicious NCPFS server could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2018-8822).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3653-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.13-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:17.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/23\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018-2023 Canonical, Inc. / NASL script (C) 2018-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(17\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 17.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-17449\", \"CVE-2017-17975\", \"CVE-2017-18203\", \"CVE-2017-18208\", \"CVE-2018-3639\", \"CVE-2018-8822\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3653-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-43-generic\", pkgver:\"4.13.0-43.48\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-43-generic-lpae\", pkgver:\"4.13.0-43.48\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-4.13.0-43-lowlatency\", pkgver:\"4.13.0-43.48\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-generic\", pkgver:\"4.13.0.43.46\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.13.0.43.46\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.13.0.43.46\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.13-generic / linux-image-4.13-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:47:22", "description": "According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :\n\n - Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.\n\n - It was found that _sctp_make_chunk() function did not check if the chunk length for INIT and INIT_ACK packets was within the allowed limits. A local attacker could exploit this to trigger a kernel crash.\n\n - It was discovered that nfnl_cthelper_list structure was accessible to any user with CAP_NET_ADMIN capability in a network namespace. An unprivileged local user could exploit that to affect netfilter conntrack helpers on the host.\n\n - It was discovered that a nlmon link inside a child network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to monitor system-wide netlink activity.\n\n - The KEYS subsystem in the Linux kernel omitted an access-control check when writing a key to the current task's default keyring, allowing a local user to bypass security checks to the keyring. This compromises the validity of the keyring for those who rely on it.\n\n - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations. This allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all network namespaces.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-06-04T00:00:00", "type": "nessus", "title": "Virtuozzo 7 : readykernel-patch (VZA-2018-038)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.9, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17807", "CVE-2018-1130", "CVE-2018-5803"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:virtuozzo:virtuozzo:readykernel", "cpe:/o:virtuozzo:virtuozzo:7"], "id": "VIRTUOZZO_VZA-2018-038.NASL", "href": "https://www.tenable.com/plugins/nessus/110311", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(110311);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\n \"CVE-2017-17448\",\n \"CVE-2017-17449\",\n \"CVE-2017-17450\",\n \"CVE-2017-17807\",\n \"CVE-2018-1130\",\n \"CVE-2018-5803\"\n );\n\n script_name(english:\"Virtuozzo 7 : readykernel-patch (VZA-2018-038)\");\n script_summary(english:\"Checks the readykernel output for the updated patch.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Virtuozzo host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerabilities :\n\n - Linux kernel before version 4.16-rc7 is vulnerable to a\n null pointer dereference in dccp_write_xmit() function\n in net/dccp/output.c in that allows a local user to\n cause a denial of service by a number of certain\n crafted system calls.\n\n - It was found that _sctp_make_chunk() function did not\n check if the chunk length for INIT and INIT_ACK packets\n was within the allowed limits. A local attacker could\n exploit this to trigger a kernel crash.\n\n - It was discovered that nfnl_cthelper_list structure was\n accessible to any user with CAP_NET_ADMIN capability in\n a network namespace. An unprivileged local user could\n exploit that to affect netfilter conntrack helpers on\n the host.\n\n - It was discovered that a nlmon link inside a child\n network namespace was not restricted to that namespace.\n An unprivileged local user could exploit that to\n monitor system-wide netlink activity.\n\n - The KEYS subsystem in the Linux kernel omitted an\n access-control check when writing a key to the current\n task's default keyring, allowing a local user to bypass\n security checks to the keyring. This compromises the\n validity of the keyring for those who rely on it.\n\n - net/netfilter/xt_osf.c in the Linux kernel through\n 4.14.4 does not require the CAP_NET_ADMIN capability\n for add_callback and remove_callback operations. This\n allows local users to bypass intended access\n restrictions because the xt_osf_fingers data structure\n is shared across all network namespaces.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://help.virtuozzo.com/customer/portal/articles/2942008\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17448\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17450\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2017-17807\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-1130\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-5803\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-48.2-52.0-2.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9fc60951\");\n script_set_attribute(attribute:\"solution\", value:\"Update the readykernel patch.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/06/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/06/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:virtuozzo:virtuozzo:readykernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:virtuozzo:virtuozzo:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Virtuozzo Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Virtuozzo/release\", \"Host/Virtuozzo/rpm-list\", \"Host/readykernel-info\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"readykernel.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/Virtuozzo/release\");\nif (isnull(release) || \"Virtuozzo\" >!< release) audit(AUDIT_OS_NOT, \"Virtuozzo\");\nos_ver = pregmatch(pattern: \"Virtuozzo Linux release ([0-9]+\\.[0-9])(\\D|$)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Virtuozzo 7.x\", \"Virtuozzo \" + os_ver);\n\nif (!get_kb_item(\"Host/Virtuozzo/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Virtuozzo\", cpu);\n\nrk_info = get_kb_item(\"Host/readykernel-info\");\nif (empty_or_null(rk_info)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\n\nchecks = make_list2(\n make_array(\n \"kernel\",\"vzkernel-3.10.0-693.21.1.vz7.48.2\",\n \"patch\",\"readykernel-patch-48.2-52.0-2.vl7\"\n )\n);\nreadykernel_execute_checks(checks:checks, severity:SECURITY_WARNING, release:\"Virtuozzo-7\");\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-05T14:39:31", "description": "The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.103 to receive various security and bugfixes. This update enables SMB encryption in the CIFS support in the Linux Kernel (fate#324404) The following security bugs were fixed :\n\n - CVE-2017-1000410: The Linux kernel was affected by an information leak in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages.\n (bnc#1070535).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192).\n\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n\n - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520).\n\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629).\n\n - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606).\n\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573).\n\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132).\n\n - CVE-2017-16646:\n drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105).\n\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107).\n\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-26T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3410-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000410", "CVE-2017-11600", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-15265", "CVE-2017-16528", "CVE-2017-16536", "CVE-2017-16537", "CVE-2017-16645", "CVE-2017-16646", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-7482", "CVE-2017-8824"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-extra", "p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2017-3410-1.NASL", "href": "https://www.tenable.com/plugins/nessus/105461", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:3410-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105461);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000410\", \"CVE-2017-11600\", \"CVE-2017-12193\", \"CVE-2017-15115\", \"CVE-2017-15265\", \"CVE-2017-16528\", \"CVE-2017-16536\", \"CVE-2017-16537\", \"CVE-2017-16645\", \"CVE-2017-16646\", \"CVE-2017-16994\", \"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-7482\", \"CVE-2017-8824\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3410-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.103 to\nreceive various security and bugfixes. This update enables SMB\nencryption in the CIFS support in the Linux Kernel (fate#324404) The\nfollowing security bugs were fixed :\n\n - CVE-2017-1000410: The Linux kernel was affected by an\n information leak in the processing of incoming L2CAP\n commands - ConfigRequest, and ConfigResponse messages.\n (bnc#1070535).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux\n kernel did not ensure that the dir value of\n xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which\n allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified\n other impact via an XFRM_MSG_MIGRATE xfrm Netlink\n message (bnc#1050231).\n\n - CVE-2017-12193: The\n assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node\n splitting, which allowed local users to cause a denial\n of service (NULL pointer dereference and panic) via a\n crafted application, as demonstrated by the keyring key\n type, and key addition and link creation operations\n (bnc#1066192).\n\n - CVE-2017-15115: The sctp_do_peeloff function in\n net/sctp/socket.c in the Linux kernel did not check\n whether the intended netns is used in a peel-off action,\n which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system calls\n (bnc#1068671).\n\n - CVE-2017-15265: Race condition in the ALSA subsystem in\n the Linux kernel allowed local users to cause a denial\n of service (use-after-free) or possibly have unspecified\n other impact via crafted /dev/snd/seq ioctl calls,\n related to sound/core/seq/seq_clientmgr.c and\n sound/core/seq/seq_ports.c (bnc#1062520).\n\n - CVE-2017-16528: sound/core/seq_device.c in the Linux\n kernel allowed local users to cause a denial of service\n (snd_rawmidi_dev_seq_free use-after-free and system\n crash) or possibly have unspecified other impact via a\n crafted USB device (bnc#1066629).\n\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux\n kernel allowed local users to cause a denial of service\n (NULL pointer dereference and system crash) or possibly\n have unspecified other impact via a crafted USB device\n (bnc#1066606).\n\n - CVE-2017-16537: The imon_probe function in\n drivers/media/rc/imon.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer\n dereference and system crash) or possibly have\n unspecified other impact via a crafted USB device\n (bnc#1066573).\n\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function\n in drivers/input/misc/ims-pcu.c in the Linux kernel\n allowed local users to cause a denial of service\n (ims_pcu_parse_cdc_data out-of-bounds read and system\n crash) or possibly have unspecified other impact via a\n crafted USB device (bnc#1067132).\n\n - CVE-2017-16646:\n drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service\n (BUG and system crash) or possibly have unspecified\n other impact via a crafted USB device (bnc#1067105).\n\n - CVE-2017-16994: The walk_hugetlb_range function in\n mm/pagewalk.c in the Linux kernel mishandled holes in\n hugetlb ranges, which allowed local users to obtain\n sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call\n (bnc#1069996).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in\n the Linux kernel did not require the CAP_NET_ADMIN\n capability for new, get, and del operations, which\n allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data\n structure is shared across all net namespaces\n (bnc#1071693).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function\n in net/netlink/af_netlink.c in the Linux kernel through\n 4.14.4, when CONFIG_NLMON is enabled, did not restrict\n observations of Netlink messages to a single net\n namespace, which allowed local users to obtain sensitive\n information by leveraging the CAP_NET_ADMIN capability\n to sniff an nlmon interface for all Netlink activity on\n the system (bnc#1071694).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux\n kernel did not require the CAP_NET_ADMIN capability for\n add_callback and remove_callback operations, which\n allowed local users to bypass intended access\n restrictions because the xt_osf_fingers data structure\n is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-7482: Fixed an overflow when decoding a krb5\n principal. (bnc#1046107).\n\n - CVE-2017-8824: The dccp_disconnect function in\n net/dccp/proto.c in the Linux kernel allowed local users\n to gain privileges or cause a denial of service\n (use-after-free) via an AF_UNSPEC connect system call\n during the DCCP_LISTEN state (bnc#1070771).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1010201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1017461\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1020645\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022595\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022914\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024412\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025461\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027301\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028971\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030061\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1034048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1037890\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046107\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1050231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1053919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1055567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056365\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056427\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1056979\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1057199\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1058135\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1059863\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1060333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1060682\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1060985\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1061451\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1061756\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1062520\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1062941\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1062962\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063026\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063460\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063475\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063501\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063509\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063516\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063520\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1063695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064206\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064701\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1064926\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065180\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065639\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065692\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1065866\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066045\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066192\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066213\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066223\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066285\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066471\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066472\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066573\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066606\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1066629\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067105\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067494\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1067888\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068671\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068978\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068980\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1068982\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069270\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069793\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069942\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1069996\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070006\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070145\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070535\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070767\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070825\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1070964\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071694\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1071833\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963575\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=964944\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966170\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966172\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966186\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966191\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966316\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=966318\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969474\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969475\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969476\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969477\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=971975\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=974590\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=979928\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989261\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=996376\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-1000410/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-11600/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-12193/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15115/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15265/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16528/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16536/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16537/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16645/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16646/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-16994/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17448/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17449/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-17450/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7482/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-8824/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20173410-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?3a4b7625\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 12-SP2:zypper in -t patch\nSUSE-SLE-WE-12-SP2-2017-2141=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t\npatch SUSE-SLE-SDK-12-SP2-2017-2141=1\n\nSUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t\npatch SUSE-SLE-RPI-12-SP2-2017-2141=1\n\nSUSE Linux Enterprise Server 12-SP2:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2017-2141=1\n\nSUSE Linux Enterprise Live Patching 12:zypper in -t patch\nSUSE-SLE-Live-Patching-12-2017-2141=1\n\nSUSE Linux Enterprise High Availability 12-SP2:zypper in -t patch\nSUSE-SLE-HA-12-SP2-2017-2141=1\n\nSUSE Linux Enterprise Desktop 12-SP2:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP2-2017-2141=1\n\nOpenStack Cloud Magnum Orchestration 7:zypper in -t patch\nSUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2141=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/07/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"s390x\", reference:\"kernel-default-man-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-base-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-base-debuginfo-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-debuginfo-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-debugsource-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-default-devel-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"kernel-syms-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-debuginfo-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-debugsource-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-devel-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-extra-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-extra-debuginfo-4.4.103-92.53.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-syms-4.4.103-92.53.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-13T17:09:07", "description": "The openSUSE Leap 42.2 kernel was updated to 4.4.102 to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496).\n\n - CVE-2017-1000410: The Linux kernel was affected by an information leak in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages.\n (bnc#1070535).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192).\n\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629).\n\n - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606).\n\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573).\n\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132).\n\n - CVE-2017-16646:\n drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105).\n\n - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702).\n\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107).\n\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n\nThe following non-security bugs were fixed :\n\n - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717).\n\n - adv7604: Initialize drive strength to default when using DT (bnc#1012382).\n\n - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382).\n\n - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382).\n\n - alsa: hda: Add Raven PCI ID (bnc#1012382).\n\n - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE (bnc#1012382).\n\n - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717).\n\n - alsa: hda - fix headset mic problem for Dell machines with alc236 (bnc#1012382).\n\n - alsa: hda - No loopback on ALC299 codec (git-fixes).\n\n - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon (bsc#1031717).\n\n - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382).\n\n - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382).\n\n - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717).\n\n - alsa: hda: Remove superfluous '-' added by printk conversion (bnc#1012382).\n\n - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382).\n\n - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717).\n\n - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717).\n\n - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382).\n\n - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382).\n\n - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382).\n\n - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382).\n\n - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382).\n\n - alsa: timer: Remove kernel warning at compat ioctl error paths (bsc#1031717).\n\n - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital (bnc#1012382).\n\n - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717).\n\n - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717).\n\n - alsa: usb-audio: Fix potential out-of-bound access at parsing SU (bsc#1031717).\n\n - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382).\n\n - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717).\n\n - alsa: vx: Do not try to update capture stream before running (bnc#1012382).\n\n - alsa: vx: Fix possible transfer overflow (bnc#1012382).\n\n - Apply generic ppc build fixes to vanilla (bsc#1070805)\n\n - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382).\n\n - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382).\n\n - arm64: fix dump_instr when PAN and UAO are in use (bnc#1012382).\n\n - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382).\n\n - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382).\n\n - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382).\n\n - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382).\n\n - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382).\n\n - arm: dts: Fix am335x and dm814x scm syscon to probe children (bnc#1012382).\n\n - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382).\n\n - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).\n\n - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382).\n\n - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382).\n\n - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6 (bnc#1012382).\n\n - arm: pxa: Do not rely on public mmc header to include leds.h (bnc#1012382).\n\n - asm/sections: add helpers to check for section data (bsc#1063026).\n\n - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382).\n\n - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717).\n\n - asoc: davinci-mcasp: Fix an error handling path in 'davinci_mcasp_probe()' (bsc#1031717).\n\n - asoc: rsnd: do not double free kctrl (bnc#1012382).\n\n - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe failure (bsc#1031717).\n\n - asoc: wm_adsp: Do not overrun firmware file buffer when reading region data (bnc#1012382).\n\n - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).\n\n - ata: fixes kernel crash while tracing ata_eh_link_autopsy event (bnc#1012382).\n\n - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382).\n\n - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).\n\n - ath10k: convert warning about non-existent OTP board id to debug message (git-fixes).\n\n - ath10k: fix a warning during channel switch with multiple vaps (bsc#1031717).\n\n - ath10k: fix board data fetch error message (bsc#1031717).\n\n - ath10k: fix diag_read to collect data for larger memory (bsc#1031717).\n\n - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382).\n\n - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() (bnc#1012382).\n\n - ath10k: free cached fw bin contents when get board id fails (bsc#1031717).\n\n - ath10k: ignore configuring the incorrect board_id (bnc#1012382).\n\n - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382).\n\n - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717).\n\n - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717).\n\n - autofs: do not fail mount for transient error (bsc#1065180).\n\n - backlight: adp5520: Fix error handling in adp5520_bl_probe() (bnc#1012382).\n\n - backlight: lcd: Fix race condition during register (bnc#1012382).\n\n - bcache: check ca->alloc_thread initialized before wake up it (bnc#1012382).\n\n - blacklist 0278b34bf15f spi: spidev_test: Fix buffer overflow in unescape() This is a binary built from Documentation and the build logs do not show it built\n\n - blacklist.conf: 79b63f12abcbbd2caf7064b294af648a87de07ff # bsc#1061756 may break existing setups\n\n - blacklist.conf: Add ath10k, mmc and rtl8192u commits (bsc#1031717)\n\n - blacklist.conf: Add drm/i915 blacklist (bsc#1031717)\n\n - blacklist.conf: added misc commits (bsc#1031717)\n\n - blacklist.conf: Add misc entries (bsc#1031717)\n\n - blacklist.conf: Blacklist 33e465ce7cb3 ('percpu_ref:\n allow operation mode switching operations to be called concurrently'). The benefits are not worth the possible risks eventually introduced.\n\n - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919)\n\n - blacklist.conf: blacklist not-applicable patch (bsc#1071231)\n\n - blacklist.conf: commit fe22cd9b7c980b8b948 ('printk:\n help pr_debug and pr_devel to optimize out arguments') is just a cosmetic change.\n\n - blacklist.conf: Update blacklist (bsc#1031717)\n\n - blacklist.conf: Update iwlwifi blacklist (bsc#1031717)\n\n - blacklist.conf: yet another serial entry (bsc#1031717)\n\n - block: Fix a race between blk_cleanup_queue() and timeout handling (FATE#319965, bsc#964944).\n\n - bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382).\n\n - bnxt_en: Call firmware to approve the random VF MAC address (bsc#963575 FATE#320144).\n\n - bnxt_en: Do not setup MAC address in bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144).\n\n - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response (bsc#963575 FATE#320144).\n\n - bnxt_en: Fix VF PCIe link speed and width logic (bsc#963575 FATE#320144).\n\n - bnxt_en: Re-arrange bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144).\n\n - bnxt_en: use eth_hw_addr_random() (bsc#963575 FATE#320144).\n\n - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382).\n\n - bpf: one perf event close won't free bpf program attached by another perf event (bnc#1012382).\n\n - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382).\n\n - brcmfmac: add length check in brcmf_cfg80211_escan_handler() (bnc#1012382).\n\n - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382).\n\n - brcmsmac: make some local variables 'static const' to reduce stack size (bnc#1012382).\n\n - bt8xx: fix memory leak (bnc#1012382).\n\n - btrfs: add a node counter to each of the rbtrees (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: add cond_resched() calls when resolving backrefs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: allow backref search checks for shared extents (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: backref, add tracepoints for prelim_ref insertion and merging (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: backref, add unode_aux_to_inode_list helper (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: backref, cleanup __ namespace abuse (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: backref, constify some arguments (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: btrfs_check_shared should manage its own transaction (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: clean up extraneous computations in add_delayed_refs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: constify tracepoint arguments (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: convert prelimary reference tracking to use rbtrees (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: fix leak and use-after-free in resolve_indirect_refs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: Fix typo in may_commit_transaction Rather than comparing the result of the percpu comparison I was comparing the value of the percpu counter against 0 or 1.\n\n - btrfs: remove ref_tree implementation from backref.c (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: return the actual error value from from btrfs_uuid_tree_iterate (bnc#1012382).\n\n - btrfs: struct-funcs, constify readers (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382).\n\n - can: c_can: do not indicate triple sampling support for D_CAN (bnc#1012382).\n\n - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382).\n\n - can: gs_usb: fix busy loop if no more TX context is available (bnc#1012382).\n\n - can: kvaser_usb: Correct return value in printout (bnc#1012382).\n\n - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382).\n\n - can: sun4i: fix loopback mode (bnc#1012382).\n\n - can: sun4i: handle overrun in RX FIFO (bnc#1012382).\n\n - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices (bnc#1012382).\n\n - ceph: clean up unsafe d_parent accesses in build_dentry_path (bnc#1012382).\n\n - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639).\n\n - cgroup, net_cls: iterate the fds of only the tasks which are being migrated (bnc#1064926).\n\n - cifs: add build_path_from_dentry_optional_prefix() (fate#323482)\n\n - cifs: Add capability to decrypt big read responses (FATE#324404). Allow to decrypt transformed packets that are bigger than the big buffer size. In particular it is used for read responses that can only exceed the big buffer size.\n\n - cifs: Add capability to transform requests before sending (FATE#324404). This will allow us to do protocol specific tranformations of packets before sending to the server. For SMB3 it can be used to support encryption.\n\n - cifs: Add copy into pages callback for a read operation (FATE#324404). Since we have two different types of reads (pagecache and direct) we need to process such responses differently after decryption of a packet. The change allows to specify a callback that copies a read payload data into preallocated pages.\n\n - cifs: Add mid handle callback (FATE#324404). We need to process read responses differently because the data should go directly into preallocated pages. This can be done by specifying a mid handle callback.\n\n - cifs: Add soft dependencies (FATE#324404). List soft dependencies of cifs so that mkinitrd and dracut can include the required helper modules.\n\n - cifs: Add transform header handling callbacks (FATE#324404). We need to recognize and parse transformed packets in demultiplex thread to find a corresponsing mid and process it further.\n\n - cifs: add use_ipc flag to SMB2_ioctl() (fate#323482)\n\n - cifs: Allow to switch on encryption with seal mount option (FATE#324404). This allows users to inforce encryption for SMB3 shares if a server supports it.\n\n - cifs: check MaxPathNameComponentLength != 0 before using it (bnc#1012382).\n\n - cifs: Decrypt and process small encrypted packets (FATE#324404). Allow to decrypt transformed packets, find a corresponding mid and process as usual further.\n\n - cifs: do not bother with kmap on read_pages side (FATE#324404). just do ITER_BVEC recvmsg\n\n - cifs: Enable encryption during session setup phase (FATE#324404). In order to allow encryption on SMB connection we need to exchange a session key and generate encryption and decryption keys.\n\n - cifs: Encrypt SMB3 requests before sending (FATE#324404). This change allows to encrypt packets if it is required by a server for SMB sessions or tree connections.\n\n - cifs: fix circular locking dependency (bsc#1064701).\n\n - cifs: Fix some return values in case of error in 'crypt_message' (fate#324404).\n\n - cifs: Fix sparse warnings (fate#323482)\n\n - cifs: implement get_dfs_refer for SMB2+ (fate#323482)\n\n - cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482)\n\n - cifs: Make send_cancel take rqst as argument (FATE#324404).\n\n - cifs: Make SendReceive2() takes resp iov (FATE#324404).\n Now SendReceive2 frees the first iov and returns a response buffer in it that increases a code complexity.\n Simplify this by making a caller responsible for freeing request buffer itself and returning a response buffer in a separate iov.\n\n - cifs: move DFS response parsing out of SMB1 code (fate#323482)\n\n - cifs: no need to wank with copying and advancing iovec on recvmsg side either (FATE#324404).\n\n - cifs: Only select the required crypto modules (FATE#324404). The sha256 and cmac crypto modules are only needed for SMB2+, so move the select statements to config CIFS_SMB2. Also select CRYPTO_AES there as SMB2+ needs it.\n\n - cifs: Prepare for encryption support (first part). Add decryption and encryption key generation. (FATE#324404).\n\n - cifs_readv_receive: use cifs_read_from_socket() (FATE#324404).\n\n - cifs: Reconnect expired SMB sessions (bnc#1012382).\n\n - cifs: remove any preceding delimiter from prefix_path (fate#323482)\n\n - cifs: Send RFC1001 length in a separate iov (FATE#324404). In order to simplify further encryption support we need to separate RFC1001 length and SMB2 header when sending a request. Put the length field in iov[0] and the rest of the packet into following iovs.\n\n - cifs: Separate RFC1001 length processing for SMB2 read (FATE#324404). Allocate and initialize SMB2 read request without RFC1001 length field to directly call cifs_send_recv() rather than SendReceive2() in a read codepath.\n\n - cifs: Separate SMB2 header structure (FATE#324404). In order to support compounding and encryption we need to separate RFC1001 length field and SMB2 header structure because the protocol treats them differently. This change will allow to simplify parsing of such complex SMB2 packets further.\n\n - cifs: Separate SMB2 sync header processing (FATE#324404). Do not process RFC1001 length in smb2_hdr_assemble() because it is not a part of SMB2 header. This allows to cleanup the code and adds a possibility combine several SMB2 packets into one for compounding.\n\n - cifs: set signing flag in SMB2+ TreeConnect if needed (fate#323482)\n\n - cifs: Simplify SMB2 and SMB311 dependencies (FATE#324404). * CIFS_SMB2 depends on CIFS, which depends on INET and selects NLS. So these dependencies do not need to be repeated for CIFS_SMB2. * CIFS_SMB311 depends on CIFS_SMB2, which depends on INET. So this dependency does not need to be repeated for CIFS_SMB311.\n\n - cifs: use DFS pathnames in SMB2+ Create requests (fate#323482)\n\n - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382).\n\n - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382).\n\n - clockevents/drivers/cs5535: Improve resilience to spurious interrupts (bnc#1012382).\n\n - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060).\n\n - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382).\n\n - cpufreq: CPPC: add ACPI_PROCESSOR dependency (bnc#1012382).\n\n - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382).\n\n - crypto: vmx - disable preemption to enable vsx in aes_ctr.c (bnc#1012382).\n\n - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382).\n\n - crypto: xts - Add ECB dependency (bnc#1012382).\n\n - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).\n\n - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1021424).\n\n - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223).\n\n - cxl: Fix leaking pid refs in some error paths (bsc#1066223).\n\n - cxl: Force context lock during EEH flow (bsc#1066223).\n\n - cxl: Prevent adapter reset if an active context exists (bsc#1066223).\n\n - cxl: Route eeh events to all drivers in cxl_pci_error_detected() (bsc#1066223).\n\n - direct-io: Prevent NULL pointer access in submit_page_section (bnc#1012382).\n\n - Disable IPMI fix patches due to regression (bsc#1071833)\n\n - Disable patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcou nting-in-bio_map_use.patch (bsc#1070767) Refresh patches.drivers/0004-bio-use-offset_in_page-macro.patch.\n\n - dmaengine: dmatest: warn user when dma test times out (bnc#1012382).\n\n - dmaengine: edma: Align the memcpy acnt array size with the transfer (bnc#1012382).\n\n - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382).\n\n - dm bufio: fix integer overflow when limiting maximum cache size (bnc#1012382).\n\n - dm: fix race between dm_get_from_kobject() and\n __dm_destroy() (bnc#1012382).\n\n - drivers: dma-mapping: Do not leave an invalid area->pages pointer in dma_common_contiguous_remap() (Git-fixes, bsc#1065692).\n\n - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382).\n\n - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717).\n\n - drm: Apply range restriction after color adjustment when allocation (bnc#1012382).\n\n - drm/armada: Fix compile fail (bnc#1012382).\n\n - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382).\n\n - drm: gma500: fix logic error (bsc#1031717).\n\n - drm/i915/bxt: set min brightness from VBT (bsc#1031717).\n\n - drm/i915: Do not try indexed reads to alternate slave addresses (bsc#1031717).\n\n - drm/i915: fix backlight invert for non-zero minimum brightness (bsc#1031717).\n\n - drm/i915: Prevent zero length 'index' write (bsc#1031717).\n\n - drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get() (bsc#1031717).\n\n - drm/msm: fix an integer overflow test (bnc#1012382).\n\n - drm/msm: Fix potential buffer overflow issue (bnc#1012382).\n\n - drm/nouveau/bsp/g92: disable by default (bnc#1012382).\n\n - drm/nouveau/gr: fallback to legacy paths during firmware lookup (bsc#1031717).\n\n - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382).\n\n - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717).\n\n - drm/panel: simple: Add missing panel_simple_unprepare() calls (bsc#1031717).\n\n - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache (bnc#1012382).\n\n - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).\n\n - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382).\n\n - e1000e: Fix error path in link detection (bnc#1012382).\n\n - e1000e: Fix return value test (bnc#1012382).\n\n - e1000e: Separate signaling for link check/link up (bnc#1012382).\n\n - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382).\n\n - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1012829).\n\n - epoll: avoid calling ep_call_nested() from ep_poll_safewake() (bsc#1056427).\n\n - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427).\n\n - ext4: cleanup goto next group (bsc#1066285).\n\n - ext4: do not use stripe_width if it is not set (bnc#1012382).\n\n - ext4: fix interaction between i_size, fallocate, and delalloc after a crash (bnc#1012382).\n\n - ext4: fix stripe-unaligned allocations (bnc#1012382).\n\n - ext4: in ext4_seek_(hole,data), return -ENXIO for negative offsets (bnc#1012382).\n\n - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285).\n\n - extcon: palmas: Check the parent instance to prevent the NULL (bnc#1012382).\n\n - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382).\n\n - f2fs crypto: add missing locking for keyring_key access (bnc#1012382).\n\n - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382).\n\n - f2fs: do not wait for writeback in write_begin (bnc#1012382).\n\n - fealnx: Fix building error on MIPS (bnc#1012382).\n\n - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382).\n\n - Fix tracing sample code warning (bnc#1012382).\n\n - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382).\n\n - fm10k: request reset when mbx->state changes (bnc#1012382).\n\n - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n\n - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1012829).\n\n - fs-cache: fix dereference of NULL user_key_payload (bnc#1012382).\n\n - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382).\n\n - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382).\n\n - fscrypto: require write access to mount to set encryption policy (bnc#1012382).\n\n - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).\n\n - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap (bnc#1012382).\n\n - hid: elo: clear BTN_LEFT mapping (bsc#1065866).\n\n - hid: usbhid: fix out-of-bounds bug (bnc#1012382).\n\n - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717).\n\n - i2c: at91: ensure state is restored after suspending (bnc#1012382).\n\n - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717).\n\n - i2c: imx: Use correct function to write to register (bsc#1031717).\n\n - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382).\n\n - i2c: riic: correctly finish transfers (bnc#1012382).\n\n - i2c: riic: fix restart condition (git-fixes).\n\n - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n\n - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n\n - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350).\n\n - ib/core: Namespace is mandatory input for address resolution (bsc#1022595 FATE#322350).\n\n - ib/ipoib: Change list_del to list_del_init in the tx object (bnc#1012382).\n\n - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350).\n\n - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp (bsc#1022595 FATE#322350).\n\n - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350).\n\n - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion initialization (bsc#1022595 FATE#322350).\n\n - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172 FATE#320226).\n\n - ibmvnic: Add netdev_dbg output for debugging (fate#323285).\n\n - ibmvnic: Add vnic client data to login buffer (bsc#1069942).\n\n - ibmvnic: Convert vnic server reported statistics to cpu endian (fate#323285).\n\n - ibmvnic: Enable scatter-gather support (bsc#1066382).\n\n - ibmvnic: Enable TSO support (bsc#1066382).\n\n - ibmvnic: Feature implementation of Vital Product Data (VPD) for the ibmvnic driver (bsc#1069942).\n\n - ibmvnic: Fix calculation of number of TX header descriptors (bsc#1066382).\n\n - ibmvnic: fix dma_mapping_error call (bsc#1069942).\n\n - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382).\n\n - ibmvnic: Implement .get_channels (fate#323285).\n\n - ibmvnic: Implement .get_ringparam (fate#323285).\n\n - ibmvnic: Implement per-queue statistics reporting (fate#323285).\n\n - ibmvnic: Let users change net device features (bsc#1066382).\n\n - ibmvnic: Update reset infrastructure to support tunable parameters (bsc#1066382).\n\n - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595 FATE#322350).\n\n - ib/srpt: Do not accept invalid initiator port names (bnc#1012382).\n\n - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).\n\n - ib/uverbs: Fix NULL pointer dereference during device removal (bsc#1022595 FATE#322350).\n\n - igb: close/suspend race in netif_device_detach (bnc#1012382).\n\n - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382).\n\n - igb: reset the PHY before reading the PHY ID (bnc#1012382).\n\n - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n\n - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n\n - iio: adc: xilinx: Fix error handling (bnc#1012382).\n\n - iio: dummy: events: Add missing break (bsc#1031717).\n\n - iio: light: fix improper return value (bnc#1012382).\n\n - iio: trigger: free trigger resource correctly (bnc#1012382).\n\n - ima: do not update security.ima if appraisal status is not INTEGRITY_PASS (bnc#1012382).\n\n - input: ar1021_i2c - fix too long name in driver's device table (bsc#1031717).\n\n - input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree (bsc#1031717).\n\n - input: elan_i2c - add ELAN060C to the ACPI table (bnc#1012382).\n\n - input: elan_i2c - add ELAN0611 to the ACPI table (bnc#1012382).\n\n - input: gtco - fix potential out-of-bound access (bnc#1012382).\n\n - input: mpr121 - handle multiple bits change of status register (bnc#1012382).\n\n - input: mpr121 - set missing event capability (bnc#1012382).\n\n - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen (bsc#1031717).\n\n - input: twl4030-pwrbutton - use correct device for irq request (bsc#1031717).\n\n - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717).\n\n - input: uinput - avoid crash when sending FF request to device going away (bsc#1031717).\n\n - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382).\n\n - iommu/arm-smmu-v3: Clear prior settings when updating STEs (bnc#1012382).\n\n - iommu/vt-d: Do not register bus-notifier under dmar_global_lock (bsc#1069793).\n\n - ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err (bnc#1012382).\n\n - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header (bnc#1012382).\n\n - ipip: only increase err_count for some certain type icmp in ipip_err (bnc#1012382).\n\n - ipmi: fix unsigned long underflow (bnc#1012382).\n\n - ipmi: Pick up slave address from SMBIOS on an ACPI device (bsc#1070006).\n\n - ipmi: Prefer ACPI system interfaces over SMBIOS ones (bsc#1070006).\n\n - ipmi_si: Clean up printks (bsc#1070006).\n\n - ipmi_si: fix memory leak on new_smi (bsc#1070006).\n\n - ipsec: do not ignore crypto err in ah4 input (bnc#1012382).\n\n - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382).\n\n - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER (bnc#1012382).\n\n - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365).\n\n - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382).\n\n - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717).\n\n - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382).\n\n - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382).\n\n - isofs: fix timestamps beyond 2027 (bnc#1012382).\n\n - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).\n\n - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW down (bsc#1031717).\n\n - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to fw (bsc#1031717).\n\n - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382).\n\n - iwlwifi: split the regulatory rules when the bandwidth flags require it (bsc#1031717).\n\n - ixgbe: add mask for 64 RSS queues (bnc#1012382).\n\n - ixgbe: do not disable FEC from the driver (bnc#1012382).\n\n - ixgbe: fix AER error handling (bnc#1012382).\n\n - ixgbe: Fix skb list corruption on Power systems (bnc#1012382).\n\n - ixgbe: handle close/suspend race with netif_device_detach/present (bnc#1012382).\n\n - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382).\n\n - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n\n - kABI fix for 4.4.99 net changes (stable-4.4.99).\n\n - kABI: protect struct l2tp_tunnel (kabi).\n\n - kABI: protect struct regulator_dev (kabi).\n\n - kABI: protect structs rt_rq+root_domain (kabi).\n\n - kABI: protect typedef rds_rdma_cookie_t (kabi).\n\n - kernel/sysctl.c: remove duplicate UINT_MAX check on do_proc_douintvec_conv() (bsc#1066470).\n\n - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516).\n\n - keys: do not let add_key() update an uninstantiated key (bnc#1012382).\n\n - keys: do not revoke uninstantiated key in request_key_auth_new() (bsc#1031717).\n\n - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382).\n\n - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717).\n\n - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717).\n\n - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717).\n\n - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2] (bnc#1012382).\n\n - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382).\n\n - keys: Fix race between updating and finding a negative key (bnc#1012382).\n\n - keys: return full count in keyring_read() if buffer is too small (bnc#1012382).\n\n - keys: trusted: fix writing past end of buffer in trusted_read() (bnc#1012382).\n\n - keys: trusted: sanitize all key material (bnc#1012382).\n\n - KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit (bnc#1012382).\n\n - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state (bnc#1012382).\n\n - KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter (bnc#1012382).\n\n - kvm: SVM: obey guest PAT (bnc#1012382).\n\n - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382).\n\n - l2tp: check ps->sock before running pppol2tp_session_ioctl() (bnc#1012382).\n\n - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382).\n\n - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382).\n\n - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).\n\n - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382).\n\n - libnvdimm, namespace: fix label initialization to use valid seq numbers (bnc#1012382).\n\n - libnvdimm, namespace: make 'resource' attribute only readable by root (bnc#1012382).\n\n - libnvdimm, pfn: make 'resource' attribute only readable by root (FATE#319858).\n\n - lib/ratelimit.c: use deferred printk() version (bsc#979928).\n\n - locking/lockdep: Add nest_lock integrity test (bnc#1012382).\n\n - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717).\n\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472).\n\n - mac80211: do not send SMPS action frame in AP mode when not needed (bsc#1031717).\n\n - mac80211: Fix addition of mesh configuration element (git-fixes).\n\n - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).\n\n - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717).\n\n - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382).\n\n - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382).\n\n - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717).\n\n - mac80211: Remove invalid flag operations in mesh TSF synchronization (bnc#1012382).\n\n - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717).\n\n - mac80211: Remove unused 'i' variable (bsc#1031717).\n\n - mac80211: Remove unused 'len' variable (bsc#1031717).\n\n - mac80211: Remove unused 'rates_idx' variable (bsc#1031717).\n\n - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717).\n\n - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717).\n\n - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382).\n\n - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717).\n\n - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717).\n\n - mac80211: use constant time comparison with keys (bsc#1066471).\n\n - md/linear: shutup lockdep warnning (bnc#1012382).\n\n - media: au0828: fix RC_CORE dependency (bsc#1031717).\n\n - media: Do not do DMA on stack for firmware upload in the AS102 driver (bnc#1012382).\n\n - media: em28xx: calculate left volume level correctly (bsc#1031717).\n\n - media: mceusb: fix memory leaks in error path (bsc#1031717).\n\n - media: rc: check for integer overflow (bnc#1012382).\n\n - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382).\n\n - megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do not support it (bsc#1027301).\n\n - mei: return error on notification request to a disconnected client (bnc#1012382).\n\n - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382).\n\n - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped (bnc#1012382).\n\n - mips: AR7: Defer registration of GPIO (bnc#1012382).\n\n - mips: AR7: Ensure that serial ports are properly set up (bnc#1012382).\n\n - mips: BCM47XX: Fix LED inversion for WRT54GSv1 (bnc#1012382).\n\n - mips: End asm function prologue macros with .insn (bnc#1012382).\n\n - mips: Fix an n32 core file generation regset support regression (bnc#1012382).\n\n - mips: Fix CM region target definitions (bnc#1012382).\n\n - mips: Fix race on setting and getting cpu_online_mask (bnc#1012382).\n\n - mips: init: Ensure bootmem does not corrupt reserved memory (bnc#1012382).\n\n - mips: init: Ensure reserved memory regions are not added to bootmem (bnc#1012382).\n\n - mips: math-emu: Remove pr_err() calls from fpu_emu() (bnc#1012382).\n\n - mips: microMIPS: Fix incorrect mask in insn_table_MM (bnc#1012382).\n\n - mips: Netlogic: Exclude netlogic,xlp-pic code from XLR builds (bnc#1012382).\n\n - mips: ralink: Fix MT7628 pinmux (bnc#1012382).\n\n - mips: ralink: Fix typo in mt7628 pinmux function (bnc#1012382).\n\n - mips: SMP: Fix deadlock & online race (bnc#1012382).\n\n - mips: SMP: Use a completion event to signal CPU up (bnc#1012382).\n\n - misc: panel: properly restore atomic counter on error path (bnc#1012382).\n\n - mmc: block: return error on failed mmc_blk_get() (bsc#1031717).\n\n - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717).\n\n - mmc: dw_mmc: rockchip: Set the drive phase properly (bsc#1031717).\n\n - mm: check the return value of lookup_page_ext for all call sites (bnc#1068982).\n\n - mmc: host: omap_hsmmc: avoid possible overflow of timeout value (bsc#1031717).\n\n - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() (bsc#1031717).\n\n - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717).\n\n - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382).\n\n - mmc: sd: limit SD card power limit according to cards capabilities (bsc#1031717).\n\n - mm, hwpoison: fixup 'mm: check the return value of lookup_page_ext for all call sites' (bnc#1012382).\n\n - mm/madvise.c: fix madvise() infinite loop under special circumstances (bnc#1070964).\n\n - mm/page_alloc.c: broken deferred calculation (bnc#1068980).\n\n - mm, page_alloc: fix potential false positive in\n __zone_watermark_ok (Git-fixes, bsc#1068978).\n\n - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982).\n\n - mm/page_owner: avoid NULL pointer dereference (bnc#1068982).\n\n - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382).\n\n - net: 3com: typhoon: typhoon_init_one: fix incorrect return values (bnc#1012382).\n\n - net: 3com: typhoon: typhoon_init_one: make return values more specific (bnc#1012382).\n\n - net/9p: Switch to wait_event_killable() (bnc#1012382).\n\n - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382).\n\n - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382).\n\n - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).\n\n - net: dsa: select NET_SWITCHDEV (bnc#1012382).\n\n - net: emac: Fix napi poll list corruption (bnc#1012382).\n\n - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed (bnc#1012382).\n\n - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value (bnc#1012382).\n\n - netfilter: nf_tables: fix oob access (bnc#1012382).\n\n - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family (bnc#1012382).\n\n - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382).\n\n - net: ibm: ibmvnic: constify vio_device_id (fate#323285).\n\n - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs (bnc#1012382).\n\n - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (bnc#1012382).\n\n - net: mvpp2: release reference to txq_cpu[] entry after unmapping (bnc#1012382).\n\n - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382).\n\n - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382).\n\n - net: Set sk_prot_creator when cloning sockets to the right proto (bnc#1012382).\n\n - net/unix: do not show information about sockets from other namespaces (bnc#1012382).\n\n - nfc: fix device-allocation error return (bnc#1012382).\n\n - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382).\n\n - nfsd: deal with revoked delegations appropriately (bnc#1012382).\n\n - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261).\n\n - nfs: Fix typo in nomigration mount option (bnc#1012382).\n\n - nfs: Fix ugly referral attributes (bnc#1012382).\n\n - nilfs2: fix race condition that causes file system corruption (bnc#1012382).\n\n - nl80211: Define policy for packet pattern attributes (bnc#1012382).\n\n - nvme: Fix memory order on async queue deletion (bnc#1012382).\n\n - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (bnc#1012382).\n\n - ocfs2: should wait dio before inode lock in ocfs2_setattr() (bnc#1012382).\n\n - packet: avoid panic in packet_getsockopt() (bnc#1012382).\n\n - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382).\n\n - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382).\n\n - parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels (bnc#1012382).\n\n - parisc: Fix validity check of pointer size argument in new CAS implementation (bnc#1012382).\n\n - pci: Apply _HPX settings only to relevant devices (bnc#1012382).\n\n - pci: mvebu: Handle changes to the bridge windows while enabled (bnc#1012382).\n\n - percpu: make this_cpu_generic_read() atomic w.r.t.\n interrupts (bnc#1012382).\n\n - perf tools: Fix build failure on perl script context (bnc#1012382).\n\n - perf tools: Only increase index if perf_evsel__new_idx() succeeds (bnc#1012382).\n\n - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes d2878d642a4ed).\n\n - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382).\n\n - pkcs#7: fix uninitialized boolean 'want' (bnc#1012382).\n\n - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set (bnc#1012382).\n\n - platform/x86: acer-wmi: setup accelerometer when ACPI device was found (bsc#1031717).\n\n - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382).\n\n - platform/x86: hp-wmi: Fix detection for dock and tablet mode (bnc#1012382).\n\n - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state (bnc#1012382).\n\n - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382).\n\n - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill() (bsc#1031717).\n\n - pm / OPP: Add missing of_node_put(np) (bnc#1012382).\n\n - power: bq27xxx_battery: Fix bq27541 AveragePower register address (bsc#1031717).\n\n - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717).\n\n - powercap: Fix an error code in powercap_register_zone() (bsc#1031717).\n\n - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717).\n\n - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code (bsc#1066223).\n\n - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223).\n\n - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4 (bnc#1012382).\n\n - powerpc: Correct instruction code for xxlor instruction (bsc#1066223).\n\n - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC (bsc#1066223).\n\n - powerpc/mm: Fix check of multiple 16G pages from device tree (bsc#1066223).\n\n - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223).\n\n - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config (bsc#1010201, bsc#1066223).\n\n - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223).\n\n - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223).\n\n - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max() (bsc#1066223).\n\n - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223).\n\n - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8 (bsc#1066223).\n\n - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223).\n\n - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context (bsc#1066223).\n\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888).\n\n - powerpc/signal: Properly handle return value from uprobe_deny_signal() (bsc#1066223).\n\n - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223).\n\n - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520 ('bsc#1069270').\n\n - power: supply: isp1704: Fix unchecked return value of devm_kzalloc (bsc#1031717).\n\n - power: supply: lp8788: prevent out of bounds array access (bsc#1031717).\n\n - power_supply: tps65217-charger: Fix NULL deref during property export (bsc#1031717).\n\n - ppp: fix race in ppp device destruction (bnc#1012382).\n\n - printk/console: Always disable boot consoles that use init memory before it is freed (bsc#1063026).\n\n - printk/console: Enhance the check for consoles using init memory (bsc#1063026).\n\n - printk: include <asm/sections.h> instead of <asm-generic/sections.h> (bsc#1063026).\n\n - printk: only unregister boot consoles when necessary (bsc#1063026).\n\n - quota: Check for register_shrinker() failure (bsc#1012829).\n\n - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717).\n\n - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382).\n\n - rcu: Allow for page faults in NMI handlers (bnc#1012382).\n\n - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350).\n\n - rds: RDMA: return appropriate error on rdma map failures (bnc#1012382).\n\n - regulator: core: Limit propagation of parent voltage count and list (bsc#1070145).\n\n - regulator: fan53555: fix I2C device ids (bnc#1012382).\n\n - Revert 'bpf: one perf event close won't free bpf program attached by another perf event' (kabi).\n\n - Revert 'bsg-lib: do not free job in bsg_prepare_job' (bnc#1012382).\n\n - Revert 'crypto: xts - Add ECB dependency' (bnc#1012382).\n\n - Revert 'drm: bridge: add DT bindings for TI ths8135' (bnc#1012382).\n\n - Revert 'keys: Fix race between updating and finding a negative key' (kabi).\n\n - Revert 'phy: increase size of MII_BUS_ID_SIZE and bus_id' (kabi).\n\n - Revert 'sctp: do not peel off an assoc from one netns to another one' (bnc#1012382).\n\n - Revert 'tty: goldfish: Fix a parameter of a call to free_irq' (bnc#1012382).\n\n - Revert 'uapi: fix linux/rds.h userspace compilation errors' (bnc#1012382).\n\n - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to kernel-binary-base (bsc#1060333).\n\n - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products (bsc#1067494)\n\n - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size (bsc#1056979).\n\n - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717).\n\n - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks (bsc#1031717).\n\n - rtc: ds1374: wdt: Fix stop/start ioctl always returning\n -EINVAL (bsc#1031717).\n\n - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).\n\n - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare (bsc#1031717).\n\n - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382).\n\n - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382).\n\n - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382).\n\n - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717).\n\n - s390/dasd: check for device error pointer within state change interrupts (bnc#1012382).\n\n - s390/disassembler: add missing end marker for e7 table (bnc#1012382).\n\n - s390/disassembler: correct disassembly lines alignment (bsc#1070825).\n\n - s390/disassembler: increase show_code buffer size (bnc#1012382).\n\n - s390: fix transactional execution control register handling (bnc#1012382).\n\n - s390/kbuild: enable modversions for symbols exported from asm (bnc#1012382).\n\n - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382).\n\n - s390/runtime instrumention: fix possible memory corruption (bnc#1012382).\n\n - sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task() (bnc#1012382).\n\n - sched: Make resched_cpu() unconditional (bnc#1012382).\n\n - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382).\n\n - scsi: aacraid: Process Error for response I/O (bnc#1012382).\n\n - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941).\n\n - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).\n\n - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213).\n\n - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003).\n\n - scsi: lpfc: Add missing memory barrier (bnc#1012382).\n\n - scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload (bnc#1012382).\n\n - scsi: lpfc: Correct host name in symbolic_name field (bnc#1012382).\n\n - scsi: lpfc: Correct issue leading to oops during link reset (bnc#1012382).\n\n - scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort (bnc#1012382).\n\n - scsi: reset wait for IO completion (bsc#996376).\n\n - scsi: scsi_devinfo: fixup string compare (bsc#1062941).\n updated patches.fixes/scsi_devinfo-fixup-string-compare.patch to the version merged upstream.\n\n - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941).\n\n - scsi: scsi_dh_emc: return success in clariion_std_inquiry() (bnc#1012382).\n\n - scsi: scsi_transport_fc: Also check for NOTPRESENT in fc_remote_port_add() (bsc#1037890).\n\n - scsi: scsi_transport_fc: set scsi_target_id upon rescan (bsc#1058135).\n\n - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382).\n\n - scsi: ufs: add capability to keep auto bkops always enabled (bnc#1012382).\n\n - scsi: ufs-qcom: Fix module autoload (bnc#1012382).\n\n - scsi: virtio_scsi: let host do exception handling (bsc#1060682).\n\n - scsi: zfcp: fix erp_action use-before-initialize in REC action trace (bnc#1012382).\n\n - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect (bnc#1012382).\n\n - sctp: do not peel off an assoc from one netns to another one (bnc#1012382).\n\n - sctp: potential read out of bounds in sctp_ulpevent_type_enabled() (bnc#1012382).\n\n - sctp: reset owner sk for data chunks on out queues when migrating a sock (bnc#1012382).\n\n - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382).\n\n - selftests: firmware: add empty string and async tests (bnc#1012382).\n\n - selftests: firmware: send expected errors to /dev/null (bnc#1012382).\n\n - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() (bsc#1031717).\n\n - serial: 8250_uniphier: fix serial port index in private data (bsc#1031717).\n\n - serial: Fix serial console on SNI RM400 machines (bsc#1031717).\n\n - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382).\n\n - serial: Remove unused port type (bsc#1066045).\n\n - serial: sh-sci: Fix register offsets for the IRDA serial port (bnc#1012382).\n\n - slub: do not merge cache if slub_debug contains a never-merge flag (bnc#1012382).\n\n - smb3: parsing for new snapshot timestamp mount parm (FATE#324404). New mount option 'snapshot=<time>' to allow mounting an earlier version of the remote volume (if such a snapshot exists on the server). Note that eventually specifying a snapshot time of 1 will allow the user to mount the oldest snapshot. A subsequent patch add the processing for that and another for actually specifying the 'time warp' create context on SMB2/SMB3 open. Check to make sure SMB2 negotiated, and ensure that we use a different tcon if mount same share twice but with different snaphshot times\n\n - sparc64: Migrate hvcons irq to panicked cpu (bnc#1012382).\n\n - spi: SPI_FSL_DSPI should depend on HAS_DMA (bnc#1012382).\n\n - spi: uapi: spidev: add missing ioctl header (bnc#1012382).\n\n - staging: iio: cdc: fix improper return value (bnc#1012382).\n\n - staging: lustre: hsm: stack overrun in hai_dump_data_field (bnc#1012382).\n\n - staging: lustre: llite: do not invoke direct_IO for the EOF case (bnc#1012382).\n\n - staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382).\n\n - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382).\n\n - staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382).\n\n - staging: rtl8712: fixed little endian problem (bnc#1012382).\n\n - staging: rtl8712u: Fix endian settings for structs describing network packets (bnc#1012382).\n\n - sunrpc: Fix tracepoint storage issues with svc_recv and svc_rqst_status (bnc#1012382).\n\n - target: fix ALUA state file path truncation (bsc#1071231).\n\n - target: Fix node_acl demo-mode + uncached dynamic shutdown regression (bnc#1012382).\n\n - target: fix PR state file path truncation (bsc#1071231).\n\n - target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382).\n\n - target/iscsi: Fix iSCSI task reassignment handling (bnc#1012382).\n\n - target/iscsi: Fix unsolicited data seq_end_offset calculation (bnc#1012382).\n\n - tcp/dccp: fix ireq->opt races (bnc#1012382).\n\n - tcp/dccp: fix lockdep splat in inet_csk_route_req() (bnc#1012382).\n\n - tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382).\n\n - tcp: do not mangle skb->cb[] in tcp_make_synack() (bnc#1012382).\n\n - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).\n\n - test: firmware_class: report errors properly on failure (bnc#1012382).\n\n - timer: Prevent timer value 0 for MWAITX (bsc#1065717).\n\n - tipc: fix link attribute propagation bug (bnc#1012382).\n\n - tipc: use only positive error codes in messages (bnc#1012382).\n\n - tools: firmware: check for distro fallback udev cancel rule (bnc#1012382).\n\n - tracing/samples: Fix creation and deletion of simple_thread_fn creation (bnc#1012382).\n\n - tun: allow positive return values on dev_get_valid_name() call (bnc#1012382).\n\n - tun: bail out from tun_get_user() if the skb is empty (bnc#1012382).\n\n - tun: call dev_get_valid_name() before register_netdevice() (bnc#1012382).\n\n - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).\n\n - uapi: fix linux/mroute6.h userspace compilation errors (bnc#1012382).\n\n - uapi: fix linux/rds.h userspace compilation error (bnc#1012382).\n\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n\n - udpv6: Fix the checksum computation when HW checksum does not apply (bnc#1012382).\n\n - usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382).\n\n - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382).\n\n - usb: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (bnc#1012382).\n\n - usb: devio: Revert 'USB: devio: Do not corrupt user memory' (bnc#1012382).\n\n - usb: dummy-hcd: Fix deadlock caused by disconnect detection (bnc#1012382).\n\n - usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options (bnc#1012382).\n\n - usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382).\n\n - usb: hub: Allow reset retry for USB2 devices on connect bounce (bnc#1012382).\n\n - usb: musb: Check for host-mode using is_host_active() on reset interrupt (bnc#1012382).\n\n - usb: musb: sunxi: Explicitly release USB PHY on exit (bnc#1012382).\n\n - usb: quirks: add quirk for WORLDE MINI MIDI keyboard (bnc#1012382).\n\n - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet (bnc#1012382).\n\n - usb: serial: console: fix use-after-free after failed setup (bnc#1012382).\n\n - usb: serial: cp210x: add support for ELV TFD500 (bnc#1012382).\n\n - usb: serial: ftdi_sio: add id for Cypress WICED dev board (bnc#1012382).\n\n - usb: serial: garmin_gps: fix I/O after failed probe and remove (bnc#1012382).\n\n - usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382).\n\n - usb: serial: metro-usb: add MS7820 device id (bnc#1012382).\n\n - usb: serial: option: add support for TP-Link LTE module (bnc#1012382).\n\n - usb: serial: qcserial: add Dell DW5818, DW5819 (bnc#1012382).\n\n - usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update (bnc#1012382).\n\n - usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382).\n\n - usb: usbtest: fix NULL pointer dereference (bnc#1012382).\n\n - usb: xhci: Handle error condition in xhci_stop_device() (bnc#1012382).\n\n - vfs: expedite unmount (bsc#1024412).\n\n - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382).\n\n - video: udlfb: Fix read EDID timeout (bsc#1031717).\n\n - vlan: fix a use-after-free in vlan_device_event() (bnc#1012382).\n\n - vsock: use new wait API for vsock_stream_sendmsg() (bnc#1012382).\n\n - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit (bnc#1012382).\n\n - watchdog: kempld: fix gcc-4.3 build (bnc#1012382).\n\n - workqueue: Fix NULL pointer dereference (bnc#1012382).\n\n - workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382).\n\n - x86/alternatives: Fix alt_max_short macro to really be a max() (bnc#1012382).\n\n - x86/decoder: Add new TEST instruction pattern (bnc#1012382).\n\n - x86/MCE/AMD: Always give panic severity for UC errors in kernel context (git-fixes bf80bbd7dcf5).\n\n - x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032).\n\n - x86/microcode/intel: Disable late loading on model 79 (bnc#1012382).\n\n - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context (bnc#1012382).\n\n - x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382).\n\n - xen: do not print error message in case of missing Xenstore entry (bnc#1012382).\n\n - xen/events: events_fifo: Do not use (get,put)_cpu() in xen_evtchn_fifo_init() (bnc#1065600).\n\n - xen: fix booting ballooned down hvm guest (bnc#1065600).\n\n - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() (bnc#1012382).\n\n - xen/manage: correct return value check on xenbus_scanf() (bnc#1012382).\n\n - xen-netback: fix error handling output (bnc#1065600).\n\n - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).\n\n - xen: xenbus driver must not accept invalid transaction ids (bnc#1012382).\n\n - zd1211rw: fix NULL-deref at probe (bsc#1031717).", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-12-18T00:00:00", "type": "nessus", "title": "openSUSE Security Update : the Linux Kernel (openSUSE-2017-1390) (Dirty COW)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000405", "CVE-2017-1000410", "CVE-2017-11600", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16528", "CVE-2017-16536", "CVE-2017-16537", "CVE-2017-16645", "CVE-2017-16646", "CVE-2017-16939", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-7482", "CVE-2017-8824"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:kernel-debug", "p-cpe:/a:novell:opensuse:kernel-debug-base", "p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debugsource", "p-cpe:/a:novell:opensuse:kernel-debug-devel", "p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default", "p-cpe:/a:novell:opensuse:kernel-default-base", "p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debugsource", "p-cpe:/a:novell:opensuse:kernel-default-devel", "p-cpe:/a:novell:opensuse:kernel-devel", "p-cpe:/a:novell:opensuse:kernel-docs-html", "p-cpe:/a:novell:opensuse:kernel-docs-pdf", "p-cpe:/a:novell:opensuse:kernel-macros", "p-cpe:/a:novell:opensuse:kernel-obs-build", "p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource", "p-cpe:/a:novell:opensuse:kernel-obs-qa", "p-cpe:/a:novell:opensuse:kernel-source", "p-cpe:/a:novell:opensuse:kernel-source-vanilla", "p-cpe:/a:novell:opensuse:kernel-syms", "p-cpe:/a:novell:opensuse:kernel-vanilla", "p-cpe:/a:novell:opensuse:kernel-vanilla-base", "p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel", "cpe:/o:novell:opensuse:42.2"], "id": "OPENSUSE-2017-1390.NASL", "href": "https://www.tenable.com/plugins/nessus/105344", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-1390.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105344);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-1000405\", \"CVE-2017-1000410\", \"CVE-2017-11600\", \"CVE-2017-12193\", \"CVE-2017-15115\", \"CVE-2017-16528\", \"CVE-2017-16536\", \"CVE-2017-16537\", \"CVE-2017-16645\", \"CVE-2017-16646\", \"CVE-2017-16939\", \"CVE-2017-16994\", \"CVE-2017-17448\", \"CVE-2017-17449\", \"CVE-2017-17450\", \"CVE-2017-7482\", \"CVE-2017-8824\");\n\n script_name(english:\"openSUSE Security Update : the Linux Kernel (openSUSE-2017-1390) (Dirty COW)\");\n script_summary(english:\"Check for the openSUSE-2017-1390 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE Leap 42.2 kernel was updated to 4.4.102 to receive\nvarious security and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-1000405: A bug in the THP CoW support could be\n used by local attackers to corrupt memory of other\n processes and cause them to crash (bnc#1069496).\n\n - CVE-2017-1000410: The Linux kernel was affected by an\n information leak in the processing of incoming L2CAP\n commands - ConfigRequest, and ConfigResponse messages.\n (bnc#1070535).\n\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux\n kernel did not ensure that the dir value of\n xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which\n allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified\n other impact via an XFRM_MSG_MIGRATE xfrm Netlink\n message (bnc#1050231).\n\n - CVE-2017-12193: The\n assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node\n splitting, which allowed local users to cause a denial\n of service (NULL pointer dereference and panic) via a\n crafted application, as demonstrated by the keyring key\n type, and key addition and link creation operations\n (bnc#1066192).\n\n - CVE-2017-15115: The sctp_do_peeloff function in\n net/sctp/socket.c in the Linux kernel did not check\n whether the intended netns is used in a peel-off action,\n which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system calls\n (bnc#1068671).\n\n - CVE-2017-16528: sound/core/seq_device.c in the Linux\n kernel allowed local users to cause a denial of service\n (snd_rawmidi_dev_seq_free use-after-free and system\n crash) or possibly have unspecified other impact via a\n crafted USB device (bnc#1066629).\n\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux\n kernel allowed local users to cause a denial of service\n (NULL pointer dereference and system crash) or possibly\n have unspecified other impact via a crafted USB device\n (bnc#1066606).\n\n - CVE-2017-16537: The imon_probe function in\n drivers/media/rc/imon.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer\n dereference and system crash) or possibly have\n unspecified other impact via a crafted USB device\n (bnc#1066573).\n\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function\n in drivers/input/misc/ims-pcu.c in the Linux kernel\n allowed local users to cause a denial of service\n (ims_pcu_parse_cdc_data out-of-bounds read and system\n crash) or possibly have unspecified other impact via a\n crafted USB device (bnc#1067132).\n\n - CVE-2017-16646:\n drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service\n (BUG and system crash) or possibly have unspecified\n other impact via a crafted USB device (bnc#1067105).\n\n - CVE-2017-16939: The XFRM dump policy implementation in\n net/xfrm/xfrm_user.c in the Linux kernel allowed local\n users to gain privileges or cause a denial of service\n (use-after-free) via a crafted SO_RCVBUF setsockopt\n system call in conjunction with XFRM_MSG_GETPOLICY\n Netlink messages (bnc#1069702).\n\n - CVE-2017-16994: The walk_hugetlb_range function in\n mm/pagewalk.c in the Linux kernel mishandled holes in\n hugetlb ranges, which allowed local users to obtain\n sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call\n (bnc#1069996).\n\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in\n the Linux kernel did not require the CAP_NET_ADMIN\n capability for new, get, and del operations, which\n allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data\n structure is shared across all net namespaces\n (bnc#1071693).\n\n - CVE-2017-17449: The __netlink_deliver_tap_skb function\n in net/netlink/af_netlink.c in the Linux kernel did not\n restrict observations of Netlink messages to a single\n net namespace, which allowed local users to obtain\n sensitive information by leveraging the CAP_NET_ADMIN\n capability to sniff an nlmon interface for all Netlink\n activity on the system (bnc#1071694).\n\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux\n kernel did not require the CAP_NET_ADMIN capability for\n add_callback and remove_callback operations, which\n allowed local users to bypass intended access\n restrictions because the xt_osf_fingers data structure\n is shared across all net namespaces (bnc#1071695).\n\n - CVE-2017-7482: Fixed an overflow when decoding a krb5\n principal. (bnc#1046107).\n\n - CVE-2017-8824: The dccp_disconnect function in\n net/dccp/proto.c in the Linux kernel allowed local users\n to gain privileges or cause a denial of service\n (use-after-free) via an AF_UNSPEC connect system call\n during the DCCP_LISTEN state (bnc#1070771).\n\nThe following non-security bugs were fixed :\n\n - adm80211: return an error if adm8211_alloc_rings() fails\n (bsc#1031717).\n\n - adv7604: Initialize drive strength to default when using\n DT (bnc#1012382).\n\n - af_netlink: ensure that NLMSG_DONE never fails in dumps\n (bnc#1012382).\n\n - alsa: caiaq: Fix stray URB at probe error path\n (bnc#1012382).\n\n - alsa: hda: Add Raven PCI ID (bnc#1012382).\n\n - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on\n HDA_FIXUP_ACT_PROBE (bnc#1012382).\n\n - alsa: hda/ca0132 - Fix memory leak at error path\n (bsc#1031717).\n\n - alsa: hda - fix headset mic problem for Dell machines\n with alc236 (bnc#1012382).\n\n - alsa: hda - No loopback on ALC299 codec (git-fixes).\n\n - alsa: hda/realtek: Add headset mic support for Intel NUC\n Skull Canyon (bsc#1031717).\n\n - alsa: hda/realtek - Add new codec ID ALC299\n (bnc#1012382).\n\n - alsa: hda/realtek - Add support for ALC236/ALC3204\n (bnc#1012382).\n\n - alsa: hda/realtek - Fix ALC700 family no sound issue\n (bsc#1031717).\n\n - alsa: hda: Remove superfluous '-' added by printk\n conversion (bnc#1012382).\n\n - alsa: line6: Fix leftover URB at error-path during probe\n (bnc#1012382).\n\n - alsa: pcm: update tstamp only if audio_tstamp changed\n (bsc#1031717).\n\n - alsa: seq: Avoid invalid lockdep class warning\n (bsc#1031717).\n\n - alsa: seq: Enable 'use' locking in all configurations\n (bnc#1012382).\n\n - alsa: seq: Fix copy_from_user() call inside lock\n (bnc#1012382).\n\n - alsa: seq: Fix nested rwsem annotation for lockdep splat\n (bnc#1012382).\n\n - alsa: seq: Fix OSS sysex delivery in OSS emulation\n (bnc#1012382).\n\n - alsa: timer: Add missing mutex lock for compat ioctls\n (bnc#1012382).\n\n - alsa: timer: Remove kernel warning at compat ioctl error\n paths (bsc#1031717).\n\n - alsa: usb-audio: Add native DSD support for Pro-Ject Pre\n Box S2 Digital (bnc#1012382).\n\n - alsa: usb-audio: Add sanity checks in v2 clock parsers\n (bsc#1031717).\n\n - alsa: usb-audio: Add sanity checks to FE parser\n (bsc#1031717).\n\n - alsa: usb-audio: Fix potential out-of-bound access at\n parsing SU (bsc#1031717).\n\n - alsa: usb-audio: Kill stray URB at exiting\n (bnc#1012382).\n\n - alsa: usb-audio: uac1: Invalidate ctl on interrupt\n (bsc#1031717).\n\n - alsa: vx: Do not try to update capture stream before\n running (bnc#1012382).\n\n - alsa: vx: Fix possible transfer overflow (bnc#1012382).\n\n - Apply generic ppc build fixes to vanilla (bsc#1070805)\n\n - arm64: dts: NS2: reserve memory for Nitro firmware\n (bnc#1012382).\n\n - arm64: ensure __dump_instr() checks addr_limit\n (bnc#1012382).\n\n - arm64: fix dump_instr when PAN and UAO are in use\n (bnc#1012382).\n\n - arm: 8715/1: add a private asm/unaligned.h\n (bnc#1012382).\n\n - arm: 8720/1: ensure dump_instr() checks addr_limit\n (bnc#1012382).\n\n - arm: 8721/1: mm: dump: check hardware RO bit for LPAE\n (bnc#1012382).\n\n - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for\n LPAE (bnc#1012382).\n\n - arm: crypto: reduce priority of bit-sliced AES cipher\n (bnc#1012382).\n\n - arm: dts: Fix am335x and dm814x scm syscon to probe\n children (bnc#1012382).\n\n - arm: dts: Fix compatible for ti81xx uarts for 8250\n (bnc#1012382).\n\n - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).\n\n - arm: dts: mvebu: pl310-cache disable double-linefill\n (bnc#1012382).\n\n - arm: OMAP2+: Fix init for multiple quirks for the same\n SoC (bnc#1012382).\n\n - arm: omap2plus_defconfig: Fix probe errors on UARTs 5\n and 6 (bnc#1012382).\n\n - arm: pxa: Do not rely on public mmc header to include\n leds.h (bnc#1012382).\n\n - asm/sections: add helpers to check for section data\n (bsc#1063026).\n\n - asoc: adau17x1: Workaround for noise bug in ADC\n (bnc#1012382).\n\n - asoc: cs42l56: Fix reset GPIO name in example DT binding\n (bsc#1031717).\n\n - asoc: davinci-mcasp: Fix an error handling path in\n 'davinci_mcasp_probe()' (bsc#1031717).\n\n - asoc: rsnd: do not double free kctrl (bnc#1012382).\n\n - asoc: samsung: Fix possible double iounmap on s3c24xx\n driver probe failure (bsc#1031717).\n\n - asoc: wm_adsp: Do not overrun firmware file buffer when\n reading region data (bnc#1012382).\n\n - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).\n\n - ata: fixes kernel crash while tracing\n ata_eh_link_autopsy event (bnc#1012382).\n\n - ata: SATA_HIGHBANK should depend on HAS_DMA\n (bnc#1012382).\n\n - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).\n\n - ath10k: convert warning about non-existent OTP board id\n to debug message (git-fixes).\n\n - ath10k: fix a warning during channel switch with\n multiple vaps (bsc#1031717).\n\n - ath10k: fix board data fetch error message\n (bsc#1031717).\n\n - ath10k: fix diag_read to collect data for larger memory\n (bsc#1031717).\n\n - ath10k: fix incorrect txpower set by P2P_DEVICE\n interface (bnc#1012382).\n\n - ath10k: fix potential memory leak in\n ath10k_wmi_tlv_op_pull_fw_stats() (bnc#1012382).\n\n - ath10k: free cached fw bin contents when get board id\n fails (bsc#1031717).\n\n - ath10k: ignore configuring the incorrect board_id\n (bnc#1012382).\n\n - ath10k: set CTS protection VDEV param only if VDEV is up\n (bnc#1012382).\n\n - ath9k_htc: check for underflow in ath9k_htc_rx_msg()\n (bsc#1031717).\n\n - ath9k: off by one in ath9k_hw_nvram_read_array()\n (bsc#1031717).\n\n - autofs: do not fail mount for transient error\n (bsc#1065180).\n\n - backlight: adp5520: Fix error handling in\n adp5520_bl_probe() (bnc#1012382).\n\n - backlight: lcd: Fix race condition during register\n (bnc#1012382).\n\n - bcache: check ca->alloc_thread initialized before wake\n up it (bnc#1012382).\n\n - blacklist 0278b34bf15f spi: spidev_test: Fix buffer\n overflow in unescape() This is a binary built from\n Documentation and the build logs do not show it built\n\n - blacklist.conf: 79b63f12abcbbd2caf7064b294af648a87de07ff\n # bsc#1061756 may break existing setups\n\n - blacklist.conf: Add ath10k, mmc and rtl8192u commits\n (bsc#1031717)\n\n - blacklist.conf: Add drm/i915 blacklist (bsc#1031717)\n\n - blacklist.conf: added misc commits (bsc#1031717)\n\n - blacklist.conf: Add misc entries (bsc#1031717)\n\n - blacklist.conf: Blacklist 33e465ce7cb3 ('percpu_ref:\n allow operation mode switching operations to be called\n concurrently'). The benefits are not worth the possible\n risks eventually introduced.\n\n - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919)\n\n - blacklist.conf: blacklist not-applicable patch\n (bsc#1071231)\n\n - blacklist.conf: commit fe22cd9b7c980b8b948 ('printk:\n help pr_debug and pr_devel to optimize out arguments')\n is just a cosmetic change.\n\n - blacklist.conf: Update blacklist (bsc#1031717)\n\n - blacklist.conf: Update iwlwifi blacklist (bsc#1031717)\n\n - blacklist.conf: yet another serial entry (bsc#1031717)\n\n - block: Fix a race between blk_cleanup_queue() and\n timeout handling (FATE#319965, bsc#964944).\n\n - bluetooth: btusb: fix QCA Rome suspend/resume\n (bnc#1012382).\n\n - bnxt_en: Call firmware to approve the random VF MAC\n address (bsc#963575 FATE#320144).\n\n - bnxt_en: Do not setup MAC address in\n bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144).\n\n - bnxt_en: Fix possible corrupted NVRAM parameters from\n firmware response (bsc#963575 FATE#320144).\n\n - bnxt_en: Fix VF PCIe link speed and width logic\n (bsc#963575 FATE#320144).\n\n - bnxt_en: Re-arrange bnxt_hwrm_func_qcaps() (bsc#963575\n FATE#320144).\n\n - bnxt_en: use eth_hw_addr_random() (bsc#963575\n FATE#320144).\n\n - bonding: discard lowest hash bit for 802.3ad layer3+4\n (bnc#1012382).\n\n - bpf: one perf event close won't free bpf program\n attached by another perf event (bnc#1012382).\n\n - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382).\n\n - brcmfmac: add length check in\n brcmf_cfg80211_escan_handler() (bnc#1012382).\n\n - brcmfmac: remove setting IBSS mode when stopping AP\n (bnc#1012382).\n\n - brcmsmac: make some local variables 'static const' to\n reduce stack size (bnc#1012382).\n\n - bt8xx: fix memory leak (bnc#1012382).\n\n - btrfs: add a node counter to each of the rbtrees\n (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: add cond_resched() calls when resolving backrefs\n (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: allow backref search checks for shared extents\n (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: backref, add tracepoints for prelim_ref insertion\n and merging (bsc#974590 bsc#1030061 bsc#1022914\n bsc#1017461).\n\n - btrfs: backref, add unode_aux_to_inode_list helper\n (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: backref, cleanup __ namespace abuse (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: backref, constify some arguments (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: btrfs_check_shared should manage its own\n transaction (bsc#974590 bsc#1030061 bsc#1022914\n bsc#1017461).\n\n - btrfs: clean up extraneous computations in\n add_delayed_refs (bsc#974590 bsc#1030061 bsc#1022914\n bsc#1017461).\n\n - btrfs: constify tracepoint arguments (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: convert prelimary reference tracking to use\n rbtrees (bsc#974590 bsc#1030061 bsc#1022914\n bsc#1017461).\n\n - btrfs: fix leak and use-after-free in\n resolve_indirect_refs (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n\n - btrfs: Fix typo in may_commit_transaction Rather than\n comparing the result of the percpu comparison I was\n comparing the value of the percpu counter against 0 or\n 1.\n\n - btrfs: remove ref_tree implementation from backref.c\n (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n\n - btrfs: return the actual error value from from\n btrfs_uuid_tree_iterate (bnc#1012382).\n\n - btrfs: struct-funcs, constify readers (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n\n - bus: mbus: fix window size calculation for 4GB windows\n (bnc#1012382).\n\n - can: c_can: do not indicate triple sampling support for\n D_CAN (bnc#1012382).\n\n - can: esd_usb2: Fix can_dlc value for received RTR,\n frames (bnc#1012382).\n\n - can: gs_usb: fix busy loop if no more TX context is\n available (bnc#1012382).\n\n - can: kvaser_usb: Correct return value in printout\n (bnc#1012382).\n\n - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages\n (bnc#1012382).\n\n - can: sun4i: fix loopback mode (bnc#1012382).\n\n - can: sun4i: handle overrun in RX FIFO (bnc#1012382).\n\n - cdc_ncm: Set NTB format again after altsetting switch\n for Huawei devices (bnc#1012382).\n\n - ceph: clean up unsafe d_parent accesses in\n build_dentry_path (bnc#1012382).\n\n - ceph: unlock dangling spinlock in try_flush_caps()\n (bsc#1065639).\n\n - cgroup, net_cls: iterate the fds of only the tasks which\n are being migrated (bnc#1064926).\n\n - cifs: add build_path_from_dentry_optional_prefix()\n (fate#323482)\n\n - cifs: Add capability to decrypt big read responses\n (FATE#324404). Allow to decrypt transformed packets that\n are bigger than the big buffer size. In particular it is\n used for read responses that can only exceed the big\n buffer size.\n\n - cifs: Add capability to transform requests before\n sending (FATE#324404). This will allow us to do protocol\n specific tranformations of packets before sending to the\n server. For SMB3 it can be used to support encryption.\n\n - cifs: Add copy into pages callback for a read operation\n (FATE#324404). Since we have two different types of\n reads (pagecache and direct) we need to process such\n responses differently after decryption of a packet. The\n change allows to specify a callback that copies a read\n payload data into preallocated pages.\n\n - cifs: Add mid handle callback (FATE#324404). We need to\n process read responses differently because the data\n should go directly into preallocated pages. This can be\n done by specifying a mid handle callback.\n\n - cifs: Add soft dependencies (FATE#324404). List soft\n dependencies of cifs so that mkinitrd and dracut can\n include the required helper modules.\n\n - cifs: Add transform header handling callbacks\n (FATE#324404). We need to recognize and parse\n transformed packets in demultiplex thread to find a\n corresponsing mid and process it further.\n\n - cifs: add use_ipc flag to SMB2_ioctl() (fate#323482)\n\n - cifs: Allow to switch on encryption with seal mount\n option (FATE#324404). This allows users to inforce\n encryption for SMB3 shares if a server supports it.\n\n - cifs: check MaxPathNameComponentLength != 0 before using\n it (bnc#1012382).\n\n - cifs: Decrypt and process small encrypted packets\n (FATE#324404). Allow to decrypt transformed packets,\n find a corresponding mid and process as usual further.\n\n - cifs: do not bother with kmap on read_pages side\n (FATE#324404). just do ITER_BVEC recvmsg\n\n - cifs: Enable encryption during session setup phase\n (FATE#324404). In order to allow encryption on SMB\n connection we need to exchange a session key and\n generate encryption and decryption keys.\n\n - cifs: Encrypt SMB3 requests before sending\n (FATE#324404). This change allows to encrypt packets if\n it is required by a server for SMB sessions or tree\n connections.\n\n - cifs: fix circular locking dependency (bsc#1064701).\n\n - cifs: Fix some return values in case of error in\n 'crypt_message' (fate#324404).\n\n - cifs: Fix sparse warnings (fate#323482)\n\n - cifs: implement get_dfs_refer for SMB2+ (fate#323482)\n\n - cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482)\n\n - cifs: Make send_cancel take rqst as argument\n (FATE#324404).\n\n - cifs: Make SendReceive2() takes resp iov (FATE#324404).\n Now SendReceive2 frees the first iov and returns a\n response buffer in it that increases a code complexity.\n Simplify this by making a caller responsible for freeing\n request buffer itself and returning a response buffer in\n a separate iov.\n\n - cifs: move DFS response parsing out of SMB1 code\n (fate#323482)\n\n - cifs: no need to wank with copying and advancing iovec\n on recvmsg side either (FATE#324404).\n\n - cifs: Only select the required crypto modules\n (FATE#324404). The sha256 and cmac crypto modules are\n only needed for SMB2+, so move the select statements to\n config CIFS_SMB2. Also select CRYPTO_AES there as SMB2+\n needs it.\n\n - cifs: Prepare for encryption support (first part). Add\n decryption and encryption key generation. (FATE#324404).\n\n - cifs_readv_receive: use cifs_read_from_socket()\n (FATE#324404).\n\n - cifs: Reconnect expired SMB sessions (bnc#1012382).\n\n - cifs: remove any preceding delimiter from prefix_path\n (fate#323482)\n\n - cifs: Send RFC1001 length in a separate iov\n (FATE#324404). In order to simplify further encryption\n support we need to separate RFC1001 length and SMB2\n header when sending a request. Put the length field in\n iov[0] and the rest of the packet into following iovs.\n\n - cifs: Separate RFC1001 length processing for SMB2 read\n (FATE#324404). Allocate and initialize SMB2 read request\n without RFC1001 length field to directly call\n cifs_send_recv() rather than SendReceive2() in a read\n codepath.\n\n - cifs: Separate SMB2 header structure (FATE#324404). In\n order to support compounding and encryption we need to\n separate RFC1001 length field and SMB2 header structure\n because the protocol treats them differently. This\n change will allow to simplify parsing of such complex\n SMB2 packets further.\n\n - cifs: Separate SMB2 sync header processing\n (FATE#324404). Do not process RFC1001 length in\n smb2_hdr_assemble() because it is not a part of SMB2\n header. This allows to cleanup the code and adds a\n possibility combine several SMB2 packets into one for\n compounding.\n\n - cifs: set signing flag in SMB2+ TreeConnect if needed\n (fate#323482)\n\n - cifs: Simplify SMB2 and SMB311 dependencies\n (FATE#324404). * CIFS_SMB2 depends on CIFS, which\n depends on INET and selects NLS. So these dependencies\n do not need to be repeated for CIFS_SMB2. * CIFS_SMB311\n depends on CIFS_SMB2, which depends on INET. So this\n dependency does not need to be repeated for CIFS_SMB311.\n\n - cifs: use DFS pathnames in SMB2+ Create requests\n (fate#323482)\n\n - clk: ti: dra7-atl-clock: fix child-node lookups\n (bnc#1012382).\n\n - clk: ti: dra7-atl-clock: Fix of_node reference counting\n (bnc#1012382).\n\n - clockevents/drivers/cs5535: Improve resilience to\n spurious interrupts (bnc#1012382).\n\n - cma: fix calculation of aligned offset (VM\n Functionality, bsc#1050060).\n\n - coda: fix 'kernel memory exposure attempt' in fsync\n (bnc#1012382).\n\n - cpufreq: CPPC: add ACPI_PROCESSOR dependency\n (bnc#1012382).\n\n - crypto: shash - Fix zero-length shash ahash digest crash\n (bnc#1012382).\n\n - crypto: vmx - disable preemption to enable vsx in\n aes_ctr.c (bnc#1012382).\n\n - crypto: x86/sha1-mb - fix panic due to unaligned access\n (bnc#1012382).\n\n - crypto: xts - Add ECB dependency (bnc#1012382).\n\n - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).\n\n - cxgb4: Fix error codes in c4iw_create_cq()\n (bsc#1021424).\n\n - cxl: Fix DAR check & use REGION_ID instead of opencoding\n (bsc#1066223).\n\n - cxl: Fix leaking pid refs in some error paths\n (bsc#1066223).\n\n - cxl: Force context lock during EEH flow (bsc#1066223).\n\n - cxl: Prevent adapter reset if an active context exists\n (bsc#1066223).\n\n - cxl: Route eeh events to all drivers in\n cxl_pci_error_detected() (bsc#1066223).\n\n - direct-io: Prevent NULL pointer access in\n submit_page_section (bnc#1012382).\n\n - Disable IPMI fix patches due to regression (bsc#1071833)\n\n - Disable\n patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcou\n nting-in-bio_map_use.patch (bsc#1070767) Refresh\n patches.drivers/0004-bio-use-offset_in_page-macro.patch.\n\n - dmaengine: dmatest: warn user when dma test times out\n (bnc#1012382).\n\n - dmaengine: edma: Align the memcpy acnt array size with\n the transfer (bnc#1012382).\n\n - dmaengine: zx: set DMA_CYCLIC cap_mask bit\n (bnc#1012382).\n\n - dm bufio: fix integer overflow when limiting maximum\n cache size (bnc#1012382).\n\n - dm: fix race between dm_get_from_kobject() and\n __dm_destroy() (bnc#1012382).\n\n - drivers: dma-mapping: Do not leave an invalid\n area->pages pointer in dma_common_contiguous_remap()\n (Git-fixes, bsc#1065692).\n\n - drm/amdgpu: when dpm disabled, also need to stop/start\n vce (bnc#1012382).\n\n - drm/amdkfd: NULL dereference involving create_process()\n (bsc#1031717).\n\n - drm: Apply range restriction after color adjustment when\n allocation (bnc#1012382).\n\n - drm/armada: Fix compile fail (bnc#1012382).\n\n - drm: drm_minor_register(): Clean up debugfs on failure\n (bnc#1012382).\n\n - drm: gma500: fix logic error (bsc#1031717).\n\n - drm/i915/bxt: set min brightness from VBT (bsc#1031717).\n\n - drm/i915: Do not try indexed reads to alternate slave\n addresses (bsc#1031717).\n\n - drm/i915: fix backlight invert for non-zero minimum\n brightness (bsc#1031717).\n\n - drm/i915: Prevent zero length 'index' write\n (bsc#1031717).\n\n - drm/i915: Read timings from the correct transcoder in\n intel_crtc_mode_get() (bsc#1031717).\n\n - drm/msm: fix an integer overflow test (bnc#1012382).\n\n - drm/msm: Fix potential buffer overflow issue\n (bnc#1012382).\n\n - drm/nouveau/bsp/g92: disable by default (bnc#1012382).\n\n - drm/nouveau/gr: fallback to legacy paths during firmware\n lookup (bsc#1031717).\n\n - drm/nouveau/mmu: flush tlbs before deleting page tables\n (bnc#1012382).\n\n - drm/omap: Fix error handling path in 'omap_dmm_probe()'\n (bsc#1031717).\n\n - drm/panel: simple: Add missing panel_simple_unprepare()\n calls (bsc#1031717).\n\n - drm/sti: sti_vtg: Handle return NULL error from\n devm_ioremap_nocache (bnc#1012382).\n\n - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).\n\n - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue\n (bnc#1012382).\n\n - e1000e: Fix error path in link detection (bnc#1012382).\n\n - e1000e: Fix return value test (bnc#1012382).\n\n - e1000e: Separate signaling for link check/link up\n (bnc#1012382).\n\n - ecryptfs: fix dereference of NULL user_key_payload\n (bnc#1012382).\n\n - eCryptfs: use after free in ecryptfs_release_messaging()\n (bsc#1012829).\n\n - epoll: avoid calling ep_call_nested() from\n ep_poll_safewake() (bsc#1056427).\n\n - epoll: remove ep_call_nested() from ep_eventpoll_poll()\n (bsc#1056427).\n\n - ext4: cleanup goto next group (bsc#1066285).\n\n - ext4: do not use stripe_width if it is not set\n (bnc#1012382).\n\n - ext4: fix interaction between i_size, fallocate, and\n delalloc after a crash (bnc#1012382).\n\n - ext4: fix stripe-unaligned allocations (bnc#1012382).\n\n - ext4: in ext4_seek_(hole,data), return -ENXIO for\n negative offsets (bnc#1012382).\n\n - ext4: reduce lock contention in __ext4_new_inode\n (bsc#1066285).\n\n - extcon: palmas: Check the parent instance to prevent the\n NULL (bnc#1012382).\n\n - exynos4-is: fimc-is: Unmap region obtained by of_iomap()\n (bnc#1012382).\n\n - f2fs crypto: add missing locking for keyring_key access\n (bnc#1012382).\n\n - f2fs crypto: replace some BUG_ON()'s with error checks\n (bnc#1012382).\n\n - f2fs: do not wait for writeback in write_begin\n (bnc#1012382).\n\n - fealnx: Fix building error on MIPS (bnc#1012382).\n\n - fix a page leak in vhost_scsi_iov_to_sgl() error\n recovery (bnc#1012382).\n\n - Fix tracing sample code warning (bnc#1012382).\n\n - fix unbalanced page refcounting in bio_map_user_iov\n (bnc#1012382).\n\n - fm10k: request reset when mbx->state changes\n (bnc#1012382).\n\n - fm10k: Use smp_rmb rather than read_barrier_depends\n (bnc#1012382).\n\n - fs/9p: Compare qid.path in v9fs_test_inode\n (bsc#1012829).\n\n - fs-cache: fix dereference of NULL user_key_payload\n (bnc#1012382).\n\n - fscrypt: fix dereference of NULL user_key_payload\n (bnc#1012382).\n\n - fscrypt: lock mutex before checking for bounce page pool\n (bnc#1012382).\n\n - fscrypto: require write access to mount to set\n encryption policy (bnc#1012382).\n\n - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).\n\n - gpu: drm: mgag200: mgag200_main:- Handle error from\n pci_iomap (bnc#1012382).\n\n - hid: elo: clear BTN_LEFT mapping (bsc#1065866).\n\n - hid: usbhid: fix out-of-bounds bug (bnc#1012382).\n\n - hsi: ssi_protocol: double free in ssip_pn_xmit()\n (bsc#1031717).\n\n - i2c: at91: ensure state is restored after suspending\n (bnc#1012382).\n\n - i2c: cadance: fix ctrl/addr reg write order\n (bsc#1031717).\n\n - i2c: imx: Use correct function to write to register\n (bsc#1031717).\n\n - i2c: ismt: Separate I2C block read from SMBus block read\n (bnc#1012382).\n\n - i2c: riic: correctly finish transfers (bnc#1012382).\n\n - i2c: riic: fix restart condition (git-fixes).\n\n - i40e: Use smp_rmb rather than read_barrier_depends\n (bnc#1012382).\n\n - i40evf: Use smp_rmb rather than read_barrier_depends\n (bnc#1012382).\n\n - ib/core: Fix calculation of maximum RoCE MTU\n (bsc#1022595 FATE#322350).\n\n - ib/core: Namespace is mandatory input for address\n resolution (bsc#1022595 FATE#322350).\n\n - ib/ipoib: Change list_del to list_del_init in the tx\n object (bnc#1012382).\n\n - ib/ipoib: Clean error paths in add port (bsc#1022595\n FATE#322350).\n\n - ib/ipoib: Prevent setting negative values to\n max_nonsrq_conn_qp (bsc#1022595 FATE#322350).\n\n - ib/ipoib: Remove double pointer assigning (bsc#1022595\n FATE#322350).\n\n - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed\n completion initialization (bsc#1022595 FATE#322350).\n\n - ib/mlx5: Fix RoCE Address Path fields (bsc#966170\n FATE#320225 bsc#966172 FATE#320226).\n\n - ibmvnic: Add netdev_dbg output for debugging\n (fate#323285).\n\n - ibmvnic: Add vnic client data to login buffer\n (bsc#1069942).\n\n - ibmvnic: Convert vnic server reported statistics to cpu\n endian (fate#323285).\n\n - ibmvnic: Enable scatter-gather support (bsc#1066382).\n\n - ibmvnic: Enable TSO support (bsc#1066382).\n\n - ibmvnic: Feature implementation of Vital Product Data\n (VPD) for the ibmvnic driver (bsc#1069942).\n\n - ibmvnic: Fix calculation of number of TX header\n descriptors (bsc#1066382).\n\n - ibmvnic: fix dma_mapping_error call (bsc#1069942).\n\n - ibmvnic: Fix failover error path for non-fatal resets\n (bsc#1066382).\n\n - ibmvnic: Implement .get_channels (fate#323285).\n\n - ibmvnic: Implement .get_ringparam (fate#323285).\n\n - ibmvnic: Implement per-queue statistics reporting\n (fate#323285).\n\n - ibmvnic: Let users change net device features\n (bsc#1066382).\n\n - ibmvnic: Update reset infrastructure to support tunable\n parameters (bsc#1066382).\n\n - ib/srp: Avoid that a cable pull can trigger a kernel\n crash (bsc#1022595 FATE#322350).\n\n - ib/srpt: Do not accept invalid initiator port names\n (bnc#1012382).\n\n - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).\n\n - ib/uverbs: Fix NULL pointer dereference during device\n removal (bsc#1022595 FATE#322350).\n\n - igb: close/suspend race in netif_device_detach\n (bnc#1012382).\n\n - igb: Fix hw_dbg logging in igb_update_flash_i210\n (bnc#1012382).\n\n - igb: reset the PHY before reading the PHY ID\n (bnc#1012382).\n\n - igb: Use smp_rmb rather than read_barrier_depends\n (bnc#1012382).\n\n - igbvf: Use smp_rmb rather than read_barrier_depends\n (bnc#1012382).\n\n - iio: adc: xilinx: Fix error handling (bnc#1012382).\n\n - iio: dummy: events: Add missing break (bsc#1031717).\n\n - iio: light: fix improper return value (bnc#1012382).\n\n - iio: trigger: free trigger resource correctly\n (bnc#1012382).\n\n - ima: do not update security.ima if appraisal status is\n not INTEGRITY_PASS (bnc#1012382).\n\n - input: ar1021_i2c - fix too long name in driver's device\n table (bsc#1031717).\n\n - input: edt-ft5x06 - fix setting gain, offset, and\n threshold via device tree (bsc#1031717).\n\n - input: elan_i2c - add ELAN060C to the ACPI table\n (bnc#1012382).\n\n - input: elan_i2c - add ELAN0611 to the ACPI table\n (bnc#1012382).\n\n - input: gtco - fix potential out-of-bound access\n (bnc#1012382).\n\n - input: mpr121 - handle multiple bits change of status\n register (bnc#1012382).\n\n - input: mpr121 - set missing event capability\n (bnc#1012382).\n\n - input: ti_am335x_tsc - fix incorrect step config for 5\n wire touchscreen (bsc#1031717).\n\n - input: twl4030-pwrbutton - use correct device for irq\n request (bsc#1031717).\n\n - input: ucb1400_ts - fix suspend and resume handling\n (bsc#1031717).\n\n - input: uinput - avoid crash when sending FF request to\n device going away (bsc#1031717).\n\n - iommu/amd: Finish TLB flush in amd_iommu_unmap()\n (bnc#1012382).\n\n - iommu/arm-smmu-v3: Clear prior settings when updating\n STEs (bnc#1012382).\n\n - iommu/vt-d: Do not register bus-notifier under\n dmar_global_lock (bsc#1069793).\n\n - ip6_gre: only increase err_count for some certain type\n icmpv6 in ip6gre_err (bnc#1012382).\n\n - ip6_gre: skb_push ipv6hdr before packing the header in\n ip6gre_header (bnc#1012382).\n\n - ipip: only increase err_count for some certain type icmp\n in ipip_err (bnc#1012382).\n\n - ipmi: fix unsigned long underflow (bnc#1012382).\n\n - ipmi: Pick up slave address from SMBIOS on an ACPI\n device (bsc#1070006).\n\n - ipmi: Prefer ACPI system interfaces over SMBIOS ones\n (bsc#1070006).\n\n - ipmi_si: Clean up printks (bsc#1070006).\n\n - ipmi_si: fix memory leak on new_smi (bsc#1070006).\n\n - ipsec: do not ignore crypto err in ah4 input\n (bnc#1012382).\n\n - ipv6: flowlabel: do not leave opt->tot_len with garbage\n (bnc#1012382).\n\n - ipv6: only call ip6_route_dev_notify() once for\n NETDEV_UNREGISTER (bnc#1012382).\n\n - ipvs: make drop_entry protection effective for SIP-pe\n (bsc#1056365).\n\n - irqchip/crossbar: Fix incorrect type of local variables\n (bnc#1012382).\n\n - isa: Prevent NULL dereference in isa_bus driver\n callbacks (bsc#1031717).\n\n - iscsi-target: Fix non-immediate TMR reference leak\n (bnc#1012382).\n\n - isdn/i4l: fetch the ppp_write buffer in one shot\n (bnc#1012382).\n\n - isofs: fix timestamps beyond 2027 (bnc#1012382).\n\n - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).\n\n - iwlwifi: mvm: return -ENODATA when reading the\n temperature with the FW down (bsc#1031717).\n\n - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask\n when sending sta to fw (bsc#1031717).\n\n - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD\n (bnc#1012382).\n\n - iwlwifi: split the regulatory rules when the bandwidth\n flags require it (bsc#1031717).\n\n - ixgbe: add mask for 64 RSS queues (bnc#1012382).\n\n - ixgbe: do not disable FEC from the driver (bnc#1012382).\n\n - ixgbe: fix AER error handling (bnc#1012382).\n\n - ixgbe: Fix skb list corruption on Power systems\n (bnc#1012382).\n\n - ixgbe: handle close/suspend race with\n netif_device_detach/present (bnc#1012382).\n\n - ixgbe: Reduce I2C retry count on X550 devices\n (bnc#1012382).\n\n - ixgbevf: Use smp_rmb rather than read_barrier_depends\n (bnc#1012382).\n\n - kABI fix for 4.4.99 net changes (stable-4.4.99).\n\n - kABI: protect struct l2tp_tunnel (kabi).\n\n - kABI: protect struct regulator_dev (kabi).\n\n - kABI: protect structs rt_rq+root_domain (kabi).\n\n - kABI: protect typedef rds_rdma_cookie_t (kabi).\n\n - kernel/sysctl.c: remove duplicate UINT_MAX check on\n do_proc_douintvec_conv() (bsc#1066470).\n\n - kernel/watchdog: Prevent false positives with turbo\n modes (bnc#1063516).\n\n - keys: do not let add_key() update an uninstantiated key\n (bnc#1012382).\n\n - keys: do not revoke uninstantiated key in\n request_key_auth_new() (bsc#1031717).\n\n - keys: encrypted: fix dereference of NULL\n user_key_payload (bnc#1012382).\n\n - keys: fix cred refcount leak in request_key_auth_new()\n (bsc#1031717).\n\n - keys: fix key refcount leak in keyctl_assume_authority()\n (bsc#1031717).\n\n - keys: fix key refcount leak in keyctl_read_key()\n (bsc#1031717).\n\n - keys: fix NULL pointer dereference during ASN.1 parsing\n [ver #2] (bnc#1012382).\n\n - keys: fix out-of-bounds read during ASN.1 parsing\n (bnc#1012382).\n\n - keys: Fix race between updating and finding a negative\n key (bnc#1012382).\n\n - keys: return full count in keyring_read() if buffer is\n too small (bnc#1012382).\n\n - keys: trusted: fix writing past end of buffer in\n trusted_read() (bnc#1012382).\n\n - keys: trusted: sanitize all key material (bnc#1012382).\n\n - KVM: nVMX: fix guest CR4 loading when emulating L2 to L1\n exit (bnc#1012382).\n\n - kvm: nVMX: set IDTR and GDTR limits when loading L1 host\n state (bnc#1012382).\n\n - KVM: PPC: Book 3S: XICS: correct the real mode ICP\n rejecting counter (bnc#1012382).\n\n - kvm: SVM: obey guest PAT (bnc#1012382).\n\n - l2tp: Avoid schedule while atomic in exit_net\n (bnc#1012382).\n\n - l2tp: check ps->sock before running\n pppol2tp_session_ioctl() (bnc#1012382).\n\n - l2tp: fix race condition in l2tp_tunnel_delete\n (bnc#1012382).\n\n - lib/digsig: fix dereference of NULL user_key_payload\n (bnc#1012382).\n\n - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).\n\n - lib/mpi: call cond_resched() from mpi_powm() loop\n (bnc#1012382).\n\n - libnvdimm, namespace: fix label initialization to use\n valid seq numbers (bnc#1012382).\n\n - libnvdimm, namespace: make 'resource' attribute only\n readable by root (bnc#1012382).\n\n - libnvdimm, pfn: make 'resource' attribute only readable\n by root (FATE#319858).\n\n - lib/ratelimit.c: use deferred printk() version\n (bsc#979928).\n\n - locking/lockdep: Add nest_lock integrity test\n (bnc#1012382).\n\n - mac80211: agg-tx: call drv_wake_tx_queue in proper\n context (bsc#1031717).\n\n - mac80211: do not compare TKIP TX MIC key in reinstall\n prevention (bsc#1066472).\n\n - mac80211: do not send SMPS action frame in AP mode when\n not needed (bsc#1031717).\n\n - mac80211: Fix addition of mesh configuration element\n (git-fixes).\n\n - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).\n\n - mac80211: fix mgmt-tx abort cookie and leak\n (bsc#1031717).\n\n - mac80211: fix power saving clients handling in iwlwifi\n (bnc#1012382).\n\n - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length\n (bnc#1012382).\n\n - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()\n (bsc#1031717).\n\n - mac80211: Remove invalid flag operations in mesh TSF\n synchronization (bnc#1012382).\n\n - mac80211: Remove unused 'beaconint_us' variable\n (bsc#1031717).\n\n - mac80211: Remove unused 'i' variable (bsc#1031717).\n\n - mac80211: Remove unused 'len' variable (bsc#1031717).\n\n - mac80211: Remove unused 'rates_idx' variable\n (bsc#1031717).\n\n - mac80211: Remove unused 'sband' and 'local' variables\n (bsc#1031717).\n\n - mac80211: Remove unused 'struct ieee80211_rx_status' ptr\n (bsc#1031717).\n\n - mac80211: Suppress NEW_PEER_CANDIDATE event if no room\n (bnc#1012382).\n\n - mac80211: TDLS: always downgrade invalid chandefs\n (bsc#1031717).\n\n - mac80211: TDLS: change BW calculation for WIDER_BW peers\n (bsc#1031717).\n\n - mac80211: use constant time comparison with keys\n (bsc#1066471).\n\n - md/linear: shutup lockdep warnning (bnc#1012382).\n\n - media: au0828: fix RC_CORE dependency (bsc#1031717).\n\n - media: Do not do DMA on stack for firmware upload in the\n AS102 driver (bnc#1012382).\n\n - media: em28xx: calculate left volume level correctly\n (bsc#1031717).\n\n - media: mceusb: fix memory leaks in error path\n (bsc#1031717).\n\n - media: rc: check for integer overflow (bnc#1012382).\n\n - media: v4l2-ctrl: Fix flags field on Control events\n (bnc#1012382).\n\n - megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to\n controllers which do not support it (bsc#1027301).\n\n - mei: return error on notification request to a\n disconnected client (bnc#1012382).\n\n - mfd: ab8500-sysctrl: Handle probe deferral\n (bnc#1012382).\n\n - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being\n swapped (bnc#1012382).\n\n - mips: AR7: Defer registration of GPIO (bnc#1012382).\n\n - mips: AR7: Ensure that serial ports are properly set up\n (bnc#1012382).\n\n - mips: BCM47XX: Fix LED inversion for WRT54GSv1\n (bnc#1012382).\n\n - mips: End asm function prologue macros with .insn\n (bnc#1012382).\n\n - mips: Fix an n32 core file generation regset support\n regression (bnc#1012382).\n\n - mips: Fix CM region target definitions (bnc#1012382).\n\n - mips: Fix race on setting and getting cpu_online_mask\n (bnc#1012382).\n\n - mips: init: Ensure bootmem does not corrupt reserved\n memory (bnc#1012382).\n\n - mips: init: Ensure reserved memory regions are not added\n to bootmem (bnc#1012382).\n\n - mips: math-emu: Remove pr_err() calls from fpu_emu()\n (bnc#1012382).\n\n - mips: microMIPS: Fix incorrect mask in insn_table_MM\n (bnc#1012382).\n\n - mips: Netlogic: Exclude netlogic,xlp-pic code from XLR\n builds (bnc#1012382).\n\n - mips: ralink: Fix MT7628 pinmux (bnc#1012382).\n\n - mips: ralink: Fix typo in mt7628 pinmux function\n (bnc#1012382).\n\n - mips: SMP: Fix deadlock & online race (bnc#1012382).\n\n - mips: SMP: Use a completion event to signal CPU up\n (bnc#1012382).\n\n - misc: panel: properly restore atomic counter on error\n path (bnc#1012382).\n\n - mmc: block: return error on failed mmc_blk_get()\n (bsc#1031717).\n\n - mmc: core/mmci: restore pre/post_req behaviour\n (bsc#1031717).\n\n - mmc: dw_mmc: rockchip: Set the drive phase properly\n (bsc#1031717).\n\n - mm: check the return value of lookup_page_ext for all\n call sites (bnc#1068982).\n\n - mmc: host: omap_hsmmc: avoid possible overflow of\n timeout value (bsc#1031717).\n\n - mmc: host: omap_hsmmc: checking for NULL instead of\n IS_ERR() (bsc#1031717).\n\n - mmc: mediatek: Fixed size in dma_free_coherent\n (bsc#1031717).\n\n - mmc: s3cmci: include linux/interrupt.h for\n tasklet_struct (bnc#1012382).\n\n - mmc: sd: limit SD card power limit according to cards\n capabilities (bsc#1031717).\n\n - mm, hwpoison: fixup 'mm: check the return value of\n lookup_page_ext for all call sites' (bnc#1012382).\n\n - mm/madvise.c: fix madvise() infinite loop under special\n circumstances (bnc#1070964).\n\n - mm/page_alloc.c: broken deferred calculation\n (bnc#1068980).\n\n - mm, page_alloc: fix potential false positive in\n __zone_watermark_ok (Git-fixes, bsc#1068978).\n\n - mm/page_ext.c: check if page_ext is not prepared\n (bnc#1068982).\n\n - mm/page_owner: avoid NULL pointer dereference\n (bnc#1068982).\n\n - mm/pagewalk.c: report holes in hugetlb ranges\n (bnc#1012382).\n\n - net: 3com: typhoon: typhoon_init_one: fix incorrect\n return values (bnc#1012382).\n\n - net: 3com: typhoon: typhoon_init_one: make return values\n more specific (bnc#1012382).\n\n - net/9p: Switch to wait_event_killable() (bnc#1012382).\n\n - net: Allow IP_MULTICAST_IF to set index to L3 slave\n (bnc#1012382).\n\n - net: cdc_ether: fix divide by 0 on bad descriptors\n (bnc#1012382).\n\n - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).\n\n - net: dsa: select NET_SWITCHDEV (bnc#1012382).\n\n - net: emac: Fix napi poll list corruption (bnc#1012382).\n\n - netfilter/ipvs: clear ipvs_property flag when SKB net\n namespace changed (bnc#1012382).\n\n - netfilter: nf_ct_expect: Change __nf_ct_expect_check()\n return value (bnc#1012382).\n\n - netfilter: nf_tables: fix oob access (bnc#1012382).\n\n - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev\n family (bnc#1012382).\n\n - netfilter: nft_queue: use raw_smp_processor_id()\n (bnc#1012382).\n\n - net: ibm: ibmvnic: constify vio_device_id (fate#323285).\n\n - net/mlx4_core: Fix VF overwrite of module param which\n disables DMFS on new probed PFs (bnc#1012382).\n\n - net/mlx4_en: fix overflow in mlx4_en_init_timestamp()\n (bnc#1012382).\n\n - net: mvpp2: release reference to txq_cpu[] entry after\n unmapping (bnc#1012382).\n\n - net: qmi_wwan: fix divide by 0 on bad descriptors\n (bnc#1012382).\n\n - net/sctp: Always set scope_id in sctp_inet6_skb_msgname\n (bnc#1012382).\n\n - net: Set sk_prot_creator when cloning sockets to the\n right proto (bnc#1012382).\n\n - net/unix: do not show information about sockets from\n other namespaces (bnc#1012382).\n\n - nfc: fix device-allocation error return (bnc#1012382).\n\n - nfsd/callback: Cleanup callback cred on shutdown\n (bnc#1012382).\n\n - nfsd: deal with revoked delegations appropriately\n (bnc#1012382).\n\n - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID\n (bsc#989261).\n\n - nfs: Fix typo in nomigration mount option (bnc#1012382).\n\n - nfs: Fix ugly referral attributes (bnc#1012382).\n\n - nilfs2: fix race condition that causes file system\n corruption (bnc#1012382).\n\n - nl80211: Define policy for packet pattern attributes\n (bnc#1012382).\n\n - nvme: Fix memory order on async queue deletion\n (bnc#1012382).\n\n - ocfs2: fstrim: Fix start offset of first cluster group\n during fstrim (bnc#1012382).\n\n - ocfs2: should wait dio before inode lock in\n ocfs2_setattr() (bnc#1012382).\n\n - packet: avoid panic in packet_getsockopt()\n (bnc#1012382).\n\n - packet: only test po->has_vnet_hdr once in packet_snd\n (bnc#1012382).\n\n - parisc: Avoid trashing sr2 and sr3 in LWS code\n (bnc#1012382).\n\n - parisc: Fix double-word compare and exchange in LWS code\n on 32-bit kernels (bnc#1012382).\n\n - parisc: Fix validity check of pointer size argument in\n new CAS implementation (bnc#1012382).\n\n - pci: Apply _HPX settings only to relevant devices\n (bnc#1012382).\n\n - pci: mvebu: Handle changes to the bridge windows while\n enabled (bnc#1012382).\n\n - percpu: make this_cpu_generic_read() atomic w.r.t.\n interrupts (bnc#1012382).\n\n - perf tools: Fix build failure on perl script context\n (bnc#1012382).\n\n - perf tools: Only increase index if perf_evsel__new_idx()\n succeeds (bnc#1012382).\n\n - perf/x86/intel/bts: Fix exclusive event reference leak\n (git-fixes d2878d642a4ed).\n\n - phy: increase size of MII_BUS_ID_SIZE and bus_id\n (bnc#1012382).\n\n - pkcs#7: fix uninitialized boolean 'want' (bnc#1012382).\n\n - pkcs7: Prevent NULL pointer dereference, since sinfo is\n not always set (bnc#1012382).\n\n - platform/x86: acer-wmi: setup accelerometer when ACPI\n device was found (bsc#1031717).\n\n - platform/x86: hp-wmi: Do not shadow error values\n (bnc#1012382).\n\n - platform/x86: hp-wmi: Fix detection for dock and tablet\n mode (bnc#1012382).\n\n - platform/x86: hp-wmi: Fix error value for\n hp_wmi_tablet_state (bnc#1012382).\n\n - platform/x86: intel_mid_thermal: Fix module autoload\n (bnc#1012382).\n\n - platform/x86: sony-laptop: Fix error handling in\n sony_nc_setup_rfkill() (bsc#1031717).\n\n - pm / OPP: Add missing of_node_put(np) (bnc#1012382).\n\n - power: bq27xxx_battery: Fix bq27541 AveragePower\n register address (bsc#1031717).\n\n - power: bq27xxx: fix reading for bq27000 and bq27010\n (bsc#1031717).\n\n - powercap: Fix an error code in powercap_register_zone()\n (bsc#1031717).\n\n - power: ipaq-micro-battery: freeing the wrong variable\n (bsc#1031717).\n\n - powerpc/64: Fix race condition in setting lock bit in\n idle/wakeup code (bsc#1066223).\n\n - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le\n (bsc#1066223).\n\n - powerpc/corenet: explicitly disable the SDHC controller\n on kmcoge4 (bnc#1012382).\n\n - powerpc: Correct instruction code for xxlor instruction\n (bsc#1066223).\n\n - powerpc: Fix VSX enabling/flushing to also test MSR_FP\n and MSR_VEC (bsc#1066223).\n\n - powerpc/mm: Fix check of multiple 16G pages from device\n tree (bsc#1066223).\n\n - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash\n (bsc#1066223).\n\n - powerpc/mm/hash64: Fix subpage protection with 4K HPTE\n config (bsc#1010201, bsc#1066223).\n\n - powerpc/mm/hash: Free the subpage_prot_table correctly\n (bsc#1066223).\n\n - powerpc/numa: Fix multiple bugs in memory_hotplug_max()\n (bsc#1066223).\n\n - powerpc/numa: Fix whitespace in\n hot_add_drconf_memory_max() (bsc#1066223).\n\n - powerpc/opal: Fix EBUSY bug in acquiring tokens\n (bsc#1066223).\n\n - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8\n (bsc#1066223).\n\n - powerpc/powernv/ioda: Fix endianness when reading TCEs\n (bsc#1066223).\n\n - powerpc/powernv: Make opal_event_shutdown() callable\n from IRQ context (bsc#1066223).\n\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice\n unregister (bsc#1067888).\n\n - powerpc/signal: Properly handle return value from\n uprobe_deny_signal() (bsc#1066223).\n\n - powerpc/sysrq: Fix oops whem ppmu is not registered\n (bsc#1066223).\n\n - power: supply: bq27xxx_battery: Fix register map for\n BQ27510 and BQ27520 ('bsc#1069270').\n\n - power: supply: isp1704: Fix unchecked return value of\n devm_kzalloc (bsc#1031717).\n\n - power: supply: lp8788: prevent out of bounds array\n access (bsc#1031717).\n\n - power_supply: tps65217-charger: Fix NULL deref during\n property export (bsc#1031717).\n\n - ppp: fix race in ppp device destruction (bnc#1012382).\n\n - printk/console: Always disable boot consoles that use\n init memory before it is freed (bsc#1063026).\n\n - printk/console: Enhance the check for consoles using\n init memory (bsc#1063026).\n\n - printk: include <asm/sections.h> instead of\n <asm-generic/sections.h> (bsc#1063026).\n\n - printk: only unregister boot consoles when necessary\n (bsc#1063026).\n\n - quota: Check for register_shrinker() failure\n (bsc#1012829).\n\n - r8169: Do not increment tx_dropped in TX ring cleaning\n (bsc#1031717).\n\n - rbd: use GFP_NOIO for parent stat and data requests\n (bnc#1012382).\n\n - rcu: Allow for page faults in NMI handlers\n (bnc#1012382).\n\n - rdma/uverbs: Prevent leak of reserved field (bsc#1022595\n FATE#322350).\n\n - rds: RDMA: return appropriate error on rdma map failures\n (bnc#1012382).\n\n - regulator: core: Limit propagation of parent voltage\n count and list (bsc#1070145).\n\n - regulator: fan53555: fix I2C device ids (bnc#1012382).\n\n - Revert 'bpf: one perf event close won't free bpf program\n attached by another perf event' (kabi).\n\n - Revert 'bsg-lib: do not free job in bsg_prepare_job'\n (bnc#1012382).\n\n - Revert 'crypto: xts - Add ECB dependency' (bnc#1012382).\n\n - Revert 'drm: bridge: add DT bindings for TI ths8135'\n (bnc#1012382).\n\n - Revert 'keys: Fix race between updating and finding a\n negative key' (kabi).\n\n - Revert 'phy: increase size of MII_BUS_ID_SIZE and\n bus_id' (kabi).\n\n - Revert 'sctp: do not peel off an assoc from one netns to\n another one' (bnc#1012382).\n\n - Revert 'tty: goldfish: Fix a parameter of a call to\n free_irq' (bnc#1012382).\n\n - Revert 'uapi: fix linux/rds.h userspace compilation\n errors' (bnc#1012382).\n\n - rpm/kernel-binary.spec.in: add the kernel-binary\n dependencies to kernel-binary-base (bsc#1060333).\n\n - rpm/kernel-binary.spec.in: Correct supplements for\n recent SLE products (bsc#1067494)\n\n - rpm/kernel-binary.spec.in: only rewrite modules.dep if\n non-zero in size (bsc#1056979).\n\n - rtc: ds1307: Fix relying on reset value for weekday\n (bsc#1031717).\n\n - rtc: ds1374: wdt: Fix issue with timeout scaling from\n secs to wdt ticks (bsc#1031717).\n\n - rtc: ds1374: wdt: Fix stop/start ioctl always returning\n -EINVAL (bsc#1031717).\n\n - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).\n\n - rtc: sa1100: fix unbalanced\n clk_prepare_enable/clk_disable_unprepare (bsc#1031717).\n\n - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time\n (bnc#1012382).\n\n - rtlwifi: rtl8192ee: Fix memory leak when loading\n firmware (bnc#1012382).\n\n - rtlwifi: rtl8821ae: Fix connection lost problem\n (bnc#1012382).\n\n - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation\n (bsc#1031717).\n\n - s390/dasd: check for device error pointer within state\n change interrupts (bnc#1012382).\n\n - s390/disassembler: add missing end marker for e7 table\n (bnc#1012382).\n\n - s390/disassembler: correct disassembly lines alignment\n (bsc#1070825).\n\n - s390/disassembler: increase show_code buffer size\n (bnc#1012382).\n\n - s390: fix transactional execution control register\n handling (bnc#1012382).\n\n - s390/kbuild: enable modversions for symbols exported\n from asm (bnc#1012382).\n\n - s390/qeth: issue STARTLAN as first IPA command\n (bnc#1012382).\n\n - s390/runtime instrumention: fix possible memory\n corruption (bnc#1012382).\n\n - sched/autogroup: Fix autogroup_move_group() to never\n skip sched_move_task() (bnc#1012382).\n\n - sched: Make resched_cpu() unconditional (bnc#1012382).\n\n - sched/rt: Simplify the IPI based RT balancing logic\n (bnc#1012382).\n\n - scsi: aacraid: Process Error for response I/O\n (bnc#1012382).\n\n - scsi_devinfo: cleanly zero-pad devinfo strings\n (bsc#1062941).\n\n - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).\n\n - scsi: ipr: Set no_report_opcodes for RAID arrays\n (bsc#1066213).\n\n - scsi: libiscsi: fix shifting of DID_REQUEUE host byte\n (bsc#1056003).\n\n - scsi: lpfc: Add missing memory barrier (bnc#1012382).\n\n - scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI\n ACC payload (bnc#1012382).\n\n - scsi: lpfc: Correct host name in symbolic_name field\n (bnc#1012382).\n\n - scsi: lpfc: Correct issue leading to oops during link\n reset (bnc#1012382).\n\n - scsi: lpfc: FCoE VPort enable-disable does not bring up\n the VPort (bnc#1012382).\n\n - scsi: reset wait for IO completion (bsc#996376).\n\n - scsi: scsi_devinfo: fixup string compare (bsc#1062941).\n updated\n patches.fixes/scsi_devinfo-fixup-string-compare.patch to\n the version merged upstream.\n\n - scsi: scsi_devinfo: handle non-terminated strings\n (bsc#1062941).\n\n - scsi: scsi_dh_emc: return success in\n clariion_std_inquiry() (bnc#1012382).\n\n - scsi: scsi_transport_fc: Also check for NOTPRESENT in\n fc_remote_port_add() (bsc#1037890).\n\n - scsi: scsi_transport_fc: set scsi_target_id upon rescan\n (bsc#1058135).\n\n - scsi: sg: Re-fix off by one in sg_fill_request_table()\n (bnc#1012382).\n\n - scsi: ufs: add capability to keep auto bkops always\n enabled (bnc#1012382).\n\n - scsi: ufs-qcom: Fix module autoload (bnc#1012382).\n\n - scsi: virtio_scsi: let host do exception handling\n (bsc#1060682).\n\n - scsi: zfcp: fix erp_action use-before-initialize in REC\n action trace (bnc#1012382).\n\n - sctp: add the missing sock_owned_by_user check in\n sctp_icmp_redirect (bnc#1012382).\n\n - sctp: do not peel off an assoc from one netns to another\n one (bnc#1012382).\n\n - sctp: potential read out of bounds in\n sctp_ulpevent_type_enabled() (bnc#1012382).\n\n - sctp: reset owner sk for data chunks on out queues when\n migrating a sock (bnc#1012382).\n\n - security/keys: add CONFIG_KEYS_COMPAT to Kconfig\n (bnc#1012382).\n\n - selftests: firmware: add empty string and async tests\n (bnc#1012382).\n\n - selftests: firmware: send expected errors to /dev/null\n (bnc#1012382).\n\n - serial: 8250_fintek: Fix rs485 disablement on invalid\n ioctl() (bsc#1031717).\n\n - serial: 8250_uniphier: fix serial port index in private\n data (bsc#1031717).\n\n - serial: Fix serial console on SNI RM400 machines\n (bsc#1031717).\n\n - serial: omap: Fix EFR write on RTS deassertion\n (bnc#1012382).\n\n - serial: Remove unused port type (bsc#1066045).\n\n - serial: sh-sci: Fix register offsets for the IRDA serial\n port (bnc#1012382).\n\n - slub: do not merge cache if slub_debug contains a\n never-merge flag (bnc#1012382).\n\n - smb3: parsing for new snapshot timestamp mount parm\n (FATE#324404). New mount option 'snapshot=<time>' to\n allow mounting an earlier version of the remote volume\n (if such a snapshot exists on the server). Note that\n eventually specifying a snapshot time of 1 will allow\n the user to mount the oldest snapshot. A subsequent\n patch add the processing for that and another for\n actually specifying the 'time warp' create context on\n SMB2/SMB3 open. Check to make sure SMB2 negotiated, and\n ensure that we use a different tcon if mount same share\n twice but with different snaphshot times\n\n - sparc64: Migrate hvcons irq to panicked cpu\n (bnc#1012382).\n\n - spi: SPI_FSL_DSPI should depend on HAS_DMA\n (bnc#1012382).\n\n - spi: uapi: spidev: add missing ioctl header\n (bnc#1012382).\n\n - staging: iio: cdc: fix improper return value\n (bnc#1012382).\n\n - staging: lustre: hsm: stack overrun in\n hai_dump_data_field (bnc#1012382).\n\n - staging: lustre: llite: do not invoke direct_IO for the\n EOF case (bnc#1012382).\n\n - staging: lustre: ptlrpc: skip lock if export failed\n (bnc#1012382).\n\n - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c\n (bnc#1012382).\n\n - staging: rtl8188eu: fix incorrect ERROR tags from logs\n (bnc#1012382).\n\n - staging: rtl8712: fixed little endian problem\n (bnc#1012382).\n\n - staging: rtl8712u: Fix endian settings for structs\n describing network packets (bnc#1012382).\n\n - sunrpc: Fix tracepoint storage issues with svc_recv and\n svc_rqst_status (bnc#1012382).\n\n - target: fix ALUA state file path truncation\n (bsc#1071231).\n\n - target: Fix node_acl demo-mode + uncached dynamic\n shutdown regression (bnc#1012382).\n\n - target: fix PR state file path truncation (bsc#1071231).\n\n - target: Fix QUEUE_FULL + SCSI task attribute handling\n (bnc#1012382).\n\n - target/iscsi: Fix iSCSI task reassignment handling\n (bnc#1012382).\n\n - target/iscsi: Fix unsolicited data seq_end_offset\n calculation (bnc#1012382).\n\n - tcp/dccp: fix ireq->opt races (bnc#1012382).\n\n - tcp/dccp: fix lockdep splat in inet_csk_route_req()\n (bnc#1012382).\n\n - tcp/dccp: fix other lockdep splats accessing ireq_opt\n (bnc#1012382).\n\n - tcp: do not mangle skb->cb[] in tcp_make_synack()\n (bnc#1012382).\n\n - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).\n\n - test: firmware_class: report errors properly on failure\n (bnc#1012382).\n\n - timer: Prevent timer value 0 for MWAITX (bsc#1065717).\n\n - tipc: fix link attribute propagation bug (bnc#1012382).\n\n - tipc: use only positive error codes in messages\n (bnc#1012382).\n\n - tools: firmware: check for distro fallback udev cancel\n rule (bnc#1012382).\n\n - tracing/samples: Fix creation and deletion of\n simple_thread_fn creation (bnc#1012382).\n\n - tun: allow positive return values on\n dev_get_valid_name() call (bnc#1012382).\n\n - tun: bail out from tun_get_user() if the skb is empty\n (bnc#1012382).\n\n - tun: call dev_get_valid_name() before\n register_netdevice() (bnc#1012382).\n\n - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).\n\n - uapi: fix linux/mroute6.h userspace compilation errors\n (bnc#1012382).\n\n - uapi: fix linux/rds.h userspace compilation error\n (bnc#1012382).\n\n - uapi: fix linux/rds.h userspace compilation errors\n (bnc#1012382).\n\n - udpv6: Fix the checksum computation when HW checksum\n does not apply (bnc#1012382).\n\n - usb: Add delay-init quirk for Corsair K70 LUX keyboards\n (bnc#1012382).\n\n - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382).\n\n - usb: core: fix out-of-bounds access bug in\n usb_get_bos_descriptor() (bnc#1012382).\n\n - usb: devio: Revert 'USB: devio: Do not corrupt user\n memory' (bnc#1012382).\n\n - usb: dummy-hcd: Fix deadlock caused by disconnect\n detection (bnc#1012382).\n\n - usb: gadget: composite: Fix use-after-free in\n usb_composite_overwrite_options (bnc#1012382).\n\n - usb: hcd: initialize hcd->flags to 0 when rm hcd\n (bnc#1012382).\n\n - usb: hub: Allow reset retry for USB2 devices on connect\n bounce (bnc#1012382).\n\n - usb: musb: Check for host-mode using is_host_active() on\n reset interrupt (bnc#1012382).\n\n - usb: musb: sunxi: Explicitly release USB PHY on exit\n (bnc#1012382).\n\n - usb: quirks: add quirk for WORLDE MINI MIDI keyboard\n (bnc#1012382).\n\n - usb: renesas_usbhs: Fix DMAC sequence for receiving\n zero-length packet (bnc#1012382).\n\n - usb: serial: console: fix use-after-free after failed\n setup (bnc#1012382).\n\n - usb: serial: cp210x: add support for ELV TFD500\n (bnc#1012382).\n\n - usb: serial: ftdi_sio: add id for Cypress WICED dev\n board (bnc#1012382).\n\n - usb: serial: garmin_gps: fix I/O after failed probe and\n remove (bnc#1012382).\n\n - usb: serial: garmin_gps: fix memory leak on probe errors\n (bnc#1012382).\n\n - usb: serial: metro-usb: add MS7820 device id\n (bnc#1012382).\n\n - usb: serial: option: add support for TP-Link LTE module\n (bnc#1012382).\n\n - usb: serial: qcserial: add Dell DW5818, DW5819\n (bnc#1012382).\n\n - usb: serial: qcserial: add pid/vid for Sierra Wireless\n EM7355 fw update (bnc#1012382).\n\n - usb: usbfs: compute urb->actual_length for isochronous\n (bnc#1012382).\n\n - usb: usbtest: fix NULL pointer dereference\n (bnc#1012382).\n\n - usb: xhci: Handle error condition in xhci_stop_device()\n (bnc#1012382).\n\n - vfs: expedite unmount (bsc#1024412).\n\n - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation\n (bnc#1012382).\n\n - video: udlfb: Fix read EDID timeout (bsc#1031717).\n\n - vlan: fix a use-after-free in vlan_device_event()\n (bnc#1012382).\n\n - vsock: use new wait API for vsock_stream_sendmsg()\n (bnc#1012382).\n\n - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit\n (bnc#1012382).\n\n - watchdog: kempld: fix gcc-4.3 build (bnc#1012382).\n\n - workqueue: Fix NULL pointer dereference (bnc#1012382).\n\n - workqueue: replace pool->manager_arb mutex with a flag\n (bnc#1012382).\n\n - x86/alternatives: Fix alt_max_short macro to really be a\n max() (bnc#1012382).\n\n - x86/decoder: Add new TEST instruction pattern\n (bnc#1012382).\n\n - x86/MCE/AMD: Always give panic severity for UC errors in\n kernel context (git-fixes bf80bbd7dcf5).\n\n - x86/microcode/AMD: Add support for fam17h microcode\n loading (bsc#1068032).\n\n - x86/microcode/intel: Disable late loading on model 79\n (bnc#1012382).\n\n - x86/oprofile/ppro: Do not use __this_cpu*() in\n preemptible context (bnc#1012382).\n\n - x86/uaccess, sched/preempt: Verify access_ok() context\n (bnc#1012382).\n\n - xen: do not print error message in case of missing\n Xenstore entry (bnc#1012382).\n\n - xen/events: events_fifo: Do not use (get,put)_cpu() in\n xen_evtchn_fifo_init() (bnc#1065600).\n\n - xen: fix booting ballooned down hvm guest (bnc#1065600).\n\n - xen/gntdev: avoid out of bounds access in case of\n partial gntdev_mmap() (bnc#1012382).\n\n - xen/manage: correct return value check on xenbus_scanf()\n (bnc#1012382).\n\n - xen-netback: fix error handling output (bnc#1065600).\n\n - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).\n\n - xen: xenbus driver must not accept invalid transaction\n ids (bnc#1012382).\n\n - zd1211rw: fix NULL-deref at probe (bsc#1031717).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1010201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1012382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1012829\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1017461\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1021424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1022595\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1022914\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024412\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027301\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1030061\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1031717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1037890\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1046107\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1050060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1050231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1053919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1056003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1056365\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1056427\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1056979\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1057199\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1058135\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1060333\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1060682\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1061756\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1062941\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1063026\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1063516\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1064701\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1064926\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065180\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065600\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065639\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065692\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1065866\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066045\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066192\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066213\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066223\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066285\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066471\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066472\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066573\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066606\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1066629\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1067105\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1067132\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1067494\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1067888\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1068671\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1068978\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1068980\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1068982\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1069270\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1069496\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1069702\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1069793\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1069942\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1069996\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070006\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070145\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070535\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070767\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070825\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1070964\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071694\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071695\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071833\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963575\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=964944\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=966170\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=966172\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=974590\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=979928\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989261\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=996376\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected the Linux Kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-macros\")