The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350i1/4%0

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel allows local users to cause a denial of service     (stack-based buffer overflow) or possibly have     unspecified other impacts via a large command size in     an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds     write access in the sg_write function.(CVE-2017-7187i1/4%0

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection     fault).(CVE-2019-3701i1/4%0

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-8890i1/4%0

  - The overlayfs implementation in the linux (aka Linux     kernel) package before 3.19.0-21.21 in Ubuntu through     15.04 does not properly check permissions for file     creation in the upper filesystem directory, which     allows local users to obtain root access by leveraging     a configuration in which overlayfs is permitted in an     arbitrary mount namespace.(CVE-2015-1328i1/4%0

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.16.3 allows local users to cause a denial of     service (xfs_ilock_attr_map_shared invalid pointer     dereference) via a crafted xfs image.(CVE-2018-10322i1/4%0

  - In the flush_tmregs_to_thread function in     arch/powerpc/kernel/ptrace.c in the Linux kernel before     4.13.5, a guest kernel crash can be triggered from     unprivileged userspace during a core dump on a POWER     host due to a missing processor feature check and an     erroneous use of transactional memory (TM) instructions     in the core dump path, leading to a denial of     service.(CVE-2018-1091i1/4%0

  - ** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in     the Linux kernel before 4.16 allows local users to     cause a denial of service (ata qc leak) by triggering     certain failure conditions. NOTE: a third party     disputes the relevance of this report because the     failure can only occur for physically proximate     attackers who unplug SAS Host Bus Adapter     cables.(CVE-2018-10021i1/4%0

  - A use-after-free flaw was discovered in the Linux     kernel's tty subsystem, which allows for the disclosure     of uncontrolled memory location and possible kernel     panic. The information leak is caused by a race     condition when attempting to set and read the tty line     discipline. A local attacker could use the TIOCSETD     (via tty_set_ldisc ) to switch to a new line discipline     a concurrent call to a TIOCGETD ioctl performing a read     on a given tty could then access previously allocated     memory. Up to 4 bytes could be leaked when querying the     line discipline or the kernel could panic with a     NULL-pointer dereference.(CVE-2016-0723i1/4%0

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182i1/4%0

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584i1/4%0

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the     system.(CVE-2015-5157i1/4%0

  - drivers/media/media-device.c in the Linux kernel before     3.11, as used in Android before 2016-08-05 on Nexus 5     and 7 (2013) devices, does not properly initialize     certain data structures, which allows local users to     obtain sensitive information via a crafted application,     aka Android internal bug 28750150 and Qualcomm internal     bug CR570757, a different vulnerability than     CVE-2014-1739.(CVE-2014-9895i1/4%0

  - A use-after-free vulnerability in sys_ioprio_get() was     found due to get_task_ioprio() accessing the     task-i1/4zio_context without holding the task lock and     could potentially race with exit_io_context(), leading     to a use-after-free.(CVE-2016-7911i1/4%0

  - A flaw was found in the Linux kernel which is related     to the user namespace lazily unmounting file systems.
    The fs_pin struct has two members (m_list and s_list)     which are usually initialized on use in the     pin_insert_group function. However, these members might     go unmodified in this case, the system panics when it     attempts to destroy or free them. This flaw could be     used to launch a denial-of-service     attack.(CVE-2015-4178i1/4%0

  - A flaw was found in the Linux kernel's implementation     of raw_sendmsg allowing a local attacker to panic the     kernel or possibly leak kernel addresses. A local     attacker, with the privilege of creating raw sockets,     can abuse a possible race condition when setting the     socket option to allow the kernel to automatically     create ip header values and thus potentially escalate     their privileges.(CVE-2017-17712i1/4%0

  - A flaw was discovered in the F2FS filesystem code in     fs/f2fs/super.c in the Linux kernel. A denial of     service, due to an out-of-bounds memory access, can     occur upon encountering an abnormal bitmap size when     mounting a crafted f2fs image.(CVE-2018-13096i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's madvise MADV_WILLNEED functionality     handled page table locking. A local, unprivileged user     could use this flaw to crash the     system.(CVE-2014-8173i1/4%0

  - An out-of-bounds heap memory access leading to a Denial     of Service, heap disclosure, or further impact was     found in setsockopt(). The function call is normally     restricted to root, however some processes with     cap_sys_admin may also be able to trigger this flaw in     privileged container environments.(CVE-2016-4998i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The skb_flow_dissect function in     net/core/flow_dissector.c in the Linux kernel through     3.12 allows remote attackers to cause a denial of     service (infinite loop) via a small value in the IHL     field of a packet with IPIP     encapsulation.(CVE-2013-4348)

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350)

  - net/ipv6/ip6_output.c in the Linux kernel through     3.11.4 does not properly determine the need for UDP     Fragmentation Offload (UFO) processing of small packets     after the UFO queueing of a large packet, which allows     remote attackers to cause a denial of service (memory     corruption and system crash) or possibly have     unspecified other impact via network traffic that     triggers a large response packet.(CVE-2013-4387)

  - The Linux kernel before 3.12, when UDP Fragmentation     Offload (UFO) is enabled, does not properly initialize     certain data structures, which allows local users to     cause a denial of service (memory corruption and system     crash) or possibly gain privileges via a crafted     application that uses the UDP_CORK option in a     setsockopt system call and sends both short and long     packets, related to the ip_ufo_append_data function in     net/ipv4/ip_output.c and the ip6_ufo_append_data     function in net/ipv6/ip6_output.c.(CVE-2013-4470)

  - Multiple integer overflows in Alchemy LCD frame-buffer     drivers in the Linux kernel before 3.12 allow local     users to create a read-write memory mapping for the     entirety of kernel memory, and consequently gain     privileges, via crafted mmap operations, related to the     (1) au1100fb_fb_mmap function in     drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap     function in drivers/video/au1200fb.c.(CVE-2013-4511)

  - The udp6_ufo_fragment function in     net/ipv6/udp_offload.c in the Linux kernel through     3.12, when UDP Fragmentation Offload (UFO) is enabled,     does not properly perform a certain size comparison     before inserting a fragment header, which allows remote     attackers to cause a denial of service (panic) via a     large IPv6 UDP packet, as demonstrated by use of the     Token Bucket Filter (TBF) queueing     discipline.(CVE-2013-4563)

  - The ath9k_htc_set_bssid_mask function in     drivers/net/wireless/ath/ath9k/htc_drv_main.c in the     Linux kernel through 3.12 uses a BSSID masking approach     to determine the set of MAC addresses on which a Wi-Fi     device is listening, which allows remote attackers to     discover the original MAC address after spoofing by     sending a series of packets to MAC addresses with     certain bit manipulations.(CVE-2013-4579)

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value.(CVE-2013-4587)

  - The apic_get_tmcct function in arch/x86/kvm/lapic.c in     the KVM subsystem in the Linux kernel through 3.12.5     allows guest OS users to cause a denial of service     (divide-by-zero error and host OS crash) via crafted     modifications of the TMICT value.(CVE-2013-6367)

  - The KVM subsystem in the Linux kernel through 3.12.5     allows local users to gain privileges or cause a denial     of service (system crash) via a VAPIC synchronization     operation involving a page-end address.(CVE-2013-6368)

  - The recalculate_apic_map function in     arch/x86/kvm/lapic.c in the KVM subsystem in the Linux     kernel through 3.12.5 allows guest OS users to cause a     denial of service (host OS crash) via a crafted ICR     write operation in x2apic mode.(CVE-2013-6376)

  - The lbs_debugfs_write function in     drivers/net/wireless/libertas/debugfs.c in the Linux     kernel through 3.12.1 allows local users to cause a     denial of service (OOPS) by leveraging root privileges     for a zero-length write operation.(CVE-2013-6378)

  - The aac_send_raw_srb function in     drivers/scsi/aacraid/commctrl.c in the Linux kernel     through 3.12.1 does not properly validate a certain     size value, which allows local users to cause a denial     of service (invalid pointer dereference) or possibly     have unspecified other impact via an     FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted     SRB command.(CVE-2013-6380)

  - Multiple buffer underflows in the XFS implementation in     the Linux kernel through 3.12.1 allow local users to     cause a denial of service (memory corruption) or     possibly have unspecified other impact by leveraging     the CAP_SYS_ADMIN capability for a (1)     XFS_IOC_ATTRLIST_BY_HANDLE or (2)     XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted     length value, related to the xfs_attrlist_by_handle     function in fs/xfs/xfs_ioctl.c and the     xfs_compat_attrlist_by_handle function in     fs/xfs/xfs_ioctl32.c.(CVE-2013-6382)

  - The aac_compat_ioctl function in     drivers/scsi/aacraid/linit.c in the Linux kernel before     3.11.8 does not require the CAP_SYS_RAWIO capability,     which allows local users to bypass intended access     restrictions via a crafted ioctl call.(CVE-2013-6383)

  - The fib6_add function in net/ipv6/ip6_fib.c in the     Linux kernel before 3.11.5 does not properly implement     error-code encoding, which allows local users to cause     a denial of service (NULL pointer dereference and     system crash) by leveraging the CAP_NET_ADMIN     capability for an IPv6 SIOCADDRT ioctl     call.(CVE-2013-6431)

  - The uio_mmap_physical function in drivers/uio/uio.c in     the Linux kernel before 3.12 does not validate the size     of a memory block, which allows local users to cause a     denial of service (memory corruption) or possibly gain     privileges via crafted mmap operations, a different     vulnerability than CVE-2013-4511.(CVE-2013-6763)

  - Multiple race conditions in ipc/shm.c in the Linux     kernel before 3.12.2 allow local users to cause a     denial of service (use-after-free and system crash) or     possibly have unspecified other impact via a crafted     application that uses shmctl IPC_RMID operations in     conjunction with other shm system calls.(CVE-2013-7026)

  - The ieee80211_radiotap_iterator_init function in     net/wireless/radiotap.c in the Linux kernel before     3.11.7 does not check whether a frame contains any data     outside of the header, which might allow attackers to     cause a denial of service (buffer over-read) via a     crafted header.(CVE-2013-7027)

  - The Linux kernel before 3.12.4 updates certain length     values before ensuring that associated data structures     have been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call, related to net/ipv4/ping.c, net/ipv4/raw.c,     net/ipv4/udp.c, net/ipv6/raw.c, and     net/ipv6/udp.c.(CVE-2013-7263)

  - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in     the Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7264)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1490 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the way IP packets with an Internet Header Length     (ihl) of zero were processed in the skb_flow_dissect() function in the     Linux kernel. A remote attacker could use this flaw to trigger an infinite     loop in the kernel, leading to a denial of service. (CVE-2013-4348,     Important)

    * A flaw was found in the way the Linux kernel's IPv6 implementation     handled certain UDP packets when the UDP Fragmentation Offload (UFO)     feature was enabled. A remote attacker could use this flaw to crash the     system or, potentially, escalate their privileges on the system.
    (CVE-2013-4387, Important)

    * A flaw was found in the way the Linux kernel handled the creation of     temporary IPv6 addresses. If the IPv6 privacy extension was enabled     (/proc/sys/net/ipv6/conf/eth0/use_tempaddr set to '2'), an attacker on     the local network could disable IPv6 temporary address generation, leading     to a potential information disclosure. (CVE-2013-0343, Moderate)

    * A flaw was found in the way the Linux kernel handled HID (Human Interface     Device) reports with an out-of-bounds Report ID. An attacker with physical     access to the system could use this flaw to crash the system or,     potentially, escalate their privileges on the system. (CVE-2013-2888,     Moderate)

    * Heap-based buffer overflow flaws were found in the way the     Pantherlord/GreenAsia game controller driver, the Logitech force feedback     drivers, and the Logitech Unifying receivers driver handled HID reports.
    An attacker with physical access to the system could use these flaws to     crash the system or, potentially, escalate their privileges on the system.
    (CVE-2013-2892, CVE-2013-2893, CVE-2013-2895, Moderate)

    * A NULL pointer dereference flaw was found in the way the N-Trig touch     screen driver handled HID reports. An attacker with physical access to the     system could use this flaw to crash the system, resulting in a denial of     service. (CVE-2013-2896, Moderate)

    * An information leak flaw was found in the way the Linux kernel's device     mapper subsystem, under certain conditions, interpreted data written to     snapshot block devices. An attacker could use this flaw to read data from     disk blocks in free space, which are normally inaccessible. (CVE-2013-4299,     Moderate)

    * A use-after-free flaw was found in the tun_set_iff() function in the     Universal TUN/TAP device driver implementation in the Linux kernel.
    A privileged user could use this flaw to crash the system or, potentially,     further escalate their privileges on the system. (CVE-2013-4343, Moderate)

    * An off-by-one flaw was found in the way the ANSI CPRNG implementation in     the Linux kernel processed non-block size aligned requests. This could lead     to random numbers being generated with less bits of entropy than expected     when ANSI CPRNG was used. (CVE-2013-4345, Moderate)

    * A flaw was found in the way the Linux kernel's IPv6 SCTP implementation     interacted with the IPsec subsystem. This resulted in unencrypted SCTP     packets being sent over the network even though IPsec encryption was     enabled. An attacker able to inspect these SCTP packets could use this flaw     to obtain potentially sensitive information. (CVE-2013-4350, Moderate)

    Red Hat would like to thank Fujitsu for reporting CVE-2013-4299 and Stephan     Mueller for reporting CVE-2013-4345. The CVE-2013-4348 issue was discovered     by Jason Wang of Red Hat.

    Bug fix:

    * RoCE appeared to be supported in the MRG Realtime kernel even when the     required user space packages from the HPN channel were not installed.
    The Realtime kernel now checks for the HPN channel packages before exposing     the RoCE interfaces. RoCE devices appear as plain 10GigE devices if the     needed HPN channel user space packages are not installed. (BZ#1012993)

    Users should upgrade to these updated packages, which upgrade the kernel-rt     kernel to version kernel-rt-3.8.13-rt14, and correct these issues.
    The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3002 advisory.

    - ip_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951078]     {CVE-2013-4470}
    - ip6_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951080]     {CVE-2013-4470}
    - KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376) (Gleb Natapov) [Orabug: 17951067]     {CVE-2013-6376}
    - KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368) (Andy Honig) [Orabug:
    17951071] {CVE-2013-6368}
    - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (Andy Honig) [Orabug: 17951073]     {CVE-2013-6367}
    - KVM: Fix iommu map/unmap to handle memory slot moves (Alex Williamson) [Orabug: 17841960]     {CVE-2013-4592}
    - ansi_cprng: Fix off by one error in non-block size request (Jerry Snitselaar) [Orabug: 17837997]     {CVE-2013-4345}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Miroslav Vadkerti discovered a flaw in how the permissions for network sysctls are handled in the Linux kernel. An unprivileged local user could exploit this flaw to have privileged access to files in /proc/sys/net/. (CVE-2013-4270)

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote authenticated user could exploit this flaw to obtain sensitive information or modify/corrupt data. (CVE-2013-4299)

Wannes Rombouts reported a vulnerability in the networking tuntap interface of the Linux kernel. A local user with the CAP_NET_ADMIN capability could leverage this flaw to gain full admin privileges.
(CVE-2013-4343)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP Fragmentation Offload (UFO) processing. A remote attacker could leverage this flaw to cause a denial of service (system crash).
(CVE-2013-4387)

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP Fragmenttation Offload (UFO). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2013-4470).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote authenticated user could exploit this flaw to obtain sensitive information or modify/corrupt data. (CVE-2013-4299)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP Fragmentation Offload (UFO) processing. A remote attacker could leverage this flaw to cause a denial of service (system crash).
(CVE-2013-4387).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An information leak was discovered in the handling of ICMPv6 Router Advertisement (RA) messages in the Linux kernel's IPv6 network stack.
A remote attacker could exploit this flaw to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information. (CVE-2013-0343)

A flaw was discovered in the Xen subsystem of the Linux kernel when it provides read-only access to a disk that supports TRIM or SCSI UNMAP to a guest OS. A privileged user in the guest OS could exploit this flaw to destroy data on the disk, even though the guest OS should not be able to write to the disk. (CVE-2013-2140)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of the Linux kernel. A physically proximate attacker could exploit this flaw to execute arbitrary code or cause a denial of service (heap memory corruption) via a specially crafted device that provides an invalid Report ID. (CVE-2013-2888)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem when CONFIG_HID_ZEROPLUS is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service via a specially crafted device. (CVE-2013-2889)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kerenl when CONFIG_HID_PANTHERLORD is enabled.
A physically proximate attacker could cause a denial of service (heap out-of-bounds write) via a specially crafted device. (CVE-2013-2892)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when any of CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF are enabled. A physcially proximate attacker can leverage this flaw to cause a denial of service vias a specially crafted device. (CVE-2013-2893)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_LOGITECH_DJ is enabled.
A physically proximate attacker could cause a denial of service (OOPS) or obtain sensitive information from kernel memory via a specially crafted device. (CVE-2013-2895)

Kees Cook discovered a vulnerability in the Linux Kernel's Human Interface Device (HID) subsystem's support for N-Trig touch screens. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2896)

Kees Cook discovered yet another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_MULTITOUCH is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2897)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kernel whe CONFIG_HID_PICOLCD is enabled. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2899)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP Fragmentation Offload (UFO) processing. A remote attacker could leverage this flaw to cause a denial of service (system crash).
(CVE-2013-4387).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application (CVE-2013-4483).

The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with IPIP encapsulation (CVE-2013-4348).

The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c (CVE-2013-4470).

The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test (CVE-2013-2015).

net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet (CVE-2013-4387).

The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network (CVE-2013-4350).

The updated packages provides a solution for these security issues.

An information leak was discovered in the handling of ICMPv6 Router Advertisement (RA) messages in the Linux kernel's IPv6 network stack.
A remote attacker could exploit this flaw to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information. (CVE-2013-0343)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of the Linux kernel. A physically proximate attacker could exploit this flaw to execute arbitrary code or cause a denial of service (heap memory corruption) via a specially crafted device that provides an invalid Report ID. (CVE-2013-2888)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem when CONFIG_HID_ZEROPLUS is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service via a specially crafted device. (CVE-2013-2889)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kerenl when CONFIG_HID_PANTHERLORD is enabled.
A physically proximate attacker could cause a denial of service (heap out-of-bounds write) via a specially crafted device. (CVE-2013-2892)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when any of CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF are enabled. A physcially proximate attacker can leverage this flaw to cause a denial of service vias a specially crafted device. (CVE-2013-2893)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_LOGITECH_DJ is enabled.
A physically proximate attacker could cause a denial of service (OOPS) or obtain sensitive information from kernel memory via a specially crafted device. (CVE-2013-2895)

Kees Cook discovered a vulnerability in the Linux Kernel's Human Interface Device (HID) subsystem's support for N-Trig touch screens. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2896)

Kees Cook discovered yet another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_MULTITOUCH is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2897)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kernel whe CONFIG_HID_PICOLCD is enabled. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2899)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP Fragmentation Offload (UFO) processing. A remote attacker could leverage this flaw to cause a denial of service (system crash).
(CVE-2013-4387).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 3.10.12 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest upstream stable release, Linux v3.11.1. Includes fixes for CVE-2013-4343 and CVE-2013-4350

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 3.11.1 update contains a number of important fixes accross the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	high
124972	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1519)	Nessus	Huawei Local Security Checks	high
124799	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1475)	Nessus	Huawei Local Security Checks	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
76669	RHEL 6 : kernel-rt (RHSA-2013:1490)	Nessus	Red Hat Local Security Checks	high
72472	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2014-3002)	Nessus	Oracle Linux Local Security Checks	medium
71260	Ubuntu 13.10 : linux vulnerabilities (USN-2049-1)	Nessus	Ubuntu Local Security Checks	medium
71210	Ubuntu 13.04 : linux vulnerabilities (USN-2045-1)	Nessus	Ubuntu Local Security Checks	medium
71207	Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2041-1)	Nessus	Ubuntu Local Security Checks	medium
71205	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2038-1)	Nessus	Ubuntu Local Security Checks	medium
70837	Mandriva Linux Security Advisory : kernel (MDVSA-2013:265)	Nessus	Mandriva Local Security Checks	high
70804	Ubuntu 12.10 : linux vulnerabilities (USN-2021-1)	Nessus	Ubuntu Local Security Checks	medium
70802	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-2019-1)	Nessus	Ubuntu Local Security Checks	medium
70061	Fedora 18 : kernel-3.10.12-100.fc18 (2013-17010)	Nessus	Fedora Local Security Checks	medium
70059	Fedora 20 : kernel-3.11.1-300.fc20 (2013-16794)	Nessus	Fedora Local Security Checks	medium
69968	Fedora 19 : kernel-3.11.1-200.fc19 (2013-17012)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4350

high

Tenable Plugins

high

high

high

critical

high

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium