Executive Summary
Summary | |
---|---|
Title | linux security update |
Informations | |||
---|---|---|---|
Name | DSA-4313 | First vendor Publication | 2018-10-08 |
Vendor | Debian | Last vendor Modification | 2018-10-08 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:S/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Local |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 3.1 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2018-15471 (XSA-270) Felix Wilhelm of Google Project Zero discovered a flaw in the hash handling of the xen-netback Linux kernel module. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in privilege escalation, denial of service, or information leaks. https://xenbits.xen.org/xsa/advisory-270.html CVE-2018-18021 It was discovered that the KVM subsystem on the arm64 platform does not properly handle the KVM_SET_ON_REG ioctl. An attacker who can create KVM based virtual machines can take advantage of this flaw for denial of service (hypervisor panic) or privilege escalation (arbitrarily redirect the hypervisor flow of control with full register control). For the stable distribution (stretch), these problems have been fixed in version 4.9.110-3+deb9u6. We recommend that you upgrade your linux packages. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux |
Original Source
Url : http://www.debian.org/security/2018/dsa-4313 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-125 | Out-of-bounds Read |
50 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-8422d94975.nasl - Type : ACT_GATHER_INFO |
2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-ddbaca855e.nasl - Type : ACT_GATHER_INFO |
2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-f392ab8c84.nasl - Type : ACT_GATHER_INFO |
2018-11-09 | Name : The remote Amazon Linux 2 host is missing a security update. File : al2_ALAS-2018-1100.nasl - Type : ACT_GATHER_INFO |
2018-11-08 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-1100.nasl - Type : ACT_GATHER_INFO |
2018-10-11 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-94315e9a6b.nasl - Type : ACT_GATHER_INFO |
2018-10-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4313.nasl - Type : ACT_GATHER_INFO |
2018-08-24 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-79d7c3d2df.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2018-11-01 17:21:39 |
|
2018-10-09 00:19:11 |
|