The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug:
    28156176] (CVE-2018-3665)

  - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng     Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741)

  - xfs: set format back to extents if     xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug:
    27989498] (CVE-2018-10323)

  - Bluetooth: Prevent stack info leak from the EFS element.
    (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410)     (CVE-2017-1000410)

  - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2549)

  - ALSA: timer: Harden slave timer list handling (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548)

  - ALSA: timer: Fix double unlink of active_list (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2545)

  - ALSA: seq: Fix missing NULL check at remove_events ioctl     (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543)

  - ALSA: seq: Fix race at timer setup and close (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2544)

  - ALSA: usb-audio: avoid freeing umidi object twice     (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384)

  - perf/hwbp: Simplify the perf-hwbp code, fix     documentation (Linus Torvalds) [Orabug: 27947608]     (CVE-2018-1000199)

  - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix     documentation' (Brian Maly) [Orabug: 27947608]

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4134 advisory.

  - Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel     before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have     unspecified other impact via vectors involving an invalid USB descriptor. (CVE-2016-2384)

  - The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of     incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of     uninitialized stack variables that may be returned to an attacker in their uninitialized state. By     manipulating the code flows that precede the handling of these configuration messages, an attacker can     also gain some control over which data will be held in the uninitialized stack variables. This can allow     him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in     this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in     L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels     which were built with the above mitigations. These are the specifics of this vulnerability: In the     function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared     without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration     parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call     that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs;, (void
    *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of     these functions the efs variable would eventually be added to the outgoing configuration request that is     being built: l2cap_add_conf_opt(&ptr;, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs;); So by sending a     configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length     that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the     uninitialized variable would be returned to the attacker (16 bytes). (CVE-2017-1000410)

  - The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint()     that can result in crash and possibly memory corruption. This attack appear to be exploitable via local     code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit     f67b15037a7a50c57f72e69a6d59941ad90a0f0f. (CVE-2018-1000199)

  - The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h. (CVE-2017-17741)

  - The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3     allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted     xfs image. (CVE-2018-10323)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based     microprocessors may potentially allow a local process to infer data from another process through a     speculative execution side channel. (CVE-2018-3665)

  - The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before     4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to     cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call. (CVE-2016-2543)

  - sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which     allows local users to cause a denial of service (deadlock) via a crafted ioctl call. (CVE-2016-2549)

  - Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1     allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call     at a certain time. (CVE-2016-2544)

  - The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly     maintain a certain linked list, which allows local users to cause a denial of service (race condition and     system crash) via a crafted ioctl call. (CVE-2016-2545)

  - sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider     slave timer instances, which allows local users to cause a denial of service (race condition, use-after-     free, and system crash) via a crafted ioctl call. (CVE-2016-2547)

  - sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop     action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call,     related to the (1) snd_timer_close and (2) _snd_timer_stop functions. (CVE-2016-2548)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4145 advisory.

  - Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel     before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have     unspecified other impact via vectors involving an invalid USB descriptor. (CVE-2016-2384)

  - The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint()     that can result in crash and possibly memory corruption. This attack appear to be exploitable via local     code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit     f67b15037a7a50c57f72e69a6d59941ad90a0f0f. (CVE-2018-1000199)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based     microprocessors may potentially allow a local process to infer data from another process through a     speculative execution side channel. (CVE-2018-3665)

  - The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before     4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to     cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call. (CVE-2016-2543)

  - sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which     allows local users to cause a denial of service (deadlock) via a crafted ioctl call. (CVE-2016-2549)

  - Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1     allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call     at a certain time. (CVE-2016-2544)

  - The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly     maintain a certain linked list, which allows local users to cause a denial of service (race condition and     system crash) via a crafted ioctl call. (CVE-2016-2545)

  - sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider     slave timer instances, which allows local users to cause a denial of service (race condition, use-after-     free, and system crash) via a crafted ioctl call. (CVE-2016-2547)

  - sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop     action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call,     related to the (1) snd_timer_close and (2) _snd_timer_stop functions. (CVE-2016-2548)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS that is 10.13.x prior to 10.13.6. It is, therefore, affected by multiple vulnerabilities in the following components:

 - Accounts
 - AMD
 - APFS
 - ATS
 - Bluetooth
 - CFNetwork
 - CoreCrypto
 - CUPS
 - DesktopServices
 - Intel Graphics Driver
 - IOGraphics
 - Kernel
 - libxpc
 - LinkPresentation
 - Perl
 - Ruby

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Published	Updated	Severity
110581	OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0231)	Nessus	OracleVM Local Security Checks	6/18/2018	9/27/2019	high
110583	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4134)	Nessus	Oracle Linux Local Security Checks	6/18/2018	9/8/2021	high
110585	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2018-4145)	Nessus	Oracle Linux Local Security Checks	6/18/2018	9/8/2021	medium
700517	macOS 10.13.x < 10.13.6 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	4/10/2019	4/10/2019	critical

Detections

Analytics

Plugins Search

high

high

medium

critical