Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with     CAP_SYS_ADMIN capability) can directly perform the     ioctl operations for dm device creation and removal and     this would typically be outside the direct control of     the unprivileged attacker.(CVE-2017-18203i1/4%0

  - The batadv_frag_merge_packets function in     net/batman-adv/fragmentation.c in the B.A.T.M.A.N.
    implementation in the Linux kernel through 3.18.1 uses     an incorrect length field during a calculation of an     amount of memory, which allows remote attackers to     cause a denial of service (mesh-node system crash) via     fragmented packets.(CVE-2014-9428i1/4%0

  - The regulator_ena_gpio_free function in     drivers/regulator/core.c in the Linux kernel allows     local users to gain privileges or cause a denial of     service (use-after-free) via a crafted     application.(CVE-2014-9940i1/4%0

  - The Linux kernel before 3.12, when UDP Fragmentation     Offload (UFO) is enabled, does not properly initialize     certain data structures, which allows local users to     cause a denial of service (memory corruption and system     crash) or possibly gain privileges via a crafted     application that uses the UDP_CORK option in a     setsockopt system call and sends both short and long     packets, related to the ip_ufo_append_data function in     net/ipv4/ip_output.c and the ip6_ufo_append_data     function in net/ipv6/ip6_output.c.(CVE-2013-4470i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Datagram Congestion Control Protocol (DCCP)     implementation freed SKB (socket buffer) resources for     a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO     option is set on the socket. A local, unprivileged user     could use this flaw to alter the kernel memory,     allowing them to escalate their privileges on the     system.(CVE-2017-6074i1/4%0

  - A NULL-pointer dereference vulnerability was found in     the Linux kernel's TCP stack, in     net/netfilter/nf_nat_redirect.c in the     nf_nat_redirect_ipv4() function. A remote,     unauthenticated user could exploit this flaw to create     a system crash (denial of service).(CVE-2015-8787i1/4%0

  - A use-after-free flaw was found in the CXGB3 kernel     driver when the network was considered to be congested.
    The kernel incorrectly misinterpreted the congestion as     an error condition and incorrectly freed or cleaned up     the socket buffer (skb). When the device then sent the     skb's queued data, these structures were referenced. A     local attacker could use this flaw to panic the system     (denial of service) or, with a local account, escalate     their privileges.(CVE-2015-8812i1/4%0

  - A flaw was found in the way the Linux kernel's     networking implementation handled UDP packets with     incorrect checksum values. A remote attacker could     potentially use this flaw to trigger an infinite loop     in the kernel, resulting in a denial of service on the     system, or cause a denial of service in applications     using the edge triggered epoll     functionality.(CVE-2015-5364i1/4%0

  - The timer_create syscall implementation in     kernel/time/posix-timers.c in the Linux kernel doesn't     properly validate the sigevent-i1/4zsigev_notify field,     which leads to out-of-bounds access in the show_timer     function.(CVE-2017-18344i1/4%0

  - A flaw was discovered in the way the Linux kernel dealt     with paging structures. When the kernel invalidated a     paging structure that was not in use locally, it could,     in principle, race against another CPU that is     switching to a process that uses the paging structure     in question. A local user could use a thread running     with a stale cached virtual-i1/4zphysical translation to     potentially escalate their privileges if the     translation in question were writable and the physical     page got reused for something critical (for example, a     page table).(CVE-2016-2069i1/4%0

  - Use after free vulnerability was found in percpu using     previously allocated memory in bpf. First
    __alloc_percpu_gfp() is called, then the memory is     freed with free_percpu() which triggers async     pcpu_balance_work and then pcpu_extend_area_map could     use a chunk after it has been freed.(CVE-2016-4794i1/4%0

  - A missing authorization check in the     fscrypt_process_policy function in fs/crypto/policy.c     in the ext4 and f2fs filesystem encryption support in     the Linux kernel allows a user to assign an encryption     policy to a directory owned by a different user,     potentially creating a denial of     service.(CVE-2016-10318i1/4%0

  - The security_context_to_sid_core function in     security/selinux/ss/services.c in the Linux kernel     before 3.13.4 allows local users to cause a denial of     service (system crash) by leveraging the CAP_MAC_ADMIN     capability to set a zero-length security     context.(CVE-2014-1874i1/4%0

  - The vfe31_proc_general function in     drivers/media/video/msm/vfe/msm_vfe31.c in the     MSM-VFE31 driver for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, does not validate a     certain id value, which allows attackers to gain     privileges or cause a denial of service (memory     corruption) via an application that makes a crafted     ioctl call.(CVE-2014-9410i1/4%0

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on a negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel.(CVE-2017-12192i1/4%0

  - Out-of-bounds memory read in the x509_decode_time     function in x509_cert_parser.c in Linux kernels 4.3-rc1     and after.(CVE-2015-5327i1/4%0

  - It was found that the espfix functionality does not     work for 32-bit KVM paravirtualized guests. A local,     unprivileged guest user could potentially use this flaw     to leak kernel stack addresses.(CVE-2014-8134i1/4%0

  - An out-of-bounds write flaw was found in the way the     Apple Magic Mouse/Trackpad multi-touch driver handled     Human Interface Device (HID) reports with an invalid     size. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3181i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's key management subsystem handled keyring     object reference counting in certain error path of the     join_session_keyring() function. A local, unprivileged     user could use this flaw to escalate their privileges     on the system.(CVE-2016-0728i1/4%0

  - Use-after-free vulnerability in the skb_segment     function in net/core/skbuff.c in the Linux kernel     through 3.13.6 allows attackers to obtain sensitive     information from kernel memory by leveraging the     absence of a certain orphaning     operation.(CVE-2014-0131i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's futex     subsystem handled the requeuing of certain Priority     Inheritance (PI) futexes. A local, unprivileged user     could use this flaw to escalate their privileges on the     system.(CVE-2014-3153)

  - An out-of-bounds write flaw was found in the way the     Apple Magic Mouse/Trackpad multi-touch driver handled     Human Interface Device (HID) reports with an invalid     size. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3181)

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182)

  - Multiple out-of-bounds write flaws were found in the     way the Cherry Cymotion keyboard driver, KYE/Genius     device drivers, Logitech device drivers, Monterey     Genius KB29E keyboard driver, Petalynx Maxter remote     control driver, and Sunplus wireless desktop driver     handled HID reports with an invalid report descriptor     size. An attacker with physical access to the system     could use either of these flaws to write data past an     allocated memory buffer.(CVE-2014-3184)

  - A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed     completion commands sent via USB Request Blocks     buffers. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3185)

  - It was found that Linux kernel's ptrace subsystem did     not properly sanitize the address-space-control bits     when the program-status word (PSW) was being set. On     IBM S/390 systems, a local, unprivileged user could use     this flaw to set address-space-control bits to the     kernel space, and thus gain read and write access to     kernel memory.(CVE-2014-3534)

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601)

  - It was found that KVM's Write to Model Specific     Register (WRMSR) instruction emulation would write     non-canonical values passed in by the guest to certain     MSRs in the host's context. A privileged guest user     could use this flaw to crash the host.(CVE-2014-3610)

  - A race condition flaw was found in the way the Linux     kernel's KVM subsystem handled PIT (Programmable     Interval Timer) emulation. A guest user who has access     to the PIT I/O ports could use this flaw to crash the     host.(CVE-2014-3611)

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT)     instructions. On hosts with an Intel processor and     invept VM exit support, an unprivileged guest user     could use these instructions to crash the     guest.(CVE-2014-3645)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invvpid     (Invalidate Translations Based on VPID) instructions.
    On hosts with an Intel processor and invppid VM exit     support, an unprivileged guest user could use these     instructions to crash the guest.(CVE-2014-3646)

  - A flaw was found in the way the Linux kernel's KVM     subsystem handled non-canonical addresses when     emulating instructions that change the RIP (for     example, branches or calls). A guest user with access     to an I/O or MMIO region could use this flaw to crash     the guest.(CVE-2014-3647)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled malformed Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3673)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled duplicate Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3687)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled the association's output queue. A remote     attacker could send specially crafted packets that     would cause the system to use an excessive amount of     memory, leading to a denial of service.(CVE-2014-3688)

  - It was found that the Linux kernel's KVM implementation     did not ensure that the host CR4 control register value     remained unchanged across VM entries on the same     virtual CPU. A local, unprivileged user could use this     flaw to cause a denial of service on the     system.(CVE-2014-3690)

  - An out-of-bounds memory access flaw was found in the     Linux kernel's system call auditing implementation. On     a system with existing audit rules defined, a local,     unprivileged user could use this flaw to leak kernel     memory to user space or, potentially, crash the     system.(CVE-2014-3917)

  - A flaw was found in the way Linux kernel's Transparent     Huge Pages (THP) implementation handled non-huge page     migration. A local, unprivileged user could use this     flaw to crash the kernel by migrating transparent     hugepages.(CVE-2014-3940)

  - The capabilities implementation in the Linux kernel     before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows     local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by     setting the setgid bit on a file with group ownership     of root.(CVE-2014-4014)

  - An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) backend driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client.(CVE-2014-4027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The SUSE Linux Enterprise 11 Service Pack 2 LTSS kernel has been updated to fix security issues on kernels on the x86_64 architecture.

The following security bugs have been fixed :

  - CVE-2012-4398: The __request_module function in     kernel/kmod.c in the Linux kernel before 3.4 did not set     a certain killable attribute, which allowed local users     to cause a denial of service (memory consumption) via a     crafted application (bnc#779488).

  - CVE-2013-2893: The Human Interface Device (HID)     subsystem in the Linux kernel through 3.11, when     CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or     CONFIG_LOGIWHEELS_FF is enabled, allowed physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device,     related to (1) drivers/hid/hid-lgff.c, (2)     drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c     (bnc#835839).

  - CVE-2013-2897: Multiple array index errors in     drivers/hid/hid-multitouch.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_MULTITOUCH is enabled, allowed     physically proximate attackers to cause a denial of     service (heap memory corruption, or NULL pointer     dereference and OOPS) via a crafted device (bnc#835839).

  - CVE-2013-2899: drivers/hid/hid-picolcd_core.c in the     Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_HID_PICOLCD is enabled,     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and OOPS) via a     crafted device (bnc#835839).

  - CVE-2013-2929: The Linux kernel before 3.12.2 did not     properly use the get_dumpable function, which allowed     local users to bypass intended ptrace restrictions or     obtain sensitive information from IA64 scratch registers     via a crafted application, related to kernel/ptrace.c     and arch/ia64/include/asm/processor.h (bnc#847652).

  - CVE-2013-7263: The Linux kernel before 3.12.4 updates     certain length values before ensuring that associated     data structures have been initialized, which allowed     local users to obtain sensitive information from kernel     stack memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call, related to net/ipv4/ping.c,     net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and     net/ipv6/udp.c (bnc#857643).

  - CVE-2014-0131: Use-after-free vulnerability in the     skb_segment function in net/core/skbuff.c in the Linux     kernel through 3.13.6 allowed attackers to obtain     sensitive information from kernel memory by leveraging     the absence of a certain orphaning operation     (bnc#867723).

  - CVE-2014-0181: The Netlink implementation in the Linux     kernel through 3.14.1 did not provide a mechanism for     authorizing socket operations based on the opener of a     socket, which allowed local users to bypass intended     access restrictions and modify network configurations by     using a Netlink socket for the (1) stdout or (2) stderr     of a setuid program (bnc#875051).

  - CVE-2014-2309: The ip6_route_add function in     net/ipv6/route.c in the Linux kernel through 3.13.6 did     not properly count the addition of routes, which allowed     remote attackers to cause a denial of service (memory     consumption) via a flood of ICMPv6 Router Advertisement     packets (bnc#867531).

  - CVE-2014-3181: Multiple stack-based buffer overflows in     the magicmouse_raw_event function in     drivers/hid/hid-magicmouse.c in the Magic Mouse HID     driver in the Linux kernel through 3.16.3 allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that provides a large amount     of (1) EHCI or (2) XHCI data associated with an event     (bnc#896382).

  - CVE-2014-3184: The report_fixup functions in the HID     subsystem in the Linux kernel before 3.16.2 might have     allowed physically proximate attackers to cause a denial     of service (out-of-bounds write) via a crafted device     that provides a small report descriptor, related to (1)     drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3)     drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c,     (5) drivers/hid/hid-petalynx.c, and (6)     drivers/hid/hid-sunplus.c (bnc#896390).

  - CVE-2014-3185: Multiple buffer overflows in the     command_port_read_callback function in     drivers/usb/serial/whiteheat.c in the Whiteheat USB     Serial Driver in the Linux kernel before 3.16.2 allowed     physically proximate attackers to execute arbitrary code     or cause a denial of service (memory corruption and     system crash) via a crafted device that provides a large     amount of (1) EHCI or (2) XHCI data associated with a     bulk response (bnc#896391).

  - CVE-2014-3186: Buffer overflow in the picolcd_raw_event     function in devices/hid/hid-picolcd_core.c in the     PicoLCD HID device driver in the Linux kernel through     3.16.3, as used in Android on Nexus 7 devices, allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that sends a large report     (bnc#896392).

  - CVE-2014-3601: The kvm_iommu_map_pages function in     virt/kvm/iommu.c in the Linux kernel through 3.16.1     miscalculates the number of pages during the handling of     a mapping failure, which allowed guest OS users to (1)     cause a denial of service (host OS memory corruption) or     possibly have unspecified other impact by triggering a     large gfn value or (2) cause a denial of service (host     OS memory consumption) by triggering a small gfn value     that leads to permanently pinned pages (bnc#892782).

  - CVE-2014-3610: The WRMSR processing functionality in the     KVM subsystem in the Linux kernel through 3.17.2 did not     properly handle the writing of a non-canonical address     to a model-specific register, which allowed guest OS     users to cause a denial of service (host OS crash) by     leveraging guest OS privileges, related to the     wrmsr_interception function in arch/x86/kvm/svm.c and     the handle_wrmsr function in arch/x86/kvm/vmx.c     (bnc#899192).

  - CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem     in the Linux kernel through 3.17.2 did not have an exit     handler for the INVVPID instruction, which allowed guest     OS users to cause a denial of service (guest OS crash)     via a crafted application (bnc#899192).

  - CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM     subsystem in the Linux kernel through 3.17.2 did not     properly perform RIP changes, which allowed guest OS     users to cause a denial of service (guest OS crash) via     a crafted application (bnc#899192).

  - CVE-2014-3673: The SCTP implementation in the Linux     kernel through 3.17.2 allowed remote attackers to cause     a denial of service (system crash) via a malformed     ASCONF chunk, related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c (bnc#902346).

  - CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function     in net/sctp/associola.c in the SCTP implementation in     the Linux kernel through 3.17.2 allowed remote attackers     to cause a denial of service (panic) via duplicate     ASCONF chunks that trigger an incorrect uncork within     the side-effect interpreter (bnc#902349).

  - CVE-2014-3688: The SCTP implementation in the Linux     kernel before 3.17.4 allowed remote attackers to cause a     denial of service (memory consumption) by triggering a     large number of chunks in an associations output queue,     as demonstrated by ASCONF probes, related to     net/sctp/inqueue.c and net/sctp/sm_statefuns.c     (bnc#902351).

  - CVE-2014-3690: arch/x86/kvm/vmx.c in the KVM subsystem     in the Linux kernel before 3.17.2 on Intel processors     did not ensure that the value in the CR4 control     register remains the same after a VM entry, which     allowed host OS users to kill arbitrary processes or     cause a denial of service (system disruption) by     leveraging /dev/kvm access, as demonstrated by     PR_SET_TSC prctl calls within a modified copy of QEMU     (bnc#902232).

  - CVE-2014-4608: Multiple integer overflows in the     lzo1x_decompress_safe function in     lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor     in the Linux kernel before 3.15.2 allowed     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Literal Run     (bnc#883948).

  - CVE-2014-4943: The PPPoL2TP feature in     net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6     allowed local users to gain privileges by leveraging     data-structure differences between an l2tp socket and an     inet socket (bnc#887082).

  - CVE-2014-5471: Stack consumption vulnerability in the     parse_rock_ridge_inode_internal function in     fs/isofs/rock.c in the Linux kernel through 3.16.1     allowed local users to cause a denial of service     (uncontrolled recursion, and system crash or reboot) via     a crafted iso9660 image with a CL entry referring to a     directory entry that has a CL entry (bnc#892490).

  - CVE-2014-5472: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel through     3.16.1 allowed local users to cause a denial of service     (unkillable mount process) via a crafted iso9660 image     with a self-referential CL entry (bnc#892490).

  - CVE-2014-7826: kernel/trace/trace_syscalls.c in the     Linux kernel through 3.17.2 did not properly handle     private syscall numbers during use of the ftrace     subsystem, which allowed local users to gain privileges     or cause a denial of service (invalid pointer     dereference) via a crafted application (bnc#904013).

  - CVE-2014-7841: The sctp_process_param function in     net/sctp/sm_make_chunk.c in the SCTP implementation in     the Linux kernel before 3.17.4, when ASCONF is used,     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) via a     malformed INIT chunk (bnc#905100).

  - CVE-2014-7842: Race condition in arch/x86/kvm/x86.c in     the Linux kernel before 3.17.4 allowed guest OS users to     cause a denial of service (guest OS crash) via a crafted     application that performs an MMIO transaction or a PIO     transaction to trigger a guest userspace emulation error     report, a similar issue to CVE-2010-5313 (bnc#905312).

  - CVE-2014-8134: The paravirt_ops_setup function in     arch/x86/kernel/kvm.c in the Linux kernel through 3.18     uses an improper paravirt_enabled setting for KVM guest     kernels, which made it easier for guest OS users to     bypass the ASLR protection mechanism via a crafted     application that reads a 16-bit value (bnc#909078).

  - CVE-2014-8369: The kvm_iommu_map_pages function in     virt/kvm/iommu.c in the Linux kernel through 3.17.2     miscalculates the number of pages during the handling of     a mapping failure, which allowed guest OS users to cause     a denial of service (host OS page unpinning) or possibly     have unspecified other impact by leveraging guest OS     privileges. NOTE: this vulnerability exists because of     an incorrect fix for CVE-2014-3601 (bnc#902675).

  - CVE-2014-8559: The d_walk function in fs/dcache.c in the     Linux kernel through 3.17.2 did not properly maintain     the semantics of rename_lock, which allowed local users     to cause a denial of service (deadlock and system hang)     via a crafted application (bnc#903640).

  - CVE-2014-8709: The ieee80211_fragment function in     net/mac80211/tx.c in the Linux kernel before 3.13.5 did     not properly maintain a certain tail pointer, which     allowed remote attackers to obtain sensitive cleartext     information by reading packets (bnc#904700).

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel before     3.18.2 did not validate a length value in the Extensions     Reference (ER) System Use Field, which allowed local     users to obtain sensitive information from kernel memory     via a crafted iso9660 image (bnc#912654).

  - CVE-2014-9585: The vdso_addr function in     arch/x86/vdso/vma.c in the Linux kernel through 3.18.2     did not properly choose memory locations for the vDSO     area, which made it easier for local users to bypass the     ASLR protection mechanism by guessing a location at the     end of a PMD (bnc#912705).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0290 advisory.

  - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not     ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS     users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm     access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU. (CVE-2014-3690)

  - The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows     local users to cause a denial of service (memory corruption or system crash) by accessing certain memory     locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage     migration, related to fs/proc/task_mmu.c and mm/mempolicy.c. (CVE-2014-3940)

  - kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall     numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-     bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. (CVE-2014-7825)

  - kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall     numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial     of service (invalid pointer dereference) via a crafted application. (CVE-2014-7826)

  - Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17     allows local users to cause a denial of service (file unavailability) via a combination of a write action     and an F_SETFL fcntl operation for the O_DIRECT flag. (CVE-2014-8086)

  - net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack     entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,     which allows remote attackers to bypass intended access restrictions via packets with disallowed port     numbers. (CVE-2014-8160)

  - The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of     files with an inappropriate locking approach, which allows local users to cause a denial of service (soft     lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations. (CVE-2014-8172)

  - The pmd_none_or_trans_huge_or_clear_bad function in include/asm-generic/pgtable.h in the Linux kernel     before 3.13 on NUMA systems does not properly determine whether a Page Middle Directory (PMD) entry is a     transparent huge-table entry, which allows local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have unspecified other impact via a crafted MADV_WILLNEED     madvise system call that leverages the absence of a page-table lock. (CVE-2014-8173)

  - The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly     maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information     by reading packets. (CVE-2014-8709)

  - Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in     drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a     denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.
    (CVE-2014-8884)

  - The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote     attribute replacement, which allows local users to cause a denial of service (transaction overrun and data     corruption) or possibly gain privileges by leveraging XFS filesystem access. (CVE-2015-0274)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed :

  - The __request_module function in kernel/kmod.c in the     Linux kernel before 3.4 did not set a certain killable     attribute, which allowed local users to cause a denial     of service (memory consumption) via a crafted     application. (bnc#779488). (CVE-2012-4398)

  - drivers/hid/hid-zpff.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_ZEROPLUS is enabled, allowed physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device.
    (bnc#835839). (CVE-2013-2889)

  - The Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_LOGITECH_FF,     CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled,     allowed physically proximate attackers to cause a denial     of service (heap-based out-of-bounds write) via a     crafted device, related to (1) drivers/hid/hid-lgff.c,     (2) drivers/hid/hid-lg3ff.c, and (3)     drivers/hid/hid-lg4ff.c. (bnc#835839). (CVE-2013-2893)

  - Multiple array index errors in     drivers/hid/hid-multitouch.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_MULTITOUCH is enabled, allowed     physically proximate attackers to cause a denial of     service (heap memory corruption, or NULL pointer     dereference and OOPS) via a crafted device.
    (bnc#835839). (CVE-2013-2897)

  - drivers/hid/hid-picolcd_core.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_PICOLCD is enabled, allowed physically     proximate attackers to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted device.
    (bnc#835839). (CVE-2013-2899)

  - The Linux kernel before 3.12.4 updates certain length     values before ensuring that associated data structures     have been initialized, which allowed local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call, related to net/ipv4/ping.c, net/ipv4/raw.c,     net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.
    (bnc#853040, bnc#857643). (CVE-2013-7263)

  - Multiple stack-based buffer overflows in the     magicmouse_raw_event function in     drivers/hid/hid-magicmouse.c in the Magic Mouse HID     driver in the Linux kernel through 3.16.3 allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that provides a large amount     of (1) EHCI or (2) XHCI data associated with an event.
    (bnc#896382). (CVE-2014-3181)

  - The report_fixup functions in the HID subsystem in the     Linux kernel before 3.16.2 allowed physically proximate     attackers to cause a denial of service (out-of-bounds     write) via a crafted device that provides a small report     descriptor, related to (1) drivers/hid/hid-cherry.c, (2)     drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4)     drivers/hid/hid-monterey.c, (5)     drivers/hid/hid-petalynx.c, and (6)     drivers/hid/hid-sunplus.c. (bnc#896390). (CVE-2014-3184)

  - Multiple buffer overflows in the     command_port_read_callback function in     drivers/usb/serial/whiteheat.c in the Whiteheat USB     Serial Driver in the Linux kernel before 3.16.2 allowed     physically proximate attackers to execute arbitrary code     or cause a denial of service (memory corruption and     system crash) via a crafted device that provides a large     amount of (1) EHCI or (2) XHCI data associated with a     bulk response. (bnc#896391). (CVE-2014-3185)

  - Buffer overflow in the picolcd_raw_event function in     devices/hid/hid-picolcd_core.c in the PicoLCD HID device     driver in the Linux kernel through 3.16.3, as used in     Android on Nexus 7 devices, allowed physically proximate     attackers to cause a denial of service (system crash) or     possibly execute arbitrary code via a crafted device     that sends a large report. (bnc#896392). (CVE-2014-3186)

  - The kvm_iommu_map_pages function in virt/kvm/iommu.c in     the Linux kernel through 3.16.1 miscalculated the number     of pages during the handling of a mapping failure, which     allowed guest OS users to (1) cause a denial of service     (host OS memory corruption) or possibly have unspecified     other impact by triggering a large gfn value or (2)     cause a denial of service (host OS memory consumption)     by triggering a small gfn value that leads to     permanently pinned pages. (bnc#892782). (CVE-2014-3601)

  - The WRMSR processing functionality in the KVM subsystem     in the Linux kernel through 3.17.2 did not properly     handle the writing of a non-canonical address to a     model-specific register, which allowed guest OS users to     cause a denial of service (host OS crash) by leveraging     guest OS privileges, related to the wrmsr_interception     function in arch/x86/kvm/svm.c and the handle_wrmsr     function in arch/x86/kvm/vmx.c. (bnc#899192).
    (CVE-2014-3610)

  - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux     kernel through 3.17.2 did not have an exit handler for     the INVVPID instruction, which allowed guest OS users to     cause a denial of service (guest OS crash) via a crafted     application. (bnc#899192). (CVE-2014-3646)

  - arch/x86/kvm/emulate.c in the KVM subsystem in the Linux     kernel through 3.17.2 did not properly perform RIP     changes, which allowed guest OS users to cause a denial     of service (guest OS crash) via a crafted application.
    (bnc#899192). (CVE-2014-3647)

  - The SCTP implementation in the Linux kernel through     3.17.2 allowed remote attackers to cause a denial of     service (system crash) via a malformed ASCONF chunk,     related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c. (bnc#902346, bnc#902349).
    (CVE-2014-3673)

  - arch/x86/kernel/entry_32.S in the Linux kernel through     3.15.1 on 32-bit x86 platforms, when syscall auditing is     enabled and the sep CPU feature flag is set, allowed     local users to cause a denial of service (OOPS and     system crash) via an invalid syscall number, as     demonstrated by number 1000. (bnc#883724).
    (CVE-2014-4508)

  - * DISPUTED * Multiple integer overflows in the     lzo1x_decompress_safe function in     lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor     in the Linux kernel before 3.15.2 allowed     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Literal Run. NOTE: the     author of the LZO algorithms says: The Linux kernel is     not affected; media hype. (bnc#883948). (CVE-2014-4608)

  - kernel/trace/trace_syscalls.c in the Linux kernel     through 3.17.2 did not properly handle private syscall     numbers during use of the ftrace subsystem, which     allowed local users to gain privileges or cause a denial     of service (invalid pointer dereference) via a crafted     application. (bnc#904013). (CVE-2014-7826)

  - An SCTP server doing ASCONF would panic on malformed     INIT ping-of-death. (bnc#905100). (CVE-2014-7841)

  - The ieee80211_fragment function in net/mac80211/tx.c in     the Linux kernel before 3.13.5 did not properly maintain     a certain tail pointer, which allowed remote attackers     to obtain sensitive cleartext information by reading     packets. (bnc#904700). (CVE-2014-8709)

  - A local user with write access could have used this flaw     to crash the kernel or elevate privileges (bnc#905522).
    The following non-security bugs have been fixed:.
    (CVE-2014-8884)

  - Build the KOTD against the SP3 Update project

  - HID: fix kabi breakage.

  - NFS: Provide stub nfs_fscache_wait_on_invalidate() for     when CONFIG_NFS_FSCACHE=n.

  - NFS: fix inverted test for delegation in     nfs4_reclaim_open_state. (bnc#903331)

  - NFS: remove incorrect Lock reclaim failed! warning.
    (bnc#903331)

  - NFSv4: nfs4_open_done first must check that GETATTR     decoded a file type. (bnc#899574)

  - PCI: pciehp: Clear Data Link Layer State Changed during     init. (bnc#898295)

  - PCI: pciehp: Enable link state change notifications.
    (bnc#898295)

  - PCI: pciehp: Handle push button event asynchronously.
    (bnc#898295)

  - PCI: pciehp: Make check_link_active() non-static.
    (bnc#898295)

  - PCI: pciehp: Use link change notifications for hot-plug     and removal. (bnc#898295)

  - PCI: pciehp: Use per-slot workqueues to avoid deadlock.
    (bnc#898295)

  - PCI: pciehp: Use symbolic constants, not hard-coded     bitmask. (bnc#898295)

  - PM / hibernate: Iterate over set bits instead of PFNs in     swsusp_free(). (bnc#860441)

  - be2net: Fix invocation of be_close() after be_clear().
    (bnc#895468)

  - block: Fix bogus partition statistics reports.
    (bnc#885077 / bnc#891211)

  - block: Fix computation of merged request priority.

  - btrfs: Fix wrong device size when we are resizing the     device.

  - btrfs: Return right extent when fiemap gives unaligned     offset and len.

  - btrfs: abtract out range locking in clone ioctl().

  - btrfs: always choose work from prio_head first.

  - btrfs: balance delayed inode updates.

  - btrfs: cache extent states in defrag code path.

  - btrfs: check file extent type before anything else.
    (bnc#897694)

  - btrfs: clone, do not create invalid hole extent map.

  - btrfs: correctly determine if blocks are shared in     btrfs_compare_trees.

  - btrfs: do not bug_on if we try to cow a free space cache     inode.

  - btrfs: ensure btrfs_prev_leaf does not miss 1 item.

  - btrfs: ensure readers see new data after a clone     operation.

  - btrfs: fill_holes: Fix slot number passed to     hole_mergeable() call.

  - btrfs: filter invalid arg for btrfs resize.

  - btrfs: fix EINVAL checks in btrfs_clone.

  - btrfs: fix EIO on reading file after ioctl clone works     on it.

  - btrfs: fix a crash of clone with inline extents split.

  - btrfs: fix crash of compressed writes. (bnc#898375)

  - btrfs: fix crash when starting transaction.

  - btrfs: fix deadlock with nested trans handles.

  - btrfs: fix hang on error (such as ENOSPC) when writing     extent pages.

  - btrfs: fix leaf corruption after __btrfs_drop_extents.

  - btrfs: fix race between balance recovery and root     deletion.

  - btrfs: fix wrong extent mapping for DirectIO.

  - btrfs: handle a missing extent for the first file     extent.

  - btrfs: limit delalloc pages outside of     find_delalloc_range. (bnc#898375)

  - btrfs: read lock extent buffer while walking backrefs.

  - btrfs: remove unused wait queue in struct extent_buffer.

  - btrfs: replace EINVAL with ERANGE for resize when     ULLONG_MAX.

  - btrfs: replace error code from btrfs_drop_extents.

  - btrfs: unlock extent and pages on error in     cow_file_range.

  - btrfs: unlock inodes in correct order in clone ioctl.

  - btrfs_ioctl_clone: Move clone code into its own     function.

  - cifs: delay super block destruction until all     cifsFileInfo objects are gone. (bnc#903653)

  - drm/i915: Flush the PTEs after updating them before     suspend. (bnc#901638)

  - drm/i915: Undo gtt scratch pte unmapping again.
    (bnc#901638)

  - ext3: return 32/64-bit dir name hash according to usage     type. (bnc#898554)

  - ext4: return 32/64-bit dir name hash according to usage     type. (bnc#898554)

  - fix: use after free of xfs workqueues. (bnc#894895)

  - fs: add new FMODE flags: FMODE_32bithash and     FMODE_64bithash. (bnc#898554)

  - futex: Ensure get_futex_key_refs() always implies a     barrier (bnc#851603 (futex scalability series)).

  - futex: Fix a race condition between REQUEUE_PI and task     death (bnc#851603 (futex scalability series)).

  - ipv6: add support of peer address. (bnc#896415)

  - ipv6: fix a refcnt leak with peer addr. (bnc#896415)

  - megaraid_sas: Disable fastpath writes for non-RAID0.
    (bnc#897502)

  - mm: change __remove_pages() to call     release_mem_region_adjustable(). (bnc#891790)

  - netxen: Fix link event handling. (bnc#873228)

  - netxen: fix link notification order. (bnc#873228)

  - nfsd: rename int access to int may_flags in nfsd_open().
    (bnc#898554)

  - nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes).
    (bnc#898554)

  - ocfs2: fix NULL pointer dereference in     ocfs2_duplicate_clusters_by_page. (bnc#899843)

  - powerpc: Add smp_mb() to arch_spin_is_locked()     (bsc#893758).

  - powerpc: Add smp_mb()s to arch_spin_unlock_wait()     (bsc#893758).

  - powerpc: Add support for the optimised lockref     implementation (bsc#893758).

  - powerpc: Implement arch_spin_is_locked() using     arch_spin_value_unlocked() (bsc#893758).

  - refresh patches.xen/xen-blkback-multi-page-ring     (bnc#897708)).

  - remove filesize checks for sync I/O journal commit.
    (bnc#800255)

  - resource: add __adjust_resource() for internal use.
    (bnc#891790)

  - resource: add release_mem_region_adjustable().
    (bnc#891790)

  - revert PM / Hibernate: Iterate over set bits instead of     PFNs in swsusp_free(). (bnc#860441)

  - rpm/mkspec: Generate specfiles according to Factory     requirements.

  - rpm/mkspec: Generate a per-architecture per-package
    _constraints file

  - sched: Fix unreleased llc_shared_mask bit during CPU     hotplug. (bnc#891368)

  - scsi_dh_alua: disable ALUA handling for non-disk     devices. (bnc#876633)

  - usb: Do not re-read descriptors for wired devices in     usb_authorize_device(). (bnc#904358)

  - usbback: Do not access request fields in shared ring     more than once.

  - usbhid: add another mouse that needs QUIRK_ALWAYS_POLL.
    (bnc#888607)

  - vfs,proc: guarantee unique inodes in /proc. (bnc#868049)

  - x86, cpu hotplug: Fix stack frame warning     incheck_irq_vectors_for_cpu_disable(). (bnc#887418)

  - x86, ioremap: Speed up check for RAM pages (Boot time     optimisations (bnc#895387)).

  - x86: Add check for number of available vectors before     CPU down. (bnc#887418)

  - x86: optimize resource lookups for ioremap (Boot time     optimisations (bnc#895387)).

  - x86: use optimized ioresource lookup in ioremap function     (Boot time optimisations (bnc#895387)).

  - xfs: Do not free EFIs before the EFDs are committed     (bsc#755743).

  - xfs: Do not reference the EFI after it is freed     (bsc#755743).

  - xfs: fix cil push sequence after log recovery     (bsc#755743).

  - zcrypt: support for extended number of ap domains     (bnc#894058, LTC#117041).

  - zcrypt: toleration of new crypto adapter hardware     (bnc#894058, LTC#117041).

The openSUSE 13.1 kernel was updated to fix security issues and bugs :

Security issues fixed: CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code.

CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.

CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace.

CVE-2014-0181: The Netlink implementation in the Linux kernel through 3.14.1 did not provide a mechanism for authorizing socket operations based on the opener of a socket, which allowed local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. (bsc#875051)

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-3688: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c.

CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

CVE-2014-7975: The do_umount function in fs/namespace.c in the Linux kernel did not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allowed local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.

CVE-2014-8884: Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel allowed local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

CVE-2014-3673: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c.

CVE-2014-3186: Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel, as used in Android on Nexus 7 devices, allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.

CVE-2014-7841: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel, when ASCONF is used, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.

CVE-2014-4611: Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.

CVE-2014-4608: Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel allowed context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run.

CVE-2014-8709: The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel did not properly maintain a certain tail pointer, which allowed remote attackers to obtain sensitive cleartext information by reading packets.

CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.

CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.

CVE-2014-3182: Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.

CVE-2014-3181: Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.

CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.

CVE-2013-7263: The Linux kernel updated certain length values before ensuring that associated data structures have been initialized, which allowed local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. This update fixes the leak of the port number when using ipv6 sockets. (bsc#853040).

CVE-2013-2898: Fixed potential kernel caller confusion via past-end-of-heap-allocation read in sensor-hub HID driver.

CVE-2013-2891: Fixed 16 byte past-end-of-heap-alloc zeroing in steelseries HID driver.

VE-2014-6410: The __udf_read_inode function in fs/udf/inode.c in the Linux kernel did not restrict the amount of ICB indirection, which allowed physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.

CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.

CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.

CVE-2014-0206: Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory via a large head value.

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-5206: The do_remount function in fs/namespace.c in the Linux kernel did not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allowed local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a 'mount -o remount' command within a user namespace.

CVE-2014-5207: fs/namespace.c in the Linux kernel did not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allowed local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a 'mount -o remount' command within a user namespace.

CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.

CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel allowed local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel, when SCTP authentication is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.

Also the following bugs were fixed :

  - KEYS: Fix stale key registration at error path     (bnc#908163).

  - parport: parport_pc, do not remove parent devices early     (bnc#856659).

  - xfs: fix directory hash ordering bug.

  - xfs: mark all internal workqueues as freezable     (bnc#899785).

  - [media] uvc: Fix destruction order in uvc_delete()     (bnc#897736).

  - cfq-iosched: Fix wrong children_weight calculation     (bnc#893429).

  - target/rd: Refactor rd_build_device_space +     rd_release_device_space (bnc#882639).

  - Btrfs: Fix memory corruption by ulist_add_merge() on     32bit arch (bnc#887046).

  - usb: pci-quirks: Prevent Sony VAIO t-series from     switching usb ports (bnc#864375).

  - xhci: Switch only Intel Lynx Point-LP ports to EHCI on     shutdown (bnc#864375).

  - xhci: Switch Intel Lynx Point ports to EHCI on shutdown     (bnc#864375).

  - ALSA: hda - Fix broken PM due to incomplete i915     initialization (bnc#890114).

  - netbk: Don't destroy the netdev until the vif is shut     down (bnc#881008).

  - swiotlb: don't assume PA 0 is invalid (bnc#865882).

  - PM / sleep: Fix request_firmware() error at resume     (bnc#873790).

  - usbcore: don't log on consecutive debounce failures of     the same port (bnc#818966).

The openSUSE 12.3 kernel was updated to fix security issues :

This will be the final kernel update for openSUSE 13.2 during its lifetime, which ends January 4th 2015.

CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code.

CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.

CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace.

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-8884: Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel allowed local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

CVE-2014-3186: Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel, as used in Android on Nexus 7 devices, allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.

CVE-2014-7841: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel, when ASCONF is used, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.

CVE-2014-4608: Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel allowed context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run.

CVE-2014-8709: The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel did not properly maintain a certain tail pointer, which allowed remote attackers to obtain sensitive cleartext information by reading packets.

CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.

CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.

CVE-2014-3182: Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.

CVE-2014-3181: Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.

CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.

CVE-2013-7263: The Linux kernel updated certain length values before ensuring that associated data structures have been initialized, which allowed local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. This update fixes the leak of the port number when using ipv6 sockets. (bsc#853040).

CVE-2014-6410: The __udf_read_inode function in fs/udf/inode.c in the Linux kernel did not restrict the amount of ICB indirection, which allowed physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.

CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.

CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel allowed local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel, when SCTP authentication is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.

CVE-2013-2888, CVE-2013-2889, CVE-2013-2890, CVE-2013-2891, CVE-2013-2892, CVE-2013-2893, CVE-2013-2894, CVE-2013-2895, CVE-2013-2896, CVE-2013-2897, CVE-2013-2898, CVE-2013-2899: Multiple issues in the Human Interface Device (HID) subsystem in the Linux kernel allowed physically proximate attackers to cause a denial of service or system crash via (heap-based out-of-bounds write) via a crafted device. (Not separately listed.)

Other bugfixes :

  - xfs: mark all internal workqueues as freezable     (bnc#899785).

  - target/rd: Refactor rd_build_device_space +     rd_release_device_space (bnc#882639)

  - Enable CONFIG_ATH9K_HTC for armv7hl/omap2plus config     (bnc#890624)

  - swiotlb: don't assume PA 0 is invalid (bnc#865882).

  - drm/i915: Apply alignment restrictions on scanout     surfaces for VT-d (bnc#818561).

  - tg3: Change nvram command timeout value to 50ms     (bnc#768714).

  - tg3: Override clock, link aware and link idle mode     during NVRAM dump (bnc#768714).

  - tg3: Set the MAC clock to the fastest speed during boot     code load (bnc#768714).

* A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service.
(CVE-2014-3688, Important)

* Two flaws were found in the way the Apple Magic Mouse/Trackpad multi- touch driver and the Minibox PicoLCD driver handled invalid HID reports. An attacker with physical access to the system could use these flaws to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3181, CVE-2014-3186, Moderate)

* A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate)

* A flaw was found in the way the Linux kernel's keys subsystem handled the termination condition in the associative array garbage collection functionality. A local, unprivileged user could use this flaw to crash the system. (CVE-2014-3631, Moderate)

* Multiple flaws were found in the way the Linux kernel's ALSA implementation handled user controls. A local, privileged user could use either of these flaws to crash the system. (CVE-2014-4654, CVE-2014-4655, CVE-2014-4656, Moderate)

* A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. (CVE-2014-5045, Moderate)

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low)

* A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low)

* An information leak flaw in the way the Linux kernel handled media device enumerate entities IOCTL requests could allow a local user able to access the /dev/media0 device file to leak kernel memory bytes.
(CVE-2014-1739, Low)

* An out-of-bounds read flaw in the Logitech Unifying receiver driver could allow an attacker with physical access to the system to crash the system or, potentially, escalate their privileges on the system.
(CVE-2014-3182, Low)

* Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled invalid HID reports. An attacker with physical access to the system could use either of these flaws to write data past an allocated memory buffer.
(CVE-2014-3184, Low)

* An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) back end driver of the iSCSI Target subsystem could allow a privileged user to leak the contents of kernel memory to an iSCSI initiator remote client. (CVE-2014-4027, Low)

* An information leak flaw in the Linux kernel's ALSA implementation could allow a local, privileged user to leak kernel memory to user space. (CVE-2014-4652, Low)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3104 advisory.

    - HID: magicmouse: sanity check report size in raw_event() callback (Jiri Kosina) [Orabug: 19849355]     {CVE-2014-3181}
    - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen) [Orabug: 20192542]     {CVE-2014-4652}
    - target/rd: Refactor rd_build_device_space + rd_release_device_space (Nicholas Bellinger) [Orabug:
    20192517] {CVE-2014-4027}
    - media-device: fix infoleak in ioctl media_enum_entities() (Salva Peiro) [Orabug: 20192501]     {CVE-2014-1739} {CVE-2014-1739}
    - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara) [Orabug: 20192449] {CVE-2014-6410}
    - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen) [Orabug: 20192418]     {CVE-2014-4656}
    - HID: picolcd: sanity check report size in raw_event() callback (Jiri Kosina) [Orabug: 20192205]     {CVE-2014-3186}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important)

* A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service.
(CVE-2014-3688, Important)

* Two flaws were found in the way the Apple Magic Mouse/Trackpad multi-touch driver and the Minibox PicoLCD driver handled invalid HID reports. An attacker with physical access to the system could use these flaws to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3181, CVE-2014-3186, Moderate)

* A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate)

* A flaw was found in the way the Linux kernel's keys subsystem handled the termination condition in the associative array garbage collection functionality. A local, unprivileged user could use this flaw to crash the system. (CVE-2014-3631, Moderate)

* Multiple flaws were found in the way the Linux kernel's ALSA implementation handled user controls. A local, privileged user could use either of these flaws to crash the system. (CVE-2014-4654, CVE-2014-4655, CVE-2014-4656, Moderate)

* A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. (CVE-2014-5045, Moderate)

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low)

* A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low)

* An information leak flaw in the way the Linux kernel handled media device enumerate entities IOCTL requests could allow a local user able to access the /dev/media0 device file to leak kernel memory bytes.
(CVE-2014-1739, Low)

* An out-of-bounds read flaw in the Logitech Unifying receiver driver could allow an attacker with physical access to the system to crash the system or, potentially, escalate their privileges on the system.
(CVE-2014-3182, Low)

* Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled invalid HID reports. An attacker with physical access to the system could use either of these flaws to write data past an allocated memory buffer.
(CVE-2014-3184, Low)

* An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) back end driver of the iSCSI Target subsystem could allow a privileged user to leak the contents of kernel memory to an iSCSI initiator remote client. (CVE-2014-4027, Low)

* An information leak flaw in the Linux kernel's ALSA implementation could allow a local, privileged user to leak kernel memory to user space. (CVE-2014-4652, Low)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1971 advisory.

    - [alsa] control: Make sure that id->index does not overflow (Jaroslav Kysela) [1117313 1117314]     {CVE-2014-4656}
    - [alsa] control: Handle numid overflow (Jaroslav Kysela) [1117313 1117314] {CVE-2014-4656}
    - [alsa] control: Protect user controls against concurrent access (Jaroslav Kysela) [1117338 1117339]     {CVE-2014-4652}
    - [alsa] control: Fix replacing user controls (Jaroslav Kysela) [1117323 1117324] {CVE-2014-4654     CVE-2014-4655}
    - [net] sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann) [1155750 1152755]     {CVE-2014-3688}
    - [net] sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [1155737 1152755] {CVE-2014-3687}
    - [net] sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [1147856     1152755] {CVE-2014-3673}
    - [lib] assoc_array: Fix termination condition in assoc array garbage collection (David Howells) [1155136     1139431] {CVE-2014-3631}
    - [fs] udf: Avoid infinite loop when processing indirect ICBs (Jacob Tanenbaum) [1142321 1142322]     {CVE-2014-6410}
    - [hid] picolcd: fix memory corruption via OOB write (Jacob Tanenbaum) [1141408 1141409] {CVE-2014-3186}
    - [usb] serial/whiteheat: fix memory corruption flaw (Jacob Tanenbaum) [1141403 1141404] {CVE-2014-3185}
    - [hid] fix off by one error in various _report_fixup routines (Jacob Tanenbaum) [1141393 1141394]     {CVE-2014-3184}
    - [hid] logitech-dj: fix OOB array access (Jacob Tanenbaum) [1141211 1141212] {CVE-2014-3182}
    - [hid] fix OOB write in magicmouse driver (Jacob Tanenbaum) [1141176 1141177] {CVE-2014-3181}
    - [fs] vfs: fix ref count leak in path_mountpoint() (Ian Kent) [1122481 1122376] {CVE-2014-5045}
    - [kernel] ptrace: get_dumpable() incorrect tests (Jacob Tanenbaum) [1111605 1111606] {CVE-2013-2929}
    - [media] media-device: fix an information leakage (Jacob Tanenbaum) [1109776 1109777] {CVE-2014-1739}
    - [target] rd: Refactor rd_build_device_space + rd_release_device_space (Denys Vlasenko) [1108754 1108755]     {CVE-2014-4027}
    - [virt] kvm: fix PIT timer race condition (Petr  Matousek) [1144879 1144880] {CVE-2014-3611}
    - [virt] kvm/vmx: handle invept and invvpid vm exits gracefully (Petr  Matousek) [1145449 1116936]     [1144828 1144829] {CVE-2014-3645 CVE-2014-3646}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3086 advisory.

    - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw)  [Orabug: 19849336]     {CVE-2014-3185}
    - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849320]  {CVE-2014-3181}     logging macros to functions (Joe Perches)  [Orabug: 19847630]  {CVE-2014-3535}     logging macros to functions (Joe Perches)  [Orabug: 19847630]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3085 advisory.

    - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw)  [Orabug: 19849335]     {CVE-2014-3185}
    - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849318]  {CVE-2014-3181}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3084 advisory.

  - Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the     Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by     leveraging incorrect PIT emulation. (CVE-2014-3611)

  - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for     the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a     crafted application. (CVE-2014-3645)

  - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler     for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via     a crafted application. (CVE-2014-3646)

  - Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in     the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to     execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted     device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.
    (CVE-2014-3185)

  - Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c     in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to     cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that     provides a large amount of (1) EHCI or (2) XHCI data associated with an event. (CVE-2014-3181)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings (CVE-2014-3122).

Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event (CVE-2014-3181).

Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value (CVE-2014-3182).

The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c (CVE-2014-3184).

Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response (CVE-2014-3185).

Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report (CVE-2014-3186).

arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a crafted application that makes a ptrace system call (CVE-2014-3534).

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages (CVE-2014-3601).

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction (CVE-2014-5077).

The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allows local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a mount -o remount command within a user namespace (CVE-2014-5206).

Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry (CVE-2014-5471).

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry (CVE-2014-5472).

The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode (CVE-2014-6410).

The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call (CVE-2014-7975).

The updated packages provides a solution for these security issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2379-1 advisory.

    Steven Vittitoe reported multiple stack buffer overflows in Linux kernel's magicmouse HID driver. A     physically proximate attacker could exploit this flaw to cause a denial of service (system crash) or     possibly execute arbitrary code via specially crafted devices. (CVE-2014-3181)

    Ben Hawkes reported some off by one errors for report descriptors in the Linux kernel's HID stack. A     physically proximate attacker could exploit these flaws to cause a denial of service (out-of-bounds write)     via a specially crafted device. (CVE-2014-3184)

    Several bounds check flaws allowing for buffer overflows were discovered in the Linux kernel's Whiteheat     USB serial driver. A physically proximate attacker could exploit these flaws to cause a denial of service     (system crash) via a specially crafted device. (CVE-2014-3185)

    Steven Vittitoe reported a buffer overflow in the Linux kernel's PicoLCD HID device driver. A physically     proximate attacker could exploit this flaw to cause a denial of service (system crash) or possibly execute     arbitrary code via a specially craft device. (CVE-2014-3186)

    A flaw was discovered in the Linux kernel's associative-array garbage collection implementation. A local     user could exploit this flaw to cause a denial of service (system crash) or possibly have other     unspecified impact by using keyctl operations. (CVE-2014-3631)

    A flaw was discovered in the Linux kernel's UDF filesystem (used on some CD-ROMs and DVDs) when processing     indirect ICBs. An attacker who can cause CD, DVD or image file with a specially crafted inode to be     mounted can cause a denial of service (infinite loop or stack consumption). (CVE-2014-6410)

    James Eckersall discovered a buffer overflow in the Ceph filesystem in the Linux kernel. A remote attacker     could exploit this flaw to cause a denial of service (memory consumption and panic) or possibly have other     unspecified impact via a long unencrypted auth ticket. (CVE-2014-6416)

    James Eckersall discovered a flaw in the handling of memory allocation failures in the Ceph filesystem. A     remote attacker could exploit this flaw to cause a denial of service (system crash) or possibly have     unspecified other impact. (CVE-2014-6417)

    James Eckersall discovered a flaw in how the Ceph filesystem validates auth replies. A remote attacker     could exploit this flaw to cause a denial of service (system crash) or possibly have other unspecified     impact. (CVE-2014-6418)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Steven Vittitoe reported multiple stack buffer overflows in Linux kernel's magicmouse HID driver. A physically proximate attacker could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code via specially crafted devices.
(CVE-2014-3181)

Ben Hawkes reported some off by one errors for report descriptors in the Linux kernel's HID stack. A physically proximate attacker could exploit these flaws to cause a denial of service (out-of-bounds write) via a specially crafted device. (CVE-2014-3184)

Several bounds check flaws allowing for buffer overflows were discovered in the Linux kernel's Whiteheat USB serial driver. A physically proximate attacker could exploit these flaws to cause a denial of service (system crash) via a specially crafted device.
(CVE-2014-3185)

Steven Vittitoe reported a buffer overflow in the Linux kernel's PicoLCD HID device driver. A physically proximate attacker could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code via a specially craft device.
(CVE-2014-3186)

A flaw was discovered in the Linux kernel's associative-array garbage collection implementation. A local user could exploit this flaw to cause a denial of service (system crash) or possibly have other unspecified impact by using keyctl operations. (CVE-2014-3631)

A flaw was discovered in the Linux kernel's UDF filesystem (used on some CD-ROMs and DVDs) when processing indirect ICBs. An attacker who can cause CD, DVD or image file with a specially crafted inode to be mounted can cause a denial of service (infinite loop or stack consumption). (CVE-2014-6410)

James Eckersall discovered a buffer overflow in the Ceph filesystem in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (memory consumption and panic) or possibly have other unspecified impact via a long unencrypted auth ticket.
(CVE-2014-6416)

James Eckersall discovered a flaw in the handling of memory allocation failures in the Ceph filesystem. A remote attacker could exploit this flaw to cause a denial of service (system crash) or possibly have unspecified other impact. (CVE-2014-6417)

James Eckersall discovered a flaw in how the Ceph filesystem validates auth replies. A remote attacker could exploit this flaw to cause a denial of service (system crash) or possibly have other unspecified impact. (CVE-2014-6418).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Steven Vittitoe reported multiple stack buffer overflows in Linux kernel's magicmouse HID driver. A physically proximate attacker could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code via specially crafted devices.
(CVE-2014-3181)

Ben Hawkes reported some off by one errors for report descriptors in the Linux kernel's HID stack. A physically proximate attacker could exploit these flaws to cause a denial of service (out-of-bounds write) via a specially crafted device. (CVE-2014-3184)

Several bounds check flaws allowing for buffer overflows were discovered in the Linux kernel's Whiteheat USB serial driver. A physically proximate attacker could exploit these flaws to cause a denial of service (system crash) via a specially crafted device.
(CVE-2014-3185)

Steven Vittitoe reported a buffer overflow in the Linux kernel's PicoLCD HID device driver. A physically proximate attacker could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code via a specially craft device.
(CVE-2014-3186)

A flaw was discovered in the Linux kernel's UDF filesystem (used on some CD-ROMs and DVDs) when processing indirect ICBs. An attacker who can cause CD, DVD or image file with a specially crafted inode to be mounted can cause a denial of service (infinite loop or stack consumption). (CVE-2014-6410)

James Eckersall discovered a buffer overflow in the Ceph filesystem in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (memory consumption and panic) or possibly have other unspecified impact via a long unencrypted auth ticket.
(CVE-2014-6416)

James Eckersall discovered a flaw in the handling of memory allocation failures in the Ceph filesystem. A remote attacker could exploit this flaw to cause a denial of service (system crash) or possibly have unspecified other impact. (CVE-2014-6417)

James Eckersall discovered a flaw in how the Ceph filesystem validates auth replies. A remote attacker could exploit this flaw to cause a denial of service (system crash) or possibly have other unspecified impact. (CVE-2014-6418).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated Red Hat Enterprise MRG Realtime packages that fix multiple security issues and add one enhancement are now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers.

MRG Realtime provides the highest levels of predictability for consistent low-latency response times to meet the needs of time-sensitive workloads. MRG Realtime also provides new levels of determinism by optimizing lengthy kernel code paths to ensure that they do not become bottlenecks. This allows for better prioritization of applications, resulting in consistent, predictable response times for high-priority applications.

  * An out-of-bounds write flaw was found in the way the     Apple Magic Mouse/Trackpad multi-touch driver handled     Human Interface Device (HID) reports with an invalid     size. An attacker with physical access to the system     could use this flaw to crash the system or, potentially,     escalate their privileges on the system. (CVE-2014-3181,     Moderate)

  * A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed completion     commands sent via USB Request Blocks buffers. An     attacker with physical access to the system could use     this flaw to crash the system or, potentially, escalate     their privileges on the system. (CVE-2014-3185,     Moderate)

  * A race condition flaw was found in the way the Linux     kernel's mmap(2), madvise(2), and fallocate(2) system     calls interacted with each other while operating on     virtual memory file system files. A local user could use     this flaw to cause a denial of service. (CVE-2014-4171,     Moderate)

  * A stack overflow flaw caused by infinite recursion was     found in the way the Linux kernel's Universal Disk     Format (UDF) file system implementation processed     indirect Information Control Blocks (ICBs). An attacker     with physical access to the system could use a specially     crafted UDF image to crash the system. (CVE-2014-6410,     Low)

  * An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system. (CVE-2014-3182, Low)

  * Multiple out-of-bounds write flaws were found in the     way the Cherry Cymotion keyboard driver, KYE/Genius     device drivers, Logitech device drivers, Monterey     Genius KB29E keyboard driver, Petalynx Maxter remote     control driver, and Sunplus wireless desktop driver     handled HID reports with an invalid report descriptor     size. An attacker with physical access to the system     could use either of these flaws to write data past an     allocated memory buffer. (CVE-2014-3184, Low)

  * It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a specially     crafted ISO image to crash the system or, potentially,     escalate their privileges on the system. (CVE-2014-5471,     CVE-2014-5472, Low)

This update also adds the following enhancement :

  * The Solarflare SFC9120 10GBE Ethernet NICs were not     supported by the MRG Realtime kernel. With this update,     the drivers have been updated to enable the Solarflare     SFC9120 cards on the Realtime kernel. (BZ#1086945)

All Red Hat Enterprise MRG Realtime users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement.

The 3.14.19 stable update contains a number of important fixes across the tree. The 3.14.18 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux v3.16.3. Various bugfixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

kernel-3.16.2-201 fixes CVE-2014-3186, CVE-2014-3181, and CVE-2014-3631.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124980	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1527)	Nessus	Huawei Local Security Checks	critical
124804	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1480)	Nessus	Huawei Local Security Checks	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
83696	SUSE SLES11 Security Update : kernel (SUSE-SU-2015:0481-1)	Nessus	SuSE Local Security Checks	high
81800	Oracle Linux 7 : kernel (ELSA-2015-0290)	Nessus	Oracle Linux Local Security Checks	high
80250	SuSE 11.3 Security Update : Linux kernel (SAT Patch Number 10103)	Nessus	SuSE Local Security Checks	high
80249	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 10037 / 10040)	Nessus	SuSE Local Security Checks	high
80152	openSUSE Security Update : the Linux Kernel (openSUSE-SU-2014:1677-1)	Nessus	SuSE Local Security Checks	high
80150	openSUSE Security Update : the Linux Kernel (openSUSE-SU-2014:1669-1)	Nessus	SuSE Local Security Checks	high
80014	Scientific Linux Security Update : kernel on SL7.x x86_64 (20141209)	Nessus	Scientific Linux Local Security Checks	high
80005	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3104)	Nessus	Oracle Linux Local Security Checks	high
79876	CentOS 7 : kernel (CESA-2014:1971)	Nessus	CentOS Local Security Checks	high
79848	RHEL 7 : kernel (RHSA-2014:1971)	Nessus	Red Hat Local Security Checks	high
79845	Oracle Linux 7 : kernel (ELSA-2014-1971)	Nessus	Oracle Linux Local Security Checks	high
78839	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3086)	Nessus	Oracle Linux Local Security Checks	medium
78757	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel Security (ELSA-2014-3085)	Nessus	Oracle Linux Local Security Checks	medium
78756	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel Security (ELSA-2014-3084)	Nessus	Oracle Linux Local Security Checks	medium
78617	Mandriva Linux Security Advisory : kernel (MDVSA-2014:201)	Nessus	Mandriva Local Security Checks	high
78259	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2379-1)	Nessus	Ubuntu Local Security Checks	high
78258	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2378-1)	Nessus	Ubuntu Local Security Checks	high
78257	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2376-1)	Nessus	Ubuntu Local Security Checks	high
78006	RHEL 6 : MRG (RHSA-2014:1318)	Nessus	Red Hat Local Security Checks	high
77974	Fedora 19 : kernel-3.14.19-100.fc19 (2014-11008)	Nessus	Fedora Local Security Checks	medium
77798	Fedora 21 : kernel-3.16.3-300.fc21 (2014-11097)	Nessus	Fedora Local Security Checks	medium
77767	Fedora 20 : kernel-3.16.2-201.fc20 (2014-11031)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-3181

high

Tenable Plugins

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

high

high

high

high

high

medium

medium

medium