pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
vuln-list-alt/oval/p10/ALT-PU-2018-2729/definitions.json
pepelyaevip 56bb29c44b ALT Vulnerability
2024-06-28 13:17:52 +00:00

285 lines
13 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20182729",
"Version": "oval:org.altlinux.errata:def:20182729",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2018-2729: package `kernel-image-un-def` update to version 4.19.5-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p10"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2018-2729",
"RefURL": "https://errata.altlinux.org/ALT-PU-2018-2729",
"Source": "ALTPU"
},
{
"RefID": "BDU:2019-00432",
"RefURL": "https://bdu.fstec.ru/vul/2019-00432",
"Source": "BDU"
},
{
"RefID": "BDU:2019-01052",
"RefURL": "https://bdu.fstec.ru/vul/2019-01052",
"Source": "BDU"
},
{
"RefID": "BDU:2019-01062",
"RefURL": "https://bdu.fstec.ru/vul/2019-01062",
"Source": "BDU"
},
{
"RefID": "BDU:2019-01343",
"RefURL": "https://bdu.fstec.ru/vul/2019-01343",
"Source": "BDU"
},
{
"RefID": "CVE-2018-10940",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-10940",
"Source": "CVE"
},
{
"RefID": "CVE-2018-16658",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-16658",
"Source": "CVE"
},
{
"RefID": "CVE-2018-18955",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-18955",
"Source": "CVE"
},
{
"RefID": "CVE-2018-19406",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-19406",
"Source": "CVE"
},
{
"RefID": "CVE-2018-19407",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-19407",
"Source": "CVE"
},
{
"RefID": "CVE-2018-19854",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-19854",
"Source": "CVE"
}
],
"Description": "This update upgrades kernel-image-un-def to version 4.19.5-alt1. \nSecurity Fix(es):\n\n * BDU:2019-00432: Уязвимость функции map_write() (\u0026amp;quot;kernel/user_namespace.c\u0026amp;quot;) ядра операционной системы Linux, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2019-01052: Уязвимость функции vcpu_scan_ioapic ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2019-01062: Уязвимость функции crypto_report_one() ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2019-01343: Уязвимость функции cdrom_ioctl_drive_status() операционных систем Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * CVE-2018-10940: The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.\n\n * CVE-2018-16658: An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.\n\n * CVE-2018-18955: In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.\n\n * CVE-2018-19406: kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.\n\n * CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.\n\n * CVE-2018-19854: An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2018-11-30"
},
"Updated": {
"Date": "2018-11-30"
},
"BDUs": [
{
"ID": "BDU:2019-00432",
"CVSS": "AV:L/AC:H/Au:S/C:C/I:C/A:C",
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-20, CWE-863",
"Href": "https://bdu.fstec.ru/vul/2019-00432",
"Impact": "High",
"Public": "20181107"
},
{
"ID": "BDU:2019-01052",
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2019-01052",
"Impact": "Low",
"Public": "20181119"
},
{
"ID": "BDU:2019-01062",
"CVSS": "AV:L/AC:M/Au:S/C:C/I:N/A:N",
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://bdu.fstec.ru/vul/2019-01062",
"Impact": "Low",
"Public": "20181109"
},
{
"ID": "BDU:2019-01343",
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:P",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"CWE": "CWE-200",
"Href": "https://bdu.fstec.ru/vul/2019-01343",
"Impact": "Low",
"Public": "20180426"
}
],
"CVEs": [
{
"ID": "CVE-2018-10940",
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-119",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-10940",
"Impact": "Low",
"Public": "20180509"
},
{
"ID": "CVE-2018-16658",
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:P",
"CVSS3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"CWE": "CWE-200",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-16658",
"Impact": "Low",
"Public": "20180907"
},
{
"ID": "CVE-2018-18955",
"CVSS": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-863",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-18955",
"Impact": "High",
"Public": "20181116"
},
{
"ID": "CVE-2018-19406",
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-19406",
"Impact": "Low",
"Public": "20181121"
},
{
"ID": "CVE-2018-19407",
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-19407",
"Impact": "Low",
"Public": "20181121"
},
{
"ID": "CVE-2018-19854",
"CVSS": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-19854",
"Impact": "Low",
"Public": "20181204"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:kworkstation:10",
"cpe:/o:alt:workstation:10",
"cpe:/o:alt:server:10",
"cpe:/o:alt:server-v:10",
"cpe:/o:alt:education:10",
"cpe:/o:alt:slinux:10",
"cpe:/o:alt:starterkit:p10",
"cpe:/o:alt:kworkstation:10.1",
"cpe:/o:alt:workstation:10.1",
"cpe:/o:alt:server:10.1",
"cpe:/o:alt:server-v:10.1",
"cpe:/o:alt:education:10.1",
"cpe:/o:alt:slinux:10.1",
"cpe:/o:alt:starterkit:10.1",
"cpe:/o:alt:kworkstation:10.2",
"cpe:/o:alt:workstation:10.2",
"cpe:/o:alt:server:10.2",
"cpe:/o:alt:server-v:10.2",
"cpe:/o:alt:education:10.2",
"cpe:/o:alt:slinux:10.2",
"cpe:/o:alt:starterkit:10.2"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:2001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20182729001",
"Comment": "kernel-doc-un is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729002",
"Comment": "kernel-headers-modules-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729003",
"Comment": "kernel-headers-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729004",
"Comment": "kernel-image-domU-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729005",
"Comment": "kernel-image-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729006",
"Comment": "kernel-modules-drm-ancient-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729007",
"Comment": "kernel-modules-drm-nouveau-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729008",
"Comment": "kernel-modules-drm-radeon-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729009",
"Comment": "kernel-modules-drm-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729010",
"Comment": "kernel-modules-ide-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729011",
"Comment": "kernel-modules-kvm-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729012",
"Comment": "kernel-modules-staging-un-def is earlier than 1:4.19.5-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182729013",
"Comment": "kernel-modules-v4l-un-def is earlier than 1:4.19.5-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue View Git Blame Copy Permalink