net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - net/ceph/auth_none.c in the Linux kernel through 3.10     allows remote attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via an auth_reply message     that triggers an attempted build_request     operation.(CVE-2013-1059)

  - The dispatch_discard_io function in     drivers/block/xen-blkback/blkback.c in the Xen blkback     implementation in the Linux kernel before 3.10.5 allows     guest OS users to cause a denial of service (data loss)     via filesystem write operations on a read-only disk     that supports the (1) BLKIF_OP_DISCARD (aka discard or     TRIM) or (2) SCSI UNMAP feature.(CVE-2013-2140)

  - The mmc_ioctl_cdrom_read_data function in     drivers/cdrom/cdrom.c in the Linux kernel through 3.10     allows local users to obtain sensitive information from     kernel memory via a read operation on a malfunctioning     CD-ROM drive.(CVE-2013-2164)

  - Multiple array index errors in drivers/hid/hid-core.c     in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate     attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted     device that provides an invalid Report     ID.(CVE-2013-2888)

  - drivers/hid/hid-zpff.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_ZEROPLUS is enabled, allows physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2889)

  - drivers/hid/hid-pl.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_PANTHERLORD is enabled, allows physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2892)

  - A flaw was found in the way the get_dumpable() function     return value was interpreted in the ptrace subsystem of     the Linux kernel. When 'fs.suid_dumpable' was set to 2,     a local, unprivileged local user could use this flaw to     bypass intended ptrace restrictions and obtain     potentially sensitive information.(CVE-2013-2929)

  - The perf_trace_event_perm function in     kernel/trace/trace_event_perf.c in the Linux kernel     before 3.12.2 does not properly restrict access to the     perf subsystem, which allows local users to enable     function tracing via a crafted     application.(CVE-2013-2930)

  - The fib6_add_rt2node function in net/ipv6/ip6_fib.c in     the IPv6 stack in the Linux kernel through 3.10.1 does     not properly handle Router Advertisement (RA) messages     in certain circumstances involving three routes that     initially qualified for membership in an ECMP route set     until a change occurred for one of the first two     routes, which allows remote attackers to cause a denial     of service (system crash) via a crafted sequence of     messages.(CVE-2013-4125)

  - Use-after-free vulnerability in the     vhost_net_set_backend function in drivers/vhost/net.c     in the Linux kernel through 3.10.3 allows local users     to cause a denial of service (OOPS and system crash)     via vectors involving powering on a virtual     machine.(CVE-2013-4127)

  - The udp_v6_push_pending_frames function in     net/ipv6/udp.c in the IPv6 implementation in the Linux     kernel through 3.10.3 makes an incorrect function call     for pending data, which allows local users to cause a     denial of service (BUG and system crash) via a crafted     application that uses the UDP_CORK option in a     setsockopt system call.(CVE-2013-4162)

  - The ip6_append_data_mtu function in     net/ipv6/ip6_output.c in the IPv6 implementation in the     Linux kernel through 3.10.3 does not properly maintain     information about whether the IPV6_MTU setsockopt     option had been specified, which allows local users to     cause a denial of service (BUG and system crash) via a     crafted application that uses the UDP_CORK option in a     setsockopt system call.(CVE-2013-4163)

  - Memory leak in the unshare_userns function in     kernel/user_namespace.c in the Linux kernel before     3.10.6 allows local users to cause a denial of service     (memory consumption) via an invalid CLONE_NEWUSER     unshare call.(CVE-2013-4205)

  - Off-by-one error in the build_unc_path_to_root function     in fs/cifs/connect.c in the Linux kernel before 3.9.6     allows remote attackers to cause a denial of service     (memory corruption and system crash) via a DFS share     mount operation that triggers use of an unexpected DFS     referral name length.(CVE-2013-4247)

  - The net_ctl_permissions function in net/sysctl_net.c in     the Linux kernel before 3.11.5 does not properly     determine uid and gid values, which allows local users     to bypass intended /proc/sys/net restrictions via a     crafted application.(CVE-2013-4270)

  - Interpretation conflict in     drivers/md/dm-snap-persistent.c in the Linux kernel     through 3.11.6 allows remote authenticated users to     obtain sensitive information or modify data via a     crafted mapping to a snapshot block     device.(CVE-2013-4299)

  - The scm_check_creds function in net/core/scm.c in the     Linux kernel before 3.11 performs a capability check in     an incorrect namespace, which allows local users to     gain privileges via PID spoofing.(CVE-2013-4300)

  - It was found that the Linux kernel did not properly     account file descriptors passed over the unix socket     against the process limit. A local user could use this     flaw to exhaust all available memory on the     system.(CVE-2013-4312)

  - Use-after-free vulnerability in drivers/net/tun.c in     the Linux kernel through 3.11.1 allows local users to     gain privileges by leveraging the CAP_NET_ADMIN     capability and providing an invalid tuntap interface     name in a TUNSETIFF ioctl call.(CVE-2013-4343)

  - Off-by-one error in the get_prng_bytes function in     crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to     defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper     management of the state of the consumed     data.(CVE-2013-4345)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.

The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.

The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.

The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.

The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.

net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.

net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.

The SUSE Linux Enterprise 11 Service Pack 2 kernel has been updated to version 3.0.93 and includes various bug and security fixes.

The following security bugs have been fixed :

  - The fill_event_metadata function in     fs/notify/fanotify/fanotify_user.c in the Linux kernel     did not initialize a certain structure member, which     allowed local users to obtain sensitive information from     kernel memory via a read operation on the fanotify     descriptor. (CVE-2013-2148)

  - The key_notify_policy_flush function in net/key/af_key.c     in the Linux kernel did not initialize a certain     structure member, which allowed local users to obtain     sensitive information from kernel heap memory by reading     a broadcast message from the notify_policy interface of     an IPSec key_socket. (CVE-2013-2237)

  - The ip6_sk_dst_check function in net/ipv6/ip6_output.c     in the Linux kernel allowed local users to cause a     denial of service (system crash) by using an AF_INET6     socket for a connection to an IPv4 interface.
    (CVE-2013-2232)

  - The (1) key_notify_sa_flush and (2)     key_notify_policy_flush functions in net/key/af_key.c in     the Linux kernel did not initialize certain structure     members, which allowed local users to obtain sensitive     information from kernel heap memory by reading a     broadcast message from the notify interface of an IPSec     key_socket. (CVE-2013-2234)

  - The udp_v6_push_pending_frames function in     net/ipv6/udp.c in the IPv6 implementation in the Linux     kernel made an incorrect function call for pending data,     which allowed local users to cause a denial of service     (BUG and system crash) via a crafted application that     uses the UDP_CORK option in a setsockopt system call.
    (CVE-2013-4162)

  - net/ceph/auth_none.c in the Linux kernel allowed remote     attackers to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via an auth_reply message that     triggers an attempted build_request operation.
    (CVE-2013-1059)

  - The mmc_ioctl_cdrom_read_data function in     drivers/cdrom/cdrom.c in the Linux kernel allowed local     users to obtain sensitive information from kernel memory     via a read operation on a malfunctioning CD-ROM drive.
    (CVE-2013-2164)

  - Format string vulnerability in the register_disk     function in block/genhd.c in the Linux kernel allowed     local users to gain privileges by leveraging root access     and writing format string specifiers to     /sys/module/md_mod/parameters/new_array in order to     create a crafted /dev/md device name. (CVE-2013-2851)

  - The ip6_append_data_mtu function in     net/ipv6/ip6_output.c in the IPv6 implementation in the     Linux kernel did not properly maintain information about     whether the IPV6_MTU setsockopt option had been     specified, which allowed local users to cause a denial     of service (BUG and system crash) via a crafted     application that uses the UDP_CORK option in a     setsockopt system call. (CVE-2013-4163)

  - Heap-based buffer overflow in the tg3_read_vpd function     in drivers/net/ethernet/broadcom/tg3.c in the Linux     kernel allowed physically proximate attackers to cause a     denial of service (system crash) or possibly execute     arbitrary code via crafted firmware that specifies a     long string in the Vital Product Data (VPD) data     structure. (CVE-2013-1929)

  - The _xfs_buf_find function in fs/xfs/xfs_buf.c in the     Linux kernel did not validate block numbers, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by leveraging the ability to     mount an XFS filesystem containing a metadata inode with     an invalid extent map. (CVE-2013-1819)

  - The chase_port function in drivers/usb/serial/io_ti.c in     the Linux kernel allowed local users to cause a denial     of service (NULL pointer dereference and system crash)     via an attempted /dev/ttyUSB read or write operation on     a disconnected Edgeport USB serial converter.
    (CVE-2013-1774)

Also the following bugs have been fixed :

BTRFS :

  - btrfs: merge contiguous regions when loading free space     cache

  - btrfs: fix how we deal with the orphan block rsv

  - btrfs: fix wrong check during log recovery

  - btrfs: change how we indicate we are adding csums

  - btrfs: flush delayed inodes if we are short on space.
    (bnc#801427)

  - btrfs: rework shrink_delalloc. (bnc#801427)

  - btrfs: fix our overcommit math. (bnc#801427)

  - btrfs: delay block group item insertion. (bnc#801427)

  - btrfs: remove bytes argument from do_chunk_alloc.
    (bnc#801427)

  - btrfs: run delayed refs first when out of space.
    (bnc#801427)

  - btrfs: do not commit instead of overcommitting.
    (bnc#801427)

  - btrfs: do not take inode delalloc mutex if we are a free     space inode. (bnc#801427)

  - btrfs: fix chunk allocation error handling. (bnc#801427)

  - btrfs: remove extent mapping if we fail to add chunk.
    (bnc#801427)

  - btrfs: do not overcommit if we do not have enough space     for global rsv. (bnc#801427)

  - btrfs: rework the overcommit logic to be based on the     total size. (bnc#801427)

  - btrfs: steal from global reserve if we are cleaning up     orphans. (bnc#801427)

  - btrfs: clear chunk_alloc flag on retryable failure.
    (bnc#801427)

  - btrfs: use reserved space for creating a snapshot.
    (bnc#801427)

  - btrfs: cleanup to make the function     btrfs_delalloc_reserve_metadata more logic. (bnc#801427)

  - btrfs: fix space leak when we fail to reserve metadata     space. (bnc#801427)

  - btrfs: fix space accounting for unlink and rename.
    (bnc#801427)

  - btrfs: allocate new chunks if the space is not enough     for global rsv. (bnc#801427)

  - btrfs: various abort cleanups. (bnc#812526 / bnc#801427)

  - btrfs: simplify unlink reservations (bnc#801427). OTHER :

  - x86: Add workaround to NMI iret woes. (bnc#831949)

  - x86: Do not schedule while still in NMI context.
    (bnc#831949)

  - bnx2x: Avoid sending multiple statistics queries.
    (bnc#814336)

  - bnx2x: protect different statistics flows. (bnc#814336)

  - futex: Take hugepages into account when generating     futex_key.

  - drivers/hv: util: Fix a bug in version negotiation code     for util services. (bnc#828714)

  - printk: Add NMI ringbuffer. (bnc#831949)

  - printk: extract ringbuffer handling from vprintk.
    (bnc#831949)

  - printk: NMI safe printk. (bnc#831949)

  - printk: Make NMI ringbuffer size independent on     log_buf_len. (bnc#831949)

  - printk: Do not call console_unlock from nmi context.
    (bnc#831949)

  - printk: Do not use printk_cpu from finish_printk.
    (bnc#831949)

  - mlx4_en: Adding 40gb speed report for ethtool.
    (bnc#831410)

  - reiserfs: Fixed double unlock in reiserfs_setattr     failure path.

  - reiserfs: delay reiserfs lock until journal     initialization. (bnc#815320)

  - reiserfs: do not lock journal_init(). (bnc#815320)

  - reiserfs: locking, handle nested locks properly.
    (bnc#815320)

  - reiserfs: locking, push write lock out of xattr code.
    (bnc#815320)

  - reiserfs: locking, release lock around quota operations.
    (bnc#815320)

  - NFS: support 'nosharetransport' option (bnc#807502,     bnc#828192, FATE#315593).

  - dm mpath: add retain_attached_hw_handler feature.
    (bnc#760407)

  - scsi_dh: add scsi_dh_attached_handler_name. (bnc#760407)

  - bonding: disallow change of MAC if fail_over_mac     enabled. (bnc#827376)

  - bonding: propagate unicast lists down to slaves.
    (bnc#773255 / bnc#827372)

  - bonding: emit address change event also in bond_release.
    (bnc#773255 / bnc#827372)

  - bonding: emit event when bonding changes MAC.
    (bnc#773255 / bnc#827372)

  - SUNRPC: Ensure we release the socket write lock if the     rpc_task exits early. (bnc#830901)

  - ext4: force read-only unless rw=1 module option is used     (fate#314864).

  - HID: fix unused rsize usage. (bnc#783475)

  - HID: fix data access in implement(). (bnc#783475)

  - xfs: fix deadlock in xfs_rtfree_extent with kernel v3.x.
    (bnc#829622)

  - r8169: allow multicast packets on sub-8168f chipset.
    (bnc#805371)

  - r8169: support new chips of RTL8111F. (bnc#805371)

  - r8169: define the early size for 8111evl. (bnc#805371)

  - r8169: fix the reset setting for 8111evl. (bnc#805371)

  - r8169: add MODULE_FIRMWARE for the firmware of 8111evl.
    (bnc#805371)

  - r8169: fix sticky accepts packet bits in RxConfig.
    (bnc#805371)

  - r8169: adjust the RxConfig settings. (bnc#805371)

  - r8169: support RTL8111E-VL. (bnc#805371)

  - r8169: add ERI functions. (bnc#805371)

  - r8169: modify the flow of the hw reset. (bnc#805371)

  - r8169: adjust some registers. (bnc#805371)

  - r8169: check firmware content sooner. (bnc#805371)

  - r8169: support new firmware format. (bnc#805371)

  - r8169: explicit firmware format check. (bnc#805371)

  - r8169: move the firmware down into the device private     data. (bnc#805371)

  - mm: link_mem_sections make sure nmi watchdog does not     trigger while linking memory sections. (bnc#820434)

  - kernel: lost IPIs on CPU hotplug (bnc#825048,     LTC#94784).

  - iwlwifi: use correct supported firmware for 6035 and     6000g2. (bnc#825887)

  - watchdog: Update watchdog_thresh atomically.
    (bnc#829357)

  - watchdog: update watchdog_tresh properly. (bnc#829357)

  - watchdog:
    watchdog-make-disable-enable-hotplug-and-preempt-save.pa     tch. (bnc#829357)

  - include/1/smp.h: define __smp_call_function_single for     !CONFIG_SMP. (bnc#829357)

  - lpfc: Return correct error code on bsg_timeout.
    (bnc#816043)

  - dm-multipath: Drop table when retrying ioctl.
    (bnc#808940)

  - scsi: Do not retry invalid function error. (bnc#809122)

  - scsi: Always retry internal target error. (bnc#745640,     bnc#825227)

  - ibmvfc: Driver version 1.0.1. (bnc#825142)

  - ibmvfc: Fix for offlining devices during error recovery.
    (bnc#825142)

  - ibmvfc: Properly set cancel flags when cancelling abort.
    (bnc#825142)

  - ibmvfc: Send cancel when link is down. (bnc#825142)

  - ibmvfc: Support FAST_IO_FAIL in EH handlers.
    (bnc#825142)

  - ibmvfc: Suppress ABTS if target gone. (bnc#825142)

  - fs/dcache.c: add cond_resched() to     shrink_dcache_parent(). (bnc#829082)

  - kmsg_dump: do not run on non-error paths by default.
    (bnc#820172)

  - mm: honor min_free_kbytes set by user. (bnc#826960)

  - hyperv: Fix a kernel warning from     netvsc_linkstatus_callback(). (bnc#828574)

  - RT: Fix up hardening patch to not gripe when avg >     available, which lockless access makes possible and     happens in -rt kernels running a cpubound ltp realtime     testcase. Just keep the output sane in that case.

  - md/raid10: Fix two bug affecting RAID10 reshape (-).

  - Allow NFSv4 to run execute-only files. (bnc#765523)

  - fs/ocfs2/namei.c: remove unnecessary ERROR when removing     non-empty directory. (bnc#819363)

  - block: Reserve only one queue tag for sync IO if only 3     tags are available. (bnc#806396)

  - drm/i915: Add wait_for in init_ring_common. (bnc#813604)

  - drm/i915: Mark the ringbuffers as being in the GTT     domain. (bnc#813604)

  - ext4: avoid hang when mounting non-journal filesystems     with orphan list. (bnc#817377)

  - autofs4 - fix get_next_positive_subdir(). (bnc#819523)

  - ocfs2: Add bits_wanted while calculating credits in     ocfs2_calc_extend_credits. (bnc#822077)

  - re-enable io tracing. (bnc#785901)

  - SUNRPC: Prevent an rpc_task wakeup race. (bnc#825591)

  - tg3: Prevent system hang during repeated EEH errors.
    (bnc#822066)

  - backends: Check for insane amounts of requests on the     ring.

  - Update Xen patches to 3.0.82.

  - netiucv: Hold rtnl between name allocation and device     registration. (bnc#824159)

  - drm/edid: Do not print messages regarding stereo or     csync by default. (bnc#821235)

  - net/sunrpc: xpt_auth_cache should be ignored when     expired. (bnc#803320)

  - sunrpc/cache: ensure items removed from cache do not     have pending upcalls. (bnc#803320)

  - sunrpc/cache: remove races with queuing an upcall.
    (bnc#803320)

  - sunrpc/cache: use cache_fresh_unlocked consistently and     correctly. (bnc#803320)

  - md/raid10 'enough' fixes. (bnc#773837)

  - Update config files: disable IP_PNP. (bnc#822825)

  - Disable efi pstore by default. (bnc#804482 / bnc#820172)

  - md: Fix problem with GET_BITMAP_FILE returning wrong     status. (bnc#812974 / bnc#823497)

  - USB: xHCI: override bogus bulk wMaxPacketSize values.
    (bnc#823082)

  - ALSA: hda - Fix system panic when DMA > 40 bits for     Nvidia audio controllers. (bnc#818465)

  - USB: UHCI: fix for suspend of virtual HP controller.
    (bnc#817035)

  - mm: mmu_notifier: re-fix freed page still mapped in     secondary MMU. (bnc#821052)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2546 advisory.

  - The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows     local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning     CD-ROM drive. (CVE-2013-2164)

  - The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux     kernel before 3.10 do not initialize certain structure members, which allows local users to obtain     sensitive information from kernel heap memory by reading a broadcast message from the notify interface of     an IPSec key_socket. (CVE-2013-2234)

  - The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not     initialize a certain structure member, which allows local users to obtain sensitive information from     kernel heap memory via a crafted application. (CVE-2012-6549)

  - The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove     a prefix string from a syslog header, which allows local users to cause a denial of service (buffer     overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers     function call. (CVE-2013-1772)

  - The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation     in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via     filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or     TRIM) or (2) SCSI UNMAP feature. (CVE-2013-2140)

  - The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which     allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or     recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg     function in crypto/algif_skcipher.c. (CVE-2013-3076)

  - The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel     through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had     been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted     application that uses the UDP_CORK option in a setsockopt system call. (CVE-2013-4163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chanam Park reported a NULL pointer flaw in the Linux kernel's Ceph client. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2013-1059)

Vasily Kulikov discovered a flaw in the Linux Kernel's perf tool that allows for privilege escalation. A local user could exploit this flaw to run commands as root when using the perf tool. (CVE-2013-1060)

Jonathan Salwan discovered an information leak in the Linux kernel's cdrom driver. A local user can exploit this leak to obtain sensitive information from kernel memory if the CD-ROM drive is malfunctioning.
(CVE-2013-2164)

A flaw was discovered in the Linux kernel when an IPv6 socket is used to connect to an IPv4 destination. An unprivileged local user could exploit this flaw to cause a denial of service (system crash).
(CVE-2013-2232)

An information leak was discovered in the IPSec key_socket implementation in the Linux kernel. An local user could exploit this flaw to examine potentially sensitive information in kernel memory.
(CVE-2013-2234)

Kees Cook discovered a format string vulnerability in the Linux kernel's disk block layer. A local user with administrator privileges could exploit this flaw to gain kernel privileges. (CVE-2013-2851)

Hannes Frederic Sowa discovered a flaw in setsockopt UDP_CORK option in the Linux kernel's IPv6 stack. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2013-4162)

Hannes Frederic Sowa discovered a flaw in the IPv6 subsystem of the Linux kernel when the IPV6_MTU setsockopt option has been specified in combination with the UDP_CORK option. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2013-4163).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2543 advisory.

    - block: do not pass disk names as format strings (Kees Cook) [Orabug: 17230083] {CVE-2013-2851}
    - libceph: Fix NULL pointer dereference in auth client code (Tyler Hicks) [Orabug: 17230108]     {CVE-2013-1059}
    - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17371078] {CVE-2013-2232}
    - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370788]     {CVE-2013-2237}
    - Bluetooth: HCI - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17370892] {CVE-2012-6544}
    - Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17371050] {CVE-2012-6544}
    - Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias Krause) [Orabug: 17371065]     {CVE-2012-6544}
    - sctp: Use correct sideffect command in duplicate cookie handling (Vlad Yasevich) [Orabug: 17371118]     {CVE-2013-2206}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-1059     Chanam Park reported an issue in the Ceph distributed     storage system. Remote users can cause a denial of     service by sending a specially crafted auth_reply     message.

  - CVE-2013-2148     Dan Carpenter reported an information leak in the     filesystem wide access notification subsystem     (fanotify). Local users could gain access to sensitive     kernel memory.

  - CVE-2013-2164     Jonathan Salwan reported an information leak in the     CD-ROM driver. A local user on a system with a     malfunctioning CD-ROM drive could gain access to     sensitive memory.

  - CVE-2013-2232     Dave Jones and Hannes Frederic Sowa resolved an issue in     the IPv6 subsystem. Local users could cause a denial of     service by using an AF_INET6 socket to connect to an     IPv4 destination.

  - CVE-2013-2234     Mathias Krause reported a memory leak in the     implementation of PF_KEYv2 sockets. Local users could     gain access to sensitive kernel memory.

  - CVE-2013-2237     Nicolas Dichtel reported a memory leak in the     implementation of PF_KEYv2 sockets. Local users could     gain access to sensitive kernel memory.

  - CVE-2013-2851     Kees Cook reported an issue in the block subsystem.
    Local users with uid 0 could gain elevated ring 0     privileges. This is only a security issue for certain     specially configured systems.

  - CVE-2013-2852     Kees Cook reported an issue in the b43 network driver     for certain Broadcom wireless devices. Local users with     uid 0 could gain elevated ring 0 privileges. This is     only a security issue for certain specially configured     systems.

  - CVE-2013-4162     Hannes Frederic Sowa reported an issue in the IPv6     networking subsystem. Local users can cause a denial of     service (system crash).

  - CVE-2013-4163     Dave Jones reported an issue in the IPv6 networking     subsystem. Local users can cause a denial of service     (system crash).

This update also includes a fix for a regression in the Xen subsystem.

Chanam Park reported a NULL pointer flaw in the Linux kernel's Ceph client. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2013-1059)

An information leak was discovered in the Linux kernel's fanotify interface. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2148)

Jonathan Salwan discovered an information leak in the Linux kernel's cdrom driver. A local user can exploit this leak to obtain sensitive information from kernel memory if the CD-ROM drive is malfunctioning.
(CVE-2013-2164)

Kees Cook discovered a format string vulnerability in the Linux kernel's disk block layer. A local user with administrator privileges could exploit this flaw to gain kernel privileges. (CVE-2013-2851)

Hannes Frederic Sowa discovered that the Linux kernel's IPv6 stack does not correctly handle Router Advertisement (RA) message in some cases. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2013-4125)

A vulnerability was discovered in the Linux kernel's vhost net driver.
A local user could cause a denial of service (system crash) by powering on a virtual machine. (CVE-2013-4127)

Marcus Moeller and Ken Fallon discovered that the CIFS incorrectly built certain paths. A local attacker with access to a CIFS partition could exploit this to crash the system, leading to a denial of service. (CVE-2013-4247).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chanam Park reported a NULL pointer flaw in the Linux kernel's Ceph client. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2013-1059)

An information leak was discovered in the Linux kernel's fanotify interface. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2148)

Jonathan Salwan discovered an information leak in the Linux kernel's cdrom driver. A local user can exploit this leak to obtain sensitive information from kernel memory if the CD-ROM drive is malfunctioning.
(CVE-2013-2164)

Kees Cook discovered a format string vulnerability in the Linux kernel's disk block layer. A local user with administrator privileges could exploit this flaw to gain kernel privileges. (CVE-2013-2851)

Hannes Frederic Sowa discovered that the Linux kernel's IPv6 stack does not correctly handle Router Advertisement (RA) message in some cases. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2013-4125)

A vulnerability was discovered in the Linux kernel's vhost net driver.
A local user could cause a denial of service (system crash) by powering on a virtual machine. (CVE-2013-4127).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chanam Park reported a NULL pointer flaw in the Linux kernel's Ceph client. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2013-1059)

An information leak was discovered in the Linux kernel's fanotify interface. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2148)

Jonathan Salwan discovered an information leak in the Linux kernel's cdrom driver. A local user can exploit this leak to obtain sensitive information from kernel memory if the CD-ROM drive is malfunctioning.
(CVE-2013-2164)

Kees Cook discovered a format string vulnerability in the Linux kernel's disk block layer. A local user with administrator privileges could exploit this flaw to gain kernel privileges. (CVE-2013-2851).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest stable upstream release, Linux v3.9.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest upstream stable release, Linux v3.9.9. This also includes fixes for issues running VM guests some people were seeing.
Update to latest stable upstream release, Linux v3.9.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream stable release 3.9.9 contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.
(CVE-2013-1059)

The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.
(CVE-2013-2147)

The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a read operation on the fanotify descriptor. (CVE-2013-2148)

Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name. (CVE-2013-2851)

The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive. (CVE-2013-2164)

The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket. (CVE-2013-2237)

The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.
(CVE-2013-2234)

The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface. (CVE-2013-2232)

The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator. (CVE-2012-5517)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call. (CVE-2013-3301)

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages.
NOTE: some of these details are obtained from third-party information.
(CVE-2013-0231)

The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter. (CVE-2013-1774)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet.
(CVE-2013-2850)

The updated packages provides a solution for these security issues.

ID	Name	Product	Family	Severity
124797	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1473)	Nessus	Huawei Local Security Checks	medium
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
74878	openSUSE Security Update : kernel (openSUSE-SU-2013:1971-1)	Nessus	SuSE Local Security Checks	high
70222	Amazon Linux AMI : kernel (ALAS-2013-218)	Nessus	Amazon Linux Local Security Checks	medium
70040	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 8269 / 8270 / 8283)	Nessus	SuSE Local Security Checks	high
70039	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 8263 / 8265 / 8273)	Nessus	SuSE Local Security Checks	high
69942	Oracle Linux 5 / 6 : Unbreakable Enterprise Kernel (ELSA-2013-2546)	Nessus	Oracle Linux Local Security Checks	high
69809	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1941-1)	Nessus	Ubuntu Local Security Checks	high
69510	Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2013-2543)	Nessus	Oracle Linux Local Security Checks	medium
69505	Debian DSA-2745-1 : linux - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	high
69419	Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-1936-1)	Nessus	Ubuntu Local Security Checks	high
69418	Ubuntu 13.04 : linux vulnerabilities (USN-1935-1)	Nessus	Ubuntu Local Security Checks	high
69417	Ubuntu 12.10 : linux vulnerabilities (USN-1932-1)	Nessus	Ubuntu Local Security Checks	high
69416	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-1931-1)	Nessus	Ubuntu Local Security Checks	high
68974	Fedora 17 : kernel-3.9.10-100.fc17 (2013-12990)	Nessus	Fedora Local Security Checks	high
67343	Fedora 18 : kernel-3.9.9-201.fc18 (2013-12530)	Nessus	Fedora Local Security Checks	high
67342	Fedora 19 : kernel-3.9.9-301.fc19 (2013-12339)	Nessus	Fedora Local Security Checks	high
67254	Mandriva Linux Security Advisory : kernel (MDVSA-2013:194)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2013-1059

medium

Tenable Plugins

medium

critical

high

medium

high

high

high

high

medium

high

high

high

high

high

high

high

high

high