7.1 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.5 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
64.8%
The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3821-1 advisory.
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (CVE-2018-10880)
The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)
An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of- bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image. (CVE-2018-13096)
An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
__del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc rb_trees when reloc control has not been initialized. (CVE-2018-14609)
An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
(CVE-2018-14617)
An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)
arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes. (CVE-2018-18021)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3821-1. The text
# itself is copyright (C) Canonical, Inc. See
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
#
include('compat.inc');
if (description)
{
script_id(118971);
script_version("1.11");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/01/09");
script_cve_id(
"CVE-2018-10880",
"CVE-2018-13053",
"CVE-2018-13096",
"CVE-2018-14609",
"CVE-2018-14617",
"CVE-2018-17972",
"CVE-2018-18021"
);
script_xref(name:"USN", value:"3821-1");
script_name(english:"Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3821-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in
the USN-3821-1 advisory.
- Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and
writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system
crash and a denial of service. (CVE-2018-10880)
- The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an
integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)
- An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-
bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted
f2fs image. (CVE-2018-13096)
- An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
__del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc
rb_trees when reloc control has not been initialized. (CVE-2018-14609)
- An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic
in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+
filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
(CVE-2018-14617)
- An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through
4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a
local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)
- arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the
KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can
arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also
cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of
insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation
does not prevent unintended execution modes. (CVE-2018-18021)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-3821-1");
script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-17972");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-18021");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/02");
script_set_attribute(attribute:"patch_publication_date", value:"2018/11/14");
script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/15");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1037-kvm");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1072-aws");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1100-raspi2");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1104-snapdragon");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-generic");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-generic-lpae");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-lowlatency");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc-e500mc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc-smp");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc64-emb");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc64-smp");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Ubuntu Local Security Checks");
script_copyright(english:"Ubuntu Security Notice (C) 2018-2024 Canonical, Inc. / NASL script (C) 2018-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
exit(0);
}
include('debian_package.inc');
include('ksplice.inc');
if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('16.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);
var kernel_mappings = {
'16.04': {
'4.4.0': {
'generic': '4.4.0-139',
'generic-lpae': '4.4.0-139',
'lowlatency': '4.4.0-139',
'powerpc-e500mc': '4.4.0-139',
'powerpc-smp': '4.4.0-139',
'powerpc64-emb': '4.4.0-139',
'powerpc64-smp': '4.4.0-139',
'kvm': '4.4.0-1037',
'aws': '4.4.0-1072',
'raspi2': '4.4.0-1100',
'snapdragon': '4.4.0-1104'
}
}
};
var host_kernel_release = get_kb_item('Host/uptrack-uname-r');
if (empty_or_null(host_kernel_release)) host_kernel_release = get_kb_item_or_exit('Host/uname-r');
var host_kernel_base_version = get_kb_item_or_exit('Host/Debian/kernel-base-version');
var host_kernel_type = get_kb_item_or_exit('Host/Debian/kernel-type');
if(empty_or_null(kernel_mappings[os_release][host_kernel_base_version][host_kernel_type])) audit(AUDIT_INST_VER_NOT_VULN, 'kernel ' + host_kernel_release);
var extra = '';
var kernel_fixed_version = kernel_mappings[os_release][host_kernel_base_version][host_kernel_type] + "-" + host_kernel_type;
if (deb_ver_cmp(ver1:host_kernel_release, ver2:kernel_fixed_version) < 0)
{
extra = extra + 'Running Kernel level of ' + host_kernel_release + ' does not meet the minimum fixed level of ' + kernel_fixed_version + ' for this advisory.\n\n';
}
else
{
audit(AUDIT_PATCH_INSTALLED, 'Kernel package for USN-3821-1');
}
if (get_one_kb_item('Host/ksplice/kernel-cves'))
{
var cve_list = make_list('CVE-2018-10880', 'CVE-2018-13053', 'CVE-2018-13096', 'CVE-2018-14609', 'CVE-2018-14617', 'CVE-2018-17972', 'CVE-2018-18021');
if (ksplice_cves_check(cve_list))
{
audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for USN-3821-1');
}
else
{
extra = extra + ksplice_reporting_text();
}
}
if (extra) {
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : extra
);
exit(0);
}
Vendor | Product | Version | CPE |
---|---|---|---|
canonical | ubuntu_linux | linux-image-4.4.0-1037-kvm | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1037-kvm |
canonical | ubuntu_linux | linux-image-4.4.0-1072-aws | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1072-aws |
canonical | ubuntu_linux | linux-image-4.4.0-1100-raspi2 | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1100-raspi2 |
canonical | ubuntu_linux | linux-image-4.4.0-1104-snapdragon | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1104-snapdragon |
canonical | ubuntu_linux | linux-image-4.4.0-139-generic | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-generic |
canonical | ubuntu_linux | linux-image-4.4.0-139-generic-lpae | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-generic-lpae |
canonical | ubuntu_linux | linux-image-4.4.0-139-lowlatency | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-lowlatency |
canonical | ubuntu_linux | linux-image-4.4.0-139-powerpc-e500mc | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc-e500mc |
canonical | ubuntu_linux | linux-image-4.4.0-139-powerpc-smp | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc-smp |
canonical | ubuntu_linux | linux-image-4.4.0-139-powerpc64-emb | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc64-emb |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10880
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13053
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13096
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14609
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14617
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17972
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18021
ubuntu.com/security/notices/USN-3821-1
7.1 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.5 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
64.8%