The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An information-leak vulnerability was found in the     kernel when it truncated a file to a smaller size which     consisted of an inline extent that was compressed. The     data between the new file size and the old file size     was not discarded and the number of bytes used by the     inode were not correctly decremented, which gave the     wrong report for callers of the stat(2) syscall. This     wasted metadata space and allowed for the truncated     data to be leaked, and data corruption or loss to     occur. A caller of the clone ioctl could exploit this     flaw by using only standard file-system operations     without root access to read the truncated     data.(CVE-2015-8374i1/4%0

  - crypto/pcrypt.c in the Linux kernel, before 4.14.13,     mishandles freeing instances, allowing a local user     able to access the AF_ALG-based AEAD interface     (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt     (CONFIG_CRYPTO_PCRYPT) to cause a denial of service     (kfree of an incorrect pointer) or possibly have     unspecified other impact by executing a crafted     sequence of system calls. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-18075i1/4%0

  - An elevation of privilege vulnerability in the Qualcomm     Wi-Fi driver could enable a local malicious application     to execute arbitrary code within the context of the     kernel. This issue is rated as High because it first     requires compromising a privileged process. Product:
    Android. Versions: N/A. Android ID: A-32835279.
    References: QC-CR#1096945.(CVE-2017-0523i1/4%0

  - The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel through 4.10.14 allows local users to cause a     denial of service (out-of-bounds array access) or     possibly have unspecified other impact by changing a     certain sequence-number value, aka a 'double fetch'     vulnerability.(CVE-2017-8831i1/4%0

  - A flaw was found in the way the Linux kernel's splice()     system call validated its parameters. On certain file     systems, a local, unprivileged user could use this flaw     to write past the maximum file size, and thus crash the     system.(CVE-2014-7822i1/4%0

  - The vc4_get_bcl function in     drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM     driver in the Linux kernel before 4.9.7 does not set an     errno value upon certain overflow detections allowing     local users to cause a denial of service (incorrect     pointer dereference and OOPS) via inconsistent size     values in a VC4_SUBMIT_CL ioctl call.(CVE-2017-5577i1/4%0

  - In fs/ocfs2/cluster/nodemanager.c in the Linux kernel     before 4.15, local users can cause a denial of service     (NULL pointer dereference and BUG) because a required     mutex is not used.(CVE-2017-18216i1/4%0

  - A race condition issue leading to a use-after-free flaw     was found in the way the raw packet sockets     implementation in the Linux kernel networking subsystem     handled synchronization while creating the TPACKET_V3     ring buffer. A local user able to open a raw packet     socket (requires the CAP_NET_RAW capability) could use     this flaw to elevate their privileges on the     system.(CVE-2016-8655i1/4%0

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112i1/4%0

  - A security flaw was found in the Linux kernel in a way     that the cleancache subsystem clears an inode after the     final file truncation (removal). The new file created     with the same inode may contain leftover pages from     cleancache and the old file data instead of the new     one.(CVE-2018-16862i1/4%0

  - arch/arm64/ include /asm/pgtable.h in the Linux kernel     before 3.15-rc5-next-20140519, as used in Android     before 2016-07-05 on Nexus 5X and 6P devices,     mishandles execute-only pages, which allows attackers     to gain privileges via a crafted application, aka     Android internal bug 28557020.(CVE-2014-9803i1/4%0

  - A heap-buffer overflow vulnerability was found in the     arcmsr_iop_message_xfer() function in     'drivers/scsi/arcmsr/arcmsr_hba.c' file in the Linux     kernel through 4.8.2. The function does not restrict a     certain length field, which allows local users to gain     privileges or cause a denial of service via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code. This can     potentially cause kernel heap corruption and arbitrary     kernel code execution.(CVE-2016-7425i1/4%0

  - An issue was discovered in the Linux kernel before     4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to     obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev     and next fields via an SIOCFINDIPDDPRT ioctl     call.(CVE-2018-20511i1/4%0

  - A memory leak in the irda_bind function in     net/irda/af_irda.c in the Linux kernel, through 4.16,     allows local users to cause a denial of service due to     a memory consumption by repeatedly binding an AF_IRDA     socket.(CVE-2018-6554i1/4%0

  - sound/core/timer.c in the Linux kernel before 4.4.1     employs a locking approach that does not consider slave     timer instances, which allows local users to cause a     denial of service (race condition, use-after-free, and     system crash) via a crafted ioctl     call.(CVE-2016-2547i1/4%0

  - Buffer overflow in the complete_emulated_mmio function     in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6     allows guest OS users to execute arbitrary code on the     host OS by leveraging a loop that triggers an invalid     memory copy affecting certain cancel_work_item     data.(CVE-2014-0049i1/4%0

  - An issue was discovered in the F2FS filesystem code in     the Linux kernel in fs/f2fs/inode.c. A denial of     service due to a slab out-of-bounds read can occur for     a crafted f2fs filesystem image in which FI_EXTRA_ATTR     is set in an inode.(CVE-2018-13098i1/4%0

  - A vulnerability was found in the Linux kernel where     having malicious IP options present would cause the     ipv4_pktinfo_prepare() function to drop/free the dst.
    This could result in a system crash or possible     privilege escalation.(CVE-2017-5970i1/4%0

  - In the Linux kernel's vmw_gb_surface_define_ioctl()     function, in 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c'     file, a 'req-i1/4zmip_levels' is a user-controlled value     which is later used as a loop count limit. This allows     local unprivileged user to cause a denial of service by     a kernel lockup via a crafted ioctl call for a     '/dev/dri/renderD*' device.(CVE-2017-7346i1/4%0

  - It was found that the NFSv4 server in the Linux kernel     did not properly validate layout type when processing     NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A     remote attacker could use this flaw to soft-lockup the     system and thus cause denial of     service.(CVE-2017-8797i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0147 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3098 advisory.

    - virtio-net: drop NETIF_F_FRAGLIST (Jason Wang)  [Orabug: 22145600]  {CVE-2015-5156}
    - RDS: fix race condition when sending a message on unbound socket. (Quentin Casasnovas)  [Orabug:
    21882586]  {CVE-2015-6937}
    - sctp: fix ASCONF list handling (Marcelo Ricardo Leitner)  [Orabug: 21842665]  {CVE-2015-3212}
    - KEYS: ensure we free the assoc array edit if edit is valid (Colin Ian King)  [Orabug: 21842653]     {CVE-2015-1333}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.38 to receive various security and bugfixes.

This update contains the following feature enablements :

  - The remote block device (rbd) and ceph drivers have been     enabled and are now supported. (FATE#318350) These can     be used e.g. for accessing the SUSE Enterprise Storage     product services.

  - Support for Intel Select Bay trail CPUs has been added.
    (FATE#316038)

Following security issues were fixed :

  - CVE-2014-9419: The __switch_to function in     arch/x86/kernel/process_64.c in the Linux kernel through     3.18.1 did not ensure that Thread Local Storage (TLS)     descriptors were loaded before proceeding with other     steps, which made it easier for local users to bypass     the ASLR protection mechanism via a crafted application     that reads a TLS base address (bnc#911326).

  - CVE-2014-7822: A flaw was found in the way the Linux     kernels splice() system call validated its parameters.
    On certain file systems, a local, unprivileged user     could have used this flaw to write past the maximum file     size, and thus crash the system.

  - CVE-2014-8160: The connection tracking module could be     bypassed if a specific protocol module was not loaded,     e.g. allowing SCTP traffic while the firewall should     have filtered it.

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel before     3.18.2 did not validate a length value in the Extensions     Reference (ER) System Use Field, which allowed local     users to obtain sensitive information from kernel memory     via a crafted iso9660 image (bnc#912654).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel was updated to fix various bugs and security issues.

Following security issues were fixed :

  - CVE-2014-8173: A NULL pointer dereference flaw was found     in the way the Linux kernels madvise MADV_WILLNEED     functionality handled page table locking. A local,     unprivileged user could have used this flaw to crash the     system.

  - CVE-2015-1593: A integer overflow reduced the     effectiveness of the stack randomization on 64-bit     systems.

  - CVE-2014-7822: A flaw was found in the way the Linux     kernels splice() system call validated its parameters.
    On certain file systems, a local, unprivileged user     could have used this flaw to write past the maximum file     size, and thus crash the system.

  - CVE-2014-9419: The __switch_to function in     arch/x86/kernel/process_64.c in the Linux kernel did not     ensure that Thread Local Storage (TLS) descriptors are     loaded before proceeding with other steps, which made it     easier for local users to bypass the ASLR protection     mechanism via a crafted application that reads a TLS     base address.

  - CVE-2014-8134: The paravirt_ops_setup function in     arch/x86/kernel/kvm.c in the Linux kernel used an     improper paravirt_enabled setting for KVM guest kernels,     which made it easier for guest OS users to bypass the     ASLR protection mechanism via a crafted application that     reads a 16-bit value.

  - CVE-2014-8160:
    net/netfilter/nf_conntrack_proto_generic.c in the Linux     kernel generated incorrect conntrack entries during     handling of certain iptables rule sets for the SCTP,     DCCP, GRE, and UDP-Lite protocols, which allowed remote     attackers to bypass intended access restrictions via     packets with disallowed port numbers.

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key.

  - CVE-2014-8559: The d_walk function in fs/dcache.c in the     Linux kernel through did not properly maintain the     semantics of rename_lock, which allowed local users to     cause a denial of service (deadlock and system hang) via     a crafted application.

  - CVE-2014-9420: The rock_continue function in     fs/isofs/rock.c in the Linux kernel did not restrict the     number of Rock Ridge continuation entries, which allowed     local users to cause a denial of service (infinite loop,     and system crash or hang) via a crafted iso9660 image.

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel did not     validate a length value in the Extensions Reference (ER)     System Use Field, which allowed local users to obtain     sensitive information from kernel memory via a crafted     iso9660 image.

  - CVE-2014-9585: The vdso_addr function in     arch/x86/vdso/vma.c in the Linux kernel did not properly     choose memory locations for the vDSO area, which made it     easier for local users to bypass the ASLR protection     mechanism by guessing a location at the end of a PMD.

Following bugs were fixed :

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 0103 (bnc#920901).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 016f (bnc#920901).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 009b (bnc#920901).

  - HID: usbhid: add another mouse that needs     QUIRK_ALWAYS_POLL (bnc#920901).

  - HID: usbhid: fix PIXART optical mouse (bnc#920901).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen (bnc#920901).

  - HID: usbhid: add always-poll quirk (bnc#920901).

  - storvsc: ring buffer failures may result in I/O freeze     (bnc#914175).

  - mm, vmscan: prevent kswapd livelock due to     pfmemalloc-throttled process being killed (VM     Functionality bnc#910150).

  - Input: evdev - fix EVIOCG(type) ioctl (bnc#904899).

  - mnt: Implicitly add MNT_NODEV on remount when it was     implicitly added by mount (bsc#907988).

  - DocBook: Do not exceed argument list limit.

  - DocBook: Make mandocs parallel-safe.

  - mm: free compound page with correct order (bnc#913695).

  - udf: Check component length before reading it.

  - udf: Check path length when reading symlink.

  - udf: Verify symlink size before loading it.

  - udf: Verify i_size when loading inode.

  - xfs: remote attribute overwrite causes transaction     overrun.

This update fixes the CVEs described below.

A further issue, CVE-2014-9419, was considered, but appears to require extensive changes with a consequent high risk of regression. It is now unlikely to be fixed in squeeze-lts.

CVE-2013-6885

It was discovered that under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang on AMD 16h 00h through 0Fh processors. A local user can use this flaw to mount a denial of service (system hang) via a crafted application.

For more information please refer to the AMD CPU erratum 793 in http://support.amd.com/TechDocs/51810_16h_00h-0Fh_Rev_Guide.
pdf

CVE-2014-7822

It was found that the splice() system call did not validate the given file offset and length. A local unprivileged user can use this flaw to cause filesystem corruption on ext4 filesystems, or possibly other effects.

CVE-2014-8133

It was found that the espfix functionality can be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks for) and using it for stack. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8134

It was found that the espfix functionality is wrongly disabled in a 32-bit KVM guest. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8160

It was found that a netfilter (iptables or ip6tables) rule accepting packets to a specific SCTP, DCCP, GRE or UDPlite port/endpoint could result in incorrect connection tracking state. If only the generic connection tracking module (nf_conntrack) was loaded, and not the protocol-specific connection tracking module, this would allow access to any port/endpoint of the specified protocol.

CVE-2014-9420

It was found that the ISO-9660 filesystem implementation (isofs) follows arbitrarily long chains, including loops, of Continuation Entries (CEs). This allows local users to mount a denial of service via a crafted disc image.

CVE-2014-9584

It was found that the ISO-9660 filesystem implementation (isofs) does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted disc image.

CVE-2014-9585

It was discovered that address randomisation for the vDSO in 64-bit processes is extremely biassed. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

CVE-2015-1421

It was found that the SCTP implementation could free authentication state while it was still in use, resulting in heap corruption. This could allow remote users to cause a denial of service or privilege escalation.

CVE-2015-1593

It was found that address randomisation for the initial stack in 64-bit processes was limited to 20 rather than 22 bits of entropy. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2544-1 advisory.

    Eric Windisch discovered flaw in how the Linux kernel's XFS file system replaces remote attributes. A     local access with access to an XFS file system could exploit this flaw to escalate their privileges.
    (CVE-2015-0274)

    A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A     local user could exploit this flaw to load installed kernel modules, increasing the attack surface and     potentially using this to gain administrative privileges. (CVE-2013-7421)

    The Linux kernel's splice system call did not correctly validate its parameters. A local, unprivileged     user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-7822)

    A flaw was discovered in the crypto subsystem when screening module names for automatic module loading if     the name contained a valid crypto module name, eg. vfat(aes). A local user could exploit this flaw to load     installed kernel modules, increasing the attack surface and potentially using this to gain administrative     privileges. (CVE-2014-9644)

    Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) failed to verify symlink size info. A     local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a     denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9728)

    Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not valid inode size information . A     local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a     denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9729)

    Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not correctly verify the component     length for symlinks. A local attacker, who is able to mount a malicous UDF file system image, could     exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors.
    (CVE-2014-9730)

    Carl H Lunde discovered an information leak in the UDF file system (CONFIG_UDF_FS). A local attacker, who     is able to mount a malicous UDF file system image, could exploit this flaw to read potential sensitve     kernel memory. (CVE-2014-9731)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Eric Windisch discovered flaw in how the Linux kernel's XFS file system replaces remote attributes. A local access with access to an XFS file system could exploit this flaw to escalate their privileges.
(CVE-2015-0274)

A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges.
(CVE-2013-7421)

The Linux kernel's splice system call did not correctly validate its parameters. A local, unprivileged user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-7822)

A flaw was discovered in the crypto subsystem when screening module names for automatic module loading if the name contained a valid crypto module name, eg. vfat(aes). A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges.
(CVE-2014-9644).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel's splice system call did not correctly validate its parameters. A local, unprivileged user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-7822)

A flaw was discovered in how Thread Local Storage (TLS) is handled by the task switching function in the Linux kernel for x86_64 based machines. A local user could exploit this flaw to bypass the Address Space Layout Radomization (ASLR) protection mechanism. (CVE-2014-9419)

Dmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file name decoding. A local unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain administrative privileges. (CVE-2014-9683)

Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. (CVE-2015-1421).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0694 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the way the Linux kernel's XFS file system handled     replacing of remote attributes under certain conditions. A local user with     access to XFS file system mount could potentially use this flaw to escalate     their privileges on the system. (CVE-2015-0274, Important)

    * A flaw was found in the way the Linux kernel's splice() system call     validated its parameters. On certain file systems, a local, unprivileged     user could use this flaw to write past the maximum file size, and thus     crash the system. (CVE-2014-7822, Moderate)

    * A race condition flaw was found in the Linux kernel's ext4 file system     implementation that allowed a local, unprivileged user to crash the system     by simultaneously writing to a file and toggling the O_DIRECT flag using     fcntl(F_SETFL) on that file. (CVE-2014-8086, Moderate)

    * It was found that due to excessive files_lock locking, a soft lockup     could be triggered in the Linux kernel when performing asynchronous I/O     operations. A local, unprivileged user could use this flaw to crash the     system. (CVE-2014-8172, Moderate)

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     madvise MADV_WILLNEED functionality handled page table locking. A local,     unprivileged user could use this flaw to crash the system. (CVE-2014-8173,     Moderate)

    Red Hat would like to thank Eric Windisch of the Docker project for     reporting CVE-2015-0274, and Akira Fujita of NEC for reporting     CVE-2014-7822.

    Bug fixes:

    * A patch removing the xt_connlimit revision zero ABI was not reverted in     the kernel-rt package, which caused problems because the iptables package     requires this revision. A patch to remove the xt_connlimit revision 0 was     reverted from the kernel-rt sources to allow the iptables command to     execute correctly. (BZ#1169755)

    * With an older Mellanox Connect-IB (mlx4) driver present in the MRG     Realtime kernel, a race condition could occur that would cause a loss of     connection. The mlx4 driver was updated, resolving the race condition and     allowing proper connectivity. (BZ#1182246)

    * The MRG Realtime kernel did not contain the appropriate code to resume     after a device failed, causing the volume status after a repair to not be     properly updated. A refresh needed was still listed in the lvs output     after executing the lvchange --refresh command. A patch was added that     adds the ability to correctly restore a transiently failed device upon     resume. (BZ#1159803)

    * The sosreport executable would hang when reading     /proc/net/rpc/use-gss-proxy because of faulty wait_queue logic in the proc     handler. This wait_queue logic was removed from the proc handler, allowing     the reads to correctly return the current state. (BZ#1169900)

    Enhancements:

    * The MRG Realtime kernel-rt sources have been modified to take advantage     of the updated 3.10 kernel sources that are available with the Red Hat     Enterprise Linux 7 releases. (BZ#1172844)

    * The MRG Realtime version of the e1000e driver has been updated to provide     support for the Intel I218-LM network adapter. (BZ#1191767)

    * The MRG Realtime kernel was updated to provide support for the     Mellanox Connect-IB (mlx5). (BZ#1171363)

    * The rt-firmware package has been updated to provide additional firmware     files required by the new version of the Red Hat Enterprise MRG 2.5 kernel     (BZ#1184251)

    All kernel-rt users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add these     enhancements. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- It was found that the Linux kernel's Infiniband     subsystem did not properly sanitize input parameters     while registering memory regions from user space via the     (u)verbs API. A local user with access to a     /dev/infiniband/uverbsX device could use this flaw to     crash the system or, potentially, escalate their     privileges on the system. (CVE-2014-8159, Important)

  - A flaw was found in the way the Linux kernel's splice()     system call validated its parameters. On certain file     systems, a local, unprivileged user could use this flaw     to write past the maximum file size, and thus crash the     system. (CVE-2014-7822, Moderate)

  - A flaw was found in the way the Linux kernel's netfilter     subsystem handled generic protocol tracking. As     demonstrated in the Stream Control Transmission Protocol     (SCTP) case, a remote attacker could use this flaw to     bypass intended iptables rule restrictions when the     associated connection tracking module was not loaded on     the system. (CVE-2014-8160, Moderate)

  - It was found that the fix for CVE-2014-3601 was     incomplete: the Linux kernel's kvm_iommu_map_pages()     function still handled IOMMU mapping failures     incorrectly. A privileged user in a guest with an     assigned host device could use this flaw to crash the     host. (CVE-2014-8369, Moderate)

Bug fixes :

  - The maximum amount of entries in the IPv6 route table     (net.ipv6.route.max_size) was 4096, and every route     towards this maximum size limit was counted.
    Communication to more systems was impossible when the     limit was exceeded. Now, only cached routes are counted,     which guarantees that the kernel does not run out of     memory, but the user can now install as many routes as     the memory allows until the kernel indicates it can no     longer handle the amount of memory and returns an error     message.

In addition, the default 'net.ipv6.route.max_size' value has been increased to 16384 for performance improvement reasons.

  - When the user attempted to scan for an FCOE-served     Logical Unit Number (LUN), after an initial LUN scan, a     kernel panic occurred in bnx2fc_init_task. System     scanning for LUNs is now stable after LUNs have been     added.

  - Under certain conditions, such as when attempting to     scan the network for LUNs, a race condition in the     bnx2fc driver could trigger a kernel panic in     bnx2fc_init_task. A patch fixing a locking issue that     caused the race condition has been applied, and scanning     the network for LUNs no longer leads to a kernel panic.

  - Previously, it was not possible to boot the kernel on     Xen hypervisor in PVHVM mode if more than 32 vCPUs were     specified in the guest configuration. Support for more     than 32 vCPUs has been added, and the kernel now boots     successfully in the described situation.

  - When the NVMe driver allocated a namespace queue, it     indicated that it was a request-based driver when it was     actually a block I/O-based driver. Consequently, when     NVMe driver was loaded along with a request-based dm     device, the system could terminate unexpectedly or     become unresponsive when attempting to access data. The     NVMe driver no longer sets the QUEUE_FLAG_STACKABLE bit     when allocating a namespace queue and device- mapper no     longer perceives NVMe driver as request-based; system     hangs or crashes no longer occur.

  - If a user attempted to apply an NVRAM firmware update     when running the tg3 module provided with Scientific     Linux 6.6 kernels, the update could fail. As a     consequence, the Network Interface Card (NIC) could stay     in an unusable state and this could prevent the entire     system from booting. The tg3 module has been updated to     correctly apply firmware updates.

  - Support for key sizes of 256 and 192 bits has been added     to AES-NI.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system.
(CVE-2014-8159, Important)

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

* A flaw was found in the way the Linux kernel's netfilter subsystem handled generic protocol tracking. As demonstrated in the Stream Control Transmission Protocol (SCTP) case, a remote attacker could use this flaw to bypass intended iptables rule restrictions when the associated connection tracking module was not loaded on the system.
(CVE-2014-8160, Moderate)

* It was found that the fix for CVE-2014-3601 was incomplete: the Linux kernel's kvm_iommu_map_pages() function still handled IOMMU mapping failures incorrectly. A privileged user in a guest with an assigned host device could use this flaw to crash the host.
(CVE-2014-8369, Moderate)

Red Hat would like to thank Mellanox for reporting CVE-2014-8159, and Akira Fujita of NEC for reporting CVE-2014-7822.

Bug fixes :

* The maximum amount of entries in the IPv6 route table (net.ipv6.route.max_size) was 4096, and every route towards this maximum size limit was counted. Communication to more systems was impossible when the limit was exceeded. Now, only cached routes are counted, which guarantees that the kernel does not run out of memory, but the user can now install as many routes as the memory allows until the kernel indicates it can no longer handle the amount of memory and returns an error message.

In addition, the default 'net.ipv6.route.max_size' value has been increased to 16384 for performance improvement reasons. (BZ#1177581)

* When the user attempted to scan for an FCOE-served Logical Unit Number (LUN), after an initial LUN scan, a kernel panic occurred in bnx2fc_init_task. System scanning for LUNs is now stable after LUNs have been added. (BZ#1179098)

* Under certain conditions, such as when attempting to scan the network for LUNs, a race condition in the bnx2fc driver could trigger a kernel panic in bnx2fc_init_task. A patch fixing a locking issue that caused the race condition has been applied, and scanning the network for LUNs no longer leads to a kernel panic. (BZ#1179098)

* Previously, it was not possible to boot the kernel on Xen hypervisor in PVHVM mode if more than 32 vCPUs were specified in the guest configuration. Support for more than 32 vCPUs has been added, and the kernel now boots successfully in the described situation. (BZ#1179343)

* When the NVMe driver allocated a namespace queue, it indicated that it was a request-based driver when it was actually a block I/O-based driver. Consequently, when NVMe driver was loaded along with a request-based dm device, the system could terminate unexpectedly or become unresponsive when attempting to access data. The NVMe driver no longer sets the QUEUE_FLAG_STACKABLE bit when allocating a namespace queue and device-mapper no longer perceives NVMe driver as request-based; system hangs or crashes no longer occur. (BZ#1180555)

* If a user attempted to apply an NVRAM firmware update when running the tg3 module provided with Red Hat Enterprise Linux 6.6 kernels, the update could fail. As a consequence, the Network Interface Card (NIC) could stay in an unusable state and this could prevent the entire system from booting. The tg3 module has been updated to correctly apply firmware updates. (BZ#1182903)

* Support for key sizes of 256 and 192 bits has been added to AES-NI.
(BZ#1184332)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0674 advisory.

    - [infiniband] core: Prevent integer overflow in ib_umem_get address arithmetic (Doug Ledford) [1181173     1179327] {CVE-2014-8159}
    - [fs] splice: perform generic write checks (Eric Sandeen) [1163798 1155900] {CVE-2014-7822}
    - [virt] kvm: excessive pages un-pinning in kvm_iommu_map error path (Jacob Tanenbaum) [1156520 1156521]     {CVE-2014-8369}
    - [net] netfilter: conntrack: disable generic tracking for known protocols (Daniel Borkmann) [1182071     1114697] {CVE-2014-8160}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation.

  - CVE-2013-7421 / CVE-2014-9644     It was discovered that the Crypto API allowed     unprivileged users to load arbitrary kernel modules. A     local user can use this flaw to exploit vulnerabilities     in modules that would not normally be loaded.

  - CVE-2014-7822     Akira Fujita found that the splice() system call did not     validate the given file offset and length. A local     unprivileged user can use this flaw to cause filesystem     corruption on ext4 filesystems, or possibly other     effects.

  - CVE-2014-8160     Florian Westphal discovered that a netfilter     (iptables/ip6tables) rule accepting packets to a     specific SCTP, DCCP, GRE or UDPlite port/endpoint could     result in incorrect connection tracking state. If only     the generic connection tracking module (nf_conntrack)     was loaded, and not the protocol-specific connection     tracking module, this would allow access to any     port/endpoint of the specified protocol.

  - CVE-2014-8559     It was found that kernel functions that iterate over a     directory tree can dead-lock or live-lock in case some     of the directory entries were recently deleted or     dropped from the cache. A local unprivileged user can     use this flaw for denial of service.

  - CVE-2014-9585     Andy Lutomirski discovered that address randomisation     for the vDSO in 64-bit processes is extremely biased. A     local unprivileged user could potentially use this flaw     to bypass the ASLR protection mechanism.

  - CVE-2014-9683     Dmitry Chernenkov discovered that eCryptfs writes past     the end of the allocated buffer during encrypted     filename decoding, resulting in local denial of service.

  - CVE-2015-0239     It was found that KVM did not correctly emulate the x86     SYSENTER instruction. An unprivileged user within a     guest system that has not enabled SYSENTER, for example     because the emulated CPU vendor is AMD, could     potentially use this flaw to cause a denial of service     or privilege escalation in that guest.

  - CVE-2015-1420     It was discovered that the open_by_handle_at() system     call reads the handle size from user memory a second     time after validating it. A local user with the     CAP_DAC_READ_SEARCH capability could use this flaw for     privilege escalation.

  - CVE-2015-1421     It was found that the SCTP implementation could free an     authentication state while it was still in use,     resulting in heap corruption. This could allow remote     users to cause a denial of service or privilege     escalation.

  - CVE-2015-1593     It was found that address randomisation for the initial     stack in 64-bit processes was limited to 20 rather than     22 bits of entropy. A local unprivileged user could     potentially use this flaw to bypass the ASLR protection     mechanism.

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a 'negative groups' issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c. (CVE-2014-8989)

A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822)

- A flaw was found in the way the Linux kernel's splice()     system call validated its parameters. On certain file     systems, a local, unprivileged user could use this flaw     to write past the maximum file size, and thus crash the     system. (CVE-2014-7822, Moderate)

This update also fixes the following bugs :

  - Previously, hot-unplugging of a virtio-blk device could     in some cases lead to a kernel panic, for example during     in-flight I/O requests. This update fixes race condition     in the hot-unplug code in the virtio_blk.ko module. As a     result, hot unplugging of the virtio-blk device no     longer causes the guest kernel oops when there are     in-flight I/O requests.

  - Before this update, due to a bug in the error-handling     path, a corrupted metadata block could be used as a     valid block. With this update, the error handling path     has been fixed and more checks have been added to verify     the metadata block. Now, when a corrupted metadata block     is encountered, it is properly marked as corrupted and     handled accordingly.

  - Previously, an incorrectly initialized variable resulted     in a random value being stored in the variable that     holds the number of default ACLs, and is sent in the     SET_PATH_INFO data structure. Consequently, the setfacl     command could, under certain circumstances, fail with an     'Invalid argument' error. With this update, the variable     is correctly initialized to zero, thus fixing the bug.

The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-0164 advisory.

    - [fs] splice: perform generic write checks (Eric Sandeen) [1155908] {CVE-2014-7822}
    - [x86] traps: stop using IST for #SS (Petr Matousek) [1172809] {CVE-2014-9322}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

Red Hat would like to thank Akira Fujita of NEC for reporting this issue.

This update also fixes the following bugs :

* Previously, hot-unplugging of a virtio-blk device could in some cases lead to a kernel panic, for example during in-flight I/O requests. This update fixes race condition in the hot-unplug code in the virtio_blk.ko module. As a result, hot unplugging of the virtio-blk device no longer causes the guest kernel oops when there are in-flight I/O requests. (BZ#1006536)

* Before this update, due to a bug in the error-handling path, a corrupted metadata block could be used as a valid block. With this update, the error handling path has been fixed and more checks have been added to verify the metadata block. Now, when a corrupted metadata block is encountered, it is properly marked as corrupted and handled accordingly. (BZ#1034403)

* Previously, an incorrectly initialized variable resulted in a random value being stored in the variable that holds the number of default ACLs, and is sent in the SET_PATH_INFO data structure. Consequently, the setfacl command could, under certain circumstances, fail with an 'Invalid argument' error. With this update, the variable is correctly initialized to zero, thus fixing the bug. (BZ#1105625)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system. (CVE-2014-7841, Important)

* A race condition flaw was found in the way the Linux kernel's mmap(2), madvise(2), and fallocate(2) system calls interacted with each other while operating on virtual memory file system files. A local user could use this flaw to cause a denial of service.
(CVE-2014-4171, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's Common Internet File System (CIFS) implementation handled mounting of file system shares. A remote attacker could use this flaw to crash a client system that would mount a file system share from a malicious server. (CVE-2014-7145, Moderate)

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

* It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags.
An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low)

Red Hat would like to thank Akira Fujita of NEC for reporting the CVE-2014-7822 issue. The CVE-2014-7841 issue was discovered by Liu Wei of Red Hat.

This update also fixes the following bugs :

* Previously, a kernel panic could occur if a process reading from a locked NFS file was killed and the lock was not released properly before the read operations finished. Consequently, the system crashed.
The code handling file locks has been fixed, and instead of halting, the system now emits a warning about the unreleased lock. (BZ#1172266)

* A race condition in the command abort handling logic of the ipr device driver could cause the kernel to panic when the driver received a response to an abort command prior to receiving other responses to the aborted command due to the support for multiple interrupts. With this update, the abort handler waits for the aborted command's responses first before completing an abort operation. (BZ#1162734)

* Previously, a race condition could occur when changing a Page Table Entry (PTE) or a Page Middle Directory (PMD) to 'pte_numa' or 'pmd_numa', respectively, causing the kernel to crash. This update removes the BUG_ON() macro from the __handle_mm_fault() function, preventing the kernel panic in the aforementioned scenario.
(BZ#1170662)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

- A flaw was found in the way the Linux kernel's SCTP     implementation validated INIT chunks when performing     Address Configuration Change (ASCONF). A remote attacker     could use this flaw to crash the system by sending a     specially crafted SCTP packet to trigger a NULL pointer     dereference on the system. (CVE-2014-7841, Important)

  - A race condition flaw was found in the way the Linux     kernel's mmap(2), madvise(2), and fallocate(2) system     calls interacted with each other while operating on     virtual memory file system files. A local user could use     this flaw to cause a denial of service. (CVE-2014-4171,     Moderate)

  - A NULL pointer dereference flaw was found in the way the     Linux kernel's Common Internet File System (CIFS)     implementation handled mounting of file system shares. A     remote attacker could use this flaw to crash a client     system that would mount a file system share from a     malicious server. (CVE-2014-7145, Moderate)

  - A flaw was found in the way the Linux kernel's splice()     system call validated its parameters. On certain file     systems, a local, unprivileged user could use this flaw     to write past the maximum file size, and thus crash the     system. (CVE-2014-7822, Moderate)

  - It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a specially     crafted ISO image to crash the system or, potentially,     escalate their privileges on the system. (CVE-2014-5471,     CVE-2014-5472, Low)

This update also fixes the following bugs :

  - Previously, a kernel panic could occur if a process     reading from a locked NFS file was killed and the lock     was not released properly before the read operations     finished. Consequently, the system crashed. The code     handling file locks has been fixed, and instead of     halting, the system now emits a warning about the     unreleased lock.

  - A race condition in the command abort handling logic of     the ipr device driver could cause the kernel to panic     when the driver received a response to an abort command     prior to receiving other responses to the aborted     command due to the support for multiple interrupts. With     this update, the abort handler waits for the aborted     command's responses first before completing an abort     operation.

  - Previously, a race condition could occur when changing a     Page Table Entry (PTE) or a Page Middle Directory (PMD)     to 'pte_numa' or 'pmd_numa', respectively, causing the     kernel to crash. This update removes the BUG_ON() macro     from the __handle_mm_fault() function, preventing the     kernel panic in the aforementioned scenario.

The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0102 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the way the Linux kernel's SCTP implementation     validated INIT chunks when performing Address Configuration Change     (ASCONF). A remote attacker could use this flaw to crash the system by     sending a specially crafted SCTP packet to trigger a NULL pointer     dereference on the system. (CVE-2014-7841, Important)

    * A race condition flaw was found in the way the Linux kernel's mmap(2),     madvise(2), and fallocate(2) system calls interacted with each other while     operating on virtual memory file system files. A local user could use this     flaw to cause a denial of service. (CVE-2014-4171, Moderate)

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     Common Internet File System (CIFS) implementation handled mounting of file     system shares. A remote attacker could use this flaw to crash a client     system that would mount a file system share from a malicious server.
    (CVE-2014-7145, Moderate)

    * A flaw was found in the way the Linux kernel's splice() system call     validated its parameters. On certain file systems, a local, unprivileged     user could use this flaw to write past the maximum file size, and thus     crash the system. (CVE-2014-7822, Moderate)

    * It was found that the parse_rock_ridge_inode_internal() function of the     Linux kernel's ISOFS implementation did not correctly check relocated     directories when processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a specially crafted ISO image     to crash the system or, potentially, escalate their privileges on the     system. (CVE-2014-5471, CVE-2014-5472, Low)

    Red Hat would like to thank Akira Fujita of NEC for reporting the     CVE-2014-7822 issue. The CVE-2014-7841 issue was discovered by Liu Wei of     Red Hat.

    This update also fixes the following bugs:

    * Previously, a kernel panic could occur if a process reading from a locked     NFS file was killed and the lock was not released properly before the read     operations finished. Consequently, the system crashed. The code handling     file locks has been fixed, and instead of halting, the system now emits a     warning about the unreleased lock. (BZ#1172266)

    * A race condition in the command abort handling logic of the ipr device     driver could cause the kernel to panic when the driver received a response     to an abort command prior to receiving other responses to the aborted     command due to the support for multiple interrupts. With this update, the     abort handler waits for the aborted command's responses first before     completing an abort operation. (BZ#1162734)

    * Previously, a race condition could occur when changing a Page Table Entry     (PTE) or a Page Middle Directory (PMD) to pte_numa or pmd_numa,     respectively, causing the kernel to crash. This update removes the BUG_ON()     macro from the __handle_mm_fault() function, preventing the kernel panic in     the aforementioned scenario. (BZ#1170662)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0102 advisory.

    - [mm] shmem: fix splicing from a hole while it's punched (Denys Vlasenko) [1118244 1118245]     {CVE-2014-4171}
    - [mm] shmem: fix faulting into a hole, not taking i_mutex (Denys Vlasenko) [1118244 1118245]     {CVE-2014-4171}
    - [mm] shmem: fix faulting into a hole while it's punched (Denys Vlasenko) [118244 1118245]     {CVE-2014-4171}
    - [x86] traps: stop using IST for #SS (Petr  Matousek) [1172812 1172813] {CVE-2014-9322}
    - [fs] splice: perform generic write checks (Eric Sandeen) [1163799 1155907] {CVE-2014-7822}
    - [net] sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)     [1163094 1154002] {CVE-2014-7841}
    - [fs] cifs: NULL pointer dereference in SMB2_tcon (Jacob Tanenbaum) [1147528 1147529] {CVE-2014-7145}
    - [fs] isofs: unbound recursion when processing relocated directories (Jacob Tanenbaum) [1142270 1142271]     {CVE-2014-5471 CVE-2014-5472}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
124806	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1482)	Nessus	Huawei Local Security Checks	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
86882	OracleVM 3.3 : kernel-uek (OVMSA-2015-0147)	Nessus	OracleVM Local Security Checks	high
86881	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3098)	Nessus	Oracle Linux Local Security Checks	medium
85854	F5 Networks BIG-IP : Linux kernel vulnerability (SOL17237)	Nessus	F5 Networks Local Security Checks	high
83702	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0529-1)	Nessus	SuSE Local Security Checks	high
82755	openSUSE Security Update : the Linux Kernel (openSUSE-2015-301)	Nessus	SuSE Local Security Checks	high
82138	Debian DLA-155-1 : linux-2.6 security update	Nessus	Debian Local Security Checks	critical
82071	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2544-1)	Nessus	Ubuntu Local Security Checks	medium
82070	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2543-1)	Nessus	Ubuntu Local Security Checks	high
82069	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2541-1)	Nessus	Ubuntu Local Security Checks	critical
82020	SuSE 11.3 Security Update : Linux Kernel (SAT Patch Numbers 10412 / 10415 / 10416)	Nessus	SuSE Local Security Checks	high
81905	RHEL 6 : kernel-rt (RHSA-2015:0694)	Nessus	Red Hat Local Security Checks	medium
81809	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20150311)	Nessus	Scientific Linux Local Security Checks	high
81792	CentOS 6 : kernel (CESA-2015:0674)	Nessus	CentOS Local Security Checks	high
81769	RHEL 6 : kernel (RHSA-2015:0674)	Nessus	Red Hat Local Security Checks	high
81766	Oracle Linux 6 : kernel (ELSA-2015-0674)	Nessus	Oracle Linux Local Security Checks	high
81449	Debian DSA-3170-1 : linux - security update	Nessus	Debian Local Security Checks	critical
81322	Amazon Linux AMI : kernel (ALAS-2015-476)	Nessus	Amazon Linux Local Security Checks	high
81308	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20150210)	Nessus	Scientific Linux Local Security Checks	high
81307	Oracle Linux 5 : kernel (ELSA-2015-0164)	Nessus	Oracle Linux Local Security Checks	high
81291	RHEL 5 : kernel (RHSA-2015:0164)	Nessus	Red Hat Local Security Checks	high
81276	CentOS 5 : kernel (CESA-2015:0164)	Nessus	CentOS Local Security Checks	high
81089	CentOS 7 : kernel (CESA-2015:0102)	Nessus	CentOS Local Security Checks	high
81073	Scientific Linux Security Update : kernel on SL7.x x86_64 (20150128)	Nessus	Scientific Linux Local Security Checks	high
81070	RHEL 7 : kernel (RHSA-2015:0102)	Nessus	Red Hat Local Security Checks	medium
81067	Oracle Linux 7 : kernel (ELSA-2015-0102)	Nessus	Oracle Linux Local Security Checks	medium

Detections

Analytics

CVE-2014-7822

high

Tenable Plugins

high

critical

high

medium

high

high

high

critical

medium

high

critical

high

medium

high

high

high

high

critical

high

high

high

high

high

high

high

medium

medium