Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4261)

2018-10-26T00:00:00
ID ORACLELINUX_ELSA-2018-4261.NASL
Type nessus
Reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
Modified 2020-05-02T00:00:00

Description

Description of changes:

[4.1.12-124.20.7.el7uek] - Revert

                                        
                                            #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2018-4261.
#

include("compat.inc");

if (description)
{
  script_id(118441);
  script_version("1.7");
  script_cvs_date("Date: 2019/09/27 13:00:39");

  script_cve_id("CVE-2018-14734", "CVE-2018-15572");

  script_name(english:"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4261)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Oracle Linux host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Description of changes:

[4.1.12-124.20.7.el7uek]
- Revert 'rds: RDS (tcp) hangs on sendto() to unresponding address' 
(Brian Maly)  [Orabug: 28837953]

[4.1.12-124.20.6.el7uek]
- x86/speculation: Retpoline should always be available on Skylake 
(Alexandre Chartre)  [Orabug: 28801831]

[4.1.12-124.20.5.el7uek]
- x86/speculation: Add sysfs entry to enable/disable retpoline 
(Alexandre Chartre)  [Orabug: 28607548]
- x86/speculation: Switch to IBRS when loading a non-retpoline module 
(Alexandre Chartre)  [Orabug: 28607548]
- x86/speculation: Remove unnecessary retpoline alternatives (Alexandre 
Chartre)  [Orabug: 28607548]
- x86/speculation: Use static key to enable/disable retpoline (Alexandre 
Chartre)  [Orabug: 28607548]
- locking/static_keys: Provide DECLARE and well as DEFINE macros (Tony 
Luck)  [Orabug: 28607548]
- jump_label: remove bug.h, atomic.h dependencies for HAVE_JUMP_LABEL 
(Jason Baron)  [Orabug: 28607548]
- locking/static_key: Fix concurrent static_key_slow_inc() (Paolo 
Bonzini)  [Orabug: 28607548]
- jump_label: make static_key_enabled() work on static_key_true/false 
types too (Tejun Heo)  [Orabug: 28607548]
- locking/static_keys: Fix up the static keys documentation (Jonathan 
Corbet)  [Orabug: 28607548]
- locking/static_keys: Fix a silly typo (Jonathan Corbet)  [Orabug: 
28607548]
- jump label, locking/static_keys: Update docs (Jason Baron)  [Orabug: 
28607548]
- x86/asm: Add asm macros for static keys/jump labels (Andy Lutomirski) 
[Orabug: 28607548]
- x86/asm: Error out if asm/jump_label.h is included inappropriately 
(Andy Lutomirski)  [Orabug: 28607548]
- jump_label/x86: Work around asm build bug on older/backported GCCs 
(Peter Zijlstra)  [Orabug: 28607548]
- locking/static_keys: Add a new static_key interface (Peter Zijlstra) 
[Orabug: 28607548]
- locking/static_keys: Rework update logic (Peter Zijlstra)  [Orabug: 
28607548]
- jump_label: Add jump_entry_key() helper (Peter Zijlstra)  [Orabug: 
28607548]
- jump_label, locking/static_keys: Rename JUMP_LABEL_TYPE_* and related 
helpers to the static_key* pattern (Peter Zijlstra)  [Orabug: 28607548]
- jump_label: Rename JUMP_LABEL_{EN,DIS}ABLE to JUMP_LABEL_{JMP,NOP} 
(Peter Zijlstra)  [Orabug: 28607548]
- module, jump_label: Fix module locking (Peter Zijlstra)  [Orabug: 
28607548]
- x86/speculation: Protect against userspace-userspace spectreRSB (Jiri 
Kosina)  [Orabug: 28631590]  {CVE-2018-15572}
- x86/spectre_v2: Remove remaining references to lfence mitigation 
(Alejandro Jimenez)  [Orabug: 28631590]  {CVE-2018-15572}
- Revert 'md: allow a partially recovered device to be hot-added to an 
array.' (NeilBrown)  [Orabug: 28702623]
- x86/bugs: ssbd_ibrs_selected called prematurely (Daniel Jordan) 
[Orabug: 28788839]
- net/mlx4_core: print firmware version during driver loading (Qing 
Huang)  [Orabug: 28809377]
- mm: numa: Do not trap faults on shared data section pages. (Henry 
Willard)  [Orabug: 28814880]
- hugetlbfs: dirty pages as they are added to pagecache (Mike Kravetz) 
[Orabug: 28813968]

[4.1.12-124.20.4.el7uek]
- rds: RDS (tcp) hangs on sendto() to unresponding address (Ka-Cheong 
Poon)  [Orabug: 28762608]
- nfs: fix a deadlock in nfs client initialization (Scott Mayhew) 
[Orabug: 28486463]
- infiniband: fix a possible use-after-free bug (Cong Wang)  [Orabug: 
28774517]  {CVE-2018-14734}"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://oss.oracle.com/pipermail/el-errata/2018-October/008169.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://oss.oracle.com/pipermail/el-errata/2018-October/008170.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected unbreakable enterprise kernel packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Oracle Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
include("ksplice.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
os_ver = os_ver[1];
if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6 / 7", "Oracle Linux " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);

if (get_one_kb_item("Host/ksplice/kernel-cves"))
{
  rm_kb_item(name:"Host/uptrack-uname-r");
  cve_list = make_list("CVE-2018-14734", "CVE-2018-15572");  
  if (ksplice_cves_check(cve_list))
  {
    audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for ELSA-2018-4261");
  }
  else
  {
    __rpm_report = ksplice_reporting_text();
  }
}

kernel_major_minor = get_kb_item("Host/uname/major_minor");
if (empty_or_null(kernel_major_minor)) exit(1, "Unable to determine kernel major-minor level.");
expected_kernel_major_minor = "4.1";
if (kernel_major_minor != expected_kernel_major_minor)
  audit(AUDIT_OS_NOT, "running kernel level " + expected_kernel_major_minor + ", it is running kernel level " + kernel_major_minor);

flag = 0;
if (rpm_exists(release:"EL6", rpm:"kernel-uek-4.1.12") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-4.1.12-124.20.7.el6uek")) flag++;
if (rpm_exists(release:"EL6", rpm:"kernel-uek-debug-4.1.12") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-debug-4.1.12-124.20.7.el6uek")) flag++;
if (rpm_exists(release:"EL6", rpm:"kernel-uek-debug-devel-4.1.12") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-debug-devel-4.1.12-124.20.7.el6uek")) flag++;
if (rpm_exists(release:"EL6", rpm:"kernel-uek-devel-4.1.12") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-devel-4.1.12-124.20.7.el6uek")) flag++;
if (rpm_exists(release:"EL6", rpm:"kernel-uek-doc-4.1.12") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-doc-4.1.12-124.20.7.el6uek")) flag++;
if (rpm_exists(release:"EL6", rpm:"kernel-uek-firmware-4.1.12") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-firmware-4.1.12-124.20.7.el6uek")) flag++;

if (rpm_exists(release:"EL7", rpm:"kernel-uek-4.1.12") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-4.1.12-124.20.7.el7uek")) flag++;
if (rpm_exists(release:"EL7", rpm:"kernel-uek-debug-4.1.12") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-debug-4.1.12-124.20.7.el7uek")) flag++;
if (rpm_exists(release:"EL7", rpm:"kernel-uek-debug-devel-4.1.12") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-debug-devel-4.1.12-124.20.7.el7uek")) flag++;
if (rpm_exists(release:"EL7", rpm:"kernel-uek-devel-4.1.12") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-devel-4.1.12-124.20.7.el7uek")) flag++;
if (rpm_exists(release:"EL7", rpm:"kernel-uek-doc-4.1.12") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-doc-4.1.12-124.20.7.el7uek")) flag++;
if (rpm_exists(release:"EL7", rpm:"kernel-uek-firmware-4.1.12") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-firmware-4.1.12-124.20.7.el7uek")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "affected kernel");
}