{"id": "TALOS-2019-0900", "bulletinFamily": "info", "title": "Linux kernel CAM table denial-of-service vulnerability", "description": "# Talos Vulnerability Report\n\n### TALOS-2019-0900\n\n## Linux kernel CAM table denial-of-service vulnerability\n\n##### December 11, 2019\n\n##### CVE Number\n\nCVE-2019-5108\n\n### Summary\n\nAn exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.\n\n### Tested Versions\n\nLinux 4.14.98-v7+\n\n### Product URLs\n\n<https://www.kernel.org>\n\n### CVSSv3 Score\n\n7.4 - AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\n\n### CWE\n\nCWE-440 - Expected Behavior Violation\n\n### Details\n\nThe Linux kernel will send Inter-Access Point Protocol(IAPP) location updates to support roaming, allowing clients to seamlessly go from one access point to another. However, upon receipt of an Authentication and AssociationRequest packet, Linux will send a broadcast packet with the MAC address of the connecting station to the LAN. This packet is sent before the station has successfully authenticated. The kernel provides a helper fuction for drivers `cfg80211_send_layer2_update()` that provides this functionality. Drivers call this function when a new station entry is added (before full authentication is completed) in `ieee80211_add_station()`.\n\nAn attacker could iterate through a large set of unique MAC addresses to trigger DoS attacks within the upstream network infrastructure. A number of different denial-of-service attacks could be performed by an unauthenticated attacker, for example: an attacker could use this vulnerability to flood a switch with a large number of MAC addresses, resulting in filling the CAM table to capacity, preventing the switch from learning new MAC addresses.\n\n##### Credit\n\nDiscovered by Mitchell Frank of Cisco\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2019-0853\n\nPrevious Report\n\nTALOS-2019-0943\n", "published": "2019-12-11T00:00:00", "modified": "2019-12-11T00:00:00", "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0900", "reporter": "Talos Intelligence", "references": [], "cvelist": ["CVE-2019-5108"], "type": "talos", "lastseen": "2020-02-12T18:31:08", "edition": 5, "viewCount": 54, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2019-5108"]}, {"type": "symantec", "idList": ["SMNTC-111398"]}, {"type": "nessus", "idList": ["EULEROS_SA-2020-1342.NASL", "UBUNTU_USN-4286-1.NASL", "UBUNTU_USN-4287-1.NASL", "DEBIAN_DSA-4698.NASL", "SUSE_SU-2020-0868-1.NASL", "EULEROS_SA-2020-1112.NASL", "SLACKWARE_SSA_2020-086-01.NASL", "EULEROS_SA-2020-1158.NASL", "UBUNTU_USN-4285-1.NASL", "REDHAT-RHSA-2020-1493.NASL"]}, {"type": "talos", "idList": ["TALOS-2019-0849"]}, {"type": "talosblog", "idList": ["TALOSBLOG:3408EA53C759FF775E8D772720035A70"]}, {"type": "redhat", "idList": ["RHSA-2020:1493"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562311220201342", "OPENVAS:1361412562310892241", "OPENVAS:1361412562310844341", "OPENVAS:1361412562310844342", "OPENVAS:1361412562310892242", "OPENVAS:1361412562311220201536", "OPENVAS:1361412562311220201112", "OPENVAS:1361412562310844347", "OPENVAS:1361412562310704698", "OPENVAS:1361412562311220201158"]}, {"type": "ubuntu", "idList": ["USN-4286-2", "USN-4287-2", "USN-4285-1", "USN-4287-1", "USN-4286-1"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:C4D1C1686A388941AD439B6E19ADC7F2"]}, {"type": "debian", "idList": ["DEBIAN:DLA-2241-1:DE3AB", "DEBIAN:DLA-2242-1:573AF", "DEBIAN:DSA-4698-1:66813", "DEBIAN:DLA-2241-2:3E557"]}], "modified": "2020-02-12T18:31:08", "rev": 2}, "score": {"value": 5.1, "vector": "NONE", "modified": "2020-02-12T18:31:08", "rev": 2}, "vulnersScore": 5.1}, "scheme": null}

{"cve": [{"lastseen": "2021-02-02T07:13:01", "description": "An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.", "edition": 28, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2019-12-23T19:15:00", "title": "CVE-2019-5108", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 3.3, "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-5108"], "modified": "2020-06-10T20:15:00", "cpe": [], "id": "CVE-2019-5108", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5108", "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": []}], "symantec": [{"lastseen": "2020-01-08T16:40:07", "bulletinFamily": "software", "cvelist": ["CVE-2019-5108"], "description": "### Description\n\nLinux Kernel is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service conditions. Versions prior to Linux kernel 5.3 are vulnerable.\n\n### Technologies Affected\n\n * Linux kernel 2.0.0 \n * Linux kernel 2.0.1 \n * Linux kernel 2.0.10 \n * Linux kernel 2.0.11 \n * Linux kernel 2.0.12 \n * Linux kernel 2.0.13 \n * Linux kernel 2.0.14 \n * Linux kernel 2.0.15 \n * Linux kernel 2.0.16 \n * Linux kernel 2.0.17 \n * Linux kernel 2.0.18 \n * Linux kernel 2.0.19 \n * Linux kernel 2.0.2 \n * Linux kernel 2.0.20 \n * Linux kernel 2.0.21 \n * Linux kernel 2.0.22 \n * Linux kernel 2.0.23 \n * Linux kernel 2.0.24 \n * Linux kernel 2.0.25 \n * Linux kernel 2.0.26 \n * Linux kernel 2.0.27 \n * Linux kernel 2.0.28 \n * Linux kernel 2.0.29 \n * Linux kernel 2.0.3 \n * Linux kernel 2.0.30 \n * Linux kernel 2.0.31 \n * Linux kernel 2.0.32 \n * Linux kernel 2.0.33 \n * Linux kernel 2.0.34 \n * Linux kernel 2.0.35 \n * Linux kernel 2.0.36 \n * Linux kernel 2.0.37 \n * Linux kernel 2.0.38 \n * Linux kernel 2.0.39 \n * Linux kernel 2.0.4 \n * Linux kernel 2.0.40 \n * Linux kernel 2.0.5 \n * Linux kernel 2.0.6 \n * Linux kernel 2.0.7 \n * Linux kernel 2.0.8 \n * Linux kernel 2.0.9 \n * Linux kernel 2.1.0 \n * Linux kernel 2.1.132 \n * Linux kernel 2.1.89 \n * Linux kernel 2.2.0 \n * Linux kernel 2.2.1 \n * Linux kernel 2.2.10 \n * Linux kernel 2.2.11 \n * Linux kernel 2.2.12 \n * Linux kernel 2.2.13 \n * Linux kernel 2.2.14 \n * Linux kernel 2.2.15 \n * Linux kernel 2.2.16 \n * Linux kernel 2.2.17 \n * Linux kernel 2.2.18 \n * Linux kernel 2.2.19 \n * Linux kernel 2.2.2 \n * Linux kernel 2.2.20 \n * Linux kernel 2.2.21 \n * Linux kernel 2.2.22 \n * Linux kernel 2.2.23 \n * Linux kernel 2.2.24 \n * Linux kernel 2.2.25 \n * Linux kernel 2.2.26 \n * Linux kernel 2.2.3 \n * Linux kernel 2.2.4 \n * Linux kernel 2.2.5 \n * Linux kernel 2.2.6 \n * Linux kernel 2.2.7 \n * Linux kernel 2.2.8 \n * Linux kernel 2.2.9 \n * Linux kernel 2.3.0 \n * Linux kernel 2.3.1 \n * Linux kernel 2.3.10 \n * Linux kernel 2.3.11 \n * Linux kernel 2.3.12 \n * Linux kernel 2.3.13 \n * Linux kernel 2.3.14 \n * Linux kernel 2.3.15 \n * Linux kernel 2.3.16 \n * Linux kernel 2.3.17 \n * Linux kernel 2.3.18 \n * Linux kernel 2.3.19 \n * Linux kernel 2.3.2 \n * Linux kernel 2.3.20 \n * Linux kernel 2.3.21 \n * Linux kernel 2.3.22 \n * Linux kernel 2.3.23 \n * Linux kernel 2.3.24 \n * Linux kernel 2.3.25 \n * Linux kernel 2.3.26 \n * Linux kernel 2.3.27 \n * Linux kernel 2.3.28 \n * Linux kernel 2.3.29 \n * Linux kernel 2.3.3 \n * Linux kernel 2.3.30 \n * Linux kernel 2.3.31 \n * Linux kernel 2.3.32 \n * Linux kernel 2.3.33 \n * Linux kernel 2.3.34 \n * Linux kernel 2.3.35 \n * Linux kernel 2.3.36 \n * Linux kernel 2.3.37 \n * Linux kernel 2.3.38 \n * Linux kernel 2.3.39 \n * Linux kernel 2.3.4 \n * Linux kernel 2.3.40 \n * Linux kernel 2.3.41 \n * Linux kernel 2.3.42 \n * Linux kernel 2.3.43 \n * Linux kernel 2.3.44 \n * Linux kernel 2.3.45 \n * Linux kernel 2.3.46 \n * Linux kernel 2.3.47 \n * Linux kernel 2.3.48 \n * Linux kernel 2.3.49 \n * Linux kernel 2.3.5 \n * Linux kernel 2.3.50 \n * Linux kernel 2.3.51 \n * Linux kernel 2.3.6 \n * Linux kernel 2.3.7 \n * Linux kernel 2.3.8 \n * Linux kernel 2.3.9 \n * Linux kernel 2.3.99 \n * Linux kernel 2.4.0 \n * Linux kernel 2.4.1 \n * Linux kernel 2.4.10 \n * Linux kernel 2.4.11 \n * Linux kernel 2.4.12 \n * Linux kernel 2.4.13 \n * Linux kernel 2.4.14 \n * Linux kernel 2.4.15 \n * Linux kernel 2.4.16 \n * Linux kernel 2.4.17 \n * Linux kernel 2.4.18 \n * Linux kernel 2.4.19 \n * Linux kernel 2.4.2 \n * Linux kernel 2.4.20 \n * Linux kernel 2.4.21 \n * Linux kernel 2.4.22 \n * Linux kernel 2.4.23 \n * Linux kernel 2.4.24 \n * Linux kernel 2.4.25 \n * Linux kernel 2.4.26 \n * Linux kernel 2.4.27 \n * Linux kernel 2.4.28 \n * Linux kernel 2.4.29 \n * Linux kernel 2.4.3 \n * Linux kernel 2.4.30 \n * Linux kernel 2.4.31 \n * Linux kernel 2.4.32 \n * Linux kernel 2.4.33 2 \n * Linux kernel 2.4.33 \n * Linux kernel 2.4.33.1 \n * Linux kernel 2.4.33.4 \n * Linux kernel 2.4.33.5 \n * Linux kernel 2.4.33.7 \n * Linux kernel 2.4.34 \n * Linux kernel 2.4.34.1 \n * Linux kernel 2.4.34.2 \n * Linux kernel 2.4.34.3 \n * Linux kernel 2.4.34.5 \n * Linux kernel 2.4.34.6 \n * Linux kernel 2.4.35 \n * Linux kernel 2.4.35.2 \n * Linux kernel 2.4.35.3 \n * Linux kernel 2.4.36 \n * Linux kernel 2.4.36.1 \n * Linux kernel 2.4.36.4 \n * Linux kernel 2.4.36.5 \n * Linux kernel 2.4.36.6 \n * Linux kernel 2.4.36.7 \n * Linux kernel 2.4.36.8 \n * Linux kernel 2.4.36.9 \n * Linux kernel 2.4.37 \n * Linux kernel 2.4.37.5 \n * Linux kernel 2.4.37.6 \n * Linux kernel 2.4.37.7 \n * Linux kernel 2.4.37.8 \n * Linux kernel 2.4.37.9 \n * Linux kernel 2.4.4 \n * Linux kernel 2.4.5 \n * Linux kernel 2.4.6 \n * Linux kernel 2.4.7 \n * Linux kernel 2.4.8 \n * Linux kernel 2.4.9 \n * Linux kernel 2.5.1 \n * Linux kernel 2.5.10 \n * Linux kernel 2.5.11 \n * Linux kernel 2.5.12 \n * Linux kernel 2.5.13 \n * Linux kernel 2.5.14 \n * Linux kernel 2.5.15 \n * Linux kernel 2.5.16 \n * Linux kernel 2.5.17 \n * Linux kernel 2.5.18 \n * Linux kernel 2.5.19 \n * Linux kernel 2.5.2 \n * Linux kernel 2.5.20 \n * Linux kernel 2.5.21 \n * Linux kernel 2.5.22 \n * Linux kernel 2.5.23 \n * Linux kernel 2.5.24 \n * Linux kernel 2.5.25 \n * Linux kernel 2.5.26 \n * Linux kernel 2.5.27 \n * Linux kernel 2.5.28 \n * Linux kernel 2.5.29 \n * Linux kernel 2.5.3 \n * Linux kernel 2.5.30 \n * Linux kernel 2.5.31 \n * Linux kernel 2.5.32 \n * Linux kernel 2.5.33 \n * Linux kernel 2.5.34 \n * Linux kernel 2.5.35 \n * Linux kernel 2.5.36 \n * Linux kernel 2.5.37 \n * Linux kernel 2.5.38 \n * Linux kernel 2.5.39 \n * Linux kernel 2.5.4 \n * Linux kernel 2.5.40 \n * Linux kernel 2.5.41 \n * Linux kernel 2.5.42 \n * Linux kernel 2.5.43 \n * Linux kernel 2.5.44 \n * Linux kernel 2.5.45 \n * Linux kernel 2.5.46 \n * Linux kernel 2.5.47 \n * Linux kernel 2.5.48 \n * Linux kernel 2.5.49 \n * Linux kernel 2.5.5 \n * Linux kernel 2.5.50 \n * Linux kernel 2.5.51 \n * Linux kernel 2.5.52 \n * Linux kernel 2.5.53 \n * Linux kernel 2.5.54 \n * Linux kernel 2.5.55 \n * Linux kernel 2.5.56 \n * Linux kernel 2.5.57 \n * Linux kernel 2.5.58 \n * Linux kernel 2.5.59 \n * Linux kernel 2.5.6 \n * Linux kernel 2.5.60 \n * Linux kernel 2.5.61 \n * Linux kernel 2.5.62 \n * Linux kernel 2.5.63 \n * Linux kernel 2.5.64 \n * Linux kernel 2.5.65 \n * Linux kernel 2.5.66 \n * Linux kernel 2.5.67 \n * Linux kernel 2.5.68 \n * Linux kernel 2.5.69 \n * Linux kernel 2.5.7 \n * Linux kernel 2.5.8 \n * Linux kernel 2.5.9 \n * Linux kernel 2.6.0 \n * Linux kernel 2.6.1 \n * Linux kernel 2.6.10 \n * Linux kernel 2.6.11 \n * Linux kernel 2.6.11.1 \n * Linux kernel 2.6.11.10 \n * Linux kernel 2.6.11.11 \n * Linux kernel 2.6.11.12 \n * Linux kernel 2.6.11.2 \n * Linux kernel 2.6.11.3 \n * Linux kernel 2.6.11.4 \n * Linux kernel 2.6.11.5 \n * Linux kernel 2.6.11.6 \n * Linux kernel 2.6.11.7 \n * Linux kernel 2.6.11.8 \n * Linux kernel 2.6.11.9 \n * Linux kernel 2.6.12 \n * Linux kernel 2.6.12.1 \n * Linux kernel 2.6.12.2 \n * Linux kernel 2.6.12.3 \n * Linux kernel 2.6.12.4 \n * Linux kernel 2.6.12.5 \n * Linux kernel 2.6.12.6 \n * Linux kernel 2.6.13 \n * Linux kernel 2.6.13.1 \n * Linux kernel 2.6.13.2 \n * Linux kernel 2.6.13.3 \n * Linux kernel 2.6.13.4 \n * Linux kernel 2.6.13.5 \n * Linux kernel 2.6.14 .1 \n * Linux kernel 2.6.14 .2 \n * Linux kernel 2.6.14 .3 \n * Linux kernel 2.6.14 \n * Linux kernel 2.6.14.1 \n * Linux kernel 2.6.14.2 \n * Linux kernel 2.6.14.3 \n * Linux kernel 2.6.14.4 \n * Linux kernel 2.6.14.5 \n * Linux kernel 2.6.14.6 \n * Linux kernel 2.6.14.7 \n * Linux kernel 2.6.15 .4 \n * Linux kernel 2.6.15 \n * Linux kernel 2.6.15.1 \n * Linux kernel 2.6.15.11 \n * Linux kernel 2.6.15.2 \n * Linux kernel 2.6.15.3 \n * Linux kernel 2.6.15.4 \n * Linux kernel 2.6.15.5 \n * Linux kernel 2.6.15.6 \n * Linux kernel 2.6.15.7 \n * Linux kernel 2.6.16 .1 \n * Linux kernel 2.6.16 .23 \n * Linux kernel 2.6.16 \n * Linux kernel 2.6.16.10 \n * Linux kernel 2.6.16.11 \n * Linux kernel 2.6.16.12 \n * Linux kernel 2.6.16.13 \n * Linux kernel 2.6.16.14 \n * Linux kernel 2.6.16.15 \n * Linux kernel 2.6.16.16 \n * Linux kernel 2.6.16.17 \n * Linux kernel 2.6.16.18 \n * Linux kernel 2.6.16.19 \n * Linux kernel 2.6.16.2 \n * Linux kernel 2.6.16.20 \n * Linux kernel 2.6.16.21 \n * Linux kernel 2.6.16.22 \n * Linux kernel 2.6.16.24 \n * Linux kernel 2.6.16.25 \n * Linux kernel 2.6.16.26 \n * Linux kernel 2.6.16.27 \n * Linux kernel 2.6.16.28 \n * Linux kernel 2.6.16.29 \n * Linux kernel 2.6.16.3 \n * Linux kernel 2.6.16.30 \n * Linux kernel 2.6.16.31 \n * Linux kernel 2.6.16.32 \n * Linux kernel 2.6.16.33 \n * Linux kernel 2.6.16.34 \n * Linux kernel 2.6.16.35 \n * Linux kernel 2.6.16.36 \n * Linux kernel 2.6.16.37 \n * Linux kernel 2.6.16.38 \n * Linux kernel 2.6.16.39 \n * Linux kernel 2.6.16.4 \n * Linux kernel 2.6.16.40 \n * Linux kernel 2.6.16.41 \n * Linux kernel 2.6.16.43 \n * Linux kernel 2.6.16.44 \n * Linux kernel 2.6.16.45 \n * Linux kernel 2.6.16.46 \n * Linux kernel 2.6.16.47 \n * Linux kernel 2.6.16.48 \n * Linux kernel 2.6.16.49 \n * Linux kernel 2.6.16.5 \n * Linux kernel 2.6.16.50 \n * Linux kernel 2.6.16.51 \n * Linux kernel 2.6.16.52 \n * Linux kernel 2.6.16.53 \n * Linux kernel 2.6.16.6 \n * Linux kernel 2.6.16.7 \n * Linux kernel 2.6.16.8 \n * Linux kernel 2.6.16.9 \n * Linux kernel 2.6.17 .8 \n * Linux kernel 2.6.17 \n * Linux kernel 2.6.17.1 \n * Linux kernel 2.6.17.10 \n * Linux kernel 2.6.17.11 \n * Linux kernel 2.6.17.12 \n * Linux kernel 2.6.17.13 \n * Linux kernel 2.6.17.14 \n * Linux kernel 2.6.17.2 \n * Linux kernel 2.6.17.3 \n * Linux kernel 2.6.17.4 \n * Linux kernel 2.6.17.5 \n * Linux kernel 2.6.17.6 \n * Linux kernel 2.6.17.7 \n * Linux kernel 2.6.17.9 \n * Linux kernel 2.6.18 .1 \n * Linux kernel 2.6.18 \n * Linux kernel 2.6.18.1 \n * Linux kernel 2.6.18.2 \n * Linux kernel 2.6.18.3 \n * Linux kernel 2.6.18.4 \n * Linux kernel 2.6.18.5 \n * Linux kernel 2.6.18.6 \n * Linux kernel 2.6.18.7 \n * Linux kernel 2.6.18.8 \n * Linux kernel 2.6.19 \n * Linux kernel 2.6.19.1 \n * Linux kernel 2.6.19.2 \n * Linux kernel 2.6.19.3 \n * Linux kernel 2.6.19.4 \n * Linux kernel 2.6.2 \n * Linux kernel 2.6.20 \n * Linux kernel 2.6.20-2 \n * Linux kernel 2.6.20.1 \n * Linux kernel 2.6.20.10 \n * Linux kernel 2.6.20.11 \n * Linux kernel 2.6.20.12 \n * Linux kernel 2.6.20.13 \n * Linux kernel 2.6.20.14 \n * Linux kernel 2.6.20.15 \n * Linux kernel 2.6.20.2 \n * Linux kernel 2.6.20.3 \n * Linux kernel 2.6.20.4 \n * Linux kernel 2.6.20.5 \n * Linux kernel 2.6.20.6 \n * Linux kernel 2.6.20.7 \n * Linux kernel 2.6.20.8 \n * Linux kernel 2.6.20.9 \n * Linux kernel 2.6.21 .1 \n * Linux kernel 2.6.21 4 \n * Linux kernel 2.6.21 \n * Linux kernel 2.6.21.2 \n * Linux kernel 2.6.21.3 \n * Linux kernel 2.6.21.6 \n * Linux kernel 2.6.21.7 \n * Linux kernel 2.6.22 \n * Linux kernel 2.6.22.1 \n * Linux kernel 2.6.22.11 \n * Linux kernel 2.6.22.12 \n * Linux kernel 2.6.22.13 \n * Linux kernel 2.6.22.14 \n * Linux kernel 2.6.22.15 \n * Linux kernel 2.6.22.16 \n * Linux kernel 2.6.22.17 \n * Linux kernel 2.6.22.2 \n * Linux kernel 2.6.22.3 \n * Linux kernel 2.6.22.4 \n * Linux kernel 2.6.22.5 \n * Linux kernel 2.6.22.6 \n * Linux kernel 2.6.22.7 \n * Linux kernel 2.6.22.8 \n * Linux kernel 2.6.23 \n * Linux kernel 2.6.23.09 \n * Linux kernel 2.6.23.1 \n * Linux kernel 2.6.23.10 \n * Linux kernel 2.6.23.14 \n * Linux kernel 2.6.23.2 \n * Linux kernel 2.6.23.3 \n * Linux kernel 2.6.23.4 \n * Linux kernel 2.6.23.5 \n * Linux kernel 2.6.23.6 \n * Linux kernel 2.6.23.7 \n * Linux kernel 2.6.24 \n * Linux kernel 2.6.24.1 \n * Linux kernel 2.6.24.2 \n * Linux kernel 2.6.24.3 \n * Linux kernel 2.6.24.4 \n * Linux kernel 2.6.24.6 \n * Linux kernel 2.6.25 .15 \n * Linux kernel 2.6.25 19 \n * Linux kernel 2.6.25 \n * Linux kernel 2.6.25.1 \n * Linux kernel 2.6.25.10 \n * Linux kernel 2.6.25.11 \n * Linux kernel 2.6.25.12 \n * Linux kernel 2.6.25.13 \n * Linux kernel 2.6.25.2 \n * Linux kernel 2.6.25.3 \n * Linux kernel 2.6.25.4 \n * Linux kernel 2.6.25.5 \n * Linux kernel 2.6.25.6 \n * Linux kernel 2.6.25.7 \n * Linux kernel 2.6.25.8 \n * Linux kernel 2.6.25.9 \n * Linux kernel 2.6.26 7 \n * Linux kernel 2.6.26 \n * Linux kernel 2.6.26.1 \n * Linux kernel 2.6.26.3 \n * Linux kernel 2.6.26.4 \n * Linux kernel 2.6.26.5 \n * Linux kernel 2.6.26.6 \n * Linux kernel 2.6.27 12 \n * Linux kernel 2.6.27 3 \n * Linux kernel 2.6.27 6 \n * Linux kernel 2.6.27 \n * Linux kernel 2.6.27.12 \n * Linux kernel 2.6.27.13 \n * Linux kernel 2.6.27.14 \n * Linux kernel 2.6.27.24 \n * Linux kernel 2.6.27.26 \n * Linux kernel 2.6.27.46 \n * Linux kernel 2.6.27.49 \n * Linux kernel 2.6.27.51 \n * Linux kernel 2.6.27.54 \n * Linux kernel 2.6.27.8 \n * Linux kernel 2.6.28 \n * Linux kernel 2.6.28.1 \n * Linux kernel 2.6.28.10 \n * Linux kernel 2.6.28.2 \n * Linux kernel 2.6.28.3 \n * Linux kernel 2.6.28.4 \n * Linux kernel 2.6.28.5 \n * Linux kernel 2.6.28.6 \n * Linux kernel 2.6.28.8 \n * Linux kernel 2.6.28.9 \n * Linux kernel 2.6.29 \n * Linux kernel 2.6.29.1 \n * Linux kernel 2.6.29.4 \n * Linux kernel 2.6.3 \n * Linux kernel 2.6.30 \n * Linux kernel 2.6.30.1 \n * Linux kernel 2.6.30.10 \n * Linux kernel 2.6.30.3 \n * Linux kernel 2.6.30.4 \n * Linux kernel 2.6.30.5 \n * Linux kernel 2.6.31 \n * Linux kernel 2.6.31.1 \n * Linux kernel 2.6.31.11 \n * Linux kernel 2.6.31.13 \n * Linux kernel 2.6.31.2 \n * Linux kernel 2.6.31.4 \n * Linux kernel 2.6.31.5 \n * Linux kernel 2.6.31.6 \n * Linux kernel 2.6.32 \n * Linux kernel 2.6.32.1 \n * Linux kernel 2.6.32.10 \n * Linux kernel 2.6.32.11 \n * Linux kernel 2.6.32.12 \n * Linux kernel 2.6.32.13 \n * Linux kernel 2.6.32.14 \n * Linux kernel 2.6.32.15 \n * Linux kernel 2.6.32.16 \n * Linux kernel 2.6.32.17 \n * Linux kernel 2.6.32.18 \n * Linux kernel 2.6.32.2 \n * Linux kernel 2.6.32.22 \n * Linux kernel 2.6.32.28 \n * Linux kernel 2.6.32.3 \n * Linux kernel 2.6.32.4 \n * Linux kernel 2.6.32.5 \n * Linux kernel 2.6.32.6 \n * Linux kernel 2.6.32.60 \n * Linux kernel 2.6.32.61 \n * Linux kernel 2.6.32.62 \n * Linux kernel 2.6.32.7 \n * Linux kernel 2.6.32.8 \n * Linux kernel 2.6.32.9 \n * Linux kernel 2.6.33 \n * Linux kernel 2.6.33.1 \n * Linux kernel 2.6.33.7 \n * Linux kernel 2.6.34 \n * Linux kernel 2.6.34.1 \n * Linux kernel 2.6.34.13 \n * Linux kernel 2.6.34.14 \n * Linux kernel 2.6.34.2 \n * Linux kernel 2.6.34.3 \n * Linux kernel 2.6.35 \n * Linux kernel 2.6.35.1 \n * Linux kernel 2.6.35.13 \n * Linux kernel 2.6.35.4 \n * Linux kernel 2.6.35.5 \n * Linux kernel 2.6.36 \n * Linux kernel 2.6.37 \n * Linux kernel 2.6.37.2 \n * Linux kernel 2.6.38 \n * Linux kernel 2.6.38.2 \n * Linux kernel 2.6.38.3 \n * Linux kernel 2.6.38.4 \n * Linux kernel 2.6.38.6 \n * Linux kernel 2.6.39 \n * Linux kernel 2.6.4 \n * Linux kernel 2.6.5 \n * Linux kernel 2.6.6 \n * Linux kernel 2.6.7 \n * Linux kernel 2.6.8 \n * Linux kernel 2.6.9 \n * Linux kernel 3.0 \n * Linux kernel 3.0.1 \n * Linux kernel 3.0.18 \n * Linux kernel 3.0.2 \n * Linux kernel 3.0.34 \n * Linux kernel 3.0.37 \n * Linux kernel 3.0.4 \n * Linux kernel 3.0.5 \n * Linux kernel 3.0.58 \n * Linux kernel 3.0.59 \n * Linux kernel 3.0.60 \n * Linux kernel 3.0.62 \n * Linux kernel 3.0.65 \n * Linux kernel 3.0.66 \n * Linux kernel 3.0.69 \n * Linux kernel 3.0.72 \n * Linux kernel 3.0.75 \n * Linux kernel 3.0.98 \n * Linux kernel 3.1 \n * Linux kernel 3.1.8 \n * Linux kernel 3.10.0 \n * Linux kernel 3.10.1 \n * Linux kernel 3.10.10 \n * Linux kernel 3.10.14 \n * Linux kernel 3.10.17 \n * Linux kernel 3.10.20 \n * Linux kernel 3.10.21 \n * Linux kernel 3.10.22 \n * Linux kernel 3.10.23 \n * Linux kernel 3.10.26 \n * Linux kernel 3.10.27 \n * Linux kernel 3.10.30 \n * Linux kernel 3.10.31 \n * Linux kernel 3.10.36 \n * Linux kernel 3.10.37 \n * Linux kernel 3.10.38 \n * Linux kernel 3.10.41 \n * Linux kernel 3.10.43 \n * Linux kernel 3.10.45 \n * Linux kernel 3.10.5 \n * Linux kernel 3.10.7 \n * Linux kernel 3.10.73 \n * Linux kernel 3.10.81 \n * Linux kernel 3.10.9 \n * Linux kernel 3.10.90 \n * Linux kernel 3.11 \n * Linux kernel 3.11.3 \n * Linux kernel 3.11.6 \n * Linux kernel 3.11.9 \n * Linux kernel 3.12 \n * Linux kernel 3.12.1 \n * Linux kernel 3.12.11 \n * Linux kernel 3.12.12 \n * Linux kernel 3.12.14 \n * Linux kernel 3.12.15 \n * Linux kernel 3.12.16 \n * Linux kernel 3.12.17 \n * Linux kernel 3.12.18 \n * Linux kernel 3.12.2 \n * Linux kernel 3.12.21 \n * Linux kernel 3.12.22 \n * Linux kernel 3.12.3 \n * Linux kernel 3.12.4 \n * Linux kernel 3.12.40 \n * Linux kernel 3.12.44 \n * Linux kernel 3.12.48 \n * Linux kernel 3.12.49 \n * Linux kernel 3.12.7 \n * Linux kernel 3.13.0 \n * Linux kernel 3.13.1 \n * Linux kernel 3.13.11 \n * Linux kernel 3.13.3 \n * Linux kernel 3.13.4 \n * Linux kernel 3.13.5 \n * Linux kernel 3.13.6 \n * Linux kernel 3.13.7 \n * Linux kernel 3.13.9 \n * Linux kernel 3.14 \n * Linux kernel 3.14-1 \n * Linux kernel 3.14-4 \n * Linux kernel 3.14.2 \n * Linux kernel 3.14.3 \n * Linux kernel 3.14.37 \n * Linux kernel 3.14.4 \n * Linux kernel 3.14.45 \n * Linux kernel 3.14.5 \n * Linux kernel 3.14.54 \n * Linux kernel 3.14.7 \n * Linux kernel 3.14.73 \n * Linux kernel 3.14.79 \n * Linux kernel 3.15 \n * Linux kernel 3.15.10 \n * Linux kernel 3.15.2 \n * Linux kernel 3.15.5 \n * Linux kernel 3.15.6-200.fc20 \n * Linux kernel 3.16 \n * Linux kernel 3.16.0-28 \n * Linux kernel 3.16.1 \n * Linux kernel 3.16.2 \n * Linux kernel 3.16.36 \n * Linux kernel 3.16.58 \n * Linux kernel 3.16.6 \n * Linux kernel 3.16.7 \n * Linux kernel 3.17 \n * Linux kernel 3.17.2 \n * Linux kernel 3.17.4 \n * Linux kernel 3.17.6 \n * Linux kernel 3.18 \n * Linux kernel 3.18.1 \n * Linux kernel 3.18.11 \n * Linux kernel 3.18.137 \n * Linux kernel 3.18.140 \n * Linux kernel 3.18.17 \n * Linux kernel 3.18.2 \n * Linux kernel 3.18.22 \n * Linux kernel 3.18.3 \n * Linux kernel 3.18.7 \n * Linux kernel 3.18.8 \n * Linux kernel 3.18.9 \n * Linux kernel 3.19 \n * Linux kernel 3.19.2 \n * Linux kernel 3.19.3 \n * Linux kernel 3.2 \n * Linux kernel 3.2.1 \n * Linux kernel 3.2.102 \n * Linux kernel 3.2.12 \n * Linux kernel 3.2.13 \n * Linux kernel 3.2.2 \n * Linux kernel 3.2.23 \n * Linux kernel 3.2.24 \n * Linux kernel 3.2.38 \n * Linux kernel 3.2.42 \n * Linux kernel 3.2.44 \n * Linux kernel 3.2.50 \n * Linux kernel 3.2.51 \n * Linux kernel 3.2.52 \n * Linux kernel 3.2.53 \n * Linux kernel 3.2.54 \n * Linux kernel 3.2.55 \n * Linux kernel 3.2.56 \n * Linux kernel 3.2.57 \n * Linux kernel 3.2.60 \n * Linux kernel 3.2.62 \n * Linux kernel 3.2.63 \n * Linux kernel 3.2.63-2 \n * Linux kernel 3.2.64 \n * Linux kernel 3.2.65 \n * Linux kernel 3.2.72 \n * Linux kernel 3.2.78 \n * Linux kernel 3.2.81 \n * Linux kernel 3.2.82 \n * Linux kernel 3.2.9 \n * Linux kernel 3.3 \n * Linux kernel 3.3.2 \n * Linux kernel 3.3.4 \n * Linux kernel 3.3.5 \n * Linux kernel 3.4 \n * Linux kernel 3.4.1 \n * Linux kernel 3.4.10 \n * Linux kernel 3.4.11 \n * Linux kernel 3.4.12 \n * Linux kernel 3.4.13 \n * Linux kernel 3.4.14 \n * Linux kernel 3.4.15 \n * Linux kernel 3.4.16 \n * Linux kernel 3.4.17 \n * Linux kernel 3.4.18 \n * Linux kernel 3.4.19 \n * Linux kernel 3.4.2 \n * Linux kernel 3.4.20 \n * Linux kernel 3.4.21 \n * Linux kernel 3.4.25 \n * Linux kernel 3.4.26 \n * Linux kernel 3.4.27 \n * Linux kernel 3.4.29 \n * Linux kernel 3.4.3 \n * Linux kernel 3.4.31 \n * Linux kernel 3.4.32 \n * Linux kernel 3.4.36 \n * Linux kernel 3.4.4 \n * Linux kernel 3.4.42 \n * Linux kernel 3.4.5 \n * Linux kernel 3.4.58 \n * Linux kernel 3.4.6 \n * Linux kernel 3.4.64 \n * Linux kernel 3.4.67 \n * Linux kernel 3.4.7 \n * Linux kernel 3.4.70 \n * Linux kernel 3.4.71 \n * Linux kernel 3.4.72 \n * Linux kernel 3.4.73 \n * Linux kernel 3.4.76 \n * Linux kernel 3.4.8 \n * Linux kernel 3.4.80 \n * Linux kernel 3.4.81 \n * Linux kernel 3.4.86 \n * Linux kernel 3.4.87 \n * Linux kernel 3.4.88 \n * Linux kernel 3.4.9 \n * Linux kernel 3.4.93 \n * Linux kernel 3.5 \n * Linux kernel 3.5.1 \n * Linux kernel 3.5.2 \n * Linux kernel 3.5.3 \n * Linux kernel 3.5.4 \n * Linux kernel 3.5.5 \n * Linux kernel 3.5.6 \n * Linux kernel 3.5.7 \n * Linux kernel 3.6 \n * Linux kernel 3.6.1 \n * Linux kernel 3.6.10 \n * Linux kernel 3.6.11 \n * Linux kernel 3.6.2 \n * Linux kernel 3.6.3 \n * Linux kernel 3.6.4 \n * Linux kernel 3.6.5 \n * Linux kernel 3.6.6 \n * Linux kernel 3.6.7 \n * Linux kernel 3.6.8 \n * Linux kernel 3.6.9 \n * Linux kernel 3.7 \n * Linux kernel 3.7.1 \n * Linux kernel 3.7.10 \n * Linux kernel 3.7.2 \n * Linux kernel 3.7.3 \n * Linux kernel 3.7.4 \n * Linux kernel 3.7.5 \n * Linux kernel 3.7.6 \n * Linux kernel 3.7.7 \n * Linux kernel 3.7.8 \n * Linux kernel 3.7.9 \n * Linux kernel 3.8 \n * Linux kernel 3.8.1 \n * Linux kernel 3.8.2 \n * Linux kernel 3.8.4 \n * Linux kernel 3.8.5 \n * Linux kernel 3.8.6 \n * Linux kernel 3.8.9 \n * Linux kernel 3.9 \n * Linux kernel 3.9.4 \n * Linux kernel 3.9.8 \n * Linux kernel 4.0 \n * Linux kernel 4.0.5 \n * Linux kernel 4.0.6 \n * Linux kernel 4.1 \n * Linux kernel 4.1.1 \n * Linux kernel 4.1.15 \n * Linux kernel 4.1.4 \n * Linux kernel 4.1.47 \n * Linux kernel 4.1.51 \n * Linux kernel 4.10.0 \n * Linux kernel 4.10.1 \n * Linux kernel 4.10.10 \n * Linux kernel 4.10.11 \n * Linux kernel 4.10.12 \n * Linux kernel 4.10.13 \n * Linux kernel 4.10.15 \n * Linux kernel 4.10.2 \n * Linux kernel 4.10.3 \n * Linux kernel 4.10.4 \n * Linux kernel 4.10.5 \n * Linux kernel 4.10.6 \n * Linux kernel 4.10.7 \n * Linux kernel 4.10.8 \n * Linux kernel 4.10.9 \n * Linux kernel 4.11.0 \n * Linux kernel 4.11.1 \n * Linux kernel 4.11.2 \n * Linux kernel 4.11.3 \n * Linux kernel 4.11.4 \n * Linux kernel 4.11.5 \n * Linux kernel 4.11.7 \n * Linux kernel 4.11.8 \n * Linux kernel 4.11.9 \n * Linux kernel 4.12 \n * Linux kernel 4.12.1 \n * Linux kernel 4.12.10 \n * Linux kernel 4.12.2 \n * Linux kernel 4.12.3 \n * Linux kernel 4.12.4 \n * Linux kernel 4.12.9 \n * Linux kernel 4.13 \n * Linux kernel 4.13.1 \n * Linux kernel 4.13.10 \n * Linux kernel 4.13.11 \n * Linux kernel 4.13.14 \n * Linux kernel 4.13.2 \n * Linux kernel 4.13.3 \n * Linux kernel 4.13.4 \n * Linux kernel 4.13.5 \n * Linux kernel 4.13.6 \n * Linux kernel 4.13.7 \n * Linux kernel 4.13.8 \n * Linux kernel 4.13.9 \n * Linux kernel 4.14 \n * Linux kernel 4.14.1 \n * Linux kernel 4.14.10 \n * Linux kernel 4.14.109 \n * Linux kernel 4.14.11 \n * Linux kernel 4.14.114 \n * Linux kernel 4.14.120 \n * Linux kernel 4.14.13 \n * Linux kernel 4.14.14 \n * Linux kernel 4.14.15 \n * Linux kernel 4.14.2 \n * Linux kernel 4.14.25 \n * Linux kernel 4.14.3 \n * Linux kernel 4.14.31 \n * Linux kernel 4.14.4 \n * Linux kernel 4.14.5 \n * Linux kernel 4.14.6 \n * Linux kernel 4.14.67 \n * Linux kernel 4.14.7 \n * Linux kernel 4.14.71 \n * Linux kernel 4.14.78 \n * Linux kernel 4.14.8 \n * Linux kernel 4.14.90 \n * Linux kernel 4.15.0 \n * Linux kernel 4.15.11 \n * Linux kernel 4.15.14 \n * Linux kernel 4.15.16 \n * Linux kernel 4.15.4 \n * Linux kernel 4.15.7 \n * Linux kernel 4.15.8 \n * Linux kernel 4.15.9 \n * Linux kernel 4.16 \n * Linux kernel 4.16.11 \n * Linux kernel 4.16.3 \n * Linux kernel 4.16.4 \n * Linux kernel 4.16.6 \n * Linux kernel 4.16.7 \n * Linux kernel 4.16.9 \n * Linux kernel 4.17 \n * Linux kernel 4.17.1 \n * Linux kernel 4.17.10 \n * Linux kernel 4.17.11 \n * Linux kernel 4.17.2 \n * Linux kernel 4.17.3 \n * Linux kernel 4.17.4 \n * Linux kernel 4.17.7 \n * Linux kernel 4.18 \n * Linux kernel 4.18.1 \n * Linux kernel 4.18.11 \n * Linux kernel 4.18.12 \n * Linux kernel 4.18.16 \n * Linux kernel 4.18.5 \n * Linux kernel 4.18.6 \n * Linux kernel 4.18.7 \n * Linux kernel 4.18.9 \n * Linux kernel 4.19 \n * Linux kernel 4.19.13 \n * Linux kernel 4.19.19 \n * Linux kernel 4.19.2 \n * Linux kernel 4.19.23 \n * Linux kernel 4.19.3 \n * Linux kernel 4.19.32 \n * Linux kernel 4.19.37 \n * Linux kernel 4.19.44 \n * Linux kernel 4.19.6 \n * Linux kernel 4.19.8 \n * Linux kernel 4.19.9 \n * Linux kernel 4.2 \n * Linux kernel 4.2.3 \n * Linux kernel 4.2.8 \n * Linux kernel 4.20 \n * Linux kernel 4.20.10 \n * Linux kernel 4.20.12 \n * Linux kernel 4.20.14 \n * Linux kernel 4.20.15 \n * Linux kernel 4.20.2 \n * Linux kernel 4.20.5 \n * Linux kernel 4.20.6 \n * Linux kernel 4.20.8 \n * Linux kernel 4.3.3 \n * Linux kernel 4.4 \n * Linux kernel 4.4.0-57 \n * Linux kernel 4.4.1 \n * Linux kernel 4.4.105 \n * Linux kernel 4.4.121 \n * Linux kernel 4.4.125 \n * Linux kernel 4.4.14 \n * Linux kernel 4.4.157 \n * Linux kernel 4.4.177 \n * Linux kernel 4.4.180 \n * Linux kernel 4.4.194 \n * Linux kernel 4.4.195 \n * Linux kernel 4.4.2 \n * Linux kernel 4.4.22 \n * Linux kernel 4.4.23 \n * Linux kernel 4.4.24 \n * Linux kernel 4.4.25 \n * Linux kernel 4.4.26 \n * Linux kernel 4.4.27 \n * Linux kernel 4.4.28 \n * Linux kernel 4.4.29 \n * Linux kernel 4.4.30 \n * Linux kernel 4.4.38 \n * Linux kernel 4.4.7 \n * Linux kernel 4.5 \n * Linux kernel 4.5.5 \n * Linux kernel 4.6 \n * Linux kernel 4.6.1 \n * Linux kernel 4.6.2 \n * Linux kernel 4.6.3 \n * Linux kernel 4.7 \n * Linux kernel 4.7.4 \n * Linux kernel 4.7.9 \n * Linux kernel 4.8 \n * Linux kernel 4.8.1 \n * Linux kernel 4.8.11 \n * Linux kernel 4.8.12 \n * Linux kernel 4.8.13 \n * Linux kernel 4.8.14 \n * Linux kernel 4.8.3 \n * Linux kernel 4.8.6 \n * Linux kernel 4.8.7 \n * Linux kernel 4.9.0 \n * Linux kernel 4.9.11 \n * Linux kernel 4.9.128 \n * Linux kernel 4.9.13 \n * Linux kernel 4.9.135 \n * Linux kernel 4.9.166 \n * Linux kernel 4.9.177 \n * Linux kernel 4.9.3 \n * Linux kernel 4.9.36 \n * Linux kernel 4.9.4 \n * Linux kernel 4.9.53 \n * Linux kernel 4.9.6 \n * Linux kernel 4.9.68 \n * Linux kernel 4.9.71 \n * Linux kernel 4.9.74 \n * Linux kernel 4.9.8 \n * Linux kernel 4.9.87 \n * Linux kernel 4.9.9 \n * Linux kernel 4.9.91 \n * Linux kernel 5.0 \n * Linux kernel 5.0.1 \n * Linux kernel 5.0.10 \n * Linux kernel 5.0.11 \n * Linux kernel 5.0.14 \n * Linux kernel 5.0.15 \n * Linux kernel 5.0.17 \n * Linux kernel 5.0.2 \n * Linux kernel 5.0.21 \n * Linux kernel 5.0.3 \n * Linux kernel 5.0.4 \n * Linux kernel 5.0.5 \n * Linux kernel 5.0.6 \n * Linux kernel 5.0.7 \n * Linux kernel 5.0.8 \n * Linux kernel 5.0.9 \n * Linux kernel 5.1 \n * Linux kernel 5.1.12 \n * Linux kernel 5.1.13 \n * Linux kernel 5.1.14 \n * Linux kernel 5.1.15 \n * Linux kernel 5.1.17 \n * Linux kernel 5.1.2 \n * Linux kernel 5.1.3 \n * Linux kernel 5.1.5 \n * Linux kernel 5.1.6 \n * Linux kernel 5.1.7 \n * Linux kernel 5.1.8 \n * Linux kernel 5.1.9 \n * Linux kernel 5.2.1 \n * Linux kernel 5.2.10 \n * Linux kernel 5.2.13 \n * Linux kernel 5.2.14 \n * Linux kernel 5.2.17 \n * Linux kernel 5.2.2 \n * Linux kernel 5.2.3 \n * Linux kernel 5.2.6 \n * Linux kernel 5.2.8 \n * Linux kernel 5.2.9 \n\n### Recommendations\n\n**Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.** \nAllow only trusted individuals to have user accounts and local access to the resources. \n\n**Run all software as a nonprivileged user with minimal access rights.** \nTo reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights. \n\nCurrently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com.\n", "modified": "2020-12-11T00:00:00", "published": "2020-12-11T00:00:00", "id": "SMNTC-111398", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/111398", "type": "symantec", "title": "Linux Kernel CVE-2019-5108 Denial of Service Vulnerability", "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}}], "nessus": [{"lastseen": "2020-10-16T10:18:18", "description": "This update for the Linux Kernel 3.12.74-60_64_124 fixes several\nissues.\n\nThe following security issues were fixed :\n\nCVE-2020-1749: Fixed an issue in the networking protocols in encrypted\nIPsec tunnel (bsc#1165631)\n\nCVE-2019-5108: Fixed an issue where by triggering AP to send IAPP\nlocation updates for stations before the required authentication\nprocess has completed could have led to denial-of-service\n(bsc#1159913).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 3, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2020-04-06T00:00:00", "title": "SUSE SLES12 Security Update : kernel (SUSE-SU-2020:0868-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2020-1749"], "modified": "2020-04-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_107-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_124-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_104-default", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_97-default-debuginfo", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_117-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_113-default-debuginfo", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_109-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_176-94_88-default-debuginfo", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_118-xen", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default-debuginfo", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_125-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_115-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_115-xen", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_114-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_176-94_88-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_110-xen", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_113-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_118-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_107-default-debuginfo", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_121-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_100-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_97-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_178-94_91-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_100-default-debuginfo", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_124-xen", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_120-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_121-xen", "p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_178-94_91-default-debuginfo", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_110-default"], "id": "SUSE_SU-2020-0868-1.NASL", "href": "https://www.tenable.com/plugins/nessus/135224", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2020:0868-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(135224);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/10/15\");\n\n script_cve_id(\"CVE-2019-5108\", \"CVE-2020-1749\");\n\n script_name(english:\"SUSE SLES12 Security Update : kernel (SUSE-SU-2020:0868-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for the Linux Kernel 3.12.74-60_64_124 fixes several\nissues.\n\nThe following security issues were fixed :\n\nCVE-2020-1749: Fixed an issue in the networking protocols in encrypted\nIPsec tunnel (bsc#1165631)\n\nCVE-2019-5108: Fixed an issue where by triggering AP to send IAPP\nlocation updates for stations before the required authentication\nprocess has completed could have led to denial-of-service\n(bsc#1159913).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1159913\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165631\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-5108/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-1749/\"\n );\n # https://www.suse.com/support/update/announcement/2020/suse-su-20200868-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0fe77d5f\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server for SAP 12-SP3:zypper in -t patch\nSUSE-SLE-SAP-12-SP3-2020-861=1 SUSE-SLE-SAP-12-SP3-2020-903=1\nSUSE-SLE-SAP-12-SP3-2020-904=1 SUSE-SLE-SAP-12-SP3-2020-905=1\nSUSE-SLE-SAP-12-SP3-2020-906=1 SUSE-SLE-SAP-12-SP3-2020-907=1\nSUSE-SLE-SAP-12-SP3-2020-908=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch\nSUSE-SLE-SAP-12-SP2-2020-862=1 SUSE-SLE-SAP-12-SP2-2020-863=1\nSUSE-SLE-SAP-12-SP2-2020-864=1 SUSE-SLE-SAP-12-SP2-2020-865=1\nSUSE-SLE-SAP-12-SP2-2020-866=1 SUSE-SLE-SAP-12-SP2-2020-867=1\n\nSUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch\nSUSE-SLE-SAP-12-SP1-2020-868=1 SUSE-SLE-SAP-12-SP1-2020-869=1\nSUSE-SLE-SAP-12-SP1-2020-870=1 SUSE-SLE-SAP-12-SP1-2020-871=1\nSUSE-SLE-SAP-12-SP1-2020-872=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2020-861=1 SUSE-SLE-SERVER-12-SP3-2020-903=1\nSUSE-SLE-SERVER-12-SP3-2020-904=1 SUSE-SLE-SERVER-12-SP3-2020-905=1\nSUSE-SLE-SERVER-12-SP3-2020-906=1 SUSE-SLE-SERVER-12-SP3-2020-907=1\nSUSE-SLE-SERVER-12-SP3-2020-908=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2020-862=1 SUSE-SLE-SERVER-12-SP2-2020-863=1\nSUSE-SLE-SERVER-12-SP2-2020-864=1 SUSE-SLE-SERVER-12-SP2-2020-865=1\nSUSE-SLE-SERVER-12-SP2-2020-866=1 SUSE-SLE-SERVER-12-SP2-2020-867=1\n\nSUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2020-868=1 SUSE-SLE-SERVER-12-SP1-2020-869=1\nSUSE-SLE-SERVER-12-SP1-2020-870=1 SUSE-SLE-SERVER-12-SP1-2020-871=1\nSUSE-SLE-SERVER-12-SP1-2020-872=1\n\nSUSE Linux Enterprise Module for Live Patching 15-SP1:zypper in -t\npatch SUSE-SLE-Module-Live-Patching-15-SP1-2020-874=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-875=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-876=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-877=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-878=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-879=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-880=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-881=1\nSUSE-SLE-Module-Live-Patching-15-SP1-2020-882=1\n\nSUSE Linux Enterprise Module for Live Patching 15:zypper in -t patch\nSUSE-SLE-Module-Live-Patching-15-2020-883=1\nSUSE-SLE-Module-Live-Patching-15-2020-884=1\nSUSE-SLE-Module-Live-Patching-15-2020-885=1\nSUSE-SLE-Module-Live-Patching-15-2020-886=1\nSUSE-SLE-Module-Live-Patching-15-2020-887=1\nSUSE-SLE-Module-Live-Patching-15-2020-888=1\nSUSE-SLE-Module-Live-Patching-15-2020-889=1\nSUSE-SLE-Module-Live-Patching-15-2020-890=1\n\nSUSE Linux Enterprise Live Patching 12-SP5:zypper in -t patch\nSUSE-SLE-Live-Patching-12-SP5-2020-892=1\nSUSE-SLE-Live-Patching-12-SP5-2020-893=1\nSUSE-SLE-Live-Patching-12-SP5-2020-909=1\n\nSUSE Linux Enterprise Live Patching 12-SP4:zypper in -t patch\nSUSE-SLE-Live-Patching-12-SP4-2020-895=1\nSUSE-SLE-Live-Patching-12-SP4-2020-896=1\nSUSE-SLE-Live-Patching-12-SP4-2020-897=1\nSUSE-SLE-Live-Patching-12-SP4-2020-898=1\nSUSE-SLE-Live-Patching-12-SP4-2020-899=1\nSUSE-SLE-Live-Patching-12-SP4-2020-900=1\nSUSE-SLE-Live-Patching-12-SP4-2020-901=1\nSUSE-SLE-Live-Patching-12-SP4-2020-902=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-1749\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_110-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_110-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_115-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_115-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_118-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_118-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_121-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_121-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_124-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_74-60_64_124-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_104-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_109-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_114-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_117-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_120-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_125-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_176-94_88-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_176-94_88-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_178-94_91-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_178-94_91-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_100-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_100-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_103-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_107-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_107-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_113-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_113-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_97-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_180-94_97-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1|2|3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1/2/3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_110-default-9-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_110-xen-9-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_115-default-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_115-xen-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_118-default-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_118-xen-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_121-default-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_121-xen-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_124-default-4-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_74-60_64_124-xen-4-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_176-94_88-default-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_176-94_88-default-debuginfo-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_178-94_91-default-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_178-94_91-default-debuginfo-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_100-default-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_100-default-debuginfo-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_103-default-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_103-default-debuginfo-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_107-default-4-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_107-default-debuginfo-4-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_113-default-3-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_113-default-debuginfo-3-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_97-default-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_180-94_97-default-debuginfo-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_121-92_104-default-9-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_121-92_109-default-9-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_121-92_114-default-8-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_121-92_117-default-7-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_121-92_120-default-6-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kgraft-patch-4_4_121-92_125-default-4-2.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-11-21T05:59:23", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1493 advisory.\n\n - kernel: heap-based buffer overflow in mwifiex_process_country_ie() function in drivers/net/wireless/marvell/mwifiex/sta_ioctl.c (CVE-2019-14895)\n\n - kernel: heap overflow in marvell/mwifiex/tdls.c (CVE-2019-14901)\n\n - kernel: powerpc: local user can read vector registers of other users' processes via an interrupt (CVE-2019-15031)\n\n - kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash (CVE-2019-15099)\n\n - kernel: out-of-bounds array access in\n __xfrm_policy_unlink (CVE-2019-15666)\n\n - kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound applications (CVE-2019-19922)\n\n - kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)\n\n - kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c (CVE-2019-20095)\n\n - kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS (CVE-2019-5108)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "edition": 4, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-04-16T00:00:00", "title": "RHEL 7 : kernel-alt (RHSA-2020:1493)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-20095", "CVE-2019-15666", "CVE-2019-14901", "CVE-2019-19922", "CVE-2019-15099", "CVE-2019-14895", "CVE-2019-15031", "CVE-2019-20054"], "modified": "2020-04-16T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:7::server", "p-cpe:/a:redhat:enterprise_linux:kernel-kdump", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists", "p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-headers", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs", "p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-bootwrapper", "p-cpe:/a:redhat:enterprise_linux:kernel-tools", "p-cpe:/a:redhat:enterprise_linux:kernel", "p-cpe:/a:redhat:enterprise_linux:python-perf", "p-cpe:/a:redhat:enterprise_linux:perf"], "id": "REDHAT-RHSA-2020-1493.NASL", "href": "https://www.tenable.com/plugins/nessus/135685", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:1493. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(135685);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/11/19\");\n\n script_cve_id(\n \"CVE-2019-5108\",\n \"CVE-2019-14895\",\n \"CVE-2019-14901\",\n \"CVE-2019-15031\",\n \"CVE-2019-15099\",\n \"CVE-2019-15666\",\n \"CVE-2019-19922\",\n \"CVE-2019-20054\",\n \"CVE-2019-20095\"\n );\n script_xref(name:\"RHSA\", value:\"2020:1493\");\n\n script_name(english:\"RHEL 7 : kernel-alt (RHSA-2020:1493)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1493 advisory.\n\n - kernel: heap-based buffer overflow in mwifiex_process_country_ie() function in drivers/net/wireless/marvell/mwifiex/sta_ioctl.c (CVE-2019-14895)\n\n - kernel: heap overflow in marvell/mwifiex/tdls.c (CVE-2019-14901)\n\n - kernel: powerpc: local user can read vector registers of other users' processes via an interrupt (CVE-2019-15031)\n\n - kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash (CVE-2019-15099)\n\n - kernel: out-of-bounds array access in\n __xfrm_policy_unlink (CVE-2019-15666)\n\n - kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound applications (CVE-2019-19922)\n\n - kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)\n\n - kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c (CVE-2019-20095)\n\n - kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS (CVE-2019-5108)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/20.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/119.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/122.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/200.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/400.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/440.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/772.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-5108\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-14895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-14901\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-15031\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-15099\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-15666\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-19922\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-20054\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-20095\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:1493\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1743560\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1747334\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1760063\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1773519\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1774870\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1789927\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1790063\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1791954\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1792512\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-14901\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(20, 119, 122, 200, 400, 440, 772);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/05/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/16\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7::server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-bootwrapper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-kdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-perf\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('ksplice.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nrepositories = {\n 'enterprise_linux_7_server': [\n 'rhel-7-for-arm-64-debug-rpms',\n 'rhel-7-for-arm-64-optional-debug-rpms',\n 'rhel-7-for-arm-64-optional-rpms',\n 'rhel-7-for-arm-64-optional-source-rpms',\n 'rhel-7-for-arm-64-rpms',\n 'rhel-7-for-arm-64-source-rpms',\n 'rhel-7-for-system-z-a-debug-rpms',\n 'rhel-7-for-system-z-a-optional-debug-rpms',\n 'rhel-7-for-system-z-a-optional-rpms',\n 'rhel-7-for-system-z-a-optional-source-rpms',\n 'rhel-7-for-system-z-a-rpms',\n 'rhel-7-for-system-z-a-source-rpms',\n 'rhel-7-for-system-z-debug-rpms',\n 'rhel-7-for-system-z-fastrack-debug-rpms',\n 'rhel-7-for-system-z-fastrack-rpms',\n 'rhel-7-for-system-z-fastrack-source-rpms',\n 'rhel-7-for-system-z-optional-debug-rpms',\n 'rhel-7-for-system-z-optional-fastrack-debug-rpms',\n 'rhel-7-for-system-z-optional-fastrack-rpms',\n 'rhel-7-for-system-z-optional-fastrack-source-rpms',\n 'rhel-7-for-system-z-optional-rpms',\n 'rhel-7-for-system-z-optional-source-rpms',\n 'rhel-7-for-system-z-rpms',\n 'rhel-7-for-system-z-source-rpms',\n 'rhel-7-server-debug-rpms',\n 'rhel-7-server-fastrack-debug-rpms',\n 'rhel-7-server-fastrack-rpms',\n 'rhel-7-server-fastrack-source-rpms',\n 'rhel-7-server-optional-debug-rpms',\n 'rhel-7-server-optional-fastrack-debug-rpms',\n 'rhel-7-server-optional-fastrack-rpms',\n 'rhel-7-server-optional-fastrack-source-rpms',\n 'rhel-7-server-optional-rpms',\n 'rhel-7-server-optional-source-rpms',\n 'rhel-7-server-rpms',\n 'rhel-7-server-source-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-source-rpms',\n 'rhel-ha-for-rhel-7-server-debug-rpms',\n 'rhel-ha-for-rhel-7-server-rpms',\n 'rhel-ha-for-rhel-7-server-source-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-source-rpms',\n 'rhel-rs-for-rhel-7-server-debug-rpms',\n 'rhel-rs-for-rhel-7-server-rpms',\n 'rhel-rs-for-rhel-7-server-source-rpms'\n ]\n};\n\nfound_repos = NULL;\nhost_repo_list = get_kb_list('Host/RedHat/repo-list/*');\nif (!(empty_or_null(host_repo_list))) {\n found_repos = make_list();\n foreach repo_key (keys(repositories)) {\n foreach repo ( repositories[repo_key] ) {\n if (get_kb_item('Host/RedHat/repo-list/' + repo)) {\n append_element(var:found_repos, value:repo_key);\n break;\n }\n }\n }\n if(empty_or_null(found_repos)) audit(AUDIT_RHSA_NOT_AFFECTED, 'RHSA-2020:1493');\n}\n\nif (get_one_kb_item('Host/ksplice/kernel-cves'))\n{\n rm_kb_item(name:'Host/uptrack-uname-r');\n cve_list = make_list('CVE-2019-5108', 'CVE-2019-14895', 'CVE-2019-14901', 'CVE-2019-15031', 'CVE-2019-15099', 'CVE-2019-15666', 'CVE-2019-19922', 'CVE-2019-20054', 'CVE-2019-20095');\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for RHSA-2020:1493');\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\npkgs = [\n {'reference':'kernel-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-abi-whitelists-4.14.0-115.19.1.el7a', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-debug-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-debug-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-debug-devel-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-debug-devel-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-devel-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-devel-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-headers-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-headers-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-kdump-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-kdump-devel-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-tools-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-tools-libs-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'kernel-tools-libs-devel-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'perf-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'perf-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'python-perf-4.14.0-115.19.1.el7a', 'cpu':'aarch64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']},\n {'reference':'python-perf-4.14.0-115.19.1.el7a', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_7_server']}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n repo_list = NULL;\n if (!empty_or_null(package_array['repo_list'])) repo_list = package_array['repo_list'];\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n repocheck = FALSE;\n if (empty_or_null(found_repos))\n {\n repocheck = TRUE;\n }\n else\n {\n foreach repo (repo_list) {\n if (contains_element(var:found_repos, value:repo))\n {\n repocheck = TRUE;\n break;\n }\n }\n }\n if (repocheck && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n if (empty_or_null(host_repo_list)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc');\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-18T11:03:50", "description": "It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors.\nA local attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices\ndid not properly check for errors in certain situations, leading to a\nNULL pointer dereference. A local attacker could possibly use this to\ncause a denial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in\nthe Linux kernel did not properly check for errors in certain\nsituations, leading to a NULL pointer dereference. A local attacker\ncould possibly use this to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF)\ndriver in the Linux kernel did not properly initialize data. A local\nattacker could possibly use this to expose sensitive information\n(kernel memory). (CVE-2019-18786).\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that multiple memory leaks existed in the Marvell\nWiFi-Ex Driver for the Linux kernel. A local attacker could possibly\nuse this to cause a denial of service (kernel memory exhaustion).\n(CVE-2019-19057)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the Kvaser CAN/USB driver in the Linux kernel\ndid not properly initialize memory in certain situations. A local\nattacker could possibly use this to expose sensitive information\n(kernel memory). (CVE-2019-19947)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer\ndereference. A local attacker could possibly use this to cause a\ndenial of service (system crash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory\nin certain error conditions. An attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux\nkernel when used as an access point would send IAPP location updates\nfor stations before client authentication had completed. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free\nwhile destroying GEM contexts in the i915 driver for the Linux kernel.\nA local attacker could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2020-7053).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 3, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-02-19T00:00:00", "title": "Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4285-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19965", "CVE-2019-14615", "CVE-2019-19947", "CVE-2019-19063", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-20096"], "modified": "2020-02-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-gcp", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-oracle", "p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-5.0", "p-cpe:/a:canonical:ubuntu_linux:linux-image-azure"], "id": "UBUNTU_USN-4285-1.NASL", "href": "https://www.tenable.com/plugins/nessus/133798", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4285-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(133798);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/17\");\n\n script_cve_id(\"CVE-2019-14615\", \"CVE-2019-16229\", \"CVE-2019-16232\", \"CVE-2019-18786\", \"CVE-2019-18809\", \"CVE-2019-19057\", \"CVE-2019-19063\", \"CVE-2019-19947\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2020-7053\");\n script_xref(name:\"USN\", value:\"4285-1\");\n\n script_name(english:\"Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4285-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors.\nA local attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices\ndid not properly check for errors in certain situations, leading to a\nNULL pointer dereference. A local attacker could possibly use this to\ncause a denial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in\nthe Linux kernel did not properly check for errors in certain\nsituations, leading to a NULL pointer dereference. A local attacker\ncould possibly use this to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF)\ndriver in the Linux kernel did not properly initialize data. A local\nattacker could possibly use this to expose sensitive information\n(kernel memory). (CVE-2019-18786).\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that multiple memory leaks existed in the Marvell\nWiFi-Ex Driver for the Linux kernel. A local attacker could possibly\nuse this to cause a denial of service (kernel memory exhaustion).\n(CVE-2019-19057)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the Kvaser CAN/USB driver in the Linux kernel\ndid not properly initialize memory in certain situations. A local\nattacker could possibly use this to expose sensitive information\n(kernel memory). (CVE-2019-19947)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer\ndereference. A local attacker could possibly use this to cause a\ndenial of service (system crash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory\nin certain error conditions. An attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux\nkernel when used as an access point would send IAPP location updates\nfor stations before client authentication had completed. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free\nwhile destroying GEM contexts in the i915 driver for the Linux kernel.\nA local attacker could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2020-7053).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4285-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-7053\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-5.0-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-5.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/02/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/02/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(18\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 18.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2019-14615\", \"CVE-2019-16229\", \"CVE-2019-16232\", \"CVE-2019-18786\", \"CVE-2019-18809\", \"CVE-2019-19057\", \"CVE-2019-19063\", \"CVE-2019-19947\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2020-7053\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-4285-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-5.0.0-1011-oracle\", pkgver:\"5.0.0-1011.16\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-5.0.0-1025-aws\", pkgver:\"5.0.0-1025.28\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-5.0.0-1030-gke\", pkgver:\"5.0.0-1030.31\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-5.0.0-1031-gcp\", pkgver:\"5.0.0-1031.32\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-5.0.0-1032-azure\", pkgver:\"5.0.0-1032.34\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-azure\", pkgver:\"5.0.0.1032.43\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gcp\", pkgver:\"5.0.0.1031.35\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gke-5.0\", pkgver:\"5.0.0.1030.18\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-5.0-aws / linux-image-5.0-azure / linux-image-5.0-gcp / etc\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-18T11:03:50", "description": "It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors.\nA local attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that a race condition existed in the Softmac USB\nPrism54 device driver in the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nJulien Grall discovered that the Xen balloon memory driver in the\nLinux kernel did not properly restrict the amount of memory set aside\nfor page mappings in some situations. An attacker could use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-17351)\n\nIt was discovered that the Intel WiMAX 2400 driver in the Linux kernel\ndid not properly deallocate memory in certain situations. A local\nattacker could use this to cause a denial of service (kernel memory\nexhaustion). (CVE-2019-19051)\n\nIt was discovered that the Marvell Wi-Fi device driver in the Linux\nkernel did not properly deallocate memory in certain error conditions.\nA local attacker could use this to possibly cause a denial of service\n(kernel memory exhaustion). (CVE-2019-19056)\n\nIt was discovered that the Brocade BFA Fibre Channel device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19066)\n\nIt was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19068)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer\ndereference. A local attacker could possibly use this to cause a\ndenial of service (system crash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory\nin certain error conditions. An attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux\nkernel when used as an access point would send IAPP location updates\nfor stations before client authentication had completed. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-5108)\n\nIt was discovered that ZR364XX Camera USB device driver for the Linux\nkernel did not properly initialize memory. A physically proximate\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-15217)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux\nkernel did not properly validate data size information from the\ndevice. A physically proximate attacker could use this to cause a\ndenial of service (system crash). (CVE-2019-15221).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 3, "cvss3": {"score": 5.5, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2020-02-19T00:00:00", "title": "Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4286-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-15217", "CVE-2019-19051", "CVE-2019-19965", "CVE-2019-14615", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-19066", "CVE-2019-17351", "CVE-2019-19068", "CVE-2019-19056", "CVE-2019-20096"], "modified": "2020-02-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic"], "id": "UBUNTU_USN-4286-1.NASL", "href": "https://www.tenable.com/plugins/nessus/133799", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4286-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(133799);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/17\");\n\n script_cve_id(\"CVE-2019-14615\", \"CVE-2019-15217\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-17351\", \"CVE-2019-19051\", \"CVE-2019-19056\", \"CVE-2019-19066\", \"CVE-2019-19068\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\");\n script_xref(name:\"USN\", value:\"4286-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4286-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors.\nA local attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that a race condition existed in the Softmac USB\nPrism54 device driver in the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-15220)\n\nJulien Grall discovered that the Xen balloon memory driver in the\nLinux kernel did not properly restrict the amount of memory set aside\nfor page mappings in some situations. An attacker could use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-17351)\n\nIt was discovered that the Intel WiMAX 2400 driver in the Linux kernel\ndid not properly deallocate memory in certain situations. A local\nattacker could use this to cause a denial of service (kernel memory\nexhaustion). (CVE-2019-19051)\n\nIt was discovered that the Marvell Wi-Fi device driver in the Linux\nkernel did not properly deallocate memory in certain error conditions.\nA local attacker could use this to possibly cause a denial of service\n(kernel memory exhaustion). (CVE-2019-19056)\n\nIt was discovered that the Brocade BFA Fibre Channel device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19066)\n\nIt was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19068)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer\ndereference. A local attacker could possibly use this to cause a\ndenial of service (system crash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory\nin certain error conditions. An attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux\nkernel when used as an access point would send IAPP location updates\nfor stations before client authentication had completed. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-5108)\n\nIt was discovered that ZR364XX Camera USB device driver for the Linux\nkernel did not properly initialize memory. A physically proximate\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-15217)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux\nkernel did not properly validate data size information from the\ndevice. A physically proximate attacker could use this to cause a\ndenial of service (system crash). (CVE-2019-15221).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4286-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-14615\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/08/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/02/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/02/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2019-14615\", \"CVE-2019-15217\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-17351\", \"CVE-2019-19051\", \"CVE-2019-19056\", \"CVE-2019-19066\", \"CVE-2019-19068\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-4286-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1066-kvm\", pkgver:\"4.4.0-1066.73\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1102-aws\", pkgver:\"4.4.0-1102.113\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1129-raspi2\", pkgver:\"4.4.0-1129.138\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1133-snapdragon\", pkgver:\"4.4.0-1133.141\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-174-generic\", pkgver:\"4.4.0-174.204\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-174-generic-lpae\", pkgver:\"4.4.0-174.204\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-174-lowlatency\", pkgver:\"4.4.0-174.204\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1102.106\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.174.182\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.174.182\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.4.0.1066.66\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.174.182\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1129.129\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.4.0.1133.125\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-virtual\", pkgver:\"4.4.0.174.182\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 1.9, "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-07T09:03:27", "description": "According to the versions of the kernel packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - A heap-based buffer overflow was discovered in the\n Linux kernel's Marvell WiFi chip driver. The flaw could\n occur when the station attempts a connection\n negotiation during the handling of the remote devices\n country settings. This could allow the remote device to\n cause a denial of service (system crash) or possibly\n execute arbitrary code.(CVE-2019-14895)\n\n - A flaw was found in the fix for CVE-2019-11135, the way\n Intel CPUs handle speculative execution of instructions\n when a TSX Asynchronous Abort (TAA) error occurs. When\n a guest is running on a host CPU affected by the TAA\n flaw (TAA_NO=0), but is not affected by the MDS issue\n (MDS_NO=1), the guest was to clear the affected buffers\n by using a VERW instruction mechanism. But when the\n MDS_NO=1 bit was exported to the guests, the guests did\n not use the VERW mechanism to clear the affected\n buffers. This issue affects guests running on Cascade\n Lake CPUs and requires that host has 'TSX' enabled.\n Confidentiality of data is the highest threat\n associated with this vulnerability.(CVE-2019-19338)\n\n - A flaw was found in the way Intel CPUs handle\n speculative execution of instructions when the TSX\n Asynchronous Abort (TAA) error occurs. A local\n authenticated attacker with the ability to monitor\n execution times could infer the TSX memory state by\n comparing abort execution times. This could allow\n information disclosure via this observed side-channel\n for any TSX transaction being executed while an\n attacker is able to observe abort timing. Intel's\n Transactional Synchronisation Extensions (TSX) are set\n of instructions which enable transactional memory\n support to improve performance of the multi-threaded\n applications, in the lock-protected critical sections.\n The CPU executes instructions in the critical-sections\n as transactions, while ensuring their atomic state.\n When such transaction execution is unsuccessful, the\n processor cannot ensure atomic updates to the\n transaction memory, so the processor rolls back or\n aborts such transaction execution. While TSX\n Asynchronous Abort (TAA) is pending, CPU may continue\n to read data from architectural buffers and pass it to\n the dependent speculative operations. This may cause\n information leakage via speculative side-channel means,\n which is quite similar to the Microarchitectural Data\n Sampling (MDS) issue.(CVE-2019-11135)\n\n - An out-of-bounds memory write issue was found in the\n way the Linux kernel's KVM hypervisor handled the\n 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID\n features emulated by the KVM hypervisor. A user or\n process able to access the '/dev/kvm' device could use\n this flaw to crash the system, resulting in a denial of\n service.(CVE-2019-19332)\n\n - A flaw was found in the Linux kernel's scheduler, where\n it can allow attackers to cause a denial of service\n against non-CPU-bound applications by generating a\n workload that triggers unwanted scheduling slice\n expiration. A local attacker who can trigger a specific\n workload type could abuse this technique to trigger a\n system to be seen as degraded, and possibly trigger\n workload-rebalance in systems that use the\n slice-expiration metric as a measure of system\n health.(CVE-2019-19922)\n\n - A stack-based buffer overflow was found in the Linux\n kernel's Marvell WiFi chip driver. An attacker is able\n to cause a denial of service (system crash) or,\n possibly execute arbitrary code, when a STA works in\n IBSS mode (allows connecting stations together without\n the use of an AP) and connects to another\n STA.(CVE-2019-14897)\n\n - A heap-based buffer overflow vulnerability was found in\n the Linux kernel's Marvell WiFi chip driver. A remote\n attacker could cause a denial of service (system crash)\n or, possibly execute arbitrary code, when the\n lbs_ibss_join_existing function is called after a STA\n connects to an AP.(CVE-2019-14896)\n\n - A flaw was found in the Linux kernel in versions\n through 5.4.6, containing information leaks of\n uninitialized memory to a USB device. The latest\n findings show that the uninitialized memory allocation\n was not leading to an information leak, but was\n allocating the memory assigned with data on the next\n line and hence causing no violation..(CVE-2019-19947)\n\n - A flaw was found in the Linux kernel's implementation\n of the Datagram Congestion Control Protocol (DCCP). A\n local attacker with access to the system can create\n DCCP sockets to cause a memory leak and repeat this\n operation to exhaust all memory and panic the\n system.(CVE-2019-20096)\n\n - A flaw was found in the Linux kernel's mwifiex driver\n implementation when connecting to other WiFi devices in\n 'Test Mode.' A kernel memory leak can occur if an error\n condition is met during the parameter negotiation. This\n issue can lead to a denial of service if multiple error\n conditions meeting the repeated connection attempts are\n attempted.(CVE-2019-20095)\n\n - A flaw was found in the Linux kernel's implementation\n of the WiFi station handoff code. An attacker within\n the radio range could use this flaw to deny a valid\n device from joining the access point.(CVE-2019-5108)\n\n - A flaw was found in the way Linux kernel's KVM\n hypervisor handled deferred TLB flush requests from\n guest. A race condition may occur between the guest\n issuing a deferred TLB flush request to KVM, and then\n KVM handling and acknowledging it. This may result in\n invalid address translations from TLB being used to\n access guest memory, leading to a potential information\n leakage issue. An attacker may use this flaw to access\n guest memory locations that it should not have access\n to.(CVE-2019-3016)\n\n - fs/namei.c in the Linux kernel before 5.5 has a\n may_create_in_sticky use-after-free, which allows local\n users to cause a denial of service (OOPS) or possibly\n obtain sensitive information from kernel memory, aka\n CID-d0cb50185ae9. One attack vector may be an open\n system call for a UNIX domain socket, if the socket is\n being moved to a new parent directory and its old\n parent directory is being removed.(CVE-2020-8428)\n\n - There is a use-after-free vulnerability in the Linux\n kernel through 5.5.2 in the n_tty_receive_buf_common\n function in drivers/tty/n_tty.c.(CVE-2020-8648)\n\n - An issue was discovered in the Linux kernel through\n 5.5.6. set_fdc in drivers/block/floppy.c leads to a\n wait_til_ready out-of-bounds read because the FDC index\n is not checked for errors before assigning it, aka\n CID-2e90ca68b0d2.(CVE-2020-9383)\n\n - There is a use-after-free vulnerability in the Linux\n kernel through 5.5.2 in the vgacon_invert_region\n function in\n drivers/video/console/vgacon.c.(CVE-2020-8649)\n\n - There is a use-after-free vulnerability in the Linux\n kernel through 5.5.2 in the vc_do_resize function in\n drivers/tty/vt/vt.c.(CVE-2020-8647)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 5, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-04-02T00:00:00", "title": "EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1342)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2020-8648", "CVE-2020-9383", "CVE-2019-20095", "CVE-2019-19332", "CVE-2019-14896", "CVE-2019-19922", "CVE-2019-3016", "CVE-2019-11135", "CVE-2019-19947", "CVE-2019-19338", "CVE-2019-14895", "CVE-2019-14897", "CVE-2020-8428", "CVE-2020-8649", "CVE-2020-8647", "CVE-2019-20096"], "modified": "2020-04-02T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel", "cpe:/o:huawei:euleros:uvp:3.0.6.0", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:python3-perf", "p-cpe:/a:huawei:euleros:python-perf", "p-cpe:/a:huawei:euleros:kernel-tools-libs"], "id": "EULEROS_SA-2020-1342.NASL", "href": "https://www.tenable.com/plugins/nessus/135129", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(135129);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-11135\",\n \"CVE-2019-14895\",\n \"CVE-2019-14896\",\n \"CVE-2019-14897\",\n \"CVE-2019-19332\",\n \"CVE-2019-19338\",\n \"CVE-2019-19922\",\n \"CVE-2019-19947\",\n \"CVE-2019-20095\",\n \"CVE-2019-20096\",\n \"CVE-2019-3016\",\n \"CVE-2019-5108\",\n \"CVE-2020-8428\",\n \"CVE-2020-8647\",\n \"CVE-2020-8648\",\n \"CVE-2020-8649\",\n \"CVE-2020-9383\"\n );\n\n script_name(english:\"EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1342)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization for ARM 64 host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - A heap-based buffer overflow was discovered in the\n Linux kernel's Marvell WiFi chip driver. The flaw could\n occur when the station attempts a connection\n negotiation during the handling of the remote devices\n country settings. This could allow the remote device to\n cause a denial of service (system crash) or possibly\n execute arbitrary code.(CVE-2019-14895)\n\n - A flaw was found in the fix for CVE-2019-11135, the way\n Intel CPUs handle speculative execution of instructions\n when a TSX Asynchronous Abort (TAA) error occurs. When\n a guest is running on a host CPU affected by the TAA\n flaw (TAA_NO=0), but is not affected by the MDS issue\n (MDS_NO=1), the guest was to clear the affected buffers\n by using a VERW instruction mechanism. But when the\n MDS_NO=1 bit was exported to the guests, the guests did\n not use the VERW mechanism to clear the affected\n buffers. This issue affects guests running on Cascade\n Lake CPUs and requires that host has 'TSX' enabled.\n Confidentiality of data is the highest threat\n associated with this vulnerability.(CVE-2019-19338)\n\n - A flaw was found in the way Intel CPUs handle\n speculative execution of instructions when the TSX\n Asynchronous Abort (TAA) error occurs. A local\n authenticated attacker with the ability to monitor\n execution times could infer the TSX memory state by\n comparing abort execution times. This could allow\n information disclosure via this observed side-channel\n for any TSX transaction being executed while an\n attacker is able to observe abort timing. Intel's\n Transactional Synchronisation Extensions (TSX) are set\n of instructions which enable transactional memory\n support to improve performance of the multi-threaded\n applications, in the lock-protected critical sections.\n The CPU executes instructions in the critical-sections\n as transactions, while ensuring their atomic state.\n When such transaction execution is unsuccessful, the\n processor cannot ensure atomic updates to the\n transaction memory, so the processor rolls back or\n aborts such transaction execution. While TSX\n Asynchronous Abort (TAA) is pending, CPU may continue\n to read data from architectural buffers and pass it to\n the dependent speculative operations. This may cause\n information leakage via speculative side-channel means,\n which is quite similar to the Microarchitectural Data\n Sampling (MDS) issue.(CVE-2019-11135)\n\n - An out-of-bounds memory write issue was found in the\n way the Linux kernel's KVM hypervisor handled the\n 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID\n features emulated by the KVM hypervisor. A user or\n process able to access the '/dev/kvm' device could use\n this flaw to crash the system, resulting in a denial of\n service.(CVE-2019-19332)\n\n - A flaw was found in the Linux kernel's scheduler, where\n it can allow attackers to cause a denial of service\n against non-CPU-bound applications by generating a\n workload that triggers unwanted scheduling slice\n expiration. A local attacker who can trigger a specific\n workload type could abuse this technique to trigger a\n system to be seen as degraded, and possibly trigger\n workload-rebalance in systems that use the\n slice-expiration metric as a measure of system\n health.(CVE-2019-19922)\n\n - A stack-based buffer overflow was found in the Linux\n kernel's Marvell WiFi chip driver. An attacker is able\n to cause a denial of service (system crash) or,\n possibly execute arbitrary code, when a STA works in\n IBSS mode (allows connecting stations together without\n the use of an AP) and connects to another\n STA.(CVE-2019-14897)\n\n - A heap-based buffer overflow vulnerability was found in\n the Linux kernel's Marvell WiFi chip driver. A remote\n attacker could cause a denial of service (system crash)\n or, possibly execute arbitrary code, when the\n lbs_ibss_join_existing function is called after a STA\n connects to an AP.(CVE-2019-14896)\n\n - A flaw was found in the Linux kernel in versions\n through 5.4.6, containing information leaks of\n uninitialized memory to a USB device. The latest\n findings show that the uninitialized memory allocation\n was not leading to an information leak, but was\n allocating the memory assigned with data on the next\n line and hence causing no violation..(CVE-2019-19947)\n\n - A flaw was found in the Linux kernel's implementation\n of the Datagram Congestion Control Protocol (DCCP). A\n local attacker with access to the system can create\n DCCP sockets to cause a memory leak and repeat this\n operation to exhaust all memory and panic the\n system.(CVE-2019-20096)\n\n - A flaw was found in the Linux kernel's mwifiex driver\n implementation when connecting to other WiFi devices in\n 'Test Mode.' A kernel memory leak can occur if an error\n condition is met during the parameter negotiation. This\n issue can lead to a denial of service if multiple error\n conditions meeting the repeated connection attempts are\n attempted.(CVE-2019-20095)\n\n - A flaw was found in the Linux kernel's implementation\n of the WiFi station handoff code. An attacker within\n the radio range could use this flaw to deny a valid\n device from joining the access point.(CVE-2019-5108)\n\n - A flaw was found in the way Linux kernel's KVM\n hypervisor handled deferred TLB flush requests from\n guest. A race condition may occur between the guest\n issuing a deferred TLB flush request to KVM, and then\n KVM handling and acknowledging it. This may result in\n invalid address translations from TLB being used to\n access guest memory, leading to a potential information\n leakage issue. An attacker may use this flaw to access\n guest memory locations that it should not have access\n to.(CVE-2019-3016)\n\n - fs/namei.c in the Linux kernel before 5.5 has a\n may_create_in_sticky use-after-free, which allows local\n users to cause a denial of service (OOPS) or possibly\n obtain sensitive information from kernel memory, aka\n CID-d0cb50185ae9. One attack vector may be an open\n system call for a UNIX domain socket, if the socket is\n being moved to a new parent directory and its old\n parent directory is being removed.(CVE-2020-8428)\n\n - There is a use-after-free vulnerability in the Linux\n kernel through 5.5.2 in the n_tty_receive_buf_common\n function in drivers/tty/n_tty.c.(CVE-2020-8648)\n\n - An issue was discovered in the Linux kernel through\n 5.5.6. set_fdc in drivers/block/floppy.c leads to a\n wait_til_ready out-of-bounds read because the FDC index\n is not checked for errors before assigning it, aka\n CID-2e90ca68b0d2.(CVE-2020-9383)\n\n - There is a use-after-free vulnerability in the Linux\n kernel through 5.5.2 in the vgacon_invert_region\n function in\n drivers/video/console/vgacon.c.(CVE-2020-8649)\n\n - There is a use-after-free vulnerability in the Linux\n kernel through 5.5.2 in the vc_do_resize function in\n drivers/tty/vt/vt.c.(CVE-2020-8647)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1342\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3ae277fb\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.6.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.6.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.6.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"kernel-devel-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"kernel-headers-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"kernel-tools-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"kernel-tools-libs-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"kernel-tools-libs-devel-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"perf-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"python-perf-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\",\n \"python3-perf-4.19.36-vhulk1907.1.0.h697.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T09:02:28", "description": "According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz),\n the core of any Linux operating system. The kernel\n handles the basic functions of the operating system:\n memory allocation, process allocation, device input and\n output, etc.Security Fix(es):In the Linux kernel\n 4.19.83, there is a use-after-free (read) in the\n debugfs_remove function in fs/debugfs/inode.c (which is\n used to remove a file or directory in debugfs that was\n previously created with a call to another debugfs\n function such as\n debugfs_create_file).(CVE-2019-19770)mwifiex_tm_cmd in\n driverset/wireless/marvell/mwifiex/cfg80211.c in the\n Linux kernel before 5.1.6 has some error-handling cases\n that did not free allocated hostcmd memory, aka\n CID-003b686ace82. This will cause a memory leak and\n denial of service.(CVE-2019-20095)TSX Asynchronous\n Abort condition on some CPUs utilizing speculative\n execution may allow an authenticated user to\n potentially enable information disclosure via a side\n channel with local access.(CVE-2019-11135)A memory leak\n in the crypto_report() function in\n crypto/crypto_user_base.c in the Linux kernel through\n 5.3.11 allows attackers to cause a denial of service\n (memory consumption) by triggering crypto_report_alg()\n failures, aka CID-ffdde5932042.(CVE-2019-19062)In the\n Linux kernel before 5.1.6, there is a use-after-free in\n serial_ir_init_module() in\n drivers/media/rc/serial_ir.c.(CVE-2019-19543)In the\n Linux kernel through 5.4.6, there is a NULL pointer\n dereference in drivers/scsi/libsas/sas_discover.c\n because of mishandling of port disconnection during\n discovery, related to a PHY down race condition, aka\n CID-f70267f379b5.(CVE-2019-19965)In the Linux kernel\n before 5.1.6, there is a use-after-free in cpia2_exit()\n in drivers/media/usb/cpia2/cpia2_v4l.c that will cause\n denial of service, aka\n CID-dea37a972655.(CVE-2019-19966)An issue was\n discovered in drivers/xen/balloon.c in the Linux kernel\n before 5.2.3, as used in Xen through 4.12.x, allowing\n guest OS users to cause a denial of service because of\n unrestricted resource consumption during the mapping of\n guest memory, aka CID-6ef36ab967c7.(CVE-2019-17351)A\n memory leak in the crypto_reportstat() function in\n drivers/virt/vboxguest/vboxguest_utils.c in the Linux\n kernel before 5.3.9 allows attackers to cause a denial\n of service (memory consumption) by triggering\n copy_form_user() failures, aka\n CID-e0b0cb938864.(CVE-2019-19048)kernel/sched/fair.c in\n the Linux kernel before 5.3.9, when cpu.cfs_quota_us is\n used (e.g., with Kubernetes), allows attackers to cause\n a denial of service against non-cpu-bound applications\n by generating a workload that triggers unwanted slice\n expiration, aka CID-de53fd7aedb1. (In other words,\n although this slice expiration would typically be seen\n with benign workloads, it is possible that an attacker\n could calculate how many stray requests are required to\n force an entire Kubernetes cluster into a\n low-performance state caused by slice expiration, and\n ensure that a DDoS attack sent that number of stray\n requests. An attack does not affect the stability of\n the kernel it only causes mismanagement of application\n execution.)(CVE-2019-19922)An out-of-bounds memory\n write issue was found in the Linux Kernel, version 3.13\n through 5.4, in the way the Linux kernel's KVM\n hypervisor handled the 'KVM_GET_EMULATED_CPUID'\n ioctl(2) request to get CPUID features emulated by the\n KVM hypervisor. A user or process able to access the\n '/dev/kvm' device could use this flaw to crash the\n system, resulting in a denial of\n service.(CVE-2019-19332)A flaw was found in the fix for\n CVE-2019-11135, the way Intel CPUs handle speculative\n execution of instructions when a TSX Asynchronous Abort\n (TAA) error occurs. When a guest is running on a host\n CPU affected by the TAA flaw (TAA_NO=0), but is not\n affected by the MDS issue (MDS_NO=1), the guest was to\n clear the affected buffers by using a VERW instruction\n mechanism. But when the MDS_NO=1 bit was exported to\n the guests, the guests did not use the VERW mechanism\n to clear the affected buffers. This issue affects\n guests running on Cascade Lake CPUs and requires that\n host has 'TSX' enabled. Confidentiality of data is the\n highest threat associated with this\n vulnerability.(CVE-2019-19338)In the Linux kernel\n 5.0.0-rc7 (as distributed in ubuntu/linux.git on\n kernel.ubuntu.com), mounting a crafted f2fs filesystem\n image and performing some operations can lead to\n slab-out-of-bounds read access in ttm_put_pages in\n drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related\n to the vmwgfx or ttm module.(CVE-2019-19927)In the\n Linux kernel 4.14 longterm through 4.14.165 and 4.19\n longterm through 4.19.96 (and 5.x before 5.2), there is\n a use-after-free (write) in the i915_ppgtt_close\n function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka\n CID-7dc40713618c. This is related to\n i915_gem_context_destroy_ioctl in\n drivers/gpu/drm/i915/i915_gem_context.c.(CVE-2020-7053)\n In the Linux kernel through 5.4.6, there are\n information leaks of uninitialized memory to a USB\n device in the\n driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,\n aka CID-da2311a6385c.(CVE-2019-19947)In the Linux\n kernel before 5.0.6, there is a NULL pointer\n dereference in drop_sysctl_table() in\n fs/proc/proc_sysctl.c, related to put_links, aka\n CID-23da9588037e.(CVE-2019-20054)In the Linux kernel\n before 5.1, there is a memory leak in\n __feat_register_sp() in net/dccp/feat.c, which may\n cause denial of service, aka\n CID-1d3ff0950e2b.(CVE-2019-20096)A heap-based buffer\n overflow vulnerability was found in the Linux kernel,\n version kernel-2.6.32, in Marvell WiFi chip driver. A\n remote attacker could cause a denial of service (system\n crash) or, possibly execute arbitrary code, when the\n lbs_ibss_join_existing function is called after a STA\n connects to an AP.(CVE-2019-14896)A heap-based buffer\n overflow was discovered in the Linux kernel, all\n versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi\n chip driver. The flaw could occur when the station\n attempts a connection negotiation during the handling\n of the remote devices country settings. This could\n allow the remote device to cause a denial of service\n (system crash) or possibly execute arbitrary\n code.(CVE-2019-14895)A stack-based buffer overflow was\n found in the Linux kernel, version kernel-2.6.32, in\n Marvell WiFi chip driver. An attacker is able to cause\n a denial of service (system crash) or, possibly execute\n arbitrary code, when a STA works in IBSS mode (allows\n connecting stations together without the use of an AP)\n and connects to another STA.(CVE-2019-14897)An\n exploitable denial-of-service vulnerability exists in\n the Linux kernel prior to mainline 5.3. An attacker\n could exploit this vulnerability by triggering AP to\n send IAPP location updates for stations before the\n required authentication process has completed. This\n could lead to different denial-of-service scenarios,\n either by causing CAM table attacks, or by leading to\n traffic flapping if faking already existing clients in\n other nearby APs of the same wireless infrastructure.\n An attacker can forge Authentication and Association\n Request packets to trigger this\n vulnerability.(CVE-2019-5108)drivers/gpu/drm/radeon/rad\n eon_display.c in the Linux kernel 5.2.14 does not check\n the alloc_workqueue return value, leading to a NULL\n pointer dereference.(CVE-2019-16230)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 6, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-02-25T00:00:00", "title": "EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1158)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-20095", "CVE-2019-19770", "CVE-2019-19332", "CVE-2019-14896", "CVE-2019-19062", "CVE-2019-19922", "CVE-2019-19965", "CVE-2019-11135", "CVE-2019-19947", "CVE-2019-19338", "CVE-2019-19927", "CVE-2019-14895", "CVE-2019-14897", "CVE-2019-17351", "CVE-2019-16230", "CVE-2020-7053", "CVE-2019-19543", "CVE-2019-19048", "CVE-2019-19966", "CVE-2019-20054", "CVE-2019-20096"], "modified": "2020-02-25T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-source", "p-cpe:/a:huawei:euleros:python3-perf", "p-cpe:/a:huawei:euleros:bpftool", "p-cpe:/a:huawei:euleros:python-perf", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-1158.NASL", "href": "https://www.tenable.com/plugins/nessus/133992", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(133992);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-11135\",\n \"CVE-2019-14895\",\n \"CVE-2019-14896\",\n \"CVE-2019-14897\",\n \"CVE-2019-16230\",\n \"CVE-2019-17351\",\n \"CVE-2019-19048\",\n \"CVE-2019-19062\",\n \"CVE-2019-19332\",\n \"CVE-2019-19338\",\n \"CVE-2019-19543\",\n \"CVE-2019-19770\",\n \"CVE-2019-19922\",\n \"CVE-2019-19927\",\n \"CVE-2019-19947\",\n \"CVE-2019-19965\",\n \"CVE-2019-19966\",\n \"CVE-2019-20054\",\n \"CVE-2019-20095\",\n \"CVE-2019-20096\",\n \"CVE-2019-5108\",\n \"CVE-2020-7053\"\n );\n\n script_name(english:\"EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1158)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz),\n the core of any Linux operating system. The kernel\n handles the basic functions of the operating system:\n memory allocation, process allocation, device input and\n output, etc.Security Fix(es):In the Linux kernel\n 4.19.83, there is a use-after-free (read) in the\n debugfs_remove function in fs/debugfs/inode.c (which is\n used to remove a file or directory in debugfs that was\n previously created with a call to another debugfs\n function such as\n debugfs_create_file).(CVE-2019-19770)mwifiex_tm_cmd in\n driverset/wireless/marvell/mwifiex/cfg80211.c in the\n Linux kernel before 5.1.6 has some error-handling cases\n that did not free allocated hostcmd memory, aka\n CID-003b686ace82. This will cause a memory leak and\n denial of service.(CVE-2019-20095)TSX Asynchronous\n Abort condition on some CPUs utilizing speculative\n execution may allow an authenticated user to\n potentially enable information disclosure via a side\n channel with local access.(CVE-2019-11135)A memory leak\n in the crypto_report() function in\n crypto/crypto_user_base.c in the Linux kernel through\n 5.3.11 allows attackers to cause a denial of service\n (memory consumption) by triggering crypto_report_alg()\n failures, aka CID-ffdde5932042.(CVE-2019-19062)In the\n Linux kernel before 5.1.6, there is a use-after-free in\n serial_ir_init_module() in\n drivers/media/rc/serial_ir.c.(CVE-2019-19543)In the\n Linux kernel through 5.4.6, there is a NULL pointer\n dereference in drivers/scsi/libsas/sas_discover.c\n because of mishandling of port disconnection during\n discovery, related to a PHY down race condition, aka\n CID-f70267f379b5.(CVE-2019-19965)In the Linux kernel\n before 5.1.6, there is a use-after-free in cpia2_exit()\n in drivers/media/usb/cpia2/cpia2_v4l.c that will cause\n denial of service, aka\n CID-dea37a972655.(CVE-2019-19966)An issue was\n discovered in drivers/xen/balloon.c in the Linux kernel\n before 5.2.3, as used in Xen through 4.12.x, allowing\n guest OS users to cause a denial of service because of\n unrestricted resource consumption during the mapping of\n guest memory, aka CID-6ef36ab967c7.(CVE-2019-17351)A\n memory leak in the crypto_reportstat() function in\n drivers/virt/vboxguest/vboxguest_utils.c in the Linux\n kernel before 5.3.9 allows attackers to cause a denial\n of service (memory consumption) by triggering\n copy_form_user() failures, aka\n CID-e0b0cb938864.(CVE-2019-19048)kernel/sched/fair.c in\n the Linux kernel before 5.3.9, when cpu.cfs_quota_us is\n used (e.g., with Kubernetes), allows attackers to cause\n a denial of service against non-cpu-bound applications\n by generating a workload that triggers unwanted slice\n expiration, aka CID-de53fd7aedb1. (In other words,\n although this slice expiration would typically be seen\n with benign workloads, it is possible that an attacker\n could calculate how many stray requests are required to\n force an entire Kubernetes cluster into a\n low-performance state caused by slice expiration, and\n ensure that a DDoS attack sent that number of stray\n requests. An attack does not affect the stability of\n the kernel it only causes mismanagement of application\n execution.)(CVE-2019-19922)An out-of-bounds memory\n write issue was found in the Linux Kernel, version 3.13\n through 5.4, in the way the Linux kernel's KVM\n hypervisor handled the 'KVM_GET_EMULATED_CPUID'\n ioctl(2) request to get CPUID features emulated by the\n KVM hypervisor. A user or process able to access the\n '/dev/kvm' device could use this flaw to crash the\n system, resulting in a denial of\n service.(CVE-2019-19332)A flaw was found in the fix for\n CVE-2019-11135, the way Intel CPUs handle speculative\n execution of instructions when a TSX Asynchronous Abort\n (TAA) error occurs. When a guest is running on a host\n CPU affected by the TAA flaw (TAA_NO=0), but is not\n affected by the MDS issue (MDS_NO=1), the guest was to\n clear the affected buffers by using a VERW instruction\n mechanism. But when the MDS_NO=1 bit was exported to\n the guests, the guests did not use the VERW mechanism\n to clear the affected buffers. This issue affects\n guests running on Cascade Lake CPUs and requires that\n host has 'TSX' enabled. Confidentiality of data is the\n highest threat associated with this\n vulnerability.(CVE-2019-19338)In the Linux kernel\n 5.0.0-rc7 (as distributed in ubuntu/linux.git on\n kernel.ubuntu.com), mounting a crafted f2fs filesystem\n image and performing some operations can lead to\n slab-out-of-bounds read access in ttm_put_pages in\n drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related\n to the vmwgfx or ttm module.(CVE-2019-19927)In the\n Linux kernel 4.14 longterm through 4.14.165 and 4.19\n longterm through 4.19.96 (and 5.x before 5.2), there is\n a use-after-free (write) in the i915_ppgtt_close\n function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka\n CID-7dc40713618c. This is related to\n i915_gem_context_destroy_ioctl in\n drivers/gpu/drm/i915/i915_gem_context.c.(CVE-2020-7053)\n In the Linux kernel through 5.4.6, there are\n information leaks of uninitialized memory to a USB\n device in the\n driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,\n aka CID-da2311a6385c.(CVE-2019-19947)In the Linux\n kernel before 5.0.6, there is a NULL pointer\n dereference in drop_sysctl_table() in\n fs/proc/proc_sysctl.c, related to put_links, aka\n CID-23da9588037e.(CVE-2019-20054)In the Linux kernel\n before 5.1, there is a memory leak in\n __feat_register_sp() in net/dccp/feat.c, which may\n cause denial of service, aka\n CID-1d3ff0950e2b.(CVE-2019-20096)A heap-based buffer\n overflow vulnerability was found in the Linux kernel,\n version kernel-2.6.32, in Marvell WiFi chip driver. A\n remote attacker could cause a denial of service (system\n crash) or, possibly execute arbitrary code, when the\n lbs_ibss_join_existing function is called after a STA\n connects to an AP.(CVE-2019-14896)A heap-based buffer\n overflow was discovered in the Linux kernel, all\n versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi\n chip driver. The flaw could occur when the station\n attempts a connection negotiation during the handling\n of the remote devices country settings. This could\n allow the remote device to cause a denial of service\n (system crash) or possibly execute arbitrary\n code.(CVE-2019-14895)A stack-based buffer overflow was\n found in the Linux kernel, version kernel-2.6.32, in\n Marvell WiFi chip driver. An attacker is able to cause\n a denial of service (system crash) or, possibly execute\n arbitrary code, when a STA works in IBSS mode (allows\n connecting stations together without the use of an AP)\n and connects to another STA.(CVE-2019-14897)An\n exploitable denial-of-service vulnerability exists in\n the Linux kernel prior to mainline 5.3. An attacker\n could exploit this vulnerability by triggering AP to\n send IAPP location updates for stations before the\n required authentication process has completed. This\n could lead to different denial-of-service scenarios,\n either by causing CAM table attacks, or by leading to\n traffic flapping if faking already existing clients in\n other nearby APs of the same wireless infrastructure.\n An attacker can forge Authentication and Association\n Request packets to trigger this\n vulnerability.(CVE-2019-5108)drivers/gpu/drm/radeon/rad\n eon_display.c in the Linux kernel 5.2.14 does not check\n the alloc_workqueue return value, leading to a NULL\n pointer dereference.(CVE-2019-16230)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1158\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e66e3a3b\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/02/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/02/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"bpftool-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"kernel-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"kernel-devel-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"kernel-headers-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"kernel-source-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"kernel-tools-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"kernel-tools-libs-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"perf-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"python-perf-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\",\n \"python3-perf-4.19.36-vhulk1907.1.0.h683.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-18T11:03:52", "description": "It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors.\nA local attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver\nin the Linux kernel did not properly validate device metadata. A\nphysically proximate attacker could use this to cause a denial of\nservice (system crash). (CVE-2019-15099)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices\ndid not properly check for errors in certain situations, leading to a\nNULL pointer dereference. A local attacker could possibly use this to\ncause a denial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in\nthe Linux kernel did not properly check for errors in certain\nsituations, leading to a NULL pointer dereference. A local attacker\ncould possibly use this to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that a race condition existed in the Virtual Video\nTest Driver in the Linux kernel. An attacker with write access to\n/dev/video0 on a system with the vivid module loaded could possibly\nuse this to gain administrative privileges. (CVE-2019-18683)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF)\ndriver in the Linux kernel did not properly initialize data. A local\nattacker could possibly use this to expose sensitive information\n(kernel memory). (CVE-2019-18786)\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that the btrfs file system in the Linux kernel did\nnot properly validate metadata, leading to a NULL pointer dereference.\nAn attacker could use this to specially craft a file system image\nthat, when mounted, could cause a denial of service (system crash).\n(CVE-2019-18885)\n\nIt was discovered that multiple memory leaks existed in the Marvell\nWiFi-Ex Driver for the Linux kernel. A local attacker could possibly\nuse this to cause a denial of service (kernel memory exhaustion).\n(CVE-2019-19057)\n\nIt was discovered that the crypto subsystem in the Linux kernel did\nnot properly deallocate memory in certain error conditions. A local\nattacker could use this to cause a denial of service (kernel memory\nexhaustion). (CVE-2019-19062)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the RSI 91x WLAN device driver in the Linux\nkernel did not properly deallocate memory in certain error conditions.\nA local attacker could use this to cause a denial of service (kernel\nmemory exhaustion). (CVE-2019-19071)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver\nin the Linux kernel did not properly deallocate memory in certain\nerror conditions. A local attacker could possibly use this to cause a\ndenial of service (kernel memory exhaustion). (CVE-2019-19078)\n\nIt was discovered that the AMD GPU device drivers in the Linux kernel\ndid not properly deallocate memory in certain error conditions. A\nlocal attacker could use this to possibly cause a denial of service\n(kernel memory exhaustion). (CVE-2019-19082)\n\nDan Carpenter discovered that the AppleTalk networking subsystem of\nthe Linux kernel did not properly handle certain error conditions,\nleading to a NULL pointer dereference. A local attacker could use this\nto cause a denial of service (system crash). (CVE-2019-19227)\n\nIt was discovered that the KVM hypervisor implementation in the Linux\nkernel did not properly handle ioctl requests to get emulated CPUID\nfeatures. An attacker with access to /dev/kvm could use this to cause\na denial of service (system crash). (CVE-2019-19332)\n\nIt was discovered that the ext4 file system implementation in the\nLinux kernel did not properly handle certain conditions. An attacker\ncould use this to specially craft an ext4 file system that, when\nmounted, could cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2019-19767)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer\ndereference. A local attacker could possibly use this to cause a\ndenial of service (system crash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory\nin certain error conditions. An attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux\nkernel when used as an access point would send IAPP location updates\nfor stations before client authentication had completed. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free\nwhile destroying GEM contexts in the i915 driver for the Linux kernel.\nA local attacker could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2020-7053)\n\nIt was discovered that the B2C2 FlexCop USB device driver in the Linux\nkernel did not properly validate device metadata. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash). (CVE-2019-15291).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 3, "cvss3": {"score": 7.0, "vector": "AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-02-19T00:00:00", "title": "Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4287-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-19767", "CVE-2019-18683", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19332", "CVE-2019-19062", "CVE-2019-19082", "CVE-2019-19965", "CVE-2019-19078", "CVE-2019-15099", "CVE-2019-14615", "CVE-2019-19227", "CVE-2019-19063", "CVE-2019-18885", "CVE-2019-19071", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-15291", "CVE-2019-20096"], "modified": "2020-02-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-oracle", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-lts-18.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-aws", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-4.15", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gcp", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-hwe", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle-lts-18.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-azure", "p-cpe:/a:canonical:ubuntu_linux:linux-image-oem", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke"], "id": "UBUNTU_USN-4287-1.NASL", "href": "https://www.tenable.com/plugins/nessus/133800", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4287-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(133800);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/17\");\n\n script_cve_id(\"CVE-2019-14615\", \"CVE-2019-15099\", \"CVE-2019-15291\", \"CVE-2019-16229\", \"CVE-2019-16232\", \"CVE-2019-18683\", \"CVE-2019-18786\", \"CVE-2019-18809\", \"CVE-2019-18885\", \"CVE-2019-19057\", \"CVE-2019-19062\", \"CVE-2019-19063\", \"CVE-2019-19071\", \"CVE-2019-19078\", \"CVE-2019-19082\", \"CVE-2019-19227\", \"CVE-2019-19332\", \"CVE-2019-19767\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2020-7053\");\n script_xref(name:\"USN\", value:\"4287-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4287-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors.\nA local attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver\nin the Linux kernel did not properly validate device metadata. A\nphysically proximate attacker could use this to cause a denial of\nservice (system crash). (CVE-2019-15099)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices\ndid not properly check for errors in certain situations, leading to a\nNULL pointer dereference. A local attacker could possibly use this to\ncause a denial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in\nthe Linux kernel did not properly check for errors in certain\nsituations, leading to a NULL pointer dereference. A local attacker\ncould possibly use this to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that a race condition existed in the Virtual Video\nTest Driver in the Linux kernel. An attacker with write access to\n/dev/video0 on a system with the vivid module loaded could possibly\nuse this to gain administrative privileges. (CVE-2019-18683)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF)\ndriver in the Linux kernel did not properly initialize data. A local\nattacker could possibly use this to expose sensitive information\n(kernel memory). (CVE-2019-18786)\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in\nthe Linux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that the btrfs file system in the Linux kernel did\nnot properly validate metadata, leading to a NULL pointer dereference.\nAn attacker could use this to specially craft a file system image\nthat, when mounted, could cause a denial of service (system crash).\n(CVE-2019-18885)\n\nIt was discovered that multiple memory leaks existed in the Marvell\nWiFi-Ex Driver for the Linux kernel. A local attacker could possibly\nuse this to cause a denial of service (kernel memory exhaustion).\n(CVE-2019-19057)\n\nIt was discovered that the crypto subsystem in the Linux kernel did\nnot properly deallocate memory in certain error conditions. A local\nattacker could use this to cause a denial of service (kernel memory\nexhaustion). (CVE-2019-19062)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the RSI 91x WLAN device driver in the Linux\nkernel did not properly deallocate memory in certain error conditions.\nA local attacker could use this to cause a denial of service (kernel\nmemory exhaustion). (CVE-2019-19071)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver\nin the Linux kernel did not properly deallocate memory in certain\nerror conditions. A local attacker could possibly use this to cause a\ndenial of service (kernel memory exhaustion). (CVE-2019-19078)\n\nIt was discovered that the AMD GPU device drivers in the Linux kernel\ndid not properly deallocate memory in certain error conditions. A\nlocal attacker could use this to possibly cause a denial of service\n(kernel memory exhaustion). (CVE-2019-19082)\n\nDan Carpenter discovered that the AppleTalk networking subsystem of\nthe Linux kernel did not properly handle certain error conditions,\nleading to a NULL pointer dereference. A local attacker could use this\nto cause a denial of service (system crash). (CVE-2019-19227)\n\nIt was discovered that the KVM hypervisor implementation in the Linux\nkernel did not properly handle ioctl requests to get emulated CPUID\nfeatures. An attacker with access to /dev/kvm could use this to cause\na denial of service (system crash). (CVE-2019-19332)\n\nIt was discovered that the ext4 file system implementation in the\nLinux kernel did not properly handle certain conditions. An attacker\ncould use this to specially craft an ext4 file system that, when\nmounted, could cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2019-19767)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer\ndereference. A local attacker could possibly use this to cause a\ndenial of service (system crash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory\nin certain error conditions. An attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux\nkernel when used as an access point would send IAPP location updates\nfor stations before client authentication had completed. A physically\nproximate attacker could use this to cause a denial of service.\n(CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free\nwhile destroying GEM contexts in the i915 driver for the Linux kernel.\nA local attacker could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2020-7053)\n\nIt was discovered that the B2C2 FlexCop USB device driver in the Linux\nkernel did not properly validate device metadata. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash). (CVE-2019-15291).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4287-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-18683\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-hwe\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws-lts-18.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-azure\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gcp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke-4.15\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-oracle-lts-18.04\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-virtual-hwe-16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/08/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/02/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/02/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2019-14615\", \"CVE-2019-15099\", \"CVE-2019-15291\", \"CVE-2019-16229\", \"CVE-2019-16232\", \"CVE-2019-18683\", \"CVE-2019-18786\", \"CVE-2019-18809\", \"CVE-2019-18885\", \"CVE-2019-19057\", \"CVE-2019-19062\", \"CVE-2019-19063\", \"CVE-2019-19071\", \"CVE-2019-19078\", \"CVE-2019-19082\", \"CVE-2019-19227\", \"CVE-2019-19332\", \"CVE-2019-19767\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2020-7053\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-4287-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1033-oracle\", pkgver:\"4.15.0-1033.36~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1055-gcp\", pkgver:\"4.15.0-1055.59\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1060-aws\", pkgver:\"4.15.0-1060.62~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-1071-azure\", pkgver:\"4.15.0-1071.76\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-88-generic\", pkgver:\"4.15.0-88.88~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-88-generic-lpae\", pkgver:\"4.15.0-88.88~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.15.0-88-lowlatency\", pkgver:\"4.15.0-88.88~16.04.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws-hwe\", pkgver:\"4.15.0.1060.60\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-azure\", pkgver:\"4.15.0.1071.74\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gcp\", pkgver:\"4.15.0.1055.69\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-hwe-16.04\", pkgver:\"4.15.0.88.98\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae-hwe-16.04\", pkgver:\"4.15.0.88.98\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gke\", pkgver:\"4.15.0.1055.69\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency-hwe-16.04\", pkgver:\"4.15.0.88.98\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oem\", pkgver:\"4.15.0.88.98\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-oracle\", pkgver:\"4.15.0.1033.26\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-virtual-hwe-16.04\", pkgver:\"4.15.0.88.98\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1033-oracle\", pkgver:\"4.15.0-1033.36\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1052-gke\", pkgver:\"4.15.0-1052.55\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1053-kvm\", pkgver:\"4.15.0-1053.53\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1055-raspi2\", pkgver:\"4.15.0-1055.59\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1060-aws\", pkgver:\"4.15.0-1060.62\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-1072-snapdragon\", pkgver:\"4.15.0-1072.79\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-88-generic\", pkgver:\"4.15.0-88.88\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-88-generic-lpae\", pkgver:\"4.15.0-88.88\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-4.15.0-88-lowlatency\", pkgver:\"4.15.0-88.88\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-aws\", pkgver:\"4.15.0.1060.61\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-aws-lts-18.04\", pkgver:\"4.15.0.1060.61\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-generic\", pkgver:\"4.15.0.88.80\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.15.0.88.80\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gke\", pkgver:\"4.15.0.1052.56\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-gke-4.15\", pkgver:\"4.15.0.1052.56\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.15.0.1053.53\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.15.0.88.80\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-oracle\", pkgver:\"4.15.0.1033.38\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-oracle-lts-18.04\", pkgver:\"4.15.0.1033.38\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.15.0.1055.53\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.15.0.1072.75\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"linux-image-virtual\", pkgver:\"4.15.0.88.80\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.15-aws / linux-image-4.15-azure / etc\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-04-01T06:43:05", "description": "New kernel packages are available for Slackware 14.2 to fix security\nissues.", "edition": 2, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-03-27T00:00:00", "title": "Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-086-01)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2020-8648", "CVE-2020-9383", "CVE-2019-15217", "CVE-2019-16233", "CVE-2019-14901", "CVE-2019-14896", "CVE-2019-19965", "CVE-2020-0009", "CVE-2019-14615", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-14895", "CVE-2019-14897", "CVE-2019-19066", "CVE-2018-21008", "CVE-2019-19068", "CVE-2019-11487", "CVE-2020-8649", "CVE-2020-8647", "CVE-2020-2732", "CVE-2019-19056", "CVE-2019-16234"], "modified": "2020-03-27T00:00:00", "cpe": ["cpe:/o:slackware:slackware_linux:14.2", "p-cpe:/a:slackware:slackware_linux:kernel-generic-smp", "p-cpe:/a:slackware:slackware_linux:kernel-headers", "p-cpe:/a:slackware:slackware_linux:kernel-generic", "p-cpe:/a:slackware:slackware_linux:kernel-modules-smp", "p-cpe:/a:slackware:slackware_linux:kernel-source", "p-cpe:/a:slackware:slackware_linux:kernel-huge-smp", "p-cpe:/a:slackware:slackware_linux:kernel-modules", "p-cpe:/a:slackware:slackware_linux:kernel-huge"], "id": "SLACKWARE_SSA_2020-086-01.NASL", "href": "https://www.tenable.com/plugins/nessus/134971", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2020-086-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(134971);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/03/31\");\n\n script_cve_id(\"CVE-2018-21008\", \"CVE-2019-11487\", \"CVE-2019-14615\", \"CVE-2019-14895\", \"CVE-2019-14896\", \"CVE-2019-14897\", \"CVE-2019-14901\", \"CVE-2019-15217\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-16233\", \"CVE-2019-16234\", \"CVE-2019-19056\", \"CVE-2019-19066\", \"CVE-2019-19068\", \"CVE-2019-19965\", \"CVE-2019-5108\", \"CVE-2020-0009\", \"CVE-2020-2732\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_xref(name:\"SSA\", value:\"2020-086-01\");\n\n script_name(english:\"Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-086-01)\");\n script_summary(english:\"Checks for updated packages in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New kernel packages are available for Slackware 14.2 to fix security\nissues.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2020&m=slackware-security.760705\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a55cd09d\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-generic-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-huge\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-huge-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-modules-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/04/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/03/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-generic\", pkgver:\"4.4.217\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-generic-smp\", pkgver:\"4.4.217_smp\", pkgarch:\"i686\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-headers\", pkgver:\"4.4.217_smp\", pkgarch:\"x86\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-huge\", pkgver:\"4.4.217\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-huge-smp\", pkgver:\"4.4.217_smp\", pkgarch:\"i686\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-modules\", pkgver:\"4.4.217\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-modules-smp\", pkgver:\"4.4.217_smp\", pkgarch:\"i686\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-source\", pkgver:\"4.4.217_smp\", pkgarch:\"noarch\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-generic\", pkgver:\"4.4.217\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-headers\", pkgver:\"4.4.217\", pkgarch:\"x86\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-huge\", pkgver:\"4.4.217\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-modules\", pkgver:\"4.4.217\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-source\", pkgver:\"4.4.217\", pkgarch:\"noarch\", pkgnum:\"1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T09:42:38", "description": "Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2019-2182\n\nHanjun Guo and Lei Li reported a race condition in the arm64 virtual\nmemory management code, which could lead to an information disclosure,\ndenial of service (crash), or possibly privilege escalation.\n\nCVE-2019-5108\n\nMitchell Frank of Cisco discovered that when the IEEE 802.11 (WiFi)\nstack was used in AP mode with roaming, it would trigger roaming for a\nnewly associated station before the station was authenticated. An\nattacker within range of the AP could use this to cause a denial of\nservice, either by filling up a switching table or by redirecting\ntraffic away from other stations.\n\nCVE-2019-19319\n\nJungyeon discovered that a crafted filesystem can cause the ext4\nimplementation to deallocate or reallocate journal blocks. A user\npermitted to mount filesystems could use this to cause a denial of\nservice (crash), or possibly for privilege escalation.\n\nCVE-2019-19462\n\nThe syzbot tool found a missing error check in the 'relay' library\nused to implement various files under debugfs. A local user permitted\nto access debugfs could use this to cause a denial of service (crash)\nor possibly for privilege escalation.\n\nCVE-2019-19768\n\nTristan Madani reported a race condition in the blktrace debug\nfacility that could result in a use-after-free. A local user able to\ntrigger removal of block devices could possibly use this to cause a\ndenial of service (crash) or for privilege escalation.\n\nCVE-2019-20806\n\nA potential NULL pointer dereference was discovered in the tw5864\nmedia driver. The security impact of this is unclear.\n\nCVE-2019-20811\n\nThe Hulk Robot tool found a reference-counting bug in an error path in\nthe network subsystem. The security impact of this is unclear.\n\nCVE-2020-0543\n\nResearchers at VU Amsterdam discovered that on some Intel CPUs\nsupporting the RDRAND and RDSEED instructions, part of a random value\ngenerated by these instructions may be used in a later speculative\nexecution on any core of the same physical CPU. Depending on how these\ninstructions are used by applications, a local user or VM guest could\nuse this to obtain sensitive information such as cryptographic keys\nfrom other users or VMs.\n\nThis vulnerability can be mitigated by a microcode update,\neither as part of system firmware (BIOS) or through the\nintel-microcode package in Debian's non-free archive\nsection. This kernel update only provides reporting of the\nvulnerability and the option to disable the mitigation if it\nis not needed.\n\nCVE-2020-2732\n\nPaulo Bonzini discovered that the KVM implementation for Intel\nprocessors did not properly handle instruction emulation for L2 guests\nwhen nested virtualization is enabled. This could allow an L2 guest to\ncause privilege escalation, denial of service, or information leaks in\nthe L1 guest.\n\nCVE-2020-8428\n\nAl Viro discovered a potential use-after-free in the filesystem core\n(vfs). A local user could exploit this to cause a denial of service\n(crash) or possibly to obtain sensitive information from the kernel.\n\nCVE-2020-8647, CVE-2020-8649\n\nThe Hulk Robot tool found a potential MMIO out-of-bounds access in the\nvgacon driver. A local user permitted to access a virtual terminal\n(/dev/tty1 etc.) on a system using the vgacon driver could use this to\ncause a denial of service (crash or memory corruption) or possibly for\nprivilege escalation.\n\nCVE-2020-8648\n\nThe syzbot tool found a race condition in the the virtual terminal\ndriver, which could result in a use-after-free. A local user permitted\nto access a virtual terminal could use this to cause a denial of\nservice (crash or memory corruption) or possibly for privilege\nescalation.\n\nCVE-2020-9383\n\nJordy Zomer reported an incorrect range check in the floppy driver\nwhich could lead to a static out-of-bounds access. A local user\npermitted to access a floppy drive could use this to cause a denial of\nservice (crash or memory corruption) or possibly for privilege\nescalation.\n\nCVE-2020-10711\n\nMatthew Sheets reported NULL pointer dereference issues in the SELinux\nsubsystem while receiving CIPSO packet with null category. A remote\nattacker can take advantage of this flaw to cause a denial of service\n(crash). Note that this issue does not affect the binary packages\ndistributed in Debian as CONFIG_NETLABEL is not enabled.\n\nCVE-2020-10732\n\nAn information leak of kernel private memory to userspace was found in\nthe kernel's implementation of core dumping userspace processes.\n\nCVE-2020-10751\n\nDmitry Vyukov reported that the SELinux subsystem did not properly\nhandle validating multiple messages, which could allow a privileged\nattacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10757\n\nFan Yang reported a flaw in the way mremap handled DAX hugepages,\nallowing a local user to escalate their privileges\n\nCVE-2020-10942\n\nIt was discovered that the vhost_net driver did not properly validate\nthe type of sockets set as back-ends. A local user permitted to access\n/dev/vhost-net could use this to cause a stack corruption via crafted\nsystem calls, resulting in denial of service (crash) or possibly\nprivilege escalation.\n\nCVE-2020-11494\n\nIt was discovered that the slcan (serial line CAN) network driver did\nnot fully initialise CAN headers for received packets, resulting in an\ninformation leak from the kernel to user-space or over the CAN\nnetwork.\n\nCVE-2020-11565\n\nEntropy Moe reported that the shared memory filesystem (tmpfs) did not\ncorrectly handle an 'mpol' mount option specifying an empty node list,\nleading to a stack-based out-of-bounds write. If user namespaces are\nenabled, a local user could use this to cause a denial of service\n(crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\nIt was discovered that the ov519, stv06xx, and xirlink_cit media\ndrivers did not properly validate USB device descriptors. A physically\npresent user with a specially constructed USB device could use this to\ncause a denial of service (crash) or possibly for privilege\nescalation.\n\nCVE-2020-12114\n\nPiotr Krysiuk discovered a race condition between the umount and\npivot_root operations in the filesystem core (vfs). A local user with\nthe CAP_SYS_ADMIN capability in any user namespace could use this to\ncause a denial of service (crash).\n\nCVE-2020-12464\n\nKyungtae Kim reported a race condition in the USB core that can result\nin a use-after-free. It is not clear how this can be exploited, but it\ncould result in a denial of service (crash or memory corruption) or\nprivilege escalation.\n\nCVE-2020-12652\n\nTom Hatskevich reported a bug in the mptfusion storage drivers. An\nioctl handler fetched a parameter from user memory twice, creating a\nrace condition which could result in incorrect locking of internal\ndata structures. A local user permitted to access /dev/mptctl could\nuse this to cause a denial of service (crash or memory corruption) or\nfor privilege escalation.\n\nCVE-2020-12653\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently\nvalidate scan requests, resulting a potential heap buffer overflow. A\nlocal user with CAP_NET_ADMIN capability could use this to cause a\ndenial of service (crash or memory corruption) or possibly for\nprivilege escalation.\n\nCVE-2020-12654\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently\nvalidate WMM parameters received from an access point (AP), resulting\na potential heap buffer overflow. A malicious AP could use this to\ncause a denial of service (crash or memory corruption) or possibly to\nexecute code on a vulnerable system.\n\nCVE-2020-12770\n\nIt was discovered that the sg (SCSI generic) driver did not correctly\nrelease internal resources in a particular error case. A local user\npermitted to access an sg device could possibly use this to cause a\ndenial of service (resource exhaustion).\n\nCVE-2020-13143\n\nKyungtae Kim reported a potential heap out-of-bounds write in the USB\ngadget subsystem. A local user permitted to write to the gadget\nconfiguration filesystem could use this to cause a denial of service\n(crash or memory corruption) or potentially for privilege escalation.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n4.9.210-1+deb9u1~deb8u1. This version also fixes some related bugs\nthat do not have their own CVE IDs, and a regression in the macvlan\ndriver introduced in the previous security update (bug #952660).\n\nWe recommend that you upgrade your linux-4.9 packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.", "edition": 5, "cvss3": {"score": 6.7, "vector": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-06-11T00:00:00", "title": "Debian DLA-2242-1 : linux-4.9 security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-10711", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2019-19462", "CVE-2019-2182", "CVE-2020-12114", "CVE-2020-10942", "CVE-2020-11609", "CVE-2020-10732", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-12654", "CVE-2019-20806", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-8428", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2020-8649", "CVE-2020-12652", "CVE-2020-10757", "CVE-2020-8647", "CVE-2019-20811", "CVE-2020-2732"], "modified": "2020-06-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common-rt", "p-cpe:/a:debian:debian_linux:linux-perf-4.9", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armhf", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae-dbg", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae", "cpe:/o:debian:debian_linux:8.0", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686-pae", "p-cpe:/a:debian:debian_linux:linux-doc-4.9", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-marvell", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common", "p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-arm", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64-dbg", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64-dbg", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-amd64", "p-cpe:/a:debian:debian_linux:linux-support-4.9.0-0.bpo.7", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-marvell", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-i386", "p-cpe:/a:debian:debian_linux:linux-kbuild-4.9", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armel", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-amd64", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae-dbg", "p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-686-pae", "p-cpe:/a:debian:debian_linux:linux-manual-4.9", "p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64", "p-cpe:/a:debian:debian_linux:linux-source-4.9"], "id": "DEBIAN_DLA-2242.NASL", "href": "https://www.tenable.com/plugins/nessus/137339", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-2242-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137339);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2019-19319\", \"CVE-2019-19462\", \"CVE-2019-19768\", \"CVE-2019-20806\", \"CVE-2019-20811\", \"CVE-2019-2182\", \"CVE-2019-5108\", \"CVE-2020-0543\", \"CVE-2020-10711\", \"CVE-2020-10732\", \"CVE-2020-10751\", \"CVE-2020-10757\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-12114\", \"CVE-2020-12464\", \"CVE-2020-12652\", \"CVE-2020-12653\", \"CVE-2020-12654\", \"CVE-2020-12770\", \"CVE-2020-13143\", \"CVE-2020-2732\", \"CVE-2020-8428\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n\n script_name(english:\"Debian DLA-2242-1 : linux-4.9 security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2019-2182\n\nHanjun Guo and Lei Li reported a race condition in the arm64 virtual\nmemory management code, which could lead to an information disclosure,\ndenial of service (crash), or possibly privilege escalation.\n\nCVE-2019-5108\n\nMitchell Frank of Cisco discovered that when the IEEE 802.11 (WiFi)\nstack was used in AP mode with roaming, it would trigger roaming for a\nnewly associated station before the station was authenticated. An\nattacker within range of the AP could use this to cause a denial of\nservice, either by filling up a switching table or by redirecting\ntraffic away from other stations.\n\nCVE-2019-19319\n\nJungyeon discovered that a crafted filesystem can cause the ext4\nimplementation to deallocate or reallocate journal blocks. A user\npermitted to mount filesystems could use this to cause a denial of\nservice (crash), or possibly for privilege escalation.\n\nCVE-2019-19462\n\nThe syzbot tool found a missing error check in the 'relay' library\nused to implement various files under debugfs. A local user permitted\nto access debugfs could use this to cause a denial of service (crash)\nor possibly for privilege escalation.\n\nCVE-2019-19768\n\nTristan Madani reported a race condition in the blktrace debug\nfacility that could result in a use-after-free. A local user able to\ntrigger removal of block devices could possibly use this to cause a\ndenial of service (crash) or for privilege escalation.\n\nCVE-2019-20806\n\nA potential NULL pointer dereference was discovered in the tw5864\nmedia driver. The security impact of this is unclear.\n\nCVE-2019-20811\n\nThe Hulk Robot tool found a reference-counting bug in an error path in\nthe network subsystem. The security impact of this is unclear.\n\nCVE-2020-0543\n\nResearchers at VU Amsterdam discovered that on some Intel CPUs\nsupporting the RDRAND and RDSEED instructions, part of a random value\ngenerated by these instructions may be used in a later speculative\nexecution on any core of the same physical CPU. Depending on how these\ninstructions are used by applications, a local user or VM guest could\nuse this to obtain sensitive information such as cryptographic keys\nfrom other users or VMs.\n\nThis vulnerability can be mitigated by a microcode update,\neither as part of system firmware (BIOS) or through the\nintel-microcode package in Debian's non-free archive\nsection. This kernel update only provides reporting of the\nvulnerability and the option to disable the mitigation if it\nis not needed.\n\nCVE-2020-2732\n\nPaulo Bonzini discovered that the KVM implementation for Intel\nprocessors did not properly handle instruction emulation for L2 guests\nwhen nested virtualization is enabled. This could allow an L2 guest to\ncause privilege escalation, denial of service, or information leaks in\nthe L1 guest.\n\nCVE-2020-8428\n\nAl Viro discovered a potential use-after-free in the filesystem core\n(vfs). A local user could exploit this to cause a denial of service\n(crash) or possibly to obtain sensitive information from the kernel.\n\nCVE-2020-8647, CVE-2020-8649\n\nThe Hulk Robot tool found a potential MMIO out-of-bounds access in the\nvgacon driver. A local user permitted to access a virtual terminal\n(/dev/tty1 etc.) on a system using the vgacon driver could use this to\ncause a denial of service (crash or memory corruption) or possibly for\nprivilege escalation.\n\nCVE-2020-8648\n\nThe syzbot tool found a race condition in the the virtual terminal\ndriver, which could result in a use-after-free. A local user permitted\nto access a virtual terminal could use this to cause a denial of\nservice (crash or memory corruption) or possibly for privilege\nescalation.\n\nCVE-2020-9383\n\nJordy Zomer reported an incorrect range check in the floppy driver\nwhich could lead to a static out-of-bounds access. A local user\npermitted to access a floppy drive could use this to cause a denial of\nservice (crash or memory corruption) or possibly for privilege\nescalation.\n\nCVE-2020-10711\n\nMatthew Sheets reported NULL pointer dereference issues in the SELinux\nsubsystem while receiving CIPSO packet with null category. A remote\nattacker can take advantage of this flaw to cause a denial of service\n(crash). Note that this issue does not affect the binary packages\ndistributed in Debian as CONFIG_NETLABEL is not enabled.\n\nCVE-2020-10732\n\nAn information leak of kernel private memory to userspace was found in\nthe kernel's implementation of core dumping userspace processes.\n\nCVE-2020-10751\n\nDmitry Vyukov reported that the SELinux subsystem did not properly\nhandle validating multiple messages, which could allow a privileged\nattacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10757\n\nFan Yang reported a flaw in the way mremap handled DAX hugepages,\nallowing a local user to escalate their privileges\n\nCVE-2020-10942\n\nIt was discovered that the vhost_net driver did not properly validate\nthe type of sockets set as back-ends. A local user permitted to access\n/dev/vhost-net could use this to cause a stack corruption via crafted\nsystem calls, resulting in denial of service (crash) or possibly\nprivilege escalation.\n\nCVE-2020-11494\n\nIt was discovered that the slcan (serial line CAN) network driver did\nnot fully initialise CAN headers for received packets, resulting in an\ninformation leak from the kernel to user-space or over the CAN\nnetwork.\n\nCVE-2020-11565\n\nEntropy Moe reported that the shared memory filesystem (tmpfs) did not\ncorrectly handle an 'mpol' mount option specifying an empty node list,\nleading to a stack-based out-of-bounds write. If user namespaces are\nenabled, a local user could use this to cause a denial of service\n(crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\nIt was discovered that the ov519, stv06xx, and xirlink_cit media\ndrivers did not properly validate USB device descriptors. A physically\npresent user with a specially constructed USB device could use this to\ncause a denial of service (crash) or possibly for privilege\nescalation.\n\nCVE-2020-12114\n\nPiotr Krysiuk discovered a race condition between the umount and\npivot_root operations in the filesystem core (vfs). A local user with\nthe CAP_SYS_ADMIN capability in any user namespace could use this to\ncause a denial of service (crash).\n\nCVE-2020-12464\n\nKyungtae Kim reported a race condition in the USB core that can result\nin a use-after-free. It is not clear how this can be exploited, but it\ncould result in a denial of service (crash or memory corruption) or\nprivilege escalation.\n\nCVE-2020-12652\n\nTom Hatskevich reported a bug in the mptfusion storage drivers. An\nioctl handler fetched a parameter from user memory twice, creating a\nrace condition which could result in incorrect locking of internal\ndata structures. A local user permitted to access /dev/mptctl could\nuse this to cause a denial of service (crash or memory corruption) or\nfor privilege escalation.\n\nCVE-2020-12653\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently\nvalidate scan requests, resulting a potential heap buffer overflow. A\nlocal user with CAP_NET_ADMIN capability could use this to cause a\ndenial of service (crash or memory corruption) or possibly for\nprivilege escalation.\n\nCVE-2020-12654\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently\nvalidate WMM parameters received from an access point (AP), resulting\na potential heap buffer overflow. A malicious AP could use this to\ncause a denial of service (crash or memory corruption) or possibly to\nexecute code on a vulnerable system.\n\nCVE-2020-12770\n\nIt was discovered that the sg (SCSI generic) driver did not correctly\nrelease internal resources in a particular error case. A local user\npermitted to access an sg device could possibly use this to cause a\ndenial of service (resource exhaustion).\n\nCVE-2020-13143\n\nKyungtae Kim reported a potential heap out-of-bounds write in the USB\ngadget subsystem. A local user permitted to write to the gadget\nconfiguration filesystem could use this to cause a denial of service\n(crash or memory corruption) or potentially for privilege escalation.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n4.9.210-1+deb9u1~deb8u1. This version also fixes some related bugs\nthat do not have their own CVE IDs, and a regression in the macvlan\ndriver introduced in the previous security update (bug #952660).\n\nWe recommend that you upgrade your linux-4.9 packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/linux-4.9\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-12464\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-doc-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-armhf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-all-i386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-common-rt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-marvell\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-0.bpo.7-rt-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-686-pae-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-amd64-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-marvell\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-686-pae-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-4.9.0-0.bpo.7-rt-amd64-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-kbuild-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-manual-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-perf-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-source-4.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-support-4.9.0-0.bpo.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.9-arm\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-doc-4.9\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-686\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-686-pae\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-amd64\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-armel\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-armhf\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-all-i386\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-amd64\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-armmp\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-armmp-lpae\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-common\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-common-rt\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-marvell\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-rt-686-pae\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-4.9.0-0.bpo.7-rt-amd64\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-686\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-686-pae\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-686-pae-dbg\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-amd64\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-amd64-dbg\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-armmp\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-armmp-lpae\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-marvell\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-686-pae\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-686-pae-dbg\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-amd64\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-4.9.0-0.bpo.7-rt-amd64-dbg\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-kbuild-4.9\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-manual-4.9\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-perf-4.9\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-source-4.9\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-support-4.9.0-0.bpo.7\", reference:\"4.9.210-1+deb9u1~deb8u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-14T13:50:55", "description": "Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\n - CVE-2019-2182\n Hanjun Guo and Lei Li reported a race condition in the\n arm64 virtual memory management code, which could lead\n to an information disclosure, denial of service (crash),\n or possibly privilege escalation.\n\n - CVE-2019-5108\n Mitchell Frank of Cisco discovered that when the IEEE\n 802.11 (WiFi) stack was used in AP mode with roaming, it\n would trigger roaming for a newly associated station\n before the station was authenticated. An attacker within\n range of the AP could use this to cause a denial of\n service, either by filling up a switching table or by\n redirecting traffic away from other stations.\n\n - CVE-2019-19319\n Jungyeon discovered that a crafted filesystem can cause\n the ext4 implementation to deallocate or reallocate\n journal blocks. A user permitted to mount filesystems\n could use this to cause a denial of service (crash), or\n possibly for privilege escalation.\n\n - CVE-2019-19462\n The syzbot tool found a missing error check in the\n 'relay' library used to implement various files under\n debugfs. A local user permitted to access debugfs could\n use this to cause a denial of service (crash) or\n possibly for privilege escalation.\n\n - CVE-2019-19768\n Tristan Madani reported a race condition in the blktrace\n debug facility that could result in a use-after-free. A\n local user able to trigger removal of block devices\n could possibly use this to cause a denial of service\n (crash) or for privilege escalation.\n\n - CVE-2019-20806\n A potential NULL pointer dereference was discovered in\n the tw5864 media driver. The security impact of this is\n unclear.\n\n - CVE-2019-20811\n The Hulk Robot tool found a reference-counting bug in an\n error path in the network subsystem. The security impact\n of this is unclear.\n\n - CVE-2020-0543\n Researchers at VU Amsterdam discovered that on some\n Intel CPUs supporting the RDRAND and RDSEED\n instructions, part of a random value generated by these\n instructions may be used in a later speculative\n execution on any core of the same physical CPU.\n Depending on how these instructions are used by\n applications, a local user or VM guest could use this to\n obtain sensitive information such as cryptographic keys\n from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either as\n part of system firmware (BIOS) or through the intel-microcode\n package in Debian's non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\n - CVE-2020-2732\n Paulo Bonzini discovered that the KVM implementation for\n Intel processors did not properly handle instruction\n emulation for L2 guests when nested virtualization is\n enabled. This could allow an L2 guest to cause privilege\n escalation, denial of service, or information leaks in\n the L1 guest.\n\n - CVE-2020-8428\n Al Viro discovered a potential use-after-free in the\n filesystem core (vfs). A local user could exploit this\n to cause a denial of service (crash) or possibly to\n obtain sensitive information from the kernel.\n\n - CVE-2020-8647, CVE-2020-8649\n The Hulk Robot tool found a potential MMIO out-of-bounds\n access in the vgacon driver. A local user permitted to\n access a virtual terminal (/dev/tty1 etc.) on a system\n using the vgacon driver could use this to cause a denial\n of service (crash or memory corruption) or possibly for\n privilege escalation.\n\n - CVE-2020-8648\n The syzbot tool found a race condition in the the\n virtual terminal driver, which could result in a\n use-after-free. A local user permitted to access a\n virtual terminal could use this to cause a denial of\n service (crash or memory corruption) or possibly for\n privilege escalation.\n\n - CVE-2020-9383\n Jordy Zomer reported an incorrect range check in the\n floppy driver which could lead to a static out-of-bounds\n access. A local user permitted to access a floppy drive\n could use this to cause a denial of service (crash or\n memory corruption) or possibly for privilege escalation.\n\n - CVE-2020-10711\n Matthew Sheets reported NULL pointer dereference issues\n in the SELinux subsystem while receiving CIPSO packet\n with null category. A remote attacker can take advantage\n of this flaw to cause a denial of service (crash). Note\n that this issue does not affect the binary packages\n distributed in Debian as CONFIG_NETLABEL is not enabled.\n\n - CVE-2020-10732\n An information leak of kernel private memory to\n userspace was found in the kernel's implementation of\n core dumping userspace processes.\n\n - CVE-2020-10751\n Dmitry Vyukov reported that the SELinux subsystem did\n not properly handle validating multiple messages, which\n could allow a privileged attacker to bypass SELinux\n netlink restrictions.\n\n - CVE-2020-10757\n Fan Yang reported a flaw in the way mremap handled DAX\n hugepages, allowing a local user to escalate their\n privileges\n\n - CVE-2020-10942\n It was discovered that the vhost_net driver did not\n properly validate the type of sockets set as back-ends.\n A local user permitted to access /dev/vhost-net could\n use this to cause a stack corruption via crafted system\n calls, resulting in denial of service (crash) or\n possibly privilege escalation.\n\n - CVE-2020-11494\n It was discovered that the slcan (serial line CAN)\n network driver did not fully initialise CAN headers for\n received packets, resulting in an information leak from\n the kernel to user-space or over the CAN network.\n\n - CVE-2020-11565\n Entropy Moe reported that the shared memory filesystem\n (tmpfs) did not correctly handle an 'mpol' mount option\n specifying an empty node list, leading to a stack-based\n out-of-bounds write. If user namespaces are enabled, a\n local user could use this to cause a denial of service\n (crash) or possibly for privilege escalation.\n\n - CVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n It was discovered that the ov519, stv06xx, and\n xirlink_cit media drivers did not properly validate USB\n device descriptors. A physically present user with a\n specially constructed USB device could use this to cause\n a denial-of-service (crash) or possibly for privilege\n escalation.\n\n - CVE-2020-12114\n Piotr Krysiuk discovered a race condition between the\n umount and pivot_root operations in the filesystem core\n (vfs). A local user with the CAP_SYS_ADMIN capability in\n any user namespace could use this to cause a denial of\n service (crash).\n\n - CVE-2020-12464\n Kyungtae Kim reported a race condition in the USB core\n that can result in a use-after-free. It is not clear how\n this can be exploited, but it could result in a denial\n of service (crash or memory corruption) or privilege\n escalation.\n\n - CVE-2020-12652\n Tom Hatskevich reported a bug in the mptfusion storage\n drivers. An ioctl handler fetched a parameter from user\n memory twice, creating a race condition which could\n result in incorrect locking of internal data structures.\n A local user permitted to access /dev/mptctl could use\n this to cause a denial of service (crash or memory\n corruption) or for privilege escalation.\n\n - CVE-2020-12653\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a\n potential heap buffer overflow. A local user with\n CAP_NET_ADMIN capability could use this to cause a\n denial of service (crash or memory corruption) or\n possibly for privilege escalation.\n\n - CVE-2020-12654\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an\n access point (AP), resulting a potential heap buffer\n overflow. A malicious AP could use this to cause a\n denial of service (crash or memory corruption) or\n possibly to execute code on a vulnerable system.\n\n - CVE-2020-12770\n It was discovered that the sg (SCSI generic) driver did\n not correctly release internal resources in a particular\n error case. A local user permitted to access an sg\n device could possibly use this to cause a denial of\n service (resource exhaustion).\n\n - CVE-2020-13143\n Kyungtae Kim reported a potential heap out-of-bounds\n write in the USB gadget subsystem. A local user\n permitted to write to the gadget configuration\n filesystem could use this to cause a denial of service\n (crash or memory corruption) or potentially for\n privilege escalation.", "edition": 3, "cvss3": {"score": 6.7, "vector": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-06-11T00:00:00", "title": "Debian DSA-4698-1 : linux - security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-10711", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2019-19462", "CVE-2019-2182", "CVE-2020-12114", "CVE-2020-10942", "CVE-2020-11609", "CVE-2020-10732", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-12654", "CVE-2019-20806", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-8428", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2020-8649", "CVE-2020-12652", "CVE-2020-10757", "CVE-2020-8647", "CVE-2019-20811", "CVE-2020-2732"], "modified": "2020-06-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:linux", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4698.NASL", "href": "https://www.tenable.com/plugins/nessus/137340", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4698. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(137340);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/18\");\n\n script_cve_id(\"CVE-2019-19319\", \"CVE-2019-19462\", \"CVE-2019-19768\", \"CVE-2019-20806\", \"CVE-2019-20811\", \"CVE-2019-2182\", \"CVE-2019-5108\", \"CVE-2020-0543\", \"CVE-2020-10711\", \"CVE-2020-10732\", \"CVE-2020-10751\", \"CVE-2020-10757\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-12114\", \"CVE-2020-12464\", \"CVE-2020-12652\", \"CVE-2020-12653\", \"CVE-2020-12654\", \"CVE-2020-12770\", \"CVE-2020-13143\", \"CVE-2020-2732\", \"CVE-2020-8428\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_xref(name:\"DSA\", value:\"4698\");\n\n script_name(english:\"Debian DSA-4698-1 : linux - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\n - CVE-2019-2182\n Hanjun Guo and Lei Li reported a race condition in the\n arm64 virtual memory management code, which could lead\n to an information disclosure, denial of service (crash),\n or possibly privilege escalation.\n\n - CVE-2019-5108\n Mitchell Frank of Cisco discovered that when the IEEE\n 802.11 (WiFi) stack was used in AP mode with roaming, it\n would trigger roaming for a newly associated station\n before the station was authenticated. An attacker within\n range of the AP could use this to cause a denial of\n service, either by filling up a switching table or by\n redirecting traffic away from other stations.\n\n - CVE-2019-19319\n Jungyeon discovered that a crafted filesystem can cause\n the ext4 implementation to deallocate or reallocate\n journal blocks. A user permitted to mount filesystems\n could use this to cause a denial of service (crash), or\n possibly for privilege escalation.\n\n - CVE-2019-19462\n The syzbot tool found a missing error check in the\n 'relay' library used to implement various files under\n debugfs. A local user permitted to access debugfs could\n use this to cause a denial of service (crash) or\n possibly for privilege escalation.\n\n - CVE-2019-19768\n Tristan Madani reported a race condition in the blktrace\n debug facility that could result in a use-after-free. A\n local user able to trigger removal of block devices\n could possibly use this to cause a denial of service\n (crash) or for privilege escalation.\n\n - CVE-2019-20806\n A potential NULL pointer dereference was discovered in\n the tw5864 media driver. The security impact of this is\n unclear.\n\n - CVE-2019-20811\n The Hulk Robot tool found a reference-counting bug in an\n error path in the network subsystem. The security impact\n of this is unclear.\n\n - CVE-2020-0543\n Researchers at VU Amsterdam discovered that on some\n Intel CPUs supporting the RDRAND and RDSEED\n instructions, part of a random value generated by these\n instructions may be used in a later speculative\n execution on any core of the same physical CPU.\n Depending on how these instructions are used by\n applications, a local user or VM guest could use this to\n obtain sensitive information such as cryptographic keys\n from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either as\n part of system firmware (BIOS) or through the intel-microcode\n package in Debian's non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\n - CVE-2020-2732\n Paulo Bonzini discovered that the KVM implementation for\n Intel processors did not properly handle instruction\n emulation for L2 guests when nested virtualization is\n enabled. This could allow an L2 guest to cause privilege\n escalation, denial of service, or information leaks in\n the L1 guest.\n\n - CVE-2020-8428\n Al Viro discovered a potential use-after-free in the\n filesystem core (vfs). A local user could exploit this\n to cause a denial of service (crash) or possibly to\n obtain sensitive information from the kernel.\n\n - CVE-2020-8647, CVE-2020-8649\n The Hulk Robot tool found a potential MMIO out-of-bounds\n access in the vgacon driver. A local user permitted to\n access a virtual terminal (/dev/tty1 etc.) on a system\n using the vgacon driver could use this to cause a denial\n of service (crash or memory corruption) or possibly for\n privilege escalation.\n\n - CVE-2020-8648\n The syzbot tool found a race condition in the the\n virtual terminal driver, which could result in a\n use-after-free. A local user permitted to access a\n virtual terminal could use this to cause a denial of\n service (crash or memory corruption) or possibly for\n privilege escalation.\n\n - CVE-2020-9383\n Jordy Zomer reported an incorrect range check in the\n floppy driver which could lead to a static out-of-bounds\n access. A local user permitted to access a floppy drive\n could use this to cause a denial of service (crash or\n memory corruption) or possibly for privilege escalation.\n\n - CVE-2020-10711\n Matthew Sheets reported NULL pointer dereference issues\n in the SELinux subsystem while receiving CIPSO packet\n with null category. A remote attacker can take advantage\n of this flaw to cause a denial of service (crash). Note\n that this issue does not affect the binary packages\n distributed in Debian as CONFIG_NETLABEL is not enabled.\n\n - CVE-2020-10732\n An information leak of kernel private memory to\n userspace was found in the kernel's implementation of\n core dumping userspace processes.\n\n - CVE-2020-10751\n Dmitry Vyukov reported that the SELinux subsystem did\n not properly handle validating multiple messages, which\n could allow a privileged attacker to bypass SELinux\n netlink restrictions.\n\n - CVE-2020-10757\n Fan Yang reported a flaw in the way mremap handled DAX\n hugepages, allowing a local user to escalate their\n privileges\n\n - CVE-2020-10942\n It was discovered that the vhost_net driver did not\n properly validate the type of sockets set as back-ends.\n A local user permitted to access /dev/vhost-net could\n use this to cause a stack corruption via crafted system\n calls, resulting in denial of service (crash) or\n possibly privilege escalation.\n\n - CVE-2020-11494\n It was discovered that the slcan (serial line CAN)\n network driver did not fully initialise CAN headers for\n received packets, resulting in an information leak from\n the kernel to user-space or over the CAN network.\n\n - CVE-2020-11565\n Entropy Moe reported that the shared memory filesystem\n (tmpfs) did not correctly handle an 'mpol' mount option\n specifying an empty node list, leading to a stack-based\n out-of-bounds write. If user namespaces are enabled, a\n local user could use this to cause a denial of service\n (crash) or possibly for privilege escalation.\n\n - CVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n It was discovered that the ov519, stv06xx, and\n xirlink_cit media drivers did not properly validate USB\n device descriptors. A physically present user with a\n specially constructed USB device could use this to cause\n a denial-of-service (crash) or possibly for privilege\n escalation.\n\n - CVE-2020-12114\n Piotr Krysiuk discovered a race condition between the\n umount and pivot_root operations in the filesystem core\n (vfs). A local user with the CAP_SYS_ADMIN capability in\n any user namespace could use this to cause a denial of\n service (crash).\n\n - CVE-2020-12464\n Kyungtae Kim reported a race condition in the USB core\n that can result in a use-after-free. It is not clear how\n this can be exploited, but it could result in a denial\n of service (crash or memory corruption) or privilege\n escalation.\n\n - CVE-2020-12652\n Tom Hatskevich reported a bug in the mptfusion storage\n drivers. An ioctl handler fetched a parameter from user\n memory twice, creating a race condition which could\n result in incorrect locking of internal data structures.\n A local user permitted to access /dev/mptctl could use\n this to cause a denial of service (crash or memory\n corruption) or for privilege escalation.\n\n - CVE-2020-12653\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a\n potential heap buffer overflow. A local user with\n CAP_NET_ADMIN capability could use this to cause a\n denial of service (crash or memory corruption) or\n possibly for privilege escalation.\n\n - CVE-2020-12654\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an\n access point (AP), resulting a potential heap buffer\n overflow. A malicious AP could use this to cause a\n denial of service (crash or memory corruption) or\n possibly to execute code on a vulnerable system.\n\n - CVE-2020-12770\n It was discovered that the sg (SCSI generic) driver did\n not correctly release internal resources in a particular\n error case. A local user permitted to access an sg\n device could possibly use this to cause a denial of\n service (resource exhaustion).\n\n - CVE-2020-13143\n Kyungtae Kim reported a potential heap out-of-bounds\n write in the USB gadget subsystem. A local user\n permitted to write to the gadget configuration\n filesystem could use this to cause a denial of service\n (crash or memory corruption) or potentially for\n privilege escalation.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=952660\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-2182\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-5108\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-19319\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-19462\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-19768\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-20806\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-20811\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-0543\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-2732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-8428\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-8647\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-8649\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-8648\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-9383\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-10711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-10732\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-10751\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-10757\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-10942\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-11494\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-11565\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-11608\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-11609\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-11668\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-12114\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-12464\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-12652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-12653\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-12654\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-12770\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2020-13143\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/linux\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/linux\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2020/dsa-4698\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Upgrade the linux packages.\n\nFor the oldstable distribution (stretch), these problems have been\nfixed in version 4.9.210-1+deb9u1. This version also fixes some\nrelated bugs that do not have their own CVE IDs, and a regression in\nthe macvlan driver introduced in the previous point release (bug\n#952660).\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-12464\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/09/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"hyperv-daemons\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcpupower-dev\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcpupower1\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libusbip-dev\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-compiler-gcc-6-arm\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-compiler-gcc-6-s390\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-compiler-gcc-6-x86\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-cpupower\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-doc-4.9\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-4kc-malta\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-5kc-malta\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-686\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-686-pae\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-amd64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-arm64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-armel\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-armhf\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-i386\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-mips\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-mips64el\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-mipsel\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-ppc64el\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-all-s390x\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-amd64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-arm64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-armmp\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-armmp-lpae\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-common\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-common-rt\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-loongson-3\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-marvell\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-octeon\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-powerpc64le\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-rt-686-pae\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-rt-amd64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-headers-4.9.0-9-s390x\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-4kc-malta\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-4kc-malta-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-5kc-malta\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-5kc-malta-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-686\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-686-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-686-pae\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-686-pae-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-amd64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-amd64-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-arm64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-arm64-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-armmp\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-armmp-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-armmp-lpae\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-armmp-lpae-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-loongson-3\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-loongson-3-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-marvell\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-marvell-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-octeon\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-octeon-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-powerpc64le\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-powerpc64le-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-rt-686-pae\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-rt-686-pae-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-rt-amd64\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-rt-amd64-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-s390x\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-image-4.9.0-9-s390x-dbg\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-kbuild-4.9\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-libc-dev\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-manual-4.9\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-perf-4.9\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-source-4.9\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"linux-support-4.9.0-9\", reference:\"4.9.210-1+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"usbip\", reference:\"4.9.210-1+deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "talos": [{"lastseen": "2019-12-20T16:22:08", "bulletinFamily": "info", "cvelist": ["CVE-2019-5108", "CVE-2019-5061"], "description": "# Talos Vulnerability Report\n\n### TALOS-2019-0849\n\n## W1.fi hostapd CAM table denial-of-service vulnerability\n\n##### December 11, 2019\n\n##### CVE Number\n\nCVE-2019-5061\n\n### Summary\n\nAn exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby Aps of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability\n\n### Tested Versions\n\nhostapd version 2.6 Ubiquiti AP-AC-Pro firmware 4.0.10.9653\n\n### Product URLs\n\n<https://w1.fi/hostapd/>\n\n### CVSSv3 Score\n\n7.4 - AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\n\n### CWE\n\nCWE-440 - Expected Behavior Violation\n\n### Details\n\nWhen hostapd is compiled with default configurations the IAPP protocol is enabled. The IAPP protocol sends a broadcast packet to the LAN with the MAC address of the station.\n\nUpon receipt of an Authentication and AssociationRequest packet, hostapd will send a broadcast packet with the MAC address of the connecting station to the LAN. This packet is sent before the station has successfully authenticated. An attacker could iterate through a large set of unique MAC addresses to trigger DoS attacks within the upstream network infrastructure.\n\n### Timeline\n\n2019-07-01 - Vendor Disclosure \n2019-07-28 - Vendor acknowledged and provided comments for review to the advisory \n2019-09-10 - Talos updated security advisory;Related Linux kernel issue discovered (CVE-2019-5108); 90 day timeline reset per Talos \n2019-11-10 - Vendor confirmed fix applied to main repository \n2019-12-11 - Public Release\n\n##### Credit\n\nDiscovered by Mitchell Frank of Cisco\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2019-0850\n\nPrevious Report\n\nTALOS-2019-0808\n", "edition": 2, "modified": "2019-12-11T00:00:00", "published": "2019-12-11T00:00:00", "id": "TALOS-2019-0849", "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0849", "title": "W1.fi hostapd CAM table denial-of-service vulnerability", "type": "talos", "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}}], "talosblog": [{"lastseen": "2019-12-11T19:20:11", "bulletinFamily": "blog", "cvelist": ["CVE-2019-5061", "CVE-2019-5062", "CVE-2019-5108"], "description": "[](<https://1.bp.blogspot.com/-4KmzPgCzEnI/XUgv9m3AF_I/AAAAAAAAAC4/C28-47fWukERV4yT0uQnA2_xuy2aB8ZkgCPcBGAYYCw/s1600/recurring%2Bblog%2Bimages_vuln%2Bspotlight.jpg>)\n\n_ \n__Mitchell Frank and Mark Leonard of Cisco discovered these vulnerabilities. Blog by Jon Munshaw._ \n \nCisco Talos recently discovered two denial-of-service vulnerabilities in the open-source program W1.fi. Both of these vulnerabilities target hostapd. One could allow an attacker to forge authentication requests, while another could trigger a deauthentication, both resulting in a denial of service. \n\n\n[](<https://1.bp.blogspot.com/-JXkSIehaKi4/XUgwEX6wLjI/AAAAAAAAAC8/8mea4rZfy7AGT_PIchejkERmCFmfdbxTACPcBGAYYCw/s1600/patch_availability_available.jpg>)\n\n \nIn accordance with our coordinated disclosure policy, Cisco Talos worked with the manager of W1.fi to ensure that these issues are resolved and that an update is available for affected customers. TALOS-2019-0849 relates to TALOS-2019-0900, a denial-of-service vulnerability in the Linux kernel. Linux has also released an update to address that vulnerability, which makes more versions of Linux besides the mainline one safe from these vulnerabilities. \n \n\n\n### Vulnerability details\n\n**W1.fi hostapd CAM table denial-of-service vulnerability (TALOS-2019-0849/CVE-2019-5061)** \n \nAn exploitable denial-of-service vulnerability exists in hostapd version 2.6. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability. \n \nRead the complete vulnerability advisory [here](<https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0849>) for additional information. \n \n**W1.fi hostapd deauthentication denial-of-service vulnerability (TALOS-2019-0850/CVE-2019-5062)** \n \nAn exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service. \n \nRead the complete vulnerability advisory [here](<https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0850>) for additional information. \n \n**Linux kernel CAM table denial-of-service vulnerability (TALOS-2019-0900/CVE-2019-5108)** \n \nAn exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability. \n \nRead the complete vulnerability advisory [here](<https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0900>) for additional information. \n \n\n\n### Versions tested\n\nTalos tested and confirmed that TALOS-2019-0849 affects hostapd version 2.6 and Ubiquiti AP-AC-Pro firmware 4.0.10.9653. TALOS-2019-0850 affects hostapd version 2.6 when running on a Raspberry Pi. TALOS-2019-0900 affects versions 4.14.98-v7 and higher of the Linux operating system. \n \n \n\n\n### Coverage\n\nThe following SNORT\u24c7 rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org. \n \nSnort Rules: 50516", "modified": "2019-12-11T09:18:44", "published": "2019-12-11T09:18:44", "id": "TALOSBLOG:3408EA53C759FF775E8D772720035A70", "href": "http://feedproxy.google.com/~r/feedburner/Talos/~3/Hoe1pQFetWU/vuln-spotlight-linux-w1fi-dos-dec-19.html", "type": "talosblog", "title": "Vulnerability Spotlight: Denial-of-service vulnerabilities in Linux kernel, W1.fi", "cvss": {"score": 0.0, "vector": "NONE"}}], "redhat": [{"lastseen": "2020-04-16T15:42:34", "bulletinFamily": "unix", "cvelist": ["CVE-2019-14895", "CVE-2019-14901", "CVE-2019-15031", "CVE-2019-15099", "CVE-2019-15666", "CVE-2019-19922", "CVE-2019-20054", "CVE-2019-20095", "CVE-2019-5108"], "description": "The kernel-alt packages provide the Linux kernel version 4.x.\n\nSecurity Fix(es):\n\n* kernel: heap-based buffer overflow in mwifiex_process_country_ie() function in drivers/net/wireless/marvell/mwifiex/sta_ioctl.c (CVE-2019-14895)\n\n* kernel: heap overflow in marvell/mwifiex/tdls.c (CVE-2019-14901)\n\n* kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS (CVE-2019-5108)\n\n* kernel: powerpc: local user can read vector registers of other users' processes via an interrupt (CVE-2019-15031)\n\n* kernel: out-of-bounds array access in __xfrm_policy_unlink (CVE-2019-15666)\n\n* kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash (CVE-2019-15099)\n\n* kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound applications (CVE-2019-19922)\n\n* kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)\n\n* kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c (CVE-2019-20095)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* rhel-alt-76z bsd process accounting(acct(2)) does not work (BZ#1763618)", "modified": "2020-04-16T18:02:15", "published": "2020-04-16T17:36:34", "id": "RHSA-2020:1493", "href": "https://access.redhat.com/errata/RHSA-2020:1493", "type": "redhat", "title": "(RHSA-2020:1493) Important: kernel-alt security and bug fix update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-02-09T10:28:35", "bulletinFamily": "unix", "cvelist": ["CVE-2018-16871", "CVE-2019-10639", "CVE-2019-12819", "CVE-2019-15090", "CVE-2019-15099", "CVE-2019-15221", "CVE-2019-15223", "CVE-2019-16234", "CVE-2019-17053", "CVE-2019-17055", "CVE-2019-18282", "CVE-2019-18805", "CVE-2019-19045", "CVE-2019-19047", "CVE-2019-19055", "CVE-2019-19057", "CVE-2019-19058", "CVE-2019-19059", "CVE-2019-19065", "CVE-2019-19067", "CVE-2019-19073", "CVE-2019-19074", "CVE-2019-19077", "CVE-2019-19532", "CVE-2019-19534", "CVE-2019-19768", "CVE-2019-19922", "CVE-2019-5108", "CVE-2019-8980", "CVE-2020-10690", "CVE-2020-1749", "CVE-2020-7053"], "description": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)\n\n* kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)\n\n* kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service (CVE-2019-8980)\n\n* kernel: unprivileged users able to create RAW sockets in AF_IEEE802154 network protocol. (CVE-2019-17053)\n\n* kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol. (CVE-2019-17055)\n\n* kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)\n\n* kernel: information leak bug caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)\n\n* kernel: some ipv6 protocols not encrypted over ipsec tunnel. (CVE-2020-1749)\n\n* Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR (CVE-2019-10639)\n\n* kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure (CVE-2019-15090)\n\n* kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash (CVE-2019-15099)\n\n* kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)\n\n* kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)\n\n* kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS) (CVE-2019-19073)\n\n* kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)\n\n* kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound applications (CVE-2019-19922)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* RT: update RT source tree to the RHEL-8.2 tree (BZ#1708716)\n\n* KVM-RT guest fails boot with emulatorsched (BZ#1712781)\n\n* 8 vCPU guest need max latency < 20 us with stress [RT-8.2] (BZ#1757165)\n\n* Request nx_huge_pages=N as default value to avoid kvm-rt guest large latency spike [rt-8] (BZ#1788352)\n\n* RT: Add rpm Provide of 'kernel' to indicate that this is a kernel package (BZ#1796284)\n\n* [RHEL8] RT kernel signed by test certificate and not Red Hat Secure Boot (BZ#1806871)\n\nEnhancement(s):\n\n* update to the upstream 5.x RT patchset (BZ#1680161)", "modified": "2021-02-09T15:15:14", "published": "2020-04-28T12:51:22", "id": "RHSA-2020:1567", "href": "https://access.redhat.com/errata/RHSA-2020:1567", "type": "redhat", "title": "(RHSA-2020:1567) Important: kernel-rt security, bug fix, and enhancement update", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "openvas": [{"lastseen": "2020-05-08T17:11:22", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-15217", "CVE-2019-19051", "CVE-2019-19965", "CVE-2019-14615", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-19066", "CVE-2019-17351", "CVE-2019-19068", "CVE-2019-19056", "CVE-2019-20096"], "description": "The remote host is missing an update for the ", "modified": "2020-05-07T00:00:00", "published": "2020-02-19T00:00:00", "id": "OPENVAS:1361412562310844342", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844342", "type": "openvas", "title": "Ubuntu: Security Advisory for linux (USN-4286-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844342\");\n script_version(\"2020-05-07T08:41:48+0000\");\n script_cve_id(\"CVE-2019-14615\", \"CVE-2019-15220\", \"CVE-2019-17351\", \"CVE-2019-19051\", \"CVE-2019-19056\", \"CVE-2019-19066\", \"CVE-2019-19068\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2019-15217\", \"CVE-2019-15221\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-05-07 08:41:48 +0000 (Thu, 07 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-02-19 04:00:45 +0000 (Wed, 19 Feb 2020)\");\n script_name(\"Ubuntu: Security Advisory for linux (USN-4286-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n script_xref(name:\"USN\", value:\"4286-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2020-February/005336.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the USN-4286-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors. A\nlocal attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54\ndevice driver in the Linux kernel. A physically proximate attacker could\nuse this to cause a denial of service (system crash). (CVE-2019-15220)\n\nJulien Grall discovered that the Xen balloon memory driver in the Linux\nkernel did not properly restrict the amount of memory set aside for page\nmappings in some situations. An attacker could use this to cause a denial\nof service (kernel memory exhaustion). (CVE-2019-17351)\n\nIt was discovered that the Intel WiMAX 2400 driver in the Linux kernel did\nnot properly deallocate memory in certain situations. A local attacker\ncould use this to cause a denial of service (kernel memory exhaustion).\n(CVE-2019-19051)\n\nIt was discovered that the Marvell Wi-Fi device driver in the Linux kernel\ndid not properly deallocate memory in certain error conditions. A local\nattacker could use this to possibly cause a denial of service (kernel\nmemory exhaustion). (CVE-2019-19056)\n\nIt was discovered that the Brocade BFA Fibre Channel device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial of\nservice (kernel memory exhaustion). (CVE-2019-19066)\n\nIt was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial of\nservice (kernel memory exhaustion). (CVE-2019-19068)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer dereference. A\nlocal attacker could possibly use this to cause a denial of service (system\ncrash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory in\ncertain error conditions. An attacker could possibly use this to cause a\ndenial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel\nwhen used as an access point would send IAPP location updates for stations\nbefore client authentication had completed. A physically proximate attacker\ncould use this to cause a denial of service. (CVE-2019-5108)\n\nIt was discovered that ZR364XX Camera USB device driver for the Linux\nkernel did ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1066-kvm\", ver:\"4.4.0-1066.73\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1102-aws\", ver:\"4.4.0-1102.113\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1129-raspi2\", ver:\"4.4.0-1129.138\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-1133-snapdragon\", ver:\"4.4.0-1133.141\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-174-generic\", ver:\"4.4.0-174.204\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-174-generic-lpae\", ver:\"4.4.0-174.204\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-174-lowlatency\", ver:\"4.4.0-174.204\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-174-powerpc-e500mc\", ver:\"4.4.0-174.204\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-174-powerpc-smp\", ver:\"4.4.0-174.204\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-174-powerpc64-emb\", ver:\"4.4.0-174.204\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.4.0-174-powerpc64-smp\", ver:\"4.4.0-174.204\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.4.0.1102.106\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-kvm\", ver:\"4.4.0.1066.66\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-smp\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.4.0.1129.129\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-snapdragon\", ver:\"4.4.0.1133.125\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual\", ver:\"4.4.0.174.182\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-06-10T17:55:35", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19965", "CVE-2019-14615", "CVE-2019-19947", "CVE-2019-19063", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-20096"], "description": "The remote host is missing an update for the ", "modified": "2020-06-09T00:00:00", "published": "2020-02-19T00:00:00", "id": "OPENVAS:1361412562310844341", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844341", "type": "openvas", "title": "Ubuntu: Security Advisory for linux-aws-5.0 (USN-4285-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844341\");\n script_version(\"2020-06-09T06:40:15+0000\");\n script_cve_id(\"CVE-2019-14615\", \"CVE-2019-16229\", \"CVE-2019-16232\", \"CVE-2019-18786\", \"CVE-2019-18809\", \"CVE-2019-19057\", \"CVE-2019-19063\", \"CVE-2019-19947\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2020-7053\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-09 06:40:15 +0000 (Tue, 09 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-02-19 04:00:35 +0000 (Wed, 19 Feb 2020)\");\n script_name(\"Ubuntu: Security Advisory for linux-aws-5.0 (USN-4285-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU18\\.04 LTS\");\n\n script_xref(name:\"USN\", value:\"4285-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2020-February/005335.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-aws-5.0'\n package(s) announced via the USN-4285-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors. A\nlocal attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices did\nnot properly check for errors in certain situations, leading to a NULL\npointer dereference. A local attacker could possibly use this to cause a\ndenial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in the\nLinux kernel did not properly check for errors in certain situations,\nleading to a NULL pointer dereference. A local attacker could possibly use\nthis to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF) driver in\nthe Linux kernel did not properly initialize data. A local attacker could\npossibly use this to expose sensitive information (kernel memory)\n(CVE-2019-18786).\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial of\nservice (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that multiple memory leaks existed in the Marvell WiFi-Ex\nDriver for the Linux kernel. A local attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-19057)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the Linux\nkernel did not properly deallocate memory in certain error conditions. A\nlocal attacker could possibly use this to cause a denial of service (kernel\nmemory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the Kvaser CAN/USB driver in the Linux kernel did\nnot properly initialize memory in certain situations. A local attacker\ncould possibly use this to expose sensitive information (kernel memory).\n(CVE-2019-19947)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel\ncontained a race condition that could lead to a NULL pointer dereference. A\nlocal attacker could possibly use this to cause a denial of service (system\ncrash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\nimplementation in the Linux kernel did not properly deallocate memory in\ncertain error conditions. An attacker could possibly use this to cause a\ndenial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel\nwhen used as an access point would send IAPP location update ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux-aws-5.0' package(s) on Ubuntu 18.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-5.0.0-1011-oracle\", ver:\"5.0.0-1011.16\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-5.0.0-1025-aws\", ver:\"5.0.0-1025.28\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-5.0.0-1030-gke\", ver:\"5.0.0-1030.31\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-5.0.0-1031-gcp\", ver:\"5.0.0-1031.32\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-5.0.0-1032-azure\", ver:\"5.0.0-1032.34\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-azure\", ver:\"5.0.0.1032.43\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gcp\", ver:\"5.0.0.1031.35\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke-5.0\", ver:\"5.0.0.1030.18\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-04-03T17:04:59", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2020-8648", "CVE-2020-9383", "CVE-2019-20095", "CVE-2019-19332", "CVE-2019-14896", "CVE-2019-19922", "CVE-2019-3016", "CVE-2019-11135", "CVE-2019-19947", "CVE-2019-19338", "CVE-2019-14895", "CVE-2019-14897", "CVE-2020-8428", "CVE-2020-8649", "CVE-2020-8647", "CVE-2019-20096"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-04-01T00:00:00", "published": "2020-04-01T00:00:00", "id": "OPENVAS:1361412562311220201342", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220201342", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1342)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2020.1342\");\n script_version(\"2020-04-01T13:54:05+0000\");\n script_cve_id(\"CVE-2019-11135\", \"CVE-2019-14895\", \"CVE-2019-14896\", \"CVE-2019-14897\", \"CVE-2019-19332\", \"CVE-2019-19338\", \"CVE-2019-19922\", \"CVE-2019-19947\", \"CVE-2019-20095\", \"CVE-2019-20096\", \"CVE-2019-3016\", \"CVE-2019-5108\", \"CVE-2020-8428\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-04-01 13:54:05 +0000 (Wed, 01 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-04-01 13:54:05 +0000 (Wed, 01 Apr 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1342)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRTARM64-3\\.0\\.6\\.0\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2020-1342\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1342\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2020-1342 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A heap-based buffer overflow was discovered in the Linux kernel's Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2019-14895)\n\nA flaw was found in the fix for CVE-2019-11135, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.(CVE-2019-19338)\n\nA flaw was found in the way Intel CPUs handle speculative execution of instructions when the TSX Asynchronous Abort (TAA) error occurs. A local authenticated attacker with the ability to monitor execution times could infer the TSX memory state by comparing abort execution times. This could allow information disclosure via this observed side-channel for any TSX transaction being executed while an attacker is able to observe abort timing. Intel's Transactional Synchronisation Extensions (TSX) are set of instructions which enable transactional memory support to improve performance of the multi-threaded applications, in the lock-protected critical sections. The CPU executes instructions in the critical-sections as transactions, while ensuring their atomic state. When such transaction execution is unsuccessful, the processor cannot ensure atomic updates to the transaction memory, so the processor rolls back or aborts such transaction execution. While TSX Asynchronous Abort (TAA) is pending, CPU may continue to read data from architectural buffers and pass it to the dependent speculative operations. This may cause information leakage via speculative side-channel means, which is quite similar to the Microarchitectural Data Sampling (MDS) issue.(CVE-2019-11135)\n\nAn out-of-bounds memory write issue was found in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the s ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS Virtualization for ARM 64 3.0.6.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRTARM64-3.0.6.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs-devel\", rpm:\"kernel-tools-libs-devel~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python3-perf\", rpm:\"python3-perf~4.19.36~vhulk1907.1.0.h697.eulerosv2r8\", rls:\"EULEROSVIRTARM64-3.0.6.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-30T17:00:58", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-20095", "CVE-2019-19770", "CVE-2019-19332", "CVE-2019-14896", "CVE-2019-19062", "CVE-2019-19922", "CVE-2019-19965", "CVE-2019-11135", "CVE-2019-19947", "CVE-2019-19338", "CVE-2019-19927", "CVE-2019-14895", "CVE-2019-14897", "CVE-2019-17351", "CVE-2019-16230", "CVE-2020-7053", "CVE-2019-19543", "CVE-2019-19048", "CVE-2019-19966", "CVE-2019-20054", "CVE-2019-20096"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-03-26T00:00:00", "published": "2020-02-25T00:00:00", "id": "OPENVAS:1361412562311220201158", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220201158", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1158)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2020.1158\");\n script_version(\"2020-03-26T11:51:34+0000\");\n script_cve_id(\"CVE-2019-11135\", \"CVE-2019-14895\", \"CVE-2019-14896\", \"CVE-2019-14897\", \"CVE-2019-16230\", \"CVE-2019-17351\", \"CVE-2019-19048\", \"CVE-2019-19062\", \"CVE-2019-19332\", \"CVE-2019-19338\", \"CVE-2019-19543\", \"CVE-2019-19770\", \"CVE-2019-19922\", \"CVE-2019-19927\", \"CVE-2019-19947\", \"CVE-2019-19965\", \"CVE-2019-19966\", \"CVE-2019-20054\", \"CVE-2019-20095\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2020-7053\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-03-26 11:51:34 +0000 (Thu, 26 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-02-25 13:57:20 +0000 (Tue, 25 Feb 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1158)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP8\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2020-1158\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1158\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2020-1158 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file).(CVE-2019-19770)\n\nmwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.(CVE-2019-20095)\n\nTSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.(CVE-2019-11135)\n\nA memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042.(CVE-2019-19062)\n\nIn the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c.(CVE-2019-19543)\n\nIn the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.(CVE-2019-19965)\n\nIn the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-dea37a972655.(CVE-2019-19966)\n\nAn issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.(CVE-2019-17351)\n\nA memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864.(CVE-2019-19048)\n\nkernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kube ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS V2.0SP8.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP8\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"bpftool\", rpm:\"bpftool~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-source\", rpm:\"kernel-source~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python3-perf\", rpm:\"python3-perf~4.19.36~vhulk1907.1.0.h683.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-02-20T22:51:47", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-19767", "CVE-2019-18683", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19332", "CVE-2019-19062", "CVE-2019-19082", "CVE-2019-19965", "CVE-2019-19078", "CVE-2019-15099", "CVE-2019-14615", "CVE-2019-19227", "CVE-2019-19063", "CVE-2019-18885", "CVE-2019-19071", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-15291", "CVE-2019-20096"], "description": "The remote host is missing an update for the ", "modified": "2020-02-20T00:00:00", "published": "2020-02-19T00:00:00", "id": "OPENVAS:1361412562310844347", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844347", "type": "openvas", "title": "Ubuntu: Security Advisory for linux (USN-4287-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844347\");\n script_version(\"2020-02-20T11:12:08+0000\");\n script_cve_id(\"CVE-2019-14615\", \"CVE-2019-15099\", \"CVE-2019-16229\", \"CVE-2019-16232\", \"CVE-2019-18683\", \"CVE-2019-18786\", \"CVE-2019-18809\", \"CVE-2019-18885\", \"CVE-2019-19057\", \"CVE-2019-19062\", \"CVE-2019-19063\", \"CVE-2019-19071\", \"CVE-2019-19078\", \"CVE-2019-19082\", \"CVE-2019-19227\", \"CVE-2019-19332\", \"CVE-2019-19767\", \"CVE-2019-19965\", \"CVE-2019-20096\", \"CVE-2019-5108\", \"CVE-2020-7053\", \"CVE-2019-15291\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-02-20 11:12:08 +0000 (Thu, 20 Feb 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-02-19 04:01:16 +0000 (Wed, 19 Feb 2020)\");\n script_name(\"Ubuntu: Security Advisory for linux (USN-4287-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4287-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2020-February/005337.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the USN-4287-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was discovered that the Linux kernel did not properly clear data\nstructures on context switches for certain Intel graphics processors. A\nlocal attacker could use this to expose sensitive information.\n(CVE-2019-14615)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver in\nthe Linux kernel did not properly validate device metadata. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash). (CVE-2019-15099)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices did\nnot properly check for errors in certain situations, leading to a NULL\npointer dereference. A local attacker could possibly use this to cause a\ndenial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in the\nLinux kernel did not properly check for errors in certain situations,\nleading to a NULL pointer dereference. A local attacker could possibly use\nthis to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that a race condition existed in the Virtual Video Test\nDriver in the Linux kernel. An attacker with write access to /dev/video0 on\na system with the vivid module loaded could possibly use this to gain\nadministrative privileges. (CVE-2019-18683)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF) driver in\nthe Linux kernel did not properly initialize data. A local attacker could\npossibly use this to expose sensitive information (kernel memory).\n(CVE-2019-18786)\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in the\nLinux kernel did not properly deallocate memory in certain error\nconditions. A local attacker could possibly use this to cause a denial of\nservice (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that the btrfs file system in the Linux kernel did not\nproperly validate metadata, leading to a NULL pointer dereference. An\nattacker could use this to specially craft a file system image that, when\nmounted, could cause a denial of service (system crash). (CVE-2019-18885)\n\nIt was discovered that multiple memory leaks existed in the Marvell WiFi-Ex\nDriver for the Linux kernel. A local attacker could possibly use this to\ncause a denial of service (kernel memory exhaustion). (CVE-2019-19057)\n\nIt was discovered that the crypto subsystem in the Linux kernel did not\nproperly deallocate memory in certain error conditions. A local attacker\ncould use this to cause a denial of service (kernel memory exhaustion).\n(CVE-2019-19062)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the Linux\nkernel did not properly deallocate me ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1033-oracle\", ver:\"4.15.0-1033.36\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1052-gke\", ver:\"4.15.0-1052.55\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1053-kvm\", ver:\"4.15.0-1053.53\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1055-raspi2\", ver:\"4.15.0-1055.59\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1060-aws\", ver:\"4.15.0-1060.62\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1072-snapdragon\", ver:\"4.15.0-1072.79\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-88-generic\", ver:\"4.15.0-88.88\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-88-generic-lpae\", ver:\"4.15.0-88.88\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-88-lowlatency\", ver:\"4.15.0-88.88\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.15.0.1060.61\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws-lts-18.04\", ver:\"4.15.0.1060.61\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke\", ver:\"4.15.0.1052.56\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke-4.15\", ver:\"4.15.0.1052.56\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-kvm\", ver:\"4.15.0.1053.53\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oracle\", ver:\"4.15.0.1033.38\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oracle-lts-18.04\", ver:\"4.15.0.1033.38\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc-smp\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.15.0.1055.53\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-snapdragon\", ver:\"4.15.0.1072.75\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual\", ver:\"4.15.0.88.80\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1033-oracle\", ver:\"4.15.0-1033.36~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1055-gcp\", ver:\"4.15.0-1055.59\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1060-aws\", ver:\"4.15.0-1060.62~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-1071-azure\", ver:\"4.15.0-1071.76\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-88-generic\", ver:\"4.15.0-88.88~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-88-generic-lpae\", ver:\"4.15.0-88.88~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.15.0-88-lowlatency\", ver:\"4.15.0-88.88~16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-aws-hwe\", ver:\"4.15.0.1060.60\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-azure\", ver:\"4.15.0.1071.74\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gcp\", ver:\"4.15.0.1055.69\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-hwe-16.04\", ver:\"4.15.0.88.98\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-generic-lpae-hwe-16.04\", ver:\"4.15.0.88.98\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-gke\", ver:\"4.15.0.1055.69\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-lowlatency-hwe-16.04\", ver:\"4.15.0.88.98\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oem\", ver:\"4.15.0.88.98\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-oracle\", ver:\"4.15.0.1033.26\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"linux-image-virtual-hwe-16.04\", ver:\"4.15.0.88.98\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-06-15T15:57:08", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-10711", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2019-19462", "CVE-2019-2182", "CVE-2020-12114", "CVE-2020-10942", "CVE-2020-11609", "CVE-2020-10732", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-12654", "CVE-2019-20806", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-8428", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2020-8649", "CVE-2020-12652", "CVE-2020-10757", "CVE-2020-8647", "CVE-2019-20811", "CVE-2020-2732"], "description": "The remote host is missing an update for the ", "modified": "2020-06-11T00:00:00", "published": "2020-06-11T00:00:00", "id": "OPENVAS:1361412562310892242", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892242", "type": "openvas", "title": "Debian LTS: Security Advisory for linux-4.9 (DLA-2242-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892242\");\n script_version(\"2020-06-11T03:00:11+0000\");\n script_cve_id(\"CVE-2019-19319\", \"CVE-2019-19462\", \"CVE-2019-19768\", \"CVE-2019-20806\", \"CVE-2019-20811\", \"CVE-2019-2182\", \"CVE-2019-5108\", \"CVE-2020-0543\", \"CVE-2020-10711\", \"CVE-2020-10732\", \"CVE-2020-10751\", \"CVE-2020-10757\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-12114\", \"CVE-2020-12464\", \"CVE-2020-12652\", \"CVE-2020-12653\", \"CVE-2020-12654\", \"CVE-2020-12770\", \"CVE-2020-13143\", \"CVE-2020-2732\", \"CVE-2020-8428\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-11 03:00:11 +0000 (Thu, 11 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-06-11 03:00:11 +0000 (Thu, 11 Jun 2020)\");\n script_name(\"Debian LTS: Security Advisory for linux-4.9 (DLA-2242-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-2242-1\");\n script_xref(name:\"URL\", value:\"https://bugs.debian.org/952660\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-4.9'\n package(s) announced via the DLA-2242-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2019-2182\n\nHanjun Guo and Lei Li reported a race condition in the arm64\nvirtual memory management code, which could lead to an information\ndisclosure, denial of service (crash), or possibly privilege\nescalation.\n\nCVE-2019-5108\n\nMitchell Frank of Cisco discovered that when the IEEE 802.11\n(WiFi) stack was used in AP mode with roaming, it would trigger\nroaming for a newly associated station before the station was\nauthenticated. An attacker within range of the AP could use this\nto cause a denial of service, either by filling up a switching\ntable or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\nJungyeon discovered that a crafted filesystem can cause the ext4\nimplementation to deallocate or reallocate journal blocks. A user\npermitted to mount filesystems could use this to cause a denial of\nservice (crash), or possibly for privilege escalation.\n\nCVE-2019-19462\n\nThe syzbot tool found a missing error check in the 'relay'\nlibrary used to implement various files under debugfs. A local\nuser permitted to access debugfs could use this to cause a denial\nof service (crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\nTristan Madani reported a race condition in the blktrace debug\nfacility that could result in a use-after-free. A local user able\nto trigger removal of block devices could possibly use this to\ncause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20806\n\nA potential null pointer dereference was discovered in the tw5864\nmedia driver. The security impact of this is unclear.\n\nCVE-2019-20811\n\nThe Hulk Robot tool found a reference-counting bug in an error\npath in the network subsystem. The security impact of this is\nunclear.\n\nCVE-2020-0543\n\nResearchers at VU Amsterdam discovered that on some Intel CPUs\nsupporting the RDRAND and RDSEED instructions, part of a random\nvalue generated by these instructions may be used in a later\nspeculative execution on any core of the same physical CPU.\nDepending on how these instructions are used by applications, a\nlocal user or VM guest could use this to obtain sensitive\ninformation such as cryptographic keys from other users or VMs.\n\nThis vulnerability can be mitigated by a microcode update, either\nas part of system firmware (BIOS) or through the intel-microcode\npackage in Debian's non-free archive section. This kernel update\nonly provides reporting of the vulnerability and the option to\ndisable the mitigation if it is not needed.\n\nCVE-2020-2732\n\nPaulo Bonzini discovered that the KVM implemen ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux-4.9' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n4.9.210-1+deb9u1~deb8u1. This version also fixes some related bugs\nthat do not have their own CVE IDs, and a regression in the macvlan\ndriver introduced in the previous security update (bug #952660).\n\nWe recommend that you upgrade your linux-4.9 packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.9-arm\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-doc-4.9\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-686\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-all\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-all-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-all-armel\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-all-armhf\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-all-i386\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-armmp\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-armmp-lpae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-common\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-common-rt\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-marvell\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-rt-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.11-rt-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-686\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-all\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-all-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-all-armel\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-all-armhf\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-all-i386\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-armmp\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-armmp-lpae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-common\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-common-rt\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-marvell\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-rt-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-0.bpo.12-rt-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-686\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-686-pae-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-amd64-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-armmp\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-armmp-lpae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-marvell\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-rt-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-rt-686-pae-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-rt-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.11-rt-amd64-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-686\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-686-pae-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-amd64-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-armmp\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-armmp-lpae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-marvell\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-rt-686-pae\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-rt-686-pae-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-rt-amd64\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-0.bpo.12-rt-amd64-dbg\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-kbuild-4.9\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-manual-4.9\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-perf-4.9\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-source-4.9\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-4.9.0-0.bpo.11\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-4.9.0-0.bpo.12\", ver:\"4.9.210-1+deb9u1~deb8u1\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-15T15:57:31", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-10711", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2019-19462", "CVE-2019-2182", "CVE-2020-12114", "CVE-2020-10942", "CVE-2020-11609", "CVE-2020-10732", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-12654", "CVE-2019-20806", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-8428", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2020-8649", "CVE-2020-12652", "CVE-2020-10757", "CVE-2020-8647", "CVE-2019-20811", "CVE-2020-2732"], "description": "The remote host is missing an update for the ", "modified": "2020-06-11T00:00:00", "published": "2020-06-11T00:00:00", "id": "OPENVAS:1361412562310704698", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704698", "type": "openvas", "title": "Debian: Security Advisory for linux (DSA-4698-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704698\");\n script_version(\"2020-06-11T03:00:22+0000\");\n script_cve_id(\"CVE-2019-19319\", \"CVE-2019-19462\", \"CVE-2019-19768\", \"CVE-2019-20806\", \"CVE-2019-20811\", \"CVE-2019-2182\", \"CVE-2019-5108\", \"CVE-2020-0543\", \"CVE-2020-10711\", \"CVE-2020-10732\", \"CVE-2020-10751\", \"CVE-2020-10757\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-12114\", \"CVE-2020-12464\", \"CVE-2020-12652\", \"CVE-2020-12653\", \"CVE-2020-12654\", \"CVE-2020-12770\", \"CVE-2020-13143\", \"CVE-2020-2732\", \"CVE-2020-8428\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-11 03:00:22 +0000 (Thu, 11 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-06-11 03:00:22 +0000 (Thu, 11 Jun 2020)\");\n script_name(\"Debian: Security Advisory for linux (DSA-4698-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2020/dsa-4698.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DSA-4698-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the DSA-4698-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2019-2182\nHanjun Guo and Lei Li reported a race condition in the arm64\nvirtual memory management code, which could lead to an information\ndisclosure, denial of service (crash), or possibly privilege\nescalation.\n\nCVE-2019-5108\nMitchell Frank of Cisco discovered that when the IEEE 802.11\n(WiFi) stack was used in AP mode with roaming, it would trigger\nroaming for a newly associated station before the station was\nauthenticated. An attacker within range of the AP could use this\nto cause a denial of service, either by filling up a switching\ntable or by redirecting traffic away from other stations.\n\nCVE-2019-19319\nJungyeon discovered that a crafted filesystem can cause the ext4\nimplementation to deallocate or reallocate journal blocks. A user\npermitted to mount filesystems could use this to cause a denial of\nservice (crash), or possibly for privilege escalation.\n\nCVE-2019-19462The syzbot tool found a missing error check in the relay\n\nlibrary used to implement various files under debugfs. A local\nuser permitted to access debugfs could use this to cause a denial\nof service (crash) or possibly for privilege escalation.\n\nCVE-2019-19768\nTristan Madani reported a race condition in the blktrace debug\nfacility that could result in a use-after-free. A local user able\nto trigger removal of block devices could possibly use this to\ncause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20806\nA potential null pointer dereference was discovered in the tw5864\nmedia driver. The security impact of this is unclear.\n\nCVE-2019-20811\nThe Hulk Robot tool found a reference-counting bug in an error\npath in the network subsystem. The security impact of this is\nunclear.\n\nCVE-2020-0543\nResearchers at VU Amsterdam discovered that on some Intel CPUs\nsupporting the RDRAND and RDSEED instructions, part of a random\nvalue generated by these instructions may be used in a later\nspeculative execution on any core of the same physical CPU.\nDepending on how these instructions are used by applications, a\nlocal user or VM guest could use this to obtain sensitive\ninformation such as cryptographic keys from other users or VMs.\n\nThis vulnerability can be mitigated by a microcode update, either\nas part of system firmware (BIOS) or through the intel-microcode\npackage in Debian's non-free archive section. This kernel update\nonly provides reporting of the vulnerability and the option to\ndisable the mitigation if it is not needed.\n\nCVE-2020-2732\nPaulo Bonzini discovered that the KVM implementa ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For the oldstable distribution (stretch), these problems have been\nfixed in version 4.9.210-1+deb9u1. This version also fixes some\nrelated bugs that do not have their own CVE IDs, and a regression in\nthe macvlan driver introduced in the previous point release (bug\n\nWe recommend that you upgrade your linux packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"hyperv-daemons\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcpupower-dev\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcpupower1\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libusbip-dev\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-6-arm\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-6-s390\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-6-x86\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-cpupower\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-doc-4.9\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-4kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-5kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-686\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-arm64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-armel\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-armhf\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-i386\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-mips\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-mips64el\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-mipsel\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-ppc64el\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-all-s390x\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-arm64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-armmp\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-armmp-lpae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-common\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-common-rt\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-loongson-3\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-marvell\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-octeon\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-powerpc64le\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-rt-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-rt-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-11-s390x\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-4kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-5kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-686\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-arm64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-armel\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-armhf\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-i386\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-mips\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-mips64el\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-mipsel\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-ppc64el\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-all-s390x\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-arm64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-armmp\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-armmp-lpae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-common\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-common-rt\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-loongson-3\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-marvell\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-octeon\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-powerpc64le\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-rt-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-rt-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-4.9.0-12-s390x\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-4kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-4kc-malta-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-5kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-5kc-malta-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-686\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-686-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-686-pae-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-amd64-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-arm64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-arm64-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-armmp\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-armmp-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-armmp-lpae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-armmp-lpae-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-loongson-3\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-loongson-3-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-marvell\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-marvell-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-octeon\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-octeon-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-powerpc64le\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-powerpc64le-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-rt-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-rt-686-pae-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-rt-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-rt-amd64-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-s390x\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-11-s390x-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-4kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-4kc-malta-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-5kc-malta\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-5kc-malta-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-686\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-686-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-686-pae-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-amd64-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-arm64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-arm64-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-armmp\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-armmp-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-armmp-lpae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-armmp-lpae-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-loongson-3\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-loongson-3-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-marvell\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-marvell-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-octeon\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-octeon-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-powerpc64le\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-powerpc64le-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-rt-686-pae\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-rt-686-pae-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-rt-amd64\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-rt-amd64-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-s390x\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-4.9.0-12-s390x-dbg\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-kbuild-4.9\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-libc-dev\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-manual-4.9\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-perf-4.9\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-source-4.9\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-4.9.0-11\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-4.9.0-12\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"usbip\", ver:\"4.9.210-1+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-30T16:52:17", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-5108", "CVE-2019-19525", "CVE-2019-19045", "CVE-2019-20095", "CVE-2019-19534", "CVE-2014-3180", "CVE-2019-19332", "CVE-2019-14901", "CVE-2019-0155", "CVE-2019-14896", "CVE-2019-19922", "CVE-2019-11085", "CVE-2016-2085", "CVE-2019-19768", "CVE-2018-12207", "CVE-2018-5995", "CVE-2019-19965", "CVE-2019-19078", "CVE-2019-11135", "CVE-2018-7273", "CVE-2019-19227", "CVE-2019-19813", "CVE-2017-18549", "CVE-2019-14895", "CVE-2019-14897", "CVE-2019-9458", "CVE-2019-19447", "CVE-2017-18550", "CVE-2019-18660", "CVE-2019-19966", "CVE-2019-19536", "CVE-2019-20054"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-03-26T00:00:00", "published": "2020-02-24T00:00:00", "id": "OPENVAS:1361412562311220201112", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220201112", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1112)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2020.1112\");\n script_version(\"2020-03-26T11:51:34+0000\");\n script_cve_id(\"CVE-2014-3180\", \"CVE-2016-2085\", \"CVE-2017-18549\", \"CVE-2017-18550\", \"CVE-2018-12207\", \"CVE-2018-5995\", \"CVE-2018-7273\", \"CVE-2019-0155\", \"CVE-2019-11085\", \"CVE-2019-11135\", \"CVE-2019-14895\", \"CVE-2019-14896\", \"CVE-2019-14897\", \"CVE-2019-14901\", \"CVE-2019-18660\", \"CVE-2019-19045\", \"CVE-2019-19078\", \"CVE-2019-19227\", \"CVE-2019-19332\", \"CVE-2019-19447\", \"CVE-2019-19525\", \"CVE-2019-19534\", \"CVE-2019-19536\", \"CVE-2019-19768\", \"CVE-2019-19813\", \"CVE-2019-19922\", \"CVE-2019-19965\", \"CVE-2019-19966\", \"CVE-2019-20054\", \"CVE-2019-20095\", \"CVE-2019-5108\", \"CVE-2019-9458\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-03-26 11:51:34 +0000 (Thu, 26 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-02-24 09:05:48 +0000 (Mon, 24 Feb 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1112)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP5\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2020-1112\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1112\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2020-1112 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"** DISPUTED ** In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable.(CVE-2014-3180)\n\nA heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.(CVE-2019-14901)\n\nA heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.(CVE-2019-14896)\n\nA memory leak in the ath10k_usb_hif_tx_sg() function in drivers\net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.(CVE-2019-19078)\n\nA memory leak in the mlx5_fpga_conn_create_cq() function in drivers\net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7.(CVE-2019-19045)\n\nA stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA.(CVE-2019-14897)\n\nAn out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service.(CVE-2019-19332)\n\nImproper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of serv ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS V2.0SP5.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP5\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~862.14.1.5.h408.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~862.14.1.5.h408.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~862.14.1.5.h408.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~862.14.1.5.h408.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~862.14.1.5.h408.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~3.10.0~862.14.1.5.h408.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~3.10.0~862.14.1.5.h408.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-11T15:55:25", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2018-14610", "CVE-2015-8839", "CVE-2020-12114", "CVE-2020-12769", "CVE-2020-12826", "CVE-2020-10942", "CVE-2020-11609", "CVE-2019-20636", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-10690", "CVE-2020-0009", "CVE-2020-12654", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-1749", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2018-14612", "CVE-2020-8649", "CVE-2020-12652", "CVE-2019-19447", "CVE-2018-14611", "CVE-2020-8647", "CVE-2020-2732", "CVE-2018-14613"], "description": "The remote host is missing an update for the ", "modified": "2020-06-10T00:00:00", "published": "2020-06-10T00:00:00", "id": "OPENVAS:1361412562310892241", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892241", "type": "openvas", "title": "Debian LTS: Security Advisory for linux (DLA-2241-1)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892241\");\n script_version(\"2020-06-10T03:00:51+0000\");\n script_cve_id(\"CVE-2015-8839\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2019-19319\", \"CVE-2019-19447\", \"CVE-2019-19768\", \"CVE-2019-20636\", \"CVE-2019-5108\", \"CVE-2020-0009\", \"CVE-2020-0543\", \"CVE-2020-10690\", \"CVE-2020-10751\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-12114\", \"CVE-2020-12464\", \"CVE-2020-12652\", \"CVE-2020-12653\", \"CVE-2020-12654\", \"CVE-2020-12769\", \"CVE-2020-12770\", \"CVE-2020-12826\", \"CVE-2020-13143\", \"CVE-2020-1749\", \"CVE-2020-2732\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-10 03:00:51 +0000 (Wed, 10 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-06-10 03:00:51 +0000 (Wed, 10 Jun 2020)\");\n script_name(\"Debian LTS: Security Advisory for linux (DLA-2241-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-2241-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the DLA-2241-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2015-8839\n\nA race condition was found in the ext4 filesystem implementation.\nA local user could exploit this to cause a denial of service\n(filesystem corruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\nWen Xu from SSLab at Gatech reported that crafted Btrfs volumes\ncould trigger a crash (Oops) and/or out-of-bounds memory access.\nAn attacker able to mount such a volume could use this to cause a\ndenial of service or possibly for privilege escalation.\n\nCVE-2019-5108\n\nMitchell Frank of Cisco discovered that when the IEEE 802.11\n(WiFi) stack was used in AP mode with roaming, it would trigger\nroaming for a newly associated station before the station was\nauthenticated. An attacker within range of the AP could use this\nto cause a denial of service, either by filling up a switching\ntable or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\nJungyeon discovered that a crafted filesystem can cause the ext4\nimplementation to deallocate or reallocate journal blocks. A user\npermitted to mount filesystems could use this to cause a denial of\nservice (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\nIt was discovered that the ext4 filesystem driver did not safely\nhandle unlinking of an inode that, due to filesystem corruption,\nalready has a link count of 0. An attacker able to mount\narbitrary ext4 volumes could use this to cause a denial of service\n(memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\nTristan Madani reported a race condition in the blktrace debug\nfacility that could result in a use-after-free. A local user able\nto trigger removal of block devices could possibly use this to\ncause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\nThe syzbot tool found that the input subsystem did not fully\nvalidate keycode changes, which could result in a heap\nout-of-bounds write. A local user permitted to access the device\nnode for an input or VT device could possibly use this to cause a\ndenial of service (crash or memory corruption) or for privilege\nescalation.\n\nCVE-2020-0009\n\nJann Horn reported that the Android ashmem driver did not prevent\nread-only files from being memory-mapped and then remapped as\nread-write. However, Android drivers are not enabled in Debian\nkernel configurations.\n\nCVE-2020-0543\n\nResearchers at VU Amsterdam discovered that on some Intel CPUs\nsupporting the RDRAND and RDSEED instructions, part of a random\nvalue generated by these instructions may be use ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n3.16.84-1.\n\nWe recommend that you upgrade your linux packages. Binary packages for\nthe EABI ARM (armel) architecture are not yet available, and a separate\nannouncement will be made when they are.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.8-arm\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.9-x86\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-doc-3.16\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-armel\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-armhf\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-i386\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-common\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-ixp4xx\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-kirkwood\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-orion5x\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-versatile\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all-armhf\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all-i386\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-common\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-686-pae-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-amd64-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-ixp4xx\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-kirkwood\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-orion5x\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-versatile\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-686-pae-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-amd64-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-libc-dev\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-manual-3.16\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-source-3.16\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-10\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-11\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-10-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-11-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-05-06T01:12:17", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-19527", "CVE-2020-11494", "CVE-2019-5108", "CVE-2020-8648", "CVE-2020-9383", "CVE-2019-19525", "CVE-2019-16229", "CVE-2019-20095", "CVE-2019-19770", "CVE-2019-19767", "CVE-2019-19534", "CVE-2019-11191", "CVE-2019-19332", "CVE-2019-14901", "CVE-2019-19524", "CVE-2019-19252", "CVE-2019-14896", "CVE-2019-19922", "CVE-2019-19039", "CVE-2020-11609", "CVE-2019-3016", "CVE-2019-20636", "CVE-2019-19768", "CVE-2019-19526", "CVE-2019-11135", "CVE-2019-19227", "CVE-2019-19535", "CVE-2019-19815", "CVE-2019-10220", "CVE-2019-19947", "CVE-2019-19338", "CVE-2019-14895", "CVE-2019-14897", "CVE-2019-19036", "CVE-2020-1749", "CVE-2020-8428", "CVE-2020-11608", "CVE-2020-11668", "CVE-2019-19807", "CVE-2019-19037", "CVE-2020-11565", "CVE-2020-11669", "CVE-2020-8649", "CVE-2019-16231", "CVE-2019-19529", "CVE-2019-19447", "CVE-2020-0067", "CVE-2020-8647", "CVE-2019-16232", "CVE-2019-19532", "CVE-2020-2732", "CVE-2019-19060", "CVE-2019-19536", "CVE-2019-20096"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-04-30T00:00:00", "published": "2020-04-30T00:00:00", "id": "OPENVAS:1361412562311220201536", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220201536", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1536)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2020.1536\");\n script_version(\"2020-04-30T12:12:04+0000\");\n script_cve_id(\"CVE-2019-10220\", \"CVE-2019-11135\", \"CVE-2019-11191\", \"CVE-2019-14895\", \"CVE-2019-14896\", \"CVE-2019-14897\", \"CVE-2019-14901\", \"CVE-2019-16229\", \"CVE-2019-16231\", \"CVE-2019-16232\", \"CVE-2019-19036\", \"CVE-2019-19037\", \"CVE-2019-19039\", \"CVE-2019-19060\", \"CVE-2019-19227\", \"CVE-2019-19252\", \"CVE-2019-19332\", \"CVE-2019-19338\", \"CVE-2019-19447\", \"CVE-2019-19524\", \"CVE-2019-19525\", \"CVE-2019-19526\", \"CVE-2019-19527\", \"CVE-2019-19529\", \"CVE-2019-19532\", \"CVE-2019-19534\", \"CVE-2019-19535\", \"CVE-2019-19536\", \"CVE-2019-19767\", \"CVE-2019-19768\", \"CVE-2019-19770\", \"CVE-2019-19807\", \"CVE-2019-19815\", \"CVE-2019-19922\", \"CVE-2019-19947\", \"CVE-2019-20095\", \"CVE-2019-20096\", \"CVE-2019-20636\", \"CVE-2019-3016\", \"CVE-2019-5108\", \"CVE-2020-0067\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-11669\", \"CVE-2020-1749\", \"CVE-2020-2732\", \"CVE-2020-8428\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-04-30 12:12:04 +0000 (Thu, 30 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-04-30 12:12:04 +0000 (Thu, 30 Apr 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1536)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRTARM64-3\\.0\\.2\\.0\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2020-1536\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1536\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2020-1536 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0.(CVE-2019-19536)\n\nIn the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042.(CVE-2019-19535)\n\nvcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.(CVE-2019-19252)\n\nIn the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122.(CVE-2019-19227)\n\nA memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.(CVE-2019-19060)\n\nIn the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.(CVE-2019-19534)\n\nIn the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41.(CVE-2019-19529)\n\nIn the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098.(CVE-2019-19526)\n\nIn the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035.(CVE-2019-19525)\n\nIn the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c.(CVE-2019-19532)\n\nIn the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c drive ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS Virtualization for ARM 64 3.0.2.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRTARM64-3.0.2.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs-devel\", rpm:\"kernel-tools-libs-devel~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~4.19.36~vhulk1907.1.0.h729\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2020-07-02T11:34:21", "bulletinFamily": "unix", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19965", "CVE-2019-14615", "CVE-2019-19947", "CVE-2019-19063", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-20096"], "description": "It was discovered that the Linux kernel did not properly clear data \nstructures on context switches for certain Intel graphics processors. A \nlocal attacker could use this to expose sensitive information. \n(CVE-2019-14615)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices did \nnot properly check for errors in certain situations, leading to a NULL \npointer dereference. A local attacker could possibly use this to cause a \ndenial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in the \nLinux kernel did not properly check for errors in certain situations, \nleading to a NULL pointer dereference. A local attacker could possibly use \nthis to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF) driver in \nthe Linux kernel did not properly initialize data. A local attacker could \npossibly use this to expose sensitive information (kernel memory). \n(CVE-2019-18786).\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in the \nLinux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that multiple memory leaks existed in the Marvell WiFi-Ex \nDriver for the Linux kernel. A local attacker could possibly use this to \ncause a denial of service (kernel memory exhaustion). (CVE-2019-19057)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the Linux \nkernel did not properly deallocate memory in certain error conditions. A \nlocal attacker could possibly use this to cause a denial of service (kernel \nmemory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the Kvaser CAN/USB driver in the Linux kernel did \nnot properly initialize memory in certain situations. A local attacker \ncould possibly use this to expose sensitive information (kernel memory). \n(CVE-2019-19947)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel \ncontained a race condition that could lead to a NULL pointer dereference. A \nlocal attacker could possibly use this to cause a denial of service (system \ncrash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP) \nimplementation in the Linux kernel did not properly deallocate memory in \ncertain error conditions. An attacker could possibly use this to cause a \ndenial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel \nwhen used as an access point would send IAPP location updates for stations \nbefore client authentication had completed. A physically proximate attacker \ncould use this to cause a denial of service. (CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free while \ndestroying GEM contexts in the i915 driver for the Linux kernel. A local \nattacker could use this to cause a denial of service (system crash) or \npossibly execute arbitrary code. (CVE-2020-7053)", "edition": 4, "modified": "2020-02-18T00:00:00", "published": "2020-02-18T00:00:00", "id": "USN-4285-1", "href": "https://ubuntu.com/security/notices/USN-4285-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-07-02T11:34:24", "bulletinFamily": "unix", "cvelist": ["CVE-2019-5108", "CVE-2019-15217", "CVE-2019-19051", "CVE-2019-19965", "CVE-2019-14615", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-19066", "CVE-2019-17351", "CVE-2019-19068", "CVE-2019-19056", "CVE-2019-20096"], "description": "USN-4286-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 \nLTS. This update provides the corresponding updates for the Linux \nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu \n14.04 ESM.\n\nIt was discovered that the Linux kernel did not properly clear data \nstructures on context switches for certain Intel graphics processors. A \nlocal attacker could use this to expose sensitive information. \n(CVE-2019-14615)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 \ndevice driver in the Linux kernel. A physically proximate attacker could \nuse this to cause a denial of service (system crash). (CVE-2019-15220)\n\nJulien Grall discovered that the Xen balloon memory driver in the Linux \nkernel did not properly restrict the amount of memory set aside for page \nmappings in some situations. An attacker could use this to cause a denial \nof service (kernel memory exhaustion). (CVE-2019-17351)\n\nIt was discovered that the Intel WiMAX 2400 driver in the Linux kernel did \nnot properly deallocate memory in certain situations. A local attacker \ncould use this to cause a denial of service (kernel memory exhaustion). \n(CVE-2019-19051)\n\nIt was discovered that the Marvell Wi-Fi device driver in the Linux kernel \ndid not properly deallocate memory in certain error conditions. A local \nattacker could use this to possibly cause a denial of service (kernel \nmemory exhaustion). (CVE-2019-19056)\n\nIt was discovered that the Brocade BFA Fibre Channel device driver in the \nLinux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-19066)\n\nIt was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in the \nLinux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-19068)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel \ncontained a race condition that could lead to a NULL pointer dereference. A \nlocal attacker could possibly use this to cause a denial of service (system \ncrash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP) \nimplementation in the Linux kernel did not properly deallocate memory in \ncertain error conditions. An attacker could possibly use this to cause a \ndenial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel \nwhen used as an access point would send IAPP location updates for stations \nbefore client authentication had completed. A physically proximate attacker \ncould use this to cause a denial of service. (CVE-2019-5108)\n\nIt was discovered that ZR364XX Camera USB device driver for the Linux \nkernel did not properly initialize memory. A physically proximate attacker \ncould use this to cause a denial of service (system crash). \n(CVE-2019-15217)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel \ndid not properly validate data size information from the device. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash). (CVE-2019-15221)", "edition": 3, "modified": "2020-02-18T00:00:00", "published": "2020-02-18T00:00:00", "id": "USN-4286-2", "href": "https://ubuntu.com/security/notices/USN-4286-2", "title": "Linux kernel (Xenial HWE) vulnerabilities", "type": "ubuntu", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-07-02T11:41:44", "bulletinFamily": "unix", "cvelist": ["CVE-2019-5108", "CVE-2019-15217", "CVE-2019-19051", "CVE-2019-19965", "CVE-2019-14615", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-19066", "CVE-2019-17351", "CVE-2019-19068", "CVE-2019-19056", "CVE-2019-20096"], "description": "It was discovered that the Linux kernel did not properly clear data \nstructures on context switches for certain Intel graphics processors. A \nlocal attacker could use this to expose sensitive information. \n(CVE-2019-14615)\n\nIt was discovered that a race condition existed in the Softmac USB Prism54 \ndevice driver in the Linux kernel. A physically proximate attacker could \nuse this to cause a denial of service (system crash). (CVE-2019-15220)\n\nJulien Grall discovered that the Xen balloon memory driver in the Linux \nkernel did not properly restrict the amount of memory set aside for page \nmappings in some situations. An attacker could use this to cause a denial \nof service (kernel memory exhaustion). (CVE-2019-17351)\n\nIt was discovered that the Intel WiMAX 2400 driver in the Linux kernel did \nnot properly deallocate memory in certain situations. A local attacker \ncould use this to cause a denial of service (kernel memory exhaustion). \n(CVE-2019-19051)\n\nIt was discovered that the Marvell Wi-Fi device driver in the Linux kernel \ndid not properly deallocate memory in certain error conditions. A local \nattacker could use this to possibly cause a denial of service (kernel \nmemory exhaustion). (CVE-2019-19056)\n\nIt was discovered that the Brocade BFA Fibre Channel device driver in the \nLinux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-19066)\n\nIt was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in the \nLinux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-19068)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel \ncontained a race condition that could lead to a NULL pointer dereference. A \nlocal attacker could possibly use this to cause a denial of service (system \ncrash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP) \nimplementation in the Linux kernel did not properly deallocate memory in \ncertain error conditions. An attacker could possibly use this to cause a \ndenial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel \nwhen used as an access point would send IAPP location updates for stations \nbefore client authentication had completed. A physically proximate attacker \ncould use this to cause a denial of service. (CVE-2019-5108)\n\nIt was discovered that ZR364XX Camera USB device driver for the Linux \nkernel did not properly initialize memory. A physically proximate attacker \ncould use this to cause a denial of service (system crash). \n(CVE-2019-15217)\n\nIt was discovered that the Line 6 POD USB device driver in the Linux kernel \ndid not properly validate data size information from the device. A \nphysically proximate attacker could use this to cause a denial of service \n(system crash). (CVE-2019-15221)", "edition": 3, "modified": "2020-02-18T00:00:00", "published": "2020-02-18T00:00:00", "id": "USN-4286-1", "href": "https://ubuntu.com/security/notices/USN-4286-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-07-02T11:42:18", "bulletinFamily": "unix", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-19767", "CVE-2019-18683", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19332", "CVE-2019-19062", "CVE-2019-19082", "CVE-2019-19965", "CVE-2019-19078", "CVE-2019-15099", "CVE-2019-14615", "CVE-2019-19227", "CVE-2019-19063", "CVE-2019-18885", "CVE-2019-19071", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-15291", "CVE-2019-20096"], "description": "USN-4287-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 \nLTS. This update provides the corresponding updates for the Linux \nkernel for Microsoft Azure Cloud systems for Ubuntu 14.04 ESM.\n\nIt was discovered that the Linux kernel did not properly clear data \nstructures on context switches for certain Intel graphics processors. A \nlocal attacker could use this to expose sensitive information. \n(CVE-2019-14615)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver in \nthe Linux kernel did not properly validate device metadata. A physically \nproximate attacker could use this to cause a denial of service (system \ncrash). (CVE-2019-15099)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices did \nnot properly check for errors in certain situations, leading to a NULL \npointer dereference. A local attacker could possibly use this to cause a \ndenial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in the \nLinux kernel did not properly check for errors in certain situations, \nleading to a NULL pointer dereference. A local attacker could possibly use \nthis to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that a race condition existed in the Virtual Video Test \nDriver in the Linux kernel. An attacker with write access to /dev/video0 on \na system with the vivid module loaded could possibly use this to gain \nadministrative privileges. (CVE-2019-18683)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF) driver in \nthe Linux kernel did not properly initialize data. A local attacker could \npossibly use this to expose sensitive information (kernel memory). \n(CVE-2019-18786)\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in the \nLinux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that the btrfs file system in the Linux kernel did not \nproperly validate metadata, leading to a NULL pointer dereference. An \nattacker could use this to specially craft a file system image that, when \nmounted, could cause a denial of service (system crash). (CVE-2019-18885)\n\nIt was discovered that multiple memory leaks existed in the Marvell WiFi-Ex \nDriver for the Linux kernel. A local attacker could possibly use this to \ncause a denial of service (kernel memory exhaustion). (CVE-2019-19057)\n\nIt was discovered that the crypto subsystem in the Linux kernel did not \nproperly deallocate memory in certain error conditions. A local attacker \ncould use this to cause a denial of service (kernel memory exhaustion). \n(CVE-2019-19062)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the Linux \nkernel did not properly deallocate memory in certain error conditions. A \nlocal attacker could possibly use this to cause a denial of service (kernel \nmemory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the RSI 91x WLAN device driver in the Linux kernel \ndid not properly deallocate memory in certain error conditions. A local \nattacker could use this to cause a denial of service (kernel memory \nexhaustion). (CVE-2019-19071)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver in \nthe Linux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-19078)\n\nIt was discovered that the AMD GPU device drivers in the Linux kernel did \nnot properly deallocate memory in certain error conditions. A local \nattacker could use this to possibly cause a denial of service (kernel \nmemory exhaustion). (CVE-2019-19082)\n\nDan Carpenter discovered that the AppleTalk networking subsystem of the \nLinux kernel did not properly handle certain error conditions, leading to a \nNULL pointer dereference. A local attacker could use this to cause a denial \nof service (system crash). (CVE-2019-19227)\n\nIt was discovered that the KVM hypervisor implementation in the Linux \nkernel did not properly handle ioctl requests to get emulated CPUID \nfeatures. An attacker with access to /dev/kvm could use this to cause a \ndenial of service (system crash). (CVE-2019-19332)\n\nIt was discovered that the ext4 file system implementation in the Linux \nkernel did not properly handle certain conditions. An attacker could use \nthis to specially craft an ext4 file system that, when mounted, could cause \na denial of service (system crash) or possibly execute arbitrary code. \n(CVE-2019-19767)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel \ncontained a race condition that could lead to a NULL pointer dereference. A \nlocal attacker could possibly use this to cause a denial of service (system \ncrash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP) \nimplementation in the Linux kernel did not properly deallocate memory in \ncertain error conditions. An attacker could possibly use this to cause a \ndenial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel \nwhen used as an access point would send IAPP location updates for stations \nbefore client authentication had completed. A physically proximate attacker \ncould use this to cause a denial of service. (CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free while \ndestroying GEM contexts in the i915 driver for the Linux kernel. A local \nattacker could use this to cause a denial of service (system crash) or \npossibly execute arbitrary code. (CVE-2020-7053)\n\nIt was discovered that the B2C2 FlexCop USB device driver in the Linux \nkernel did not properly validate device metadata. A physically proximate \nattacker could use this to cause a denial of service (system crash). \n(CVE-2019-15291)", "edition": 2, "modified": "2020-02-18T00:00:00", "published": "2020-02-18T00:00:00", "id": "USN-4287-2", "href": "https://ubuntu.com/security/notices/USN-4287-2", "title": "Linux kernel (Azure) vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-07-02T11:35:33", "bulletinFamily": "unix", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-19767", "CVE-2019-18683", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19332", "CVE-2019-19062", "CVE-2019-19082", "CVE-2019-19965", "CVE-2019-19078", "CVE-2019-15099", "CVE-2019-14615", "CVE-2019-19227", "CVE-2019-19063", "CVE-2019-18885", "CVE-2019-19071", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-15291", "CVE-2019-20096"], "description": "It was discovered that the Linux kernel did not properly clear data \nstructures on context switches for certain Intel graphics processors. A \nlocal attacker could use this to expose sensitive information. \n(CVE-2019-14615)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver in \nthe Linux kernel did not properly validate device metadata. A physically \nproximate attacker could use this to cause a denial of service (system \ncrash). (CVE-2019-15099)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices did \nnot properly check for errors in certain situations, leading to a NULL \npointer dereference. A local attacker could possibly use this to cause a \ndenial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in the \nLinux kernel did not properly check for errors in certain situations, \nleading to a NULL pointer dereference. A local attacker could possibly use \nthis to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that a race condition existed in the Virtual Video Test \nDriver in the Linux kernel. An attacker with write access to /dev/video0 on \na system with the vivid module loaded could possibly use this to gain \nadministrative privileges. (CVE-2019-18683)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF) driver in \nthe Linux kernel did not properly initialize data. A local attacker could \npossibly use this to expose sensitive information (kernel memory). \n(CVE-2019-18786)\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in the \nLinux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that the btrfs file system in the Linux kernel did not \nproperly validate metadata, leading to a NULL pointer dereference. An \nattacker could use this to specially craft a file system image that, when \nmounted, could cause a denial of service (system crash). (CVE-2019-18885)\n\nIt was discovered that multiple memory leaks existed in the Marvell WiFi-Ex \nDriver for the Linux kernel. A local attacker could possibly use this to \ncause a denial of service (kernel memory exhaustion). (CVE-2019-19057)\n\nIt was discovered that the crypto subsystem in the Linux kernel did not \nproperly deallocate memory in certain error conditions. A local attacker \ncould use this to cause a denial of service (kernel memory exhaustion). \n(CVE-2019-19062)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the Linux \nkernel did not properly deallocate memory in certain error conditions. A \nlocal attacker could possibly use this to cause a denial of service (kernel \nmemory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the RSI 91x WLAN device driver in the Linux kernel \ndid not properly deallocate memory in certain error conditions. A local \nattacker could use this to cause a denial of service (kernel memory \nexhaustion). (CVE-2019-19071)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver in \nthe Linux kernel did not properly deallocate memory in certain error \nconditions. A local attacker could possibly use this to cause a denial of \nservice (kernel memory exhaustion). (CVE-2019-19078)\n\nIt was discovered that the AMD GPU device drivers in the Linux kernel did \nnot properly deallocate memory in certain error conditions. A local \nattacker could use this to possibly cause a denial of service (kernel \nmemory exhaustion). (CVE-2019-19082)\n\nDan Carpenter discovered that the AppleTalk networking subsystem of the \nLinux kernel did not properly handle certain error conditions, leading to a \nNULL pointer dereference. A local attacker could use this to cause a denial \nof service (system crash). (CVE-2019-19227)\n\nIt was discovered that the KVM hypervisor implementation in the Linux \nkernel did not properly handle ioctl requests to get emulated CPUID \nfeatures. An attacker with access to /dev/kvm could use this to cause a \ndenial of service (system crash). (CVE-2019-19332)\n\nIt was discovered that the ext4 file system implementation in the Linux \nkernel did not properly handle certain conditions. An attacker could use \nthis to specially craft an ext4 file system that, when mounted, could cause \na denial of service (system crash) or possibly execute arbitrary code. \n(CVE-2019-19767)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel \ncontained a race condition that could lead to a NULL pointer dereference. A \nlocal attacker could possibly use this to cause a denial of service (system \ncrash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP) \nimplementation in the Linux kernel did not properly deallocate memory in \ncertain error conditions. An attacker could possibly use this to cause a \ndenial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel \nwhen used as an access point would send IAPP location updates for stations \nbefore client authentication had completed. A physically proximate attacker \ncould use this to cause a denial of service. (CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free while \ndestroying GEM contexts in the i915 driver for the Linux kernel. A local \nattacker could use this to cause a denial of service (system crash) or \npossibly execute arbitrary code. (CVE-2020-7053)\n\nIt was discovered that the B2C2 FlexCop USB device driver in the Linux \nkernel did not properly validate device metadata. A physically proximate \nattacker could use this to cause a denial of service (system crash). \n(CVE-2019-15291)", "edition": 2, "modified": "2020-02-18T00:00:00", "published": "2020-02-18T00:00:00", "id": "USN-4287-1", "href": "https://ubuntu.com/security/notices/USN-4287-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "cloudfoundry": [{"lastseen": "2020-03-11T02:57:01", "bulletinFamily": "software", "cvelist": ["CVE-2019-5108", "CVE-2019-16229", "CVE-2019-19767", "CVE-2019-18683", "CVE-2019-18809", "CVE-2019-19057", "CVE-2019-19332", "CVE-2019-19062", "CVE-2019-19082", "CVE-2019-19965", "CVE-2019-19078", "CVE-2019-15099", "CVE-2019-14615", "CVE-2019-19227", "CVE-2019-19063", "CVE-2019-18885", "CVE-2019-19071", "CVE-2020-7053", "CVE-2019-16232", "CVE-2019-18786", "CVE-2019-15291", "CVE-2019-20096"], "description": "# \n\n## Severity\n\nMedium\n\n## Vendor\n\nCanonical Ubuntu\n\n## Versions Affected\n\n * Canonical Ubuntu 16.04\n\n## Description\n\nIt was discovered that the Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors. A local attacker could use this to expose sensitive information. (CVE-2019-14615)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15099)\n\nIt was discovered that the HSA Linux kernel driver for AMD GPU devices did not properly check for errors in certain situations, leading to a NULL pointer dereference. A local attacker could possibly use this to cause a denial of service. (CVE-2019-16229)\n\nIt was discovered that the Marvell 8xxx Libertas WLAN device driver in the Linux kernel did not properly check for errors in certain situations, leading to a NULL pointer dereference. A local attacker could possibly use this to cause a denial of service. (CVE-2019-16232)\n\nIt was discovered that a race condition existed in the Virtual Video Test Driver in the Linux kernel. An attacker with write access to /dev/video0 on a system with the vivid module loaded could possibly use this to gain administrative privileges. (CVE-2019-18683)\n\nIt was discovered that the Renesas Digital Radio Interface (DRIF) driver in the Linux kernel did not properly initialize data. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-18786)\n\nIt was discovered that the Afatech AF9005 DVB-T USB device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-18809)\n\nIt was discovered that the btrfs file system in the Linux kernel did not properly validate metadata, leading to a NULL pointer dereference. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service (system crash). (CVE-2019-18885)\n\nIt was discovered that multiple memory leaks existed in the Marvell WiFi-Ex Driver for the Linux kernel. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19057)\n\nIt was discovered that the crypto subsystem in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19062)\n\nIt was discovered that the Realtek rtlwifi USB device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19063)\n\nIt was discovered that the RSI 91x WLAN device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19071)\n\nIt was discovered that the Atheros 802.11ac wireless USB device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19078)\n\nIt was discovered that the AMD GPU device drivers in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to possibly cause a denial of service (kernel memory exhaustion). (CVE-2019-19082)\n\nDan Carpenter discovered that the AppleTalk networking subsystem of the Linux kernel did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-19227)\n\nIt was discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle ioctl requests to get emulated CPUID features. An attacker with access to /dev/kvm could use this to cause a denial of service (system crash). (CVE-2019-19332)\n\nIt was discovered that the ext4 file system implementation in the Linux kernel did not properly handle certain conditions. An attacker could use this to specially craft an ext4 file system that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-19767)\n\nGao Chuan discovered that the SAS Class driver in the Linux kernel contained a race condition that could lead to a NULL pointer dereference. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-19965)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel did not properly deallocate memory in certain error conditions. An attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-20096)\n\nMitchell Frank discovered that the Wi-Fi implementation in the Linux kernel when used as an access point would send IAPP location updates for stations before client authentication had completed. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-5108)\n\nIt was discovered that a race condition can lead to a use-after-free while destroying GEM contexts in the i915 driver for the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-7053)\n\nIt was discovered that the B2C2 FlexCop USB device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15291)\n\nCVEs contained in this USN include: CVE-2019-14615, CVE-2020-7053, CVE-2019-15291, CVE-2019-18683, CVE-2019-18885, CVE-2019-19057, CVE-2019-19062, CVE-2019-19063, CVE-2019-19227, CVE-2019-19332, CVE-2019-15099, CVE-2019-19071, CVE-2019-19078, CVE-2019-19082, CVE-2019-19767, CVE-2019-16229, CVE-2019-16232, CVE-2019-18786, CVE-2019-18809, CVE-2019-19965, CVE-2019-20096, CVE-2019-5108.\n\n## Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * Xenial Stemcells \n * 621.x versions prior to 621.59\n * 456.x versions prior to 456.100\n * 315.x versions prior to 315.171\n * 250.x versions prior to 250.185\n * 170.x versions prior to 170.205\n * 97.x versions prior to 97.234\n * All other stemcells not listed.\n\n## Mitigation\n\nUsers of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:\n\n * Xenial Stemcells \n * Upgrade 621.x versions to 621.59 or greater\n * Upgrade 456.x versions to 456.100 or greater\n * Upgrade 315.x versions to 315.171 or greater\n * Upgrade 250.x versions to 250.185 or greater\n * Upgrade 170.x versions to 170.205 or greater\n * Upgrade 97.x versions to 97.234 or greater\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells>).\n\n## References\n\n * [USN Notice](<https://usn.ubuntu.com/4287-1/>)\n * [CVE-2019-14615](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-14615>)\n * [CVE-2020-7053](<https://people.canonical.com/~ubuntu-security/cve/CVE-2020-7053>)\n * [CVE-2019-15291](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15291>)\n * [CVE-2019-18683](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-18683>)\n * [CVE-2019-18885](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-18885>)\n * [CVE-2019-19057](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19057>)\n * [CVE-2019-19062](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19062>)\n * [CVE-2019-19063](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19063>)\n * [CVE-2019-19227](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19227>)\n * [CVE-2019-19332](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19332>)\n * [CVE-2019-15099](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-15099>)\n * [CVE-2019-19071](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19071>)\n * [CVE-2019-19078](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19078>)\n * [CVE-2019-19082](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19082>)\n * [CVE-2019-19767](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19767>)\n * [CVE-2019-16229](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-16229>)\n * [CVE-2019-16232](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-16232>)\n * [CVE-2019-18786](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-18786>)\n * [CVE-2019-18809](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-18809>)\n * [CVE-2019-19965](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-19965>)\n * [CVE-2019-20096](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-20096>)\n * [CVE-2019-5108](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-5108>)\n\n## History\n\n2020-02-18: Initial vulnerability report published.\n", "edition": 1, "modified": "2020-03-10T00:00:00", "published": "2020-03-10T00:00:00", "id": "CFOUNDRY:C4D1C1686A388941AD439B6E19ADC7F2", "href": "https://www.cloudfoundry.org/blog/usn-4287-1/", "title": "USN-4287-1: Linux kernel vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "slackware": [{"lastseen": "2020-10-25T16:36:04", "bulletinFamily": "unix", "cvelist": ["CVE-2018-21008", "CVE-2019-11487", "CVE-2019-14615", "CVE-2019-14895", "CVE-2019-14896", "CVE-2019-14897", "CVE-2019-14901", "CVE-2019-15217", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-16233", "CVE-2019-16234", "CVE-2019-19056", "CVE-2019-19066", "CVE-2019-19068", "CVE-2019-19965", "CVE-2019-5108", "CVE-2020-0009", "CVE-2020-2732", "CVE-2020-8647", "CVE-2020-8648", "CVE-2020-8649", "CVE-2020-9383"], "description": "New kernel packages are available for Slackware 14.2 to fix security issues.\n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/linux-4.4.217/*: Upgraded.\n These updates fix various bugs and security issues.\n Be sure to upgrade your initrd after upgrading the kernel packages.\n If you use lilo to boot your machine, be sure lilo.conf points to the correct\n kernel and initrd and run lilo as root to update the bootloader.\n If you use elilo to boot your machine, you should run eliloconfig to copy the\n kernel and initrd to the EFI System Partition.\n For more information, see:\n Fixed in 4.4.209:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19965\n Fixed in 4.4.210:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19068\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14615\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14895\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19056\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19066\n Fixed in 4.4.211:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15217\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21008\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15220\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15221\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5108\n Fixed in 4.4.212:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14896\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14897\n Fixed in 4.4.215:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9383\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2732\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16233\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0009\n Fixed in 4.4.216:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11487\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8647\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8649\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16234\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8648\n Fixed in 4.4.217:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14901\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-generic-4.4.217-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-generic-smp-4.4.217_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-headers-4.4.217_smp-x86-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-huge-4.4.217-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-huge-smp-4.4.217_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-modules-4.4.217-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-modules-smp-4.4.217_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-source-4.4.217_smp-noarch-1.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-generic-4.4.217-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-headers-4.4.217-x86-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-huge-4.4.217-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-modules-4.4.217-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-source-4.4.217-noarch-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.2 packages:\na583999ff4d5aaf717389329af0bfebf kernel-generic-4.4.217-i586-1.txz\naa41f8b6cb7ca06779e11a803fd06881 kernel-generic-smp-4.4.217_smp-i686-1.txz\nec98d6aa32743124ed317edfd9b5751d kernel-headers-4.4.217_smp-x86-1.txz\n426ffbbd44d3ab47779518713079cbc2 kernel-huge-4.4.217-i586-1.txz\nf0b0c550771cdb9904e8a81e18e1c3a5 kernel-huge-smp-4.4.217_smp-i686-1.txz\n17580fde3d753faec92c69d9b1b296b3 kernel-modules-4.4.217-i586-1.txz\n35b06ec07cbc246f7e439c6ffc8b8146 kernel-modules-smp-4.4.217_smp-i686-1.txz\naa3b2bdf35fa4c2202a03910d2c53d8d kernel-source-4.4.217_smp-noarch-1.txz\n\nSlackware x86_64 14.2 packages:\nef37a3afd3ad459a0714624b32f670a2 kernel-generic-4.4.217-x86_64-1.txz\nde239ba97ad7fd3d3487038bc8bf10a5 kernel-headers-4.4.217-x86-1.txz\n2ad3dca1aeff8429de2c03bd28afdd7d kernel-huge-4.4.217-x86_64-1.txz\nea75c40c4a486b3f25de482cae24e87c kernel-modules-4.4.217-x86_64-1.txz\n933366ccd2ba028a03bed87cbeea3ac5 kernel-source-4.4.217-noarch-1.txz\n\n\nInstallation instructions:\n\nUpgrade the packages as root:\n > upgradepkg kernel-*.txz\n\nIf you are using an initrd, you'll need to rebuild it.\n\nFor a 32-bit SMP machine, use this command (substitute the appropriate\nkernel version if you are not running Slackware 14.2):\n > /usr/share/mkinitrd/mkinitrd_command_generator.sh -k 4.4.217-smp | bash\n\nFor a 64-bit machine, or a 32-bit uniprocessor machine, use this command\n(substitute the appropriate kernel version if you are not running\nSlackware 14.2):\n > /usr/share/mkinitrd/mkinitrd_command_generator.sh -k 4.4.217 | bash\n\nPlease note that \"uniprocessor\" has to do with the kernel you are running,\nnot with the CPU. Most systems should run the SMP kernel (if they can)\nregardless of the number of cores the CPU has. If you aren't sure which\nkernel you are running, run \"uname -a\". If you see SMP there, you are\nrunning the SMP kernel and should use the 4.4.217-smp version when running\nmkinitrd_command_generator. Note that this is only for 32-bit -- 64-bit\nsystems should always use 4.4.217 as the version.\n\nIf you are using lilo or elilo to boot the machine, you'll need to ensure\nthat the machine is properly prepared before rebooting.\n\nIf using LILO:\nBy default, lilo.conf contains an image= line that references a symlink\nthat always points to the correct kernel. No editing should be required\nunless your machine uses a custom lilo.conf. If that is the case, be sure\nthat the image= line references the correct kernel file. Either way,\nyou'll need to run \"lilo\" as root to reinstall the boot loader.\n\nIf using elilo:\nEnsure that the /boot/vmlinuz symlink is pointing to the kernel you wish\nto use, and then run eliloconfig to update the EFI System Partition.", "modified": "2020-03-26T23:13:28", "published": "2020-03-26T23:13:28", "id": "SSA-2020-086-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2020&m=slackware-security.760705", "type": "slackware", "title": "[slackware-security] Slackware 14.2 kernel", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2021-02-02T13:27:24", "bulletinFamily": "unix", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-10711", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2019-19462", "CVE-2019-2182", "CVE-2020-12114", "CVE-2020-10942", "CVE-2020-11609", "CVE-2020-10732", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-12654", "CVE-2019-20806", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-8428", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2020-8649", "CVE-2020-12652", "CVE-2020-10757", "CVE-2020-8647", "CVE-2019-20811", "CVE-2020-2732"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4698-1 security@debian.org\nhttps://www.debian.org/security/ Ben Hutchings\nJune 09, 2020 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : linux\nCVE ID : CVE-2019-2182 CVE-2019-5108 CVE-2019-19319 CVE-2019-19462\n CVE-2019-19768 CVE-2019-20806 CVE-2019-20811 CVE-2020-0543\n CVE-2020-2732 CVE-2020-8428 CVE-2020-8647 CVE-2020-8648\n CVE-2020-8649 CVE-2020-9383 CVE-2020-10711 CVE-2020-10732\n CVE-2020-10751 CVE-2020-10757 CVE-2020-10942 CVE-2020-11494\n CVE-2020-11565 CVE-2020-11608 CVE-2020-11609 CVE-2020-11668\n CVE-2020-12114 CVE-2020-12464 CVE-2020-12652 CVE-2020-12653\n CVE-2020-12654 CVE-2020-12770 CVE-2020-13143\nDebian Bug : 952660\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2019-2182\n\n Hanjun Guo and Lei Li reported a race condition in the arm64\n virtual memory management code, which could lead to an information\n disclosure, denial of service (crash), or possibly privilege\n escalation.\n\nCVE-2019-5108\n\n Mitchell Frank of Cisco discovered that when the IEEE 802.11\n (WiFi) stack was used in AP mode with roaming, it would trigger\n roaming for a newly associated station before the station was\n authenticated. An attacker within range of the AP could use this\n to cause a denial of service, either by filling up a switching\n table or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\n Jungyeon discovered that a crafted filesystem can cause the ext4\n implementation to deallocate or reallocate journal blocks. A user\n permitted to mount filesystems could use this to cause a denial of\n service (crash), or possibly for privilege escalation.\n\nCVE-2019-19462\n\n The syzbot tool found a missing error check in the &#x27;relay&#x27;\n library used to implement various files under debugfs. A local\n user permitted to access debugfs could use this to cause a denial\n of service (crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\n Tristan Madani reported a race condition in the blktrace debug\n facility that could result in a use-after-free. A local user able\n to trigger removal of block devices could possibly use this to\n cause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20806\n\n A potential null pointer dereference was discovered in the tw5864\n media driver. The security impact of this is unclear.\n\nCVE-2019-20811\n\n The Hulk Robot tool found a reference-counting bug in an error\n path in the network subsystem. The security impact of this is\n unclear.\n\nCVE-2020-0543\n\n Researchers at VU Amsterdam discovered that on some Intel CPUs\n supporting the RDRAND and RDSEED instructions, part of a random\n value generated by these instructions may be used in a later\n speculative execution on any core of the same physical CPU.\n Depending on how these instructions are used by applications, a\n local user or VM guest could use this to obtain sensitive\n information such as cryptographic keys from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either\n as part of system firmware (BIOS) or through the intel-microcode\n package in Debian&#x27;s non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\nCVE-2020-2732\n\n Paulo Bonzini discovered that the KVM implementation for Intel\n processors did not properly handle instruction emulation for L2\n guests when nested virtualization is enabled. This could allow an\n L2 guest to cause privilege escalation, denial of service, or\n information leaks in the L1 guest.\n\nCVE-2020-8428\n\n Al Viro discovered a potential use-after-free in the filesystem\n core (vfs). A local user could exploit this to cause a denial of\n service (crash) or possibly to obtain sensitive information from\n the kernel.\n\nCVE-2020-8647, CVE-2020-8649\n\n The Hulk Robot tool found a potential MMIO out-of-bounds access in\n the vgacon driver. A local user permitted to access a virtual\n terminal (/dev/tty1 etc.) on a system using the vgacon driver\n could use this to cause a denial of service (crash or memory\n corruption) or possibly for privilege escalation.\n\nCVE-2020-8648\n\n The syzbot tool found a race condition in the the virtual terminal\n driver, which could result in a use-after-free. A local user\n permitted to access a virtual terminal could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-9383\n\n Jordy Zomer reported an incorrect range check in the floppy driver\n which could lead to a static out-of-bounds access. A local user\n permitted to access a floppy drive could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-10711\n\n Matthew Sheets reported NULL pointer dereference issues in the\n SELinux subsystem while receiving CIPSO packet with null category. A\n remote attacker can take advantage of this flaw to cause a denial of\n service (crash). Note that this issue does not affect the binary\n packages distributed in Debian as CONFIG_NETLABEL is not enabled.\n\nCVE-2020-10732\n\n An information leak of kernel private memory to userspace was found\n in the kernel&#x27;s implementation of core dumping userspace processes.\n\nCVE-2020-10751\n\n Dmitry Vyukov reported that the SELinux subsystem did not properly\n handle validating multiple messages, which could allow a privileged\n attacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10757\n\n Fan Yang reported a flaw in the way mremap handled DAX hugepages,\n allowing a local user to escalate their privileges\n\nCVE-2020-10942\n\n It was discovered that the vhost_net driver did not properly\n validate the type of sockets set as back-ends. A local user\n permitted to access /dev/vhost-net could use this to cause a stack\n corruption via crafted system calls, resulting in denial of\n service (crash) or possibly privilege escalation.\n\nCVE-2020-11494\n\n It was discovered that the slcan (serial line CAN) network driver\n did not fully initialise CAN headers for received packets,\n resulting in an information leak from the kernel to user-space or\n over the CAN network.\n\nCVE-2020-11565\n\n Entropy Moe reported that the shared memory filesystem (tmpfs) did\n not correctly handle an &quot;mpol&quot; mount option specifying an empty\n node list, leading to a stack-based out-of-bounds write. If user\n namespaces are enabled, a local user could use this to cause a\n denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\n It was discovered that the ov519, stv06xx, and xirlink_cit media\n drivers did not properly validate USB device descriptors. A\n physically present user with a specially constructed USB device\n could use this to cause a denial-of-service (crash) or possibly\n for privilege escalation.\n\nCVE-2020-12114\n\n Piotr Krysiuk discovered a race condition between the umount and\n pivot_root operations in the filesystem core (vfs). A local user\n with the CAP_SYS_ADMIN capability in any user namespace could use\n this to cause a denial of service (crash).\n\nCVE-2020-12464\n\n Kyungtae Kim reported a race condition in the USB core that can\n result in a use-after-free. It is not clear how this can be\n exploited, but it could result in a denial of service (crash or\n memory corruption) or privilege escalation.\n\nCVE-2020-12652\n\n Tom Hatskevich reported a bug in the mptfusion storage drivers.\n An ioctl handler fetched a parameter from user memory twice,\n creating a race condition which could result in incorrect locking\n of internal data structures. A local user permitted to access\n /dev/mptctl could use this to cause a denial of service (crash or\n memory corruption) or for privilege escalation.\n\nCVE-2020-12653\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a potential heap\n buffer overflow. A local user with CAP_NET_ADMIN capability could\n use this to cause a denial of service (crash or memory corruption)\n or possibly for privilege escalation.\n\nCVE-2020-12654\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an access point\n (AP), resulting a potential heap buffer overflow. A malicious AP\n could use this to cause a denial of service (crash or memory\n corruption) or possibly to execute code on a vulnerable system.\n\nCVE-2020-12770\n\n It was discovered that the sg (SCSI generic) driver did not\n correctly release internal resources in a particular error case.\n A local user permitted to access an sg device could possibly use\n this to cause a denial of service (resource exhaustion).\n\nCVE-2020-13143\n\n Kyungtae Kim reported a potential heap out-of-bounds write in\n the USB gadget subsystem. A local user permitted to write to\n the gadget configuration filesystem could use this to cause a\n denial of service (crash or memory corruption) or potentially\n for privilege escalation.\n\nFor the oldstable distribution (stretch), these problems have been\nfixed in version 4.9.210-1+deb9u1. This version also fixes some\nrelated bugs that do not have their own CVE IDs, and a regression in\nthe macvlan driver introduced in the previous point release (bug\n#952660).\n\nWe recommend that you upgrade your linux packages.\n\nFor the detailed security status of linux please refer to its security\ntracker page at:\nhttps://security-tracker.debian.org/tracker/linux\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 12, "modified": "2020-06-09T19:44:35", "published": "2020-06-09T19:44:35", "id": "DEBIAN:DSA-4698-1:66813", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2020/msg00102.html", "title": "[SECURITY] [DSA 4698-1] linux security update", "type": "debian", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-12T00:56:54", "bulletinFamily": "unix", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-10711", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2019-19462", "CVE-2019-2182", "CVE-2020-12114", "CVE-2020-10942", "CVE-2020-11609", "CVE-2020-10732", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-12654", "CVE-2019-20806", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-8428", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2020-8649", "CVE-2020-12652", "CVE-2020-10757", "CVE-2020-8647", "CVE-2019-20811", "CVE-2020-2732"], "description": "Package : linux-4.9\nVersion : 4.9.210-1+deb9u1~deb8u1\nCVE ID : CVE-2019-2182 CVE-2019-5108 CVE-2019-19319 CVE-2019-19462\n CVE-2019-19768 CVE-2019-20806 CVE-2019-20811 CVE-2020-0543\n CVE-2020-2732 CVE-2020-8428 CVE-2020-8647 CVE-2020-8648\n CVE-2020-8649 CVE-2020-9383 CVE-2020-10711 CVE-2020-10732\n CVE-2020-10751 CVE-2020-10757 CVE-2020-10942 CVE-2020-11494\n CVE-2020-11565 CVE-2020-11608 CVE-2020-11609 CVE-2020-11668\n CVE-2020-12114 CVE-2020-12464 CVE-2020-12652 CVE-2020-12653\n CVE-2020-12654 CVE-2020-12770 CVE-2020-13143\nDebian Bug : 952660\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2019-2182\n\n Hanjun Guo and Lei Li reported a race condition in the arm64\n virtual memory management code, which could lead to an information\n disclosure, denial of service (crash), or possibly privilege\n escalation.\n\nCVE-2019-5108\n\n Mitchell Frank of Cisco discovered that when the IEEE 802.11\n (WiFi) stack was used in AP mode with roaming, it would trigger\n roaming for a newly associated station before the station was\n authenticated. An attacker within range of the AP could use this\n to cause a denial of service, either by filling up a switching\n table or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\n Jungyeon discovered that a crafted filesystem can cause the ext4\n implementation to deallocate or reallocate journal blocks. A user\n permitted to mount filesystems could use this to cause a denial of\n service (crash), or possibly for privilege escalation.\n\nCVE-2019-19462\n\n The syzbot tool found a missing error check in the &#x27;relay&#x27;\n library used to implement various files under debugfs. A local\n user permitted to access debugfs could use this to cause a denial\n of service (crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\n Tristan Madani reported a race condition in the blktrace debug\n facility that could result in a use-after-free. A local user able\n to trigger removal of block devices could possibly use this to\n cause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20806\n\n A potential null pointer dereference was discovered in the tw5864\n media driver. The security impact of this is unclear.\n\nCVE-2019-20811\n\n The Hulk Robot tool found a reference-counting bug in an error\n path in the network subsystem. The security impact of this is\n unclear.\n\nCVE-2020-0543\n\n Researchers at VU Amsterdam discovered that on some Intel CPUs\n supporting the RDRAND and RDSEED instructions, part of a random\n value generated by these instructions may be used in a later\n speculative execution on any core of the same physical CPU.\n Depending on how these instructions are used by applications, a\n local user or VM guest could use this to obtain sensitive\n information such as cryptographic keys from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either\n as part of system firmware (BIOS) or through the intel-microcode\n package in Debian&#x27;s non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\nCVE-2020-2732\n\n Paulo Bonzini discovered that the KVM implementation for Intel\n processors did not properly handle instruction emulation for L2\n guests when nested virtualization is enabled. This could allow an\n L2 guest to cause privilege escalation, denial of service, or\n information leaks in the L1 guest.\n\nCVE-2020-8428\n\n Al Viro discovered a potential use-after-free in the filesystem\n core (vfs). A local user could exploit this to cause a denial of\n service (crash) or possibly to obtain sensitive information from\n the kernel.\n\nCVE-2020-8647, CVE-2020-8649\n\n The Hulk Robot tool found a potential MMIO out-of-bounds access in\n the vgacon driver. A local user permitted to access a virtual\n terminal (/dev/tty1 etc.) on a system using the vgacon driver\n could use this to cause a denial of service (crash or memory\n corruption) or possibly for privilege escalation.\n\nCVE-2020-8648\n\n The syzbot tool found a race condition in the the virtual terminal\n driver, which could result in a use-after-free. A local user\n permitted to access a virtual terminal could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-9383\n\n Jordy Zomer reported an incorrect range check in the floppy driver\n which could lead to a static out-of-bounds access. A local user\n permitted to access a floppy drive could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-10711\n\n Matthew Sheets reported NULL pointer dereference issues in the\n SELinux subsystem while receiving CIPSO packet with null category. A\n remote attacker can take advantage of this flaw to cause a denial of\n service (crash). Note that this issue does not affect the binary\n packages distributed in Debian as CONFIG_NETLABEL is not enabled.\n\nCVE-2020-10732\n\n An information leak of kernel private memory to userspace was found\n in the kernel&#x27;s implementation of core dumping userspace processes.\n\nCVE-2020-10751\n\n Dmitry Vyukov reported that the SELinux subsystem did not properly\n handle validating multiple messages, which could allow a privileged\n attacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10757\n\n Fan Yang reported a flaw in the way mremap handled DAX hugepages,\n allowing a local user to escalate their privileges\n\nCVE-2020-10942\n\n It was discovered that the vhost_net driver did not properly\n validate the type of sockets set as back-ends. A local user\n permitted to access /dev/vhost-net could use this to cause a stack\n corruption via crafted system calls, resulting in denial of\n service (crash) or possibly privilege escalation.\n\nCVE-2020-11494\n\n It was discovered that the slcan (serial line CAN) network driver\n did not fully initialise CAN headers for received packets,\n resulting in an information leak from the kernel to user-space or\n over the CAN network.\n\nCVE-2020-11565\n\n Entropy Moe reported that the shared memory filesystem (tmpfs) did\n not correctly handle an &quot;mpol&quot; mount option specifying an empty\n node list, leading to a stack-based out-of-bounds write. If user\n namespaces are enabled, a local user could use this to cause a\n denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\n It was discovered that the ov519, stv06xx, and xirlink_cit media\n drivers did not properly validate USB device descriptors. A\n physically present user with a specially constructed USB device\n could use this to cause a denial-of-service (crash) or possibly\n for privilege escalation.\n\nCVE-2020-12114\n\n Piotr Krysiuk discovered a race condition between the umount and\n pivot_root operations in the filesystem core (vfs). A local user\n with the CAP_SYS_ADMIN capability in any user namespace could use\n this to cause a denial of service (crash).\n\nCVE-2020-12464\n\n Kyungtae Kim reported a race condition in the USB core that can\n result in a use-after-free. It is not clear how this can be\n exploited, but it could result in a denial of service (crash or\n memory corruption) or privilege escalation.\n\nCVE-2020-12652\n\n Tom Hatskevich reported a bug in the mptfusion storage drivers.\n An ioctl handler fetched a parameter from user memory twice,\n creating a race condition which could result in incorrect locking\n of internal data structures. A local user permitted to access\n /dev/mptctl could use this to cause a denial of service (crash or\n memory corruption) or for privilege escalation.\n\nCVE-2020-12653\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a potential heap\n buffer overflow. A local user with CAP_NET_ADMIN capability could\n use this to cause a denial of service (crash or memory corruption)\n or possibly for privilege escalation.\n\nCVE-2020-12654\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an access point\n (AP), resulting a potential heap buffer overflow. A malicious AP\n could use this to cause a denial of service (crash or memory\n corruption) or possibly to execute code on a vulnerable system.\n\nCVE-2020-12770\n\n It was discovered that the sg (SCSI generic) driver did not\n correctly release internal resources in a particular error case.\n A local user permitted to access an sg device could possibly use\n this to cause a denial of service (resource exhaustion).\n\nCVE-2020-13143\n\n Kyungtae Kim reported a potential heap out-of-bounds write in\n the USB gadget subsystem. A local user permitted to write to\n the gadget configuration filesystem could use this to cause a\n denial of service (crash or memory corruption) or potentially\n for privilege escalation.\n\nFor Debian 8 &quot;Jessie&quot;, these problems have been fixed in version\n4.9.210-1+deb9u1~deb8u1. This version also fixes some related bugs\nthat do not have their own CVE IDs, and a regression in the macvlan\ndriver introduced in the previous security update (bug #952660).\n\nWe recommend that you upgrade your linux-4.9 packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\n", "edition": 5, "modified": "2020-06-10T10:49:01", "published": "2020-06-10T10:49:01", "id": "DEBIAN:DLA-2242-1:573AF", "href": "https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202006/msg00012.html", "title": "[SECURITY] [DLA 2242-1] linux-4.9 security update", "type": "debian", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-12T01:01:35", "bulletinFamily": "unix", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2018-14610", "CVE-2015-8839", "CVE-2020-12114", "CVE-2020-12769", "CVE-2020-12826", "CVE-2020-10942", "CVE-2020-11609", "CVE-2019-20636", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-10690", "CVE-2020-0009", "CVE-2020-12654", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-1749", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2018-14612", "CVE-2020-8649", "CVE-2020-12652", "CVE-2019-19447", "CVE-2018-14611", "CVE-2020-8647", "CVE-2020-2732", "CVE-2018-14613"], "description": "Package : linux\nVersion : 3.16.84-1\nCVE ID : CVE-2015-8839 CVE-2018-14610 CVE-2018-14611 CVE-2018-14612\n CVE-2018-14613 CVE-2019-5108 CVE-2019-19319 CVE-2019-19447\n CVE-2019-19768 CVE-2019-20636 CVE-2020-0009 CVE-2020-0543\n CVE-2020-1749 CVE-2020-2732 CVE-2020-8647 CVE-2020-8648\n CVE-2020-8649 CVE-2020-9383 CVE-2020-10690 CVE-2020-10751\n CVE-2020-10942 CVE-2020-11494 CVE-2020-11565 CVE-2020-11608\n CVE-2020-11609 CVE-2020-11668 CVE-2020-12114 CVE-2020-12464\n CVE-2020-12652 CVE-2020-12653 CVE-2020-12654 CVE-2020-12769\n CVE-2020-12770 CVE-2020-12826 CVE-2020-13143\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2015-8839\n\n A race condition was found in the ext4 filesystem implementation.\n A local user could exploit this to cause a denial of service\n (filesystem corruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\n Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes\n could trigger a crash (Oops) and/or out-of-bounds memory access.\n An attacker able to mount such a volume could use this to cause a\n denial of service or possibly for privilege escalation.\n\nCVE-2019-5108\n\n Mitchell Frank of Cisco discovered that when the IEEE 802.11\n (WiFi) stack was used in AP mode with roaming, it would trigger\n roaming for a newly associated station before the station was\n authenticated. An attacker within range of the AP could use this\n to cause a denial of service, either by filling up a switching\n table or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\n Jungyeon discovered that a crafted filesystem can cause the ext4\n implementation to deallocate or reallocate journal blocks. A user\n permitted to mount filesystems could use this to cause a denial of\n service (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\n It was discovered that the ext4 filesystem driver did not safely\n handle unlinking of an inode that, due to filesystem corruption,\n already has a link count of 0. An attacker able to mount\n arbitrary ext4 volumes could use this to cause a denial of service\n (memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\n Tristan Madani reported a race condition in the blktrace debug\n facility that could result in a use-after-free. A local user able\n to trigger removal of block devices could possibly use this to\n cause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\n The syzbot tool found that the input subsystem did not fully\n validate keycode changes, which could result in a heap\n out-of-bounds write. A local user permitted to access the device\n node for an input or VT device could possibly use this to cause a\n denial of service (crash or memory corruption) or for privilege\n escalation.\n\nCVE-2020-0009\n\n Jann Horn reported that the Android ashmem driver did not prevent\n read-only files from being memory-mapped and then remapped as\n read-write. However, Android drivers are not enabled in Debian\n kernel configurations.\n\nCVE-2020-0543\n\n Researchers at VU Amsterdam discovered that on some Intel CPUs\n supporting the RDRAND and RDSEED instructions, part of a random\n value generated by these instructions may be used in a later\n speculative execution on any core of the same physical CPU.\n Depending on how these instructions are used by applications, a\n local user or VM guest could use this to obtain sensitive\n information such as cryptographic keys from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either\n as part of system firmware (BIOS) or through the intel-microcode\n package in Debian&#x27;s non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\nCVE-2020-1749\n\n Xiumei Mu reported that some network protocols that can run on top\n of IPv6 would bypass the Transformation (XFRM) layer used by\n IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result\n in disclosure of information over the network, since it would not\n be encrypted or routed according to the system policy.\n\nCVE-2020-2732\n\n Paulo Bonzini discovered that the KVM implementation for Intel\n processors did not properly handle instruction emulation for L2\n guests when nested virtualization is enabled. This could allow an\n L2 guest to cause privilege escalation, denial of service, or\n information leaks in the L1 guest.\n\nCVE-2020-8647, CVE-2020-8649\n\n The Hulk Robot tool found a potential MMIO out-of-bounds access in\n the vgacon driver. A local user permitted to access a virtual\n terminal (/dev/tty1 etc.) on a system using the vgacon driver\n could use this to cause a denial of service (crash or memory\n corruption) or possibly for privilege escalation.\n\nCVE-2020-8648\n\n The syzbot tool found a race condition in the the virtual terminal\n driver, which could result in a use-after-free. A local user\n permitted to access a virtual terminal could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-9383\n\n Jordy Zomer reported an incorrect range check in the floppy driver\n which could lead to a static out-of-bounds access. A local user\n permitted to access a floppy drive could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-10690\n\n It was discovered that the PTP hardware clock subsystem did not\n properly manage device lifetimes. Removing a PTP hardware clock\n from the system while a user process was using it could lead to a\n use-after-free. The security impact of this is unclear.\n\nCVE-2020-10751\n\n Dmitry Vyukov reported that the SELinux subsystem did not properly\n handle validating multiple messages, which could allow a privileged\n attacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10942\n\n It was discovered that the vhost_net driver did not properly\n validate the type of sockets set as back-ends. A local user\n permitted to access /dev/vhost-net could use this to cause a stack\n corruption via crafted system calls, resulting in denial of\n service (crash) or possibly privilege escalation.\n\nCVE-2020-11494\n\n It was discovered that the slcan (serial line CAN) network driver\n did not fully initialise CAN headers for received packets,\n resulting in an information leak from the kernel to user-space or\n over the CAN network.\n\nCVE-2020-11565\n\n Entropy Moe reported that the shared memory filesystem (tmpfs) did\n not correctly handle an &quot;mpol&quot; mount option specifying an empty\n node list, leading to a stack-based out-of-bounds write. If user\n namespaces are enabled, a local user could use this to cause a\n denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\n It was discovered that the ov519, stv06xx, and xirlink_cit media\n drivers did not properly validate USB device descriptors. A\n physically present user with a specially constructed USB device\n could use this to cause a denial-of-service (crash) or possibly\n for privilege escalation.\n\nCVE-2020-12114\n\n Piotr Krysiuk discovered a race condition between the umount and\n pivot_root operations in the filesystem core (vfs). A local user\n with the CAP_SYS_ADMIN capability in any user namespace could use\n this to cause a denial of service (crash).\n\nCVE-2020-12464\n\n Kyungtae Kim reported a race condition in the USB core that can\n result in a use-after-free. It is not clear how this can be\n exploited, but it could result in a denial of service (crash or\n memory corruption) or privilege escalation.\n\nCVE-2020-12652\n\n Tom Hatskevich reported a bug in the mptfusion storage drivers.\n An ioctl handler fetched a parameter from user memory twice,\n creating a race condition which could result in incorrect locking\n of internal data structures. A local user permitted to access\n /dev/mptctl could use this to cause a denial of service (crash or\n memory corruption) or for privilege escalation.\n\nCVE-2020-12653\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a potential heap\n buffer overflow. A local user with CAP_NET_ADMIN capability could\n use this to cause a denial of service (crash or memory corruption)\n or possibly for privilege escalation.\n\nCVE-2020-12654\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an access point\n (AP), resulting a potential heap buffer overflow. A malicious AP\n could use this to cause a denial of service (crash or memory\n corruption) or possibly to execute code on a vulnerable system.\n\nCVE-2020-12769\n\n It was discovered that the spi-dw SPI host driver did not properly\n serialise access to its internal state. The security impact of\n this is unclear, and this driver is not included in Debian&#x27;s\n binary packages.\n\nCVE-2020-12770\n\n It was discovered that the sg (SCSI generic) driver did not\n correctly release internal resources in a particular error case.\n A local user permitted to access an sg device could possibly use\n this to cause a denial of service (resource exhaustion).\n\nCVE-2020-12826\n\n Adam Zabrocki reported a weakness in the signal subsystem&#x27;s\n permission checks. A parent process can choose an arbitary signal\n for a child process to send when it exits, but if the parent has\n executed a new program then the default SIGCHLD signal is sent. A\n local user permitted to run a program for several days could\n bypass this check, execute a setuid program, and then send an\n arbitrary signal to it. Depending on the setuid programs\n installed, this could have some security impact.\n\nCVE-2020-13143\n\n Kyungtae Kim reported a potential heap out-of-bounds write in\n the USB gadget subsystem. A local user permitted to write to\n the gadget configuration filesystem could use this to cause a\n denial of service (crash or memory corruption) or potentially\n for privilege escalation.\n\nFor Debian 8 &quot;Jessie&quot;, these problems have been fixed in version\n3.16.84-1.\n\nWe recommend that you upgrade your linux packages. Binary packages for\nthe EABI ARM (armel) architecture are not yet available, and a separate\nannouncement will be made when they are.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\n", "edition": 8, "modified": "2020-06-09T21:29:55", "published": "2020-06-09T21:29:55", "id": "DEBIAN:DLA-2241-1:DE3AB", "href": "https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202006/msg00011.html", "title": "[SECURITY] [DLA 2241-1] linux security update", "type": "debian", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-12T00:55:40", "bulletinFamily": "unix", "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2018-14610", "CVE-2015-8839", "CVE-2020-12114", "CVE-2020-12769", "CVE-2020-12826", "CVE-2020-10942", "CVE-2020-11609", "CVE-2019-20636", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-10690", "CVE-2020-0009", "CVE-2020-12654", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-1749", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2018-14612", "CVE-2020-8649", "CVE-2020-12652", "CVE-2019-19447", "CVE-2018-14611", "CVE-2020-8647", "CVE-2020-2732", "CVE-2018-14613"], "description": "Package : linux\nVersion : 3.16.84-1\nCVE ID : CVE-2015-8839 CVE-2018-14610 CVE-2018-14611 CVE-2018-14612\n CVE-2018-14613 CVE-2019-5108 CVE-2019-19319 CVE-2019-19447\n CVE-2019-19768 CVE-2019-20636 CVE-2020-0009 CVE-2020-0543\n CVE-2020-1749 CVE-2020-2732 CVE-2020-8647 CVE-2020-8648\n CVE-2020-8649 CVE-2020-9383 CVE-2020-10690 CVE-2020-10751\n CVE-2020-10942 CVE-2020-11494 CVE-2020-11565 CVE-2020-11608\n CVE-2020-11609 CVE-2020-11668 CVE-2020-12114 CVE-2020-12464\n CVE-2020-12652 CVE-2020-12653 CVE-2020-12654 CVE-2020-12769\n CVE-2020-12770 CVE-2020-12826 CVE-2020-13143\n\nThis update is now available for all supported architectures. For\nreference the original advisory text follows.\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2015-8839\n\n A race condition was found in the ext4 filesystem implementation.\n A local user could exploit this to cause a denial of service\n (filesystem corruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\n Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes\n could trigger a crash (Oops) and/or out-of-bounds memory access.\n An attacker able to mount such a volume could use this to cause a\n denial of service or possibly for privilege escalation.\n\nCVE-2019-5108\n\n Mitchell Frank of Cisco discovered that when the IEEE 802.11\n (WiFi) stack was used in AP mode with roaming, it would trigger\n roaming for a newly associated station before the station was\n authenticated. An attacker within range of the AP could use this\n to cause a denial of service, either by filling up a switching\n table or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\n Jungyeon discovered that a crafted filesystem can cause the ext4\n implementation to deallocate or reallocate journal blocks. A user\n permitted to mount filesystems could use this to cause a denial of\n service (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\n It was discovered that the ext4 filesystem driver did not safely\n handle unlinking of an inode that, due to filesystem corruption,\n already has a link count of 0. An attacker able to mount\n arbitrary ext4 volumes could use this to cause a denial of service\n (memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\n Tristan Madani reported a race condition in the blktrace debug\n facility that could result in a use-after-free. A local user able\n to trigger removal of block devices could possibly use this to\n cause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\n The syzbot tool found that the input subsystem did not fully\n validate keycode changes, which could result in a heap\n out-of-bounds write. A local user permitted to access the device\n node for an input or VT device could possibly use this to cause a\n denial of service (crash or memory corruption) or for privilege\n escalation.\n\nCVE-2020-0009\n\n Jann Horn reported that the Android ashmem driver did not prevent\n read-only files from being memory-mapped and then remapped as\n read-write. However, Android drivers are not enabled in Debian\n kernel configurations.\n\nCVE-2020-0543\n\n Researchers at VU Amsterdam discovered that on some Intel CPUs\n supporting the RDRAND and RDSEED instructions, part of a random\n value generated by these instructions may be used in a later\n speculative execution on any core of the same physical CPU.\n Depending on how these instructions are used by applications, a\n local user or VM guest could use this to obtain sensitive\n information such as cryptographic keys from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either\n as part of system firmware (BIOS) or through the intel-microcode\n package in Debian&#x27;s non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\nCVE-2020-1749\n\n Xiumei Mu reported that some network protocols that can run on top\n of IPv6 would bypass the Transformation (XFRM) layer used by\n IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result\n in disclosure of information over the network, since it would not\n be encrypted or routed according to the system policy.\n\nCVE-2020-2732\n\n Paulo Bonzini discovered that the KVM implementation for Intel\n processors did not properly handle instruction emulation for L2\n guests when nested virtualization is enabled. This could allow an\n L2 guest to cause privilege escalation, denial of service, or\n information leaks in the L1 guest.\n\nCVE-2020-8647, CVE-2020-8649\n\n The Hulk Robot tool found a potential MMIO out-of-bounds access in\n the vgacon driver. A local user permitted to access a virtual\n terminal (/dev/tty1 etc.) on a system using the vgacon driver\n could use this to cause a denial of service (crash or memory\n corruption) or possibly for privilege escalation.\n\nCVE-2020-8648\n\n The syzbot tool found a race condition in the the virtual terminal\n driver, which could result in a use-after-free. A local user\n permitted to access a virtual terminal could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-9383\n\n Jordy Zomer reported an incorrect range check in the floppy driver\n which could lead to a static out-of-bounds access. A local user\n permitted to access a floppy drive could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-10690\n\n It was discovered that the PTP hardware clock subsystem did not\n properly manage device lifetimes. Removing a PTP hardware clock\n from the system while a user process was using it could lead to a\n use-after-free. The security impact of this is unclear.\n\nCVE-2020-10751\n\n Dmitry Vyukov reported that the SELinux subsystem did not properly\n handle validating multiple messages, which could allow a privileged\n attacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10942\n\n It was discovered that the vhost_net driver did not properly\n validate the type of sockets set as back-ends. A local user\n permitted to access /dev/vhost-net could use this to cause a stack\n corruption via crafted system calls, resulting in denial of\n service (crash) or possibly privilege escalation.\n\nCVE-2020-11494\n\n It was discovered that the slcan (serial line CAN) network driver\n did not fully initialise CAN headers for received packets,\n resulting in an information leak from the kernel to user-space or\n over the CAN network.\n\nCVE-2020-11565\n\n Entropy Moe reported that the shared memory filesystem (tmpfs) did\n not correctly handle an &quot;mpol&quot; mount option specifying an empty\n node list, leading to a stack-based out-of-bounds write. If user\n namespaces are enabled, a local user could use this to cause a\n denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\n It was discovered that the ov519, stv06xx, and xirlink_cit media\n drivers did not properly validate USB device descriptors. A\n physically present user with a specially constructed USB device\n could use this to cause a denial-of-service (crash) or possibly\n for privilege escalation.\n\nCVE-2020-12114\n\n Piotr Krysiuk discovered a race condition between the umount and\n pivot_root operations in the filesystem core (vfs). A local user\n with the CAP_SYS_ADMIN capability in any user namespace could use\n this to cause a denial of service (crash).\n\nCVE-2020-12464\n\n Kyungtae Kim reported a race condition in the USB core that can\n result in a use-after-free. It is not clear how this can be\n exploited, but it could result in a denial of service (crash or\n memory corruption) or privilege escalation.\n\nCVE-2020-12652\n\n Tom Hatskevich reported a bug in the mptfusion storage drivers.\n An ioctl handler fetched a parameter from user memory twice,\n creating a race condition which could result in incorrect locking\n of internal data structures. A local user permitted to access\n /dev/mptctl could use this to cause a denial of service (crash or\n memory corruption) or for privilege escalation.\n\nCVE-2020-12653\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a potential heap\n buffer overflow. A local user with CAP_NET_ADMIN capability could\n use this to cause a denial of service (crash or memory corruption)\n or possibly for privilege escalation.\n\nCVE-2020-12654\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an access point\n (AP), resulting a potential heap buffer overflow. A malicious AP\n could use this to cause a denial of service (crash or memory\n corruption) or possibly to execute code on a vulnerable system.\n\nCVE-2020-12769\n\n It was discovered that the spi-dw SPI host driver did not properly\n serialise access to its internal state. The security impact of\n this is unclear, and this driver is not included in Debian&#x27;s\n binary packages.\n\nCVE-2020-12770\n\n It was discovered that the sg (SCSI generic) driver did not\n correctly release internal resources in a particular error case.\n A local user permitted to access an sg device could possibly use\n this to cause a denial of service (resource exhaustion).\n\nCVE-2020-12826\n\n Adam Zabrocki reported a weakness in the signal subsystem&#x27;s\n permission checks. A parent process can choose an arbitary signal\n for a child process to send when it exits, but if the parent has\n executed a new program then the default SIGCHLD signal is sent. A\n local user permitted to run a program for several days could\n bypass this check, execute a setuid program, and then send an\n arbitrary signal to it. Depending on the setuid programs\n installed, this could have some security impact.\n\nCVE-2020-13143\n\n Kyungtae Kim reported a potential heap out-of-bounds write in\n the USB gadget subsystem. A local user permitted to write to\n the gadget configuration filesystem could use this to cause a\n denial of service (crash or memory corruption) or potentially\n for privilege escalation.\n\nFor Debian 8 &quot;Jessie&quot;, these problems have been fixed in version\n3.16.84-1.\n\nWe recommend that you upgrade your linux packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\n", "edition": 7, "modified": "2020-06-10T10:55:44", "published": "2020-06-10T10:55:44", "id": "DEBIAN:DLA-2241-2:3E557", "href": "https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202006/msg00013.html", "title": "[SECURITY] [DLA 2241-2] linux security update", "type": "debian", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2020-09-12T00:46:16", "bulletinFamily": "unix", "cvelist": ["CVE-2019-5108", "CVE-2020-16166", "CVE-2019-15218", "CVE-2019-3900", "CVE-2019-10639", "CVE-2020-24394", "CVE-2019-19052", "CVE-2020-12114", "CVE-2019-19922", "CVE-2019-19078", "CVE-2020-10769", "CVE-2019-3874", "CVE-2019-17075", "CVE-2020-14331", "CVE-2019-20812", "CVE-2019-16746", "CVE-2019-19535", "CVE-2019-19063", "CVE-2019-19066", "CVE-2020-10751", "CVE-2018-16884", "CVE-2019-10638", "CVE-2019-18885", "CVE-2019-11487", "CVE-2019-14898", "CVE-2019-19073", "CVE-2020-10781", "CVE-2019-19074", "CVE-2020-12771", "CVE-2019-17133", "CVE-2020-10767", "CVE-2018-14613"], "description": "[4.14.35-1902.306.2]\n- rename kABI whitelists to lockedlists (Dan Duval) [Orabug: 31783150] \n- sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Dave Chiluk) [Orabug: 31350999] {CVE-2019-19922}\n- sched/fair: Fix throttle_list starvation with low CFS quota (Phil Auld) [Orabug: 31350999] {CVE-2019-19922}\n- sched/fair: Fix bandwidth timer clock drift condition (Xunlei Pang) [Orabug: 31350999] {CVE-2019-19922}\n- btrfs: tree-checker: Verify block_group_item (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: tree-check: reduce stack consumption in check_dir_item (David Sterba) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: tree-checker: use %zu format string for size_t (Arnd Bergmann) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: tree-checker: Add checker for dir item (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: tree-checker: Fix false panic for sanity test (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: tree-checker: Enhance btrfs_check_node output (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: Move leaf and node validation checker to tree-checker.c (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: Add checker for EXTENT_CSUM (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: Add sanity check for EXTENT_DATA when reading out leaf (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: Check if item pointer overlaps with the item itself (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- btrfs: Refactor check_leaf function for later expansion (Qu Wenruo) [Orabug: 31351986] {CVE-2018-14613}\n- RDMA/cm: Fix missing RDMA_CM_EVENT_REJECTED event after receiving REJ message (Leon Romanovsky) [Orabug: 31784659] \n- nfsd: apply umask on fs without ACL support (J. Bruce Fields) [Orabug: 31779888] {CVE-2020-24394}\n- Reverts 'rds: avoid unnecessary cong_update in loop transport' (Iraimani Pavadai) [Orabug: 31741325] \n- sctp: implement memory accounting on tx path (Xin Long) [Orabug: 31351959] {CVE-2019-3874}\n- vhost_net: fix possible infinite loop (Jason Wang) [Orabug: 31351949] {CVE-2019-3900} {CVE-2019-3900}\n- vhost: introduce vhost_exceeds_weight() (Jason Wang) [Orabug: 31351949] {CVE-2019-3900}\n- vhost_net: introduce vhost_exceeds_weight() (Jason Wang) [Orabug: 31351949] {CVE-2019-3900}\n- vhost_net: use packet weight for rx handler, too (Paolo Abeni) [Orabug: 31351949] {CVE-2019-3900}\n- vhost-net: set packet weight of tx polling to 2 * vq size (haibinzhang() [Orabug: 31351949] {CVE-2019-3900}\n- repair kABI breakage from 'fs: prevent page refcount overflow in pipe_buf_get' (Dan Duval) [Orabug: 31351940] {CVE-2019-11487}\n- fs: prevent page refcount overflow in pipe_buf_get (Matthew Wilcox) [Orabug: 31351940] {CVE-2019-11487}\n- mm: add 'try_get_page()' helper function (Linus Torvalds) [Orabug: 31351940] {CVE-2019-11487}\n- mm: prevent get_user_pages() from overflowing page refcount (Linus Torvalds) [Orabug: 31351940] {CVE-2019-11487}\n- mm: make page ref count overflow check tighter and more explicit (Linus Torvalds) [Orabug: 31351940] {CVE-2019-11487}\n- tracing: Fix buffer_ref pipe ops (Jann Horn) [Orabug: 31351940] {CVE-2019-11487}\n- RDMA/cm: Protect access to remote_sidr_table (Maor Gottlieb) [Orabug: 31784892] \n- net/rds: rds_ib_remove_one() needs to wait (Ka-Cheong Poon) [Orabug: 31794612] \n- uek-rpm: Disable secureboot signing for OL7 aarch64 (Somasundaram Krishnasamy) [Orabug: 31793663]", "edition": 3, "modified": "2020-09-11T00:00:00", "published": "2020-09-11T00:00:00", "id": "ELSA-2020-5845", "href": "http://linux.oracle.com/errata/ELSA-2020-5845.html", "title": "Unbreakable Enterprise kernel security update", "type": "oraclelinux", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-10-06T22:49:41", "bulletinFamily": "unix", "cvelist": ["CVE-2019-5108", "CVE-2019-7222", "CVE-2016-10906", "CVE-2019-15218", "CVE-2020-25285", "CVE-2019-10639", "CVE-2019-15505", "CVE-2019-19052", "CVE-2019-19062", "CVE-2020-10720", "CVE-2020-10732", "CVE-2019-19768", "CVE-2019-19965", "CVE-2020-10769", "CVE-2019-3874", "CVE-2017-8924", "CVE-2019-17075", "CVE-2020-14331", "CVE-2019-15927", "CVE-2019-20812", "CVE-2019-16746", "CVE-2019-19535", "CVE-2020-25284", "CVE-2020-1749", "CVE-2019-7221", "CVE-2020-10751", "CVE-2018-16884", "CVE-2019-10638", "CVE-2019-18885", "CVE-2018-20856", "CVE-2019-11487", "CVE-2017-8925", "CVE-2019-6974", "CVE-2019-14898", "CVE-2020-25212", "CVE-2019-19073", "CVE-2020-14314", "CVE-2017-16644", "CVE-2019-3846", "CVE-2019-20811", "CVE-2016-10905", "CVE-2018-9415", "CVE-2017-16528", "CVE-2019-20054", "CVE-2019-19049", "CVE-2019-20096"], "description": "[4.1.12-124.43.4]\n- kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn) [Orabug: 29434845] {CVE-2019-6974}\n- KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier) [Orabug: 29434898] {CVE-2019-7221}\n- KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini) [Orabug: 29434924] {CVE-2019-7222}\n- net: arc_emac: fix koops caused by sk_buff free (Alexander Kochetkov) [Orabug: 30254239] {CVE-2016-10906}\n- GFS2: don't set rgrp gl_object until it's inserted into rgrp tree (Bob Peterson) [Orabug: 30254251] {CVE-2016-10905}\n- GFS2: Fix rgrp end rounding problem for bsize < page size (Bob Peterson) [Orabug: 30254251] {CVE-2016-10905}\n- x86/apic/msi: update address_hi on set msi affinity (Joe Jin) [Orabug: 31477035] \n- x86/apic/msi: check and sync apic IRR on msi_set_affinity (Joe Jin) [Orabug: 31477035] \n- net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup (Sabrina Dubroca) [Orabug: 31872821] {CVE-2020-1749}\n- nfs: Fix getxattr kernel panic and memory overflow (Jeffrey Mitchell) [Orabug: 31872910] {CVE-2020-25212}\n- rbd: require global CAP_SYS_ADMIN for mapping and unmapping (Ilya Dryomov) [Orabug: 31884169] {CVE-2020-25284}\n- mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song) [Orabug: 31884239] {CVE-2020-25285}\n- ext4: fix potential negative array index in do_split() (Eric Sandeen) [Orabug: 31895331] {CVE-2020-14314}\n[4.1.12-124.43.3]\n- ARM: amba: Fix race condition with driver_override (Geert Uytterhoeven) [Orabug: 29671212] {CVE-2018-9415}\n- block: blk_init_allocated_queue() set q->fq as NULL in the fail case (xiao jin) [Orabug: 30120513] {CVE-2018-20856}\n- USB: serial: omninet: fix reference leaks at open (Johan Hovold) [Orabug: 30484761] {CVE-2017-8925}\n- nl80211: validate beacon head (Johannes Berg) [Orabug: 30556264] {CVE-2019-16746}\n- cfg80211: Use const more consistently in for_each_element macros (Jouni Malinen) [Orabug: 30556264] {CVE-2019-16746}\n- cfg80211: add and use strongly typed element iteration macros (Johannes Berg) [Orabug: 30556264] {CVE-2019-16746}\n- cfg80211: add helper to find an IE that matches a byte-array (Luca Coelho) [Orabug: 30556264] {CVE-2019-16746}\n- cfg80211: allow finding vendor with OUI without specifying the OUI type (Emmanuel Grumbach) [Orabug: 30556264] {CVE-2019-16746}\n- dccp: Fix memleak in __feat_register_sp (YueHaibing) [Orabug: 30732821] {CVE-2019-20096}\n- fs/proc/proc_sysctl.c: Fix a NULL pointer dereference (YueHaibing) [Orabug: 30732938] {CVE-2019-20054}\n- fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links (YueHaibing) [Orabug: 30732938] {CVE-2019-20054}\n- scsi: libsas: stop discovering if oob mode is disconnected (Jason Yan) [Orabug: 30770913] {CVE-2019-19965}\n- kernel/sysctl.c: fix out-of-bounds access when setting file-max (Will Deacon) [Orabug: 31350720] {CVE-2019-14898}\n- sysctl: handle overflow for file-max (Christian Brauner) [Orabug: 31350720] {CVE-2019-14898}\n- ath9k_htc: release allocated buffer if timed out (Navid Emamdoost) [Orabug: 31351572] {CVE-2019-19073}\n- can: gs_usb: gs_can_open(): prevent memory leak (Navid Emamdoost) [Orabug: 31351682] {CVE-2019-19052}\n- ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() (Takashi Iwai) [Orabug: 31351837] {CVE-2019-15927}\n- media: usb: siano: Fix general protection fault in smsusb (Alan Stern) [Orabug: 31351875] {CVE-2019-15218}\n- crypto: vmac - separate tfm and request context (Eric Biggers) [Orabug: 31584410] \n- SUNRPC: Fix a race with XPRT_CONNECTING (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: Fix disconnection races (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: Add a helper to wake up a sleeping rpc_task and set its status (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: Reduce latency when send queue is congested (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: RPC transport queue must be low latency (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: Fix a potential race in xprt_connect() (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() (NeilBrown) [Orabug: 31796770] \n- SUNRPC: Fix races between socket connection and destroy code (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: Prevent SYN+SYNACK+RST storms (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: Report TCP errors to the caller (Trond Myklebust) [Orabug: 31796770] \n- SUNRPC: Ensure we release the TCP socket once it has been closed (Trond Myklebust) [Orabug: 31796770] \n- net-gro: fix use-after-free read in napi_gro_frags() (Eric Dumazet) [Orabug: 31856195] {CVE-2020-10720}\n- PCI: Probe bridge window attributes once at enumeration-time (Bjorn Helgaas) [Orabug: 31867577]\n[4.1.12-124.43.2]\n- ALSA: seq: Cancel pending autoload work at unbinding device (Takashi Iwai) [Orabug: 31352045] {CVE-2017-16528}\n- USB: serial: io_ti: fix information leak in completion handler (Johan Hovold) [Orabug: 31352084] {CVE-2017-8924}\n- sample-trace-array: Fix sleeping function called from invalid context (Kefeng Wang) [Orabug: 31543032] \n- sample-trace-array: Remove trace_array 'sample-instance' (Kefeng Wang) [Orabug: 31543032] \n- tracing: Sample module to demonstrate kernel access to Ftrace instances. (Divya Indi) [Orabug: 31543032] \n- tracing: Adding new functions for kernel access to Ftrace instances (Aruna Ramakrishna) [Orabug: 31543032] \n- tracing: Adding NULL checks for trace_array descriptor pointer (Divya Indi) [Orabug: 31543032] \n- tracing: Verify if trace array exists before destroying it. (Divya Indi) [Orabug: 31543032] \n- tracing: Declare newly exported APIs in include/linux/trace.h (Divya Indi) [Orabug: 31543032] \n- tracing: Kernel access to Ftrace instances (Divya Indi) [Orabug: 31543032]\n[4.1.12-124.43.1]\n- blktrace: Protect q->blk_trace with RCU (Jan Kara) [Orabug: 31123576] {CVE-2019-19768}\n- media: technisat-usb2: break out of loop at end of buffer (Sean Young) [Orabug: 31224554] {CVE-2019-15505}\n- btrfs: merge btrfs_find_device and find_device (Anand Jain) [Orabug: 31351746] {CVE-2019-18885}\n- RDMA/cxgb4: Do not dma memory off of the stack (Greg KH) [Orabug: 31351783] {CVE-2019-17075}\n- mwifiex: Abort at too short BSS descriptor element (Takashi Iwai) [Orabug: 31351916] {CVE-2019-3846}\n- mwifiex: Fix possible buffer overflows at parsing bss descriptor (Takashi Iwai) [Orabug: 31351916] {CVE-2019-3846} {CVE-2019-3846}\n- repair kABI breakage from 'fs: prevent page refcount overflow in pipe_buf_get' (Dan Duval) [Orabug: 31351941] {CVE-2019-11487}\n- mm: prevent get_user_pages() from overflowing page refcount (Linus Torvalds) [Orabug: 31351941] {CVE-2019-11487}\n- mm: add 'try_get_page()' helper function (Linus Torvalds) [Orabug: 31351941] {CVE-2019-11487}\n- fs: prevent page refcount overflow in pipe_buf_get (Matthew Wilcox) [Orabug: 31351941] {CVE-2019-11487}\n- mm: make page ref count overflow check tighter and more explicit (Linus Torvalds) [Orabug: 31351941] {CVE-2019-11487}\n- sctp: implement memory accounting on tx path (Xin Long) [Orabug: 31351960] {CVE-2019-3874}\n- sunrpc: use SVC_NET() in svcauth_gss_* functions (Vasily Averin) [Orabug: 31351995] {CVE-2018-16884}\n- sunrpc: use-after-free in svc_process_common() (Vasily Averin) [Orabug: 31351995] {CVE-2018-16884}\n- af_packet: set defaule value for tmo (Mao Wenan) [Orabug: 31439107] {CVE-2019-20812}\n- selinux: properly handle multiple messages in selinux_netlink_send() (Paul Moore) [Orabug: 31439369] {CVE-2020-10751}\n- selinux: Print 'sclass' as string when unrecognized netlink message occurs (Marek Milkovic) [Orabug: 31439369] {CVE-2020-10751}\n- mac80211: Do not send Layer 2 Update frame before authorization (Jouni Malinen) [Orabug: 31473652] {CVE-2019-5108}\n- cfg80211/mac80211: make ieee80211_send_layer2_update a public function (Dedy Lansky) [Orabug: 31473652] {CVE-2019-5108}\n- crypto: authenc - fix parsing key with misaligned rta_len (Eric Biggers) [Orabug: 31535529] {CVE-2020-10769}\n- vgacon: Fix for missing check in scrollback handling (Yunhai Zhang) [Orabug: 31705121] {CVE-2020-14331} {CVE-2020-14331}\n- rename kABI whitelists to lockedlists (Dan Duval) [Orabug: 31783151]\n[4.1.12-124.42.4]\n- rds/ib: Make i_{recv,send}_hdrs non-contigious (Hans Westgaard Ry) [Orabug: 30634865] \n- md: get sysfs entry after redundancy attr group create (Junxiao Bi) [Orabug: 31683116] \n- md: fix deadlock causing by sysfs_notify (Junxiao Bi) [Orabug: 31683116]\n[4.1.12-124.42.3]\n- can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices (Tomas Bortoli) [Orabug: 31351221] {CVE-2019-19535}\n- media: hdpvr: Fix an error handling path in hdpvr_probe() (Arvind Yadav) [Orabug: 31352053] {CVE-2017-16644}\n- fs/binfmt_misc.c: do not allow offset overflow (Thadeu Lima de Souza Cascardo) [Orabug: 31588258] \n- clear inode and truncate pages before enqueuing for async inactivation (Gautham Ananthakrishna) [Orabug: 31744270]\n[4.1.12-124.42.2]\n- mm: create alloc_last_chance debugfs entries (Mike Kravetz) [Orabug: 31295499] \n- mm: perform 'last chance' reclaim efforts before allocation failure (Mike Kravetz) [Orabug: 31295499] \n- mm: let page allocation slowpath retry 'order' times (Mike Kravetz) [Orabug: 31295499] \n- fix kABI breakage from 'netns: provide pure entropy for net_hash_mix()' (Dan Duval) [Orabug: 31351904] {CVE-2019-10638} {CVE-2019-10639}\n- netns: provide pure entropy for net_hash_mix() (Eric Dumazet) [Orabug: 31351904] {CVE-2019-10638} {CVE-2019-10639}\n- hrtimer: Annotate lockless access to timer->base (Eric Dumazet) [Orabug: 31380495] \n- rds: ib: Revert 'net/rds: Avoid stalled connection due to CM REQ retries' (Hakon Bugge) [Orabug: 31648141] \n- rds: Clear reconnect pending bit (Hakon Bugge) [Orabug: 31648141] \n- RDMA/netlink: Do not always generate an ACK for some netlink operations (Hakon Bugge) [Orabug: 31666975] \n- genirq/proc: Return proper error code when irq_set_affinity() fails (Wen Yaxng) [Orabug: 31723450]\n[4.1.12-124.42.1]\n- fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (Alexander Potapenko) [Orabug: 31350639] {CVE-2020-10732}\n- crypto: user - fix memory leak in crypto_report (Navid Emamdoost) [Orabug: 31351640] {CVE-2019-19062}\n- of: unittest: fix memory leak in unittest_data_add (Navid Emamdoost) [Orabug: 31351702] {CVE-2019-19049}\n- IB/sa: Resolv use-after-free in ib_nl_make_request() (Divya Indi) [Orabug: 31656992] \n- net-sysfs: call dev_hold if kobject_init_and_add success (YueHaibing) [Orabug: 31687545] {CVE-2019-20811}", "edition": 1, "modified": "2020-10-06T00:00:00", "published": "2020-10-06T00:00:00", "id": "ELSA-2020-5866", "href": "http://linux.oracle.com/errata/ELSA-2020-5866.html", "title": "Unbreakable Enterprise kernel security update", "type": "oraclelinux", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}