MiracleLinux 4 : kernel-2.6.32-696.20.1.el6 (AXSA:2018-2579:02)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2018-2579:02.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(289335);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/10");

  script_cve_id("CVE-2017-7542", "CVE-2017-9074", "CVE-2017-11176");

  script_name(english:"MiracleLinux 4 : kernel-2.6.32-696.20.1.el6 (AXSA:2018-2579:02)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2018-2579:02 advisory.

    * An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has
    privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt()
    function. (CVE-2017-7542, Moderate)
      * The IPv6 fragmentation implementation in the Linux kernel does not consider that the nexthdr field may
    be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds
    read and BUG) or possibly have unspecified other impact via crafted socket and send system calls. Due to
    the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is
    unlikely. (CVE-2017-9074, Moderate)
      * A use-after-free flaw was found in the Netlink functionality of the Linux kernel networking subsystem.
    Due to the insufficient cleanup in the mq_notify function, a local attacker could potentially use this
    flaw to escalate their privileges on the system. (CVE-2017-11176, Moderate)
    Bug Fix(es):
      * Previously, the default timeout and retry settings in the VMBus driver were insufficient in some
    cases, for example when a Hyper-V host was under a significant load. Consequently, in Windows Server 2016,
    Hyper-V Server 2016, and Windows Azure Platform, when running a Asianux Server Guest on the Hyper-V
    hypervisor, the guest failed to boot or booted with certain Hyper-V devices missing. This update alters
    the timeout and retry settings in VMBus, and Asianux Server guests now boot as expected under the
    described conditions. (BZ#1506145)
      * Previously, an incorrect external declaration in the be2iscsi driver caused a kernel panic when using
    the systool utility. With this update, the external declaration in be2iscsi has been fixed, and the kernel
    no longer panics when using systool. (BZ#1507512)
      * Under high usage of the NFSD file system and memory pressure, if many tasks in the Linux kernel
    attempted to obtain the global spinlock to clean the Duplicate Reply Cache (DRC), these tasks stayed in an
    active wait in the nfsd_reply_cache_shrink() function for up to 99% of time. Consequently, a high load
    average occurred. This update fixes the bug by separating the DRC in several parts, each with an
    independent spinlock. As a result, the load and CPU utilization is no longer excessive under the described
    circumstances. (BZ#1509876)
      * When attempting to attach multiple SCSI devices simultaneously, Asianux Server 4.9 on IBM z Systems
    sometimes became unresponsive. This update fixes the zfcp device driver, and attaching multiple SCSI
    devices simultaneously now works as expected in the described scenario. (BZ#1512425)
      * On IBM z Systems, the tiqdio_call_inq_handlers() function in the Linux kernel incorrectly cleared the
    device state change indicator (DSCI) for the af_iucv devices using the HiperSockets transport with
    multiple input queues. Consequently, queue stalls on such devices occasionally occurred. With this update,
    tiqdio_call_inq_handlers() has been fixed to clear the DSCI only once, prior to scanning the queues. As a
    result, queue stalls for af_iucv devices using the HiperSockets transport no longer occur under the
    described circumstances. (BZ#1513314)
      * Previously, small data chunks caused the Stream Control Transmission Protocol (SCTP) to account the
    receiver_window (rwnd) values incorrectly when recovering from a zero-window situation. As a
    consequence, window updates were not sent to the peer, and an artificial growth of rwnd could lead to
    packet drops. This update properly accounts such small data chunks and ignores the rwnd pressure values
    when reopening a window. As a result, window updates are now sent, and the announced rwnd reflects better
    the real state of the receive buffer. (BZ#1514443)
    CVE-2017-11176
    The mq_notify function in the Linux kernel through 4.11.9 does not set
    the sock pointer to NULL upon entry into the retry logic. During a
    user-space close of a Netlink socket, it allows attackers to cause a
    denial of service (use-after-free) or possibly have unspecified other
    impact.
    CVE-2017-7542
    The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux
    kernel through 4.12.3 allows local users to cause a denial of service
    (integer overflow and infinite loop) by leveraging the ability to open
    a raw socket.
    CVE-2017-9074
    The IPv6 fragmentation implementation in the Linux kernel through
    4.11.1 does not consider that the nexthdr field may be associated with
    an invalid option, which allows local users to cause a denial of
    service (out-of-bounds read and BUG) or possibly have unspecified other
    impact via crafted socket and send system calls.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/9022");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-9074");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/02/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-abi-whitelists");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-firmware");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:perf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:4");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 4.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'kernel-2.6.32-696.20.1.el6', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-2.6.32-696.20.1.el6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-abi-whitelists-2.6.32-696.20.1.el6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-2.6.32-696.20.1.el6', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-2.6.32-696.20.1.el6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-devel-2.6.32-696.20.1.el6', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-devel-2.6.32-696.20.1.el6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-devel-2.6.32-696.20.1.el6', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-devel-2.6.32-696.20.1.el6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-firmware-2.6.32-696.20.1.el6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-headers-2.6.32-696.20.1.el6', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-headers-2.6.32-696.20.1.el6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'perf-2.6.32-696.20.1.el6', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'perf-2.6.32-696.20.1.el6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc');
}