7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.053 Low
EPSS
Percentile
93.1%
The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3931-1 advisory.
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
(CVE-2018-14678)
arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes. (CVE-2018-18021)
In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c. (CVE-2018-19824)
A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1. (CVE-2019-3459)
A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1. (CVE-2019-3460)
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free. (CVE-2019-6974)
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (CVE-2019-7221)
The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (CVE-2019-7222)
kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks. (CVE-2019-7308)
In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr. (CVE-2019-8912)
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
(CVE-2019-8980)
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task. (CVE-2019-9213)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3931-1. The text
# itself is copyright (C) Canonical, Inc. See
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
#
include('compat.inc');
if (description)
{
script_id(123678);
script_version("1.11");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/01/09");
script_cve_id(
"CVE-2018-14678",
"CVE-2018-18021",
"CVE-2018-19824",
"CVE-2019-3459",
"CVE-2019-3460",
"CVE-2019-6974",
"CVE-2019-7221",
"CVE-2019-7222",
"CVE-2019-7308",
"CVE-2019-8912",
"CVE-2019-8980",
"CVE-2019-9213"
);
script_xref(name:"USN", value:"3931-1");
script_name(english:"Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3931-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in
the USN-3931-1 advisory.
- An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The
xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which
allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen,
64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
(CVE-2018-14678)
- arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the
KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can
arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also
cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of
insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation
does not prevent unintended execution modes. (CVE-2018-18021)
- In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by
supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in
sound/usb/card.c. (CVE-2018-19824)
- A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before
5.1-rc1. (CVE-2019-3459)
- A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel
before 5.1-rc1. (CVE-2019-3460)
- In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference
counting because of a race condition, leading to a use-after-free. (CVE-2019-6974)
- The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (CVE-2019-7221)
- The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (CVE-2019-7222)
- kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on
pointer arithmetic in various cases, including cases of different branches with different state or limits
to sanitize, leading to side-channel attacks. (CVE-2019-7308)
- In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for
a certain structure member, which leads to a use-after-free in sockfs_setattr. (CVE-2019-8912)
- A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows
attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
(CVE-2019-8980)
- In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum
address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP
platforms. This is related to a capability check for the wrong task. (CVE-2019-9213)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-3931-1");
script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-8912");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2019-6974");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/28");
script_set_attribute(attribute:"patch_publication_date", value:"2019/04/02");
script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/03");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1010-oracle");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1029-gcp");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1031-kvm");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1033-raspi2");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1035-oem");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-generic");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-generic-lpae");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-lowlatency");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-snapdragon");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Ubuntu Local Security Checks");
script_copyright(english:"Ubuntu Security Notice (C) 2019-2024 Canonical, Inc. / NASL script (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
exit(0);
}
include('debian_package.inc');
include('ksplice.inc');
if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('18.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 18.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);
var kernel_mappings = {
'18.04': {
'4.15.0': {
'generic': '4.15.0-47',
'generic-lpae': '4.15.0-47',
'lowlatency': '4.15.0-47',
'snapdragon': '4.15.0-47',
'oracle': '4.15.0-1010',
'gcp': '4.15.0-1029',
'kvm': '4.15.0-1031',
'raspi2': '4.15.0-1033',
'oem': '4.15.0-1035'
}
}
};
var host_kernel_release = get_kb_item('Host/uptrack-uname-r');
if (empty_or_null(host_kernel_release)) host_kernel_release = get_kb_item_or_exit('Host/uname-r');
var host_kernel_base_version = get_kb_item_or_exit('Host/Debian/kernel-base-version');
var host_kernel_type = get_kb_item_or_exit('Host/Debian/kernel-type');
if(empty_or_null(kernel_mappings[os_release][host_kernel_base_version][host_kernel_type])) audit(AUDIT_INST_VER_NOT_VULN, 'kernel ' + host_kernel_release);
var extra = '';
var kernel_fixed_version = kernel_mappings[os_release][host_kernel_base_version][host_kernel_type] + "-" + host_kernel_type;
if (deb_ver_cmp(ver1:host_kernel_release, ver2:kernel_fixed_version) < 0)
{
extra = extra + 'Running Kernel level of ' + host_kernel_release + ' does not meet the minimum fixed level of ' + kernel_fixed_version + ' for this advisory.\n\n';
}
else
{
audit(AUDIT_PATCH_INSTALLED, 'Kernel package for USN-3931-1');
}
if (get_one_kb_item('Host/ksplice/kernel-cves'))
{
var cve_list = make_list('CVE-2018-14678', 'CVE-2018-18021', 'CVE-2018-19824', 'CVE-2019-3459', 'CVE-2019-3460', 'CVE-2019-6974', 'CVE-2019-7221', 'CVE-2019-7222', 'CVE-2019-7308', 'CVE-2019-8912', 'CVE-2019-8980', 'CVE-2019-9213');
if (ksplice_cves_check(cve_list))
{
audit(AUDIT_PATCH_INSTALLED, 'KSplice hotfix for USN-3931-1');
}
else
{
extra = extra + ksplice_reporting_text();
}
}
if (extra) {
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : extra
);
exit(0);
}
Vendor | Product | Version | CPE |
---|---|---|---|
canonical | ubuntu_linux | linux-image-4.15.0-1010-oracle | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1010-oracle |
canonical | ubuntu_linux | linux-image-4.15.0-1029-gcp | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1029-gcp |
canonical | ubuntu_linux | linux-image-4.15.0-1031-kvm | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1031-kvm |
canonical | ubuntu_linux | linux-image-4.15.0-1033-raspi2 | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1033-raspi2 |
canonical | ubuntu_linux | linux-image-4.15.0-1035-oem | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-1035-oem |
canonical | ubuntu_linux | linux-image-4.15.0-47-generic | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-generic |
canonical | ubuntu_linux | linux-image-4.15.0-47-generic-lpae | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-generic-lpae |
canonical | ubuntu_linux | linux-image-4.15.0-47-lowlatency | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-lowlatency |
canonical | ubuntu_linux | linux-image-4.15.0-47-snapdragon | p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15.0-47-snapdragon |
canonical | ubuntu_linux | 18.04 | cpe:/o:canonical:ubuntu_linux:18.04:-:lts |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14678
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18021
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19824
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3459
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3460
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6974
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7221
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7222
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7308
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8912
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8980
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9213
ubuntu.com/security/notices/USN-3931-1
7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.053 Low
EPSS
Percentile
93.1%