Test Kennung:	1.3.6.1.4.1.25623.1.1.2.2019.1498
Kategorie:	Huawei EulerOS Local Security Checks
Titel:	Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1498)
Zusammenfassung:	The remote host is missing an update for the Huawei EulerOS 'kernel' package(s) announced via the EulerOS-SA-2019-1498 advisory.
Beschreibung:	Summary: The remote host is missing an update for the Huawei EulerOS 'kernel' package(s) announced via the EulerOS-SA-2019-1498 advisory. Vulnerability Insight: An integer overflow vulnerability was found in the ring_buffer_resize() calculations in which a privileged user can adjust the size of the ringbuffer message size. These calculations can create an issue where the kernel memory allocator will not allocate the correct count of pages yet expect them to be usable. This can lead to the ftrace() output to appear to corrupt kernel memory and possibly be used for privileged escalation or more likely kernel panic.(CVE-2016-9754) A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SNDRCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.(CVE-2016-9793) A use-after-free vulnerability was found in ALSA pcm layer, which allows local users to cause a denial of service, memory corruption, or possibly other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.(CVE-2016-9794) A double free vulnerability was found in netlink_dump, which could cause a denial of service or possibly other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.(CVE-2016-9806) A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets are implemented in the Linux kernel networking subsystem handling synchronization. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) can use this issue to crash the system.(CVE-2017-1000111) An exploitable memory corruption flaw was found in the Linux kernel. The append path can be erroneously switched from UFO to non-UFO in ip_ufo_append_data() when building an UFO packet with MSG_MORE option. If unprivileged user namespaces are available, this flaw can be exploited to gain root privileges.(CVE-2017-1000112) A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64le), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64le, the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'kernel' package(s) on Huawei EulerOS Virtualization 3.0.1.0. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-9754 BugTraq ID: 95278 http://www.securityfocus.com/bid/95278 Common Vulnerability Exposure (CVE) ID: CVE-2016-9793 BugTraq ID: 94655 http://www.securityfocus.com/bid/94655 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793 http://www.openwall.com/lists/oss-security/2016/12/03/1 RedHat Security Advisories: RHSA-2017:0931 https://access.redhat.com/errata/RHSA-2017:0931 RedHat Security Advisories: RHSA-2017:0932 https://access.redhat.com/errata/RHSA-2017:0932 RedHat Security Advisories: RHSA-2017:0933 https://access.redhat.com/errata/RHSA-2017:0933 http://www.securitytracker.com/id/1037968 Common Vulnerability Exposure (CVE) ID: CVE-2016-9794 BugTraq ID: 94654 http://www.securityfocus.com/bid/94654 http://www.openwall.com/lists/oss-security/2016/12/03/2 RedHat Security Advisories: RHSA-2016:2574 http://rhn.redhat.com/errata/RHSA-2016-2574.html SuSE Security Announcement: SUSE-SU-2016:3146 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00062.html SuSE Security Announcement: SUSE-SU-2016:3188 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00072.html SuSE Security Announcement: SUSE-SU-2016:3203 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00075.html SuSE Security Announcement: SUSE-SU-2016:3217 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00081.html SuSE Security Announcement: SUSE-SU-2016:3248 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00088.html SuSE Security Announcement: SUSE-SU-2016:3252 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00091.html SuSE Security Announcement: openSUSE-SU-2016:3118 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00057.html Common Vulnerability Exposure (CVE) ID: CVE-2016-9806 BugTraq ID: 94653 http://www.securityfocus.com/bid/94653 http://lists.openwall.net/netdev/2016/05/15/69 http://www.openwall.com/lists/oss-security/2016/12/03/4 RedHat Security Advisories: RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:1842 RedHat Security Advisories: RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2077 RedHat Security Advisories: RHSA-2017:2669 https://access.redhat.com/errata/RHSA-2017:2669
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.