Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-12921 advisory.

  - Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5     allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a     (1) munmap or (2) close system call. (CVE-2012-3511)

  - The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain     data structure, which allows local users to obtain sensitive information from kernel memory via a crafted     application that makes a (1) tkill or (2) tgkill system call. (CVE-2013-2141)

  - The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel     through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a     denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a     setsockopt system call. (CVE-2013-4162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it is a duplicate of oraclelinux_ELSA-2013-1292-1.nasl (plugin ID 70186).

Updated kernel-rt packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise MRG 2.2.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way Netlink messages without SCM_CREDENTIALS (used for authentication) data set were handled. When not explicitly set, the data was sent but with all values set to 0, including the process ID and user ID, causing the Netlink message to appear as if it were sent with root privileges. A local, unprivileged user could use this flaw to send spoofed Netlink messages to an application, possibly resulting in the application performing privileged operations if it relied on SCM_CREDENTIALS data for the authentication of Netlink messages. (CVE-2012-3520, Important)

* A race condition was found in the way asynchronous I/O and fallocate() interacted when using the ext4 file system. A local, unprivileged user could use this flaw to expose random data from an extent whose data blocks have not yet been written, and thus contain data from a deleted file. (CVE-2012-4508, Important)

* A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2012-2133, Moderate)

* A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511, Moderate)

* A divide-by-zero flaw was found in the TCP Illinois congestion control algorithm implementation in the Linux kernel. If the TCP Illinois congestion control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control variable set to 'illinois'), a local, unprivileged user could trigger this flaw and cause a denial of service. (CVE-2012-4565, Moderate)

* An information leak flaw was found in the uname() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space by setting the UNAME26 personality and then calling the uname() system call.
(CVE-2012-0957, Low)

* Buffer overflow flaws were found in the udf_load_logicalvol() function in the Universal Disk Format (UDF) file system implementation in the Linux kernel. An attacker with physical access to a system could use these flaws to cause a denial of service or escalate their privileges. (CVE-2012-3400, Low)

* A flaw was found in the way the msg_namelen variable in the rds_recvmsg() function of the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation was initialized. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space.
(CVE-2012-3430, Low)

Red Hat would like to thank Pablo Neira Ayuso for reporting CVE-2012-3520; Theodore Ts'o for reporting CVE-2012-4508; Shachar Raindel for reporting CVE-2012-2133; and Kees Cook for reporting CVE-2012-0957. Upstream acknowledges Dmitry Monakhov as the original reporter of CVE-2012-4508. The CVE-2012-4565 issue was discovered by Rodrigo Freire of Red Hat, and the CVE-2012-3430 issue was discovered by the Red Hat InfiniBand team.

This update also fixes multiple bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.2.33-rt50, and correct these issues. The system must be rebooted for this update to take effect.

This update fixes the following security issues :

  - A use-after-free flaw was found in the madvise() system     call implementation in the Linux kernel. A local,     unprivileged user could use this flaw to cause a denial     of service or, potentially, escalate their privileges.
    (CVE-2012-3511, Moderate)

  - A flaw was found in the way the Linux kernel's TCP/IP     protocol suite implementation handled IPv6 sockets that     used the UDP_CORK option. A local, unprivileged user     could use this flaw to cause a denial of service.
    (CVE-2013-4162, Moderate)

  - An information leak flaw in the Linux kernel could allow     a local, unprivileged user to leak kernel memory to     user-space. (CVE-2013-2141, Low)

This update also fixes the following bugs :

  - A bug in the be2net driver prevented communication     between NICs using be2net. This update applies a patch     addressing this problem along with several other     upstream patches that fix various other problems.
    Traffic between NICs using the be2net driver now     proceeds as expected.

  - A recent patch fixing a problem that prevented     communication between NICs using the be2net driver     caused the firmware of NICs to become unresponsive, and     thus triggered a kernel panic. The problem was caused by     unnecessary usage of a hardware workaround that allows     skipping VLAN tag insertion. A patch has been applied     and the workaround is now used only when the     multi-channel configuration is enabled on the NIC. Note     that the bug only affected the NICs with firmware     version 4.2.xxxx.

  - A bug in the autofs4 mount expiration code could cause     the autofs4 module to falsely report a busy tree of NFS     mounts as 'not in use'. Consequently, automount     attempted to unmount the tree and failed with a 'failed     to umount offset' error, leaving the mount tree to     appear as empty directories. A patch has been applied to     remove an incorrectly used autofs dentry mount check and     the aforementioned problem no longer occurs.

  - A race condition in the be_open function in the be2net     driver could trigger the BUG_ON() macro, which resulted     in a kernel panic. A patch addressing this problem has     been applied and the race condition is now avoided by     enabling polling before enabling interrupts globally.
    The kernel no longer panics in this situation.

The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1292 advisory.

    - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970874 970875]     {CVE-2013-2141}
    - [net] ipv6: do udp_push_pending_frames AF_INET sock pending data (Jiri Benc) [987647 987648]     {CVE-2013-4162}
    - [mm] use-after-free in madvise_remove() (Jacob Tanenbaum) [849735 849736] {CVE-2012-3511}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2013:1292 :

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511, Moderate)

* A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled IPv6 sockets that used the UDP_CORK option. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2013-4162, Moderate)

* An information leak flaw in the Linux kernel could allow a local, unprivileged user to leak kernel memory to user-space. (CVE-2013-2141, Low)

Red Hat would like to thank Hannes Frederic Sowa for reporting CVE-2013-4162.

This update also fixes the following bugs :

* A bug in the be2net driver prevented communication between NICs using be2net. This update applies a patch addressing this problem along with several other upstream patches that fix various other problems. Traffic between NICs using the be2net driver now proceeds as expected. (BZ#983864)

* A recent patch fixing a problem that prevented communication between NICs using the be2net driver caused the firmware of NICs to become unresponsive, and thus triggered a kernel panic. The problem was caused by unnecessary usage of a hardware workaround that allows skipping VLAN tag insertion. A patch has been applied and the workaround is now used only when the multi-channel configuration is enabled on the NIC. Note that the bug only affected the NICs with firmware version 4.2.xxxx. (BZ#999819)

* A bug in the autofs4 mount expiration code could cause the autofs4 module to falsely report a busy tree of NFS mounts as 'not in use'.
Consequently, automount attempted to unmount the tree and failed with a 'failed to umount offset' error, leaving the mount tree to appear as empty directories. A patch has been applied to remove an incorrectly used autofs dentry mount check and the aforementioned problem no longer occurs. (BZ#1001488)

* A race condition in the be_open function in the be2net driver could trigger the BUG_ON() macro, which resulted in a kernel panic. A patch addressing this problem has been applied and the race condition is now avoided by enabling polling before enabling interrupts globally. The kernel no longer panics in this situation. (BZ#1005239)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511, Moderate)

* A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled IPv6 sockets that used the UDP_CORK option. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2013-4162, Moderate)

* An information leak flaw in the Linux kernel could allow a local, unprivileged user to leak kernel memory to user-space. (CVE-2013-2141, Low)

Red Hat would like to thank Hannes Frederic Sowa for reporting CVE-2013-4162.

This update also fixes the following bugs :

* A bug in the be2net driver prevented communication between NICs using be2net. This update applies a patch addressing this problem along with several other upstream patches that fix various other problems. Traffic between NICs using the be2net driver now proceeds as expected. (BZ#983864)

* A recent patch fixing a problem that prevented communication between NICs using the be2net driver caused the firmware of NICs to become unresponsive, and thus triggered a kernel panic. The problem was caused by unnecessary usage of a hardware workaround that allows skipping VLAN tag insertion. A patch has been applied and the workaround is now used only when the multi-channel configuration is enabled on the NIC. Note that the bug only affected the NICs with firmware version 4.2.xxxx. (BZ#999819)

* A bug in the autofs4 mount expiration code could cause the autofs4 module to falsely report a busy tree of NFS mounts as 'not in use'.
Consequently, automount attempted to unmount the tree and failed with a 'failed to umount offset' error, leaving the mount tree to appear as empty directories. A patch has been applied to remove an incorrectly used autofs dentry mount check and the aforementioned problem no longer occurs. (BZ#1001488)

* A race condition in the be_open function in the be2net driver could trigger the BUG_ON() macro, which resulted in a kernel panic. A patch addressing this problem has been applied and the race condition is now avoided by enabling polling before enabling interrupts globally. The kernel no longer panics in this situation. (BZ#1005239)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2012-2133 , Moderate)

A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511 , Moderate)

It was found that when running a 32-bit binary that uses a large number of shared libraries, one of the libraries would always be loaded at a predictable address in memory. An attacker could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature. (CVE-2012-1568 , Low)

Buffer overflow flaws were found in the udf_load_logicalvol() function in the Universal Disk Format (UDF) file system implementation in the Linux kernel. An attacker with physical access to a system could use these flaws to cause a denial of service or escalate their privileges.
(CVE-2012-3400 , Low)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2044 advisory.

    - hugepages: fix use after free bug in 'quota' handling [15842385] {CVE-2012-2133}
    - mm: Hold a file reference in madvise_remove [15842884] {CVE-2012-3511}
    - udf: Fortify loading of sparing table [15843730] {CVE-2012-3400}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2043 advisory.

    - hugepages: fix use after free bug in 'quota' handling [Orabug: 15845276] {CVE-2012-2133}
    - udf: Fortify loading of sparing table [Orabug: 15845302] {CVE-2012-3400}
    - udf: Avoid run away loop when partition table length is corrupt [Orabug: 15845302] {CVE-2012-3400}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1426 advisory.

    - [mm] hugetlb: do not use vma_hugecache_offset() for vma_prio_tree_foreach (Frederic Weisbecker) [843034     843035] {CVE-2012-2133}
    - [mm] hugepages: fix use after free bug in 'quota' handling (Frederic Weisbecker) [843034 843035]     {CVE-2012-2133}
    - [mm] hugetlb: fix pgoff computation when unmapping page from vma (Frederic Weisbecker) [843034 843035]     {CVE-2012-2133}
    - [mm] hugetlb: fix ENOSPC returned by handle_mm_fault() (Frederic Weisbecker) [843034 843035]     {CVE-2012-2133}
    - [mm] x86_32: fix SHLIB_BASE address typo (Aristeu S. Rozanski F) [804955 804956] {CVE-2012-1568}
    - [mm] x86_32: randomize SHLIB_BASE (Aristeu Rozanski) [804955 804956] {CVE-2012-1568}
    - [mm] Hold a file reference in madvise_remove (Jerome Marchand) [849738 849739] {CVE-2012-3511}
    - [fs] udf: fix retun value on error path in udf_load_logicalvol (Nikola Pajkovsky) [843142 843143]     {CVE-2012-3400}
    - [fs] udf: Improve table length check to avoid possible overflow (Nikola Pajkovsky) [843142 843143]     {CVE-2012-3400}
    - [fs] udf: Fortify loading of sparing table (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
    - [fs] udf: Avoid run away loop when partition table length is corrupted (Nikola Pajkovsky) [843142     843143] {CVE-2012-3400}
    - [fs] udf: Use 'ret' instead of abusing 'i' in udf_load_logicalvol() (Nikola Pajkovsky) [843142 843143]     {CVE-2012-3400}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2012-2133, Moderate)

* A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511, Moderate)

* It was found that when running a 32-bit binary that uses a large number of shared libraries, one of the libraries would always be loaded at a predictable address in memory. An attacker could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature. (CVE-2012-1568, Low)

* Buffer overflow flaws were found in the udf_load_logicalvol() function in the Universal Disk Format (UDF) file system implementation in the Linux kernel. An attacker with physical access to a system could use these flaws to cause a denial of service or escalate their privileges. (CVE-2012-3400, Low)

Red Hat would like to thank Shachar Raindel for reporting CVE-2012-2133.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

* A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2012-2133, Moderate)

* A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511, Moderate)

* It was found that when running a 32-bit binary that uses a large number of shared libraries, one of the libraries would always be loaded at a predictable address in memory. An attacker could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature. (CVE-2012-1568, Low)

* Buffer overflow flaws were found in the udf_load_logicalvol() function in the Universal Disk Format (UDF) file system implementation in the Linux kernel. An attacker with physical access to a system could use these flaws to cause a denial of service or escalate their privileges. (CVE-2012-3400, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1426 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A use-after-free flaw was found in the Linux kernel's memory management     subsystem in the way quota handling for huge pages was performed. A local,     unprivileged user could use this flaw to cause a denial of service or,     potentially, escalate their privileges. (CVE-2012-2133, Moderate)

    * A use-after-free flaw was found in the madvise() system call     implementation in the Linux kernel. A local, unprivileged user could use     this flaw to cause a denial of service or, potentially, escalate their     privileges. (CVE-2012-3511, Moderate)

    * It was found that when running a 32-bit binary that uses a large number     of shared libraries, one of the libraries would always be loaded at a     predictable address in memory. An attacker could use this flaw to bypass     the Address Space Layout Randomization (ASLR) security feature.
    (CVE-2012-1568, Low)

    * Buffer overflow flaws were found in the udf_load_logicalvol() function     in the Universal Disk Format (UDF) file system implementation in the Linux     kernel. An attacker with physical access to a system could use these flaws     to cause a denial of service or escalate their privileges. (CVE-2012-3400,     Low)

    Red Hat would like to thank Shachar Raindel for reporting CVE-2012-2133.

    This update also fixes several bugs. Documentation for these changes will     be available shortly from the Technical Notes document linked to in the     References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues, and fix the bugs noted in the Technical     Notes. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the Linux kernel's KVM (kernel virtual machine). An administrative user in the guest OS could leverage this flaw to cause a denial of service in the host OS. (CVE-2012-2121)

Ben Hutchings reported a flaw in the Linux kernel with some network drivers that support TSO (TCP segment offload). A local or peer user could exploit this flaw to to cause a denial of service.
(CVE-2012-3412)

Jay Fenlason and Doug Ledford discovered a bug in the Linux kernel implementation of RDS sockets. A local unprivileged user could potentially use this flaw to read privileged information from the kernel. (CVE-2012-3430)

A flaw was discovered in the madvise feature of the Linux kernel's memory subsystem. An unprivileged local use could exploit the flaw to cause a denial of service (crash the system). (CVE-2012-3511)

A flaw was found in how the Linux kernel passed the replacement session keyring to a child process. An unprivileged local user could exploit this flaw to cause a denial of service (panic).
(CVE-2012-2745)

Ben Hutchings reported a flaw in the Linux kernel with some network drivers that support TSO (TCP segment offload). A local or peer user could exploit this flaw to to cause a denial of service.
(CVE-2012-3412)

Jay Fenlason and Doug Ledford discovered a bug in the Linux kernel implementation of RDS sockets. A local unprivileged user could potentially use this flaw to read privileged information from the kernel. (CVE-2012-3430)

A flaw was discovered in the madvise feature of the Linux kernel's memory subsystem. An unprivileged local use could exploit the flaw to cause a denial of service (crash the system). (CVE-2012-3511).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ben Hutchings reported a flaw in the Linux kernel with some network drivers that support TSO (TCP segment offload). A local or peer user could exploit this flaw to to cause a denial of service.
(CVE-2012-3412)

Jay Fenlason and Doug Ledford discovered a bug in the Linux kernel implementation of RDS sockets. A local unprivileged user could potentially use this flaw to read privileged information from the kernel. (CVE-2012-3430)

A flaw was discovered in the madvise feature of the Linux kernel's memory subsystem. An unprivileged local use could exploit the flaw to cause a denial of service (crash the system). (CVE-2012-3511).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface (which is not available to unprivileged users until granted by a root user) could exploit this flaw to crash the system or potential gain administrative privileges. (CVE-2012-2136)

Ulrich Obergfell discovered an error in the Linux kernel's memory management subsystem on 32 bit PAE systems with more than 4GB of memory installed. A local unprivileged user could exploit this flaw to crash the system. (CVE-2012-2373)

An error was discovered in the Linux kernel's memory subsystem (hugetlb). An unprivileged local user could exploit this flaw to cause a denial of service (crash the system). (CVE-2012-2390)

A flaw was discovered in the Linux kernel's epoll system call. An unprivileged local user could use this flaw to crash the system.
(CVE-2012-3375)

Some errors where discovered in the Linux kernel's UDF file system, which is used to mount some CD-ROMs and DVDs. An unprivileged local user could use these flaws to crash the system. (CVE-2012-3400)

A flaw was discovered in the madvise feature of the Linux kernel's memory subsystem. An unprivileged local use could exploit the flaw to cause a denial of service (crash the system). (CVE-2012-3511).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in the Linux kernel's macvtap device driver, which is used in KVM (Kernel-based Virtual Machine) to create a network bridge between host and guest. A privleged user in a guest could exploit this flaw to crash the host, if the vhost_net module is loaded with the experimental_zcopytx option enabled. (CVE-2012-2119)

An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface (which is not available to unprivileged users until granted by a root user) could exploit this flaw to crash the system or potential gain administrative privileges. (CVE-2012-2136)

A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem handled MSI (Message Signaled Interrupts). A local unprivileged user could exploit this flaw to cause a denial of service or potentially elevate privileges. (CVE-2012-2137)

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-2372)

Ulrich Obergfell discovered an error in the Linux kernel's memory management subsystem on 32 bit PAE systems with more than 4GB of memory installed. A local unprivileged user could exploit this flaw to crash the system. (CVE-2012-2373)

Dan Rosenberg discovered flaws in the Linux kernel's NCI (Near Field Communication Controller Interface). A remote attacker could exploit these flaws to crash the system or potentially execute privileged code. (CVE-2012-3364)

A flaw was discovered in the Linux kernel's epoll system call. An unprivileged local user could use this flaw to crash the system.
(CVE-2012-3375)

Some errors where discovered in the Linux kernel's UDF file system, which is used to mount some CD-ROMs and DVDs. An unprivileged local user could use these flaws to crash the system. (CVE-2012-3400)

A flaw was discovered in the madvise feature of the Linux kernel's memory subsystem. An unprivileged local use could exploit the flaw to cause a denial of service (crash the system). (CVE-2012-3511).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-1426.

ID	Name	Product	Family	Severity
181096	Oracle Linux 5 : ELSA-2013-1292-1: / kernel (ELSA-2013-12921) (deprecated)	Nessus	Oracle Linux Local Security Checks	medium
83611	SUSE SLES11 Security Update : kernel (SUSE-SU-2014:0287-1)	Nessus	SuSE Local Security Checks	high
76653	RHEL 6 : MRG (RHSA-2012:1491)	Nessus	Red Hat Local Security Checks	high
70188	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20130926)	Nessus	Scientific Linux Local Security Checks	medium
70187	Oracle Linux 5 : kernel (ELSA-2013-1292)	Nessus	Oracle Linux Local Security Checks	medium
70186	Oracle Linux 5 : kernel (ELSA-2013-1292-1)	Nessus	Oracle Linux Local Security Checks	medium
70179	CentOS 5 : kernel (CESA-2013:1292)	Nessus	CentOS Local Security Checks	medium
70163	RHEL 5 : kernel (RHSA-2013:1292)	Nessus	Red Hat Local Security Checks	medium
69632	Amazon Linux AMI : kernel (ALAS-2012-142)	Nessus	Amazon Linux Local Security Checks	high
68688	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2044)	Nessus	Oracle Linux Local Security Checks	high
68687	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2043)	Nessus	Oracle Linux Local Security Checks	high
68651	Oracle Linux 6 : kernel (ELSA-2012-1426)	Nessus	Oracle Linux Local Security Checks	high
62862	CentOS 6 : kernel (CESA-2012:1426)	Nessus	CentOS Local Security Checks	high
62858	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20121106)	Nessus	Scientific Linux Local Security Checks	high
62833	RHEL 6 : kernel (RHSA-2012:1426)	Nessus	Red Hat Local Security Checks	high
62238	USN-1577-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
62211	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1574-1)	Nessus	Ubuntu Local Security Checks	high
62200	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1573-1)	Nessus	Ubuntu Local Security Checks	high
62199	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1572-1)	Nessus	Ubuntu Local Security Checks	high
62111	Ubuntu 11.04 : linux vulnerabilities (USN-1567-1)	Nessus	Ubuntu Local Security Checks	high
61549	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1539-1)	Nessus	Ubuntu Local Security Checks	high
61511	Ubuntu 11.10 : linux vulnerabilities (USN-1533-1)	Nessus	Ubuntu Local Security Checks	high
61507	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1529-1)	Nessus	Ubuntu Local Security Checks	high
801529	CentOS RHSA-2012-1426 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-3511

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high