The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The pagemap_open function in fs/proc/task_mmu.c in the     Linux kernel before 3.19.3, as used in Android 6.0.1     before 2016-03-01, allows local users to obtain     sensitive physical-address information by reading a     pagemap file, aka Android internal bug     25739721.(CVE-2016-0823i1/4%0

  - drivers/hid/hid-steelseries.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_STEELSERIES is enabled, allows     physically proximate attackers to cause a denial of     service (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2891i1/4%0

  - The overlayfs implementation in the Linux kernel     through 4.5.2 does not properly maintain POSIX ACL     xattr data, which allows local users to gain privileges     by leveraging a group-writable setgid     directory.(CVE-2016-1575i1/4%0

  - Integer overflow in the vc4_get_bcl function in     drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM     driver in the Linux kernel before 4.9.7 allows local     users to cause a denial of service or possibly have     unspecified other impact via a crafted size value in a     VC4_SUBMIT_CL ioctl call.(CVE-2017-5576i1/4%0

  - The KVM subsystem in the Linux kernel through 3.12.5     allows local users to gain privileges or cause a denial     of service (system crash) via a VAPIC synchronization     operation involving a page-end     address.(CVE-2013-6368i1/4%0

  - It was found that the code in net/sctp/socket.c in the     Linux kernel through 4.10.1 does not properly restrict     association peel-off operations during certain wait     states, which allows local users to cause a denial of     service (invalid unlock and double free) via a     multithreaded application. This vulnerability was     introduced by CVE-2017-5986 fix (commit     2dcab5984841).(CVE-2017-6353i1/4%0

  - net/netfilter/nf_conntrack_proto_dccp.c in the Linux     kernel through 3.13.6 uses a DCCP header pointer     incorrectly, which allows remote attackers to cause a     denial of service (system crash) or possibly execute     arbitrary code via a DCCP packet that triggers a call     to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error     function.(CVE-2014-2523i1/4%0

  - Race condition vulnerability was found in     drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver     in the Linux kernel before 4.6.1. MIC VOP driver does     two successive reads from user space to read a variable     length data structure. Local user can obtain sensitive     information from kernel memory or can cause DoS by     corrupting kernel memory if the data structure changes     between the two reads.(CVE-2016-5728i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An invalid pointer dereference in     io_ctl_map_page() when mounting and operating a crafted     btrfs image is due to a lack of block group item     validation in check_leaf_item() in     fs/btrfs/tree-checker.c function. This could lead to a     system crash and a denial of service.(CVE-2018-14613i1/4%0

  - A flaw was found in the way the Linux kernel handled GS     segment register base switching when recovering from a     #SS (stack segment) fault on an erroneous return to     user space. A local, unprivileged user could use this     flaw to escalate their privileges on the     system.(CVE-2014-9322i1/4%0

  - The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel allows     local users to cause a denial of service via a     request_key system call for the 'dead' key     type.(CVE-2017-6951i1/4%0

  - A flaw was found in the way the Linux kernel's XFS file     system handled replacing of remote attributes under     certain conditions. A local user with access to XFS     file system mount could potentially use this flaw to     escalate their privileges on the     system.(CVE-2015-0274i1/4%0

  - A memory leak in the kernel_read_file function in     fs/exec.c in the Linux kernel through 4.20.11 allows     attackers to cause a denial of service (memory     consumption) by triggering vfs_read     failures.(CVE-2019-8980i1/4%0

  - A flaw was found in the kernel's implementation of the     Berkeley Packet Filter (BPF). A local attacker could     craft BPF code to crash the system by creating a     situation in which the JIT compiler would fail to     correctly optimize the JIT image on the last pass. This     would lead to the CPU executing instructions that were     not part of the JIT code.(CVE-2015-4700i1/4%0

  - A security flaw was discovered in     nl80211_set_rekey_data() function in the Linux kernel     since v3.1-rc1 through v4.13. This function does not     check whether the required attributes are present in a     netlink request. This request can be issued by a user     with CAP_NET_ADMIN privilege and may result in NULL     dereference and a system crash.(CVE-2017-12153i1/4%0

  - The atyfb_ioctl function in     drivers/video/fbdev/aty/atyfb_base.c in the Linux     kernel through 4.12.10 does not initialize a certain     data structure, which allows local users to obtain     sensitive information from kernel stack memory by     reading locations associated with padding     bytes.(CVE-2017-14156i1/4%0

  - kernel/events/core.c in the performance subsystem in     the Linux kernel before 4.0 mismanages locks during     certain migrations, which allows local users to gain     privileges via a crafted application, aka Android     internal bug 31095224.(CVE-2016-6787i1/4%0

  - The ioresources_init function in kernel/resource.c in     the Linux kernel through 4.7, as used in Android before     2016-08-05 on Nexus 6 and 7 (2013) devices, uses weak     permissions for /proc/iomem, which allows local users     to obtain sensitive information by reading this file,     aka Android internal bug 28814213 and Qualcomm internal     bug CR786116. NOTE: the permissions may be intentional     in most non-Android contexts.(CVE-2015-8944i1/4%0

  - Race condition in the ioctl_file_dedupe_range function     in fs/ioctl.c in the Linux kernel through 4.7 allows     local users to cause a denial of service (heap-based     buffer overflow) or possibly gain privileges by     changing a certain count value, aka a 'double fetch'     vulnerability.(CVE-2016-6516i1/4%0

  - It was found that the timer functionality in the Linux     kernel ALSA subsystem is prone to a race condition     between read and ioctl system call handlers, resulting     in an uninitialized memory disclosure to user space. A     local user could use this flaw to read information     belonging to other users.(CVE-2017-1000380i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that the Linux kernel's implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already     processed when retrying after a failed atomic access     operation, potentially resulting in memory corruption     due to an I/O vector array overrun. A local,     unprivileged user could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-1805)

  - net/llc/sysctl_net_llc.c in the Linux kernel before     3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry.(CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042)

  - Xen 3.3.x through 4.5.x and the Linux kernel through     3.19.1 do not properly restrict access to PCI command     registers, which might allow local guest OS users to     cause a denial of service (non-maskable interrupt and     host crash) by disabling the (1) memory or (2) I/O     decoding for a PCI Express device and then accessing     the device, which triggers an Unsupported Request (UR)     response.(CVE-2015-2150)

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666)

  - The xsave/xrstor implementation in     arch/x86/include/asm/xsave.h in the Linux kernel before     3.19.2 creates certain .altinstr_replacement pointers     and consequently does not provide any protection     against instruction faulting, which allows local users     to cause a denial of service (panic) by triggering a     fault, as demonstrated by an unaligned memory operand     or a non-canonical address memory     operand.(CVE-2015-2672)

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830)

  - It was found that the Linux kernel's TCP/IP protocol     suite implementation for IPv6 allowed the Hop Limit     value to be set to a smaller value than the default     one. An attacker on a local network could use this flaw     to prevent systems on that network from sending or     receiving network packets.(CVE-2015-2922)

  - A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in     which the source was inside and the destination was     outside of a bind mount. A privileged user inside a     container could use this flaw to escape the bind mount     and, potentially, escalate their privileges on the     system.(CVE-2015-2925)

  - A race condition flaw was found in the way the Linux     kernel's SCTP implementation handled Address     Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could     use this flaw to crash the system via a race condition     triggered by setting certain ASCONF options on a     socket.(CVE-2015-3212)

  - mm/memory.c in the Linux kernel before 4.1.4 mishandles     anonymous pages, which allows local users to gain     privileges or cause a denial of service (page tainting)     via a crafted application that triggers writing to page     zero.(CVE-2015-3288)

  - A flaw was found in the way the Linux kernel's nested     NMI handler and espfix64 functionalities interacted     during NMI processing. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system.(CVE-2015-3290)

  - It was found that if a Non-Maskable Interrupt (NMI)     occurred immediately after a SYSCALL call or before a     SYSRET call with the user RSP pointing to the NMI IST     stack, the kernel could skip that NMI.(CVE-2015-3291)

  - A buffer overflow flaw was found in the way the Linux     kernel's Intel AES-NI instructions optimized version of     the RFC4106 GCM mode decryption functionality handled     fragmented packets. A remote attacker could use this     flaw to crash, or potentially escalate their privileges     on, a system over a connection with an active AES-GCM     mode IPSec security association.(CVE-2015-3331)

  - A race condition flaw was found between the chown and     execve system calls. When changing the owner of a     setuid user binary to root, the race condition could     momentarily make the binary setuid root. A local,     unprivileged user could potentially use this flaw to     escalate their privileges on the system.(CVE-2015-3339)

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636)

  - An inode data validation error was found in Linux     kernels built with UDF file system (CONFIG_UDF_FS)     support. An attacker able to mount a     corrupted/malicious UDF file system image could cause     the kernel to crash.(CVE-2015-4167)

  - A flaw was discovered in the way the Linux kernel's TTY     subsystem handled the tty shutdown phase. A local,     unprivileged user could use this flaw to cause denial     of service on the system by holding a reference to the     ldisc lock during tty shutdown, causing a     deadlock.(CVE-2015-4170)

  - A flaw was discovered in the kernel's collect_mounts     function. If the kernel's audit subsystem called     collect_mounts to audit an unmounted path, it could     panic the system. With this flaw, an unprivileged user     could call umount(MNT_DETACH) to launch a     denial-of-service attack.(CVE-2015-4177)

  - A DoS flaw was found for a Linux kernel built for the     x86 architecture which had the KVM virtualization     support(CONFIG_KVM) enabled. The kernel would be     vulnerable to a NULL pointer dereference flaw in Linux     kernel's kvm_apic_has_events() function while doing an     ioctl. An unprivileged user able to access the     '/dev/kvm' device could use this flaw to crash the     system kernel.(CVE-2015-4692)

  - A flaw was found in the kernel's implementation of the     Berkeley Packet Filter (BPF). A local attacker could     craft BPF code to crash the system by creating a     situation in which the JIT compiler would fail to     correctly optimize the JIT image on the last pass. This     would lead to the CPU executing instructions that were     not part of the JIT code.(CVE-2015-4700)

  - A buffer overflow flaw was found in the way the Linux     kernel's virtio-net subsystem handled certain fraglists     when the GRO (Generic Receive Offload) functionality     was enabled in a bridged network configuration. An     attacker on the local network could potentially use     this flaw to crash the system, or, although unlikely,     elevate their privileges on the system.(CVE-2015-5156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J.
    Bruce Fields) [Orabug: 25986995] (CVE-2017-7895)

  - ocfs2/o2net: o2net_listen_data_ready should do nothing     if socket state is not TCP_LISTEN (Tariq Saeed) [Orabug:
    25510857]

  - IB/CORE: sync the resouce access in fmr_pool (Wengang     Wang) [Orabug: 23750748]

  - ipv6: Skip XFRM lookup if dst_entry in socket cache is     valid (Jakub Sitnicki) [Orabug: 25534688]

  - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles) [Orabug:
    25549845]

  - ksplice: add sysctls for determining Ksplice features.
    (Jamie Iles) 

  - signal: protect SIGNAL_UNKILLABLE from unintentional     clearing. (Jamie Iles) [Orabug: 25549845]

  - KVM: x86: fix emulation of 'MOV SS, null selector'     (Paolo Bonzini) [Orabug: 25719676] (CVE-2017-2583)     (CVE-2017-2583)

  - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Marcelo     Ricardo Leitner) [Orabug: 25719811] (CVE-2017-5986)

  - tcp: avoid infinite loop in tcp_splice_read (Eric     Dumazet) [Orabug: 25720815] (CVE-2017-6214)

  - USB: visor: fix null-deref at probe (Johan Hovold)     [Orabug: 25796604] (CVE-2016-2782)

  - ipc/shm: Fix shmat mmap nil-page protection (Davidlohr     Bueso) [Orabug: 25797014] (CVE-2017-5669)

  - vhost: actually track log eventfd file     (Marc-Andr&eacute  Lureau) [Orabug: 25797056]     (CVE-2015-6252)

  - xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size     harder (Andy Whitcroft) [Orabug: 25814664]     (CVE-2017-7184)

  - xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL     replay_window (Andy Whitcroft) [Orabug: 25814664]     (CVE-2017-7184)

  - KEYS: Remove key_type::match in favour of overriding     default by match_preparse (David Howells) [Orabug:
    25823965] (CVE-2017-2647) (CVE-2017-2647)

  - USB: whiteheat: fix potential null-deref at probe (Johan     Hovold) [Orabug: 25825107] (CVE-2015-5257)

  - RDS: fix race condition when sending a message on     unbound socket (Quentin Casasnovas) [Orabug: 25871048]     (CVE-2015-6937) (CVE-2015-6937)

  - udf: Check path length when reading symlink (Jan Kara)     [Orabug: 25871104] (CVE-2015-9731)

  - udf: Treat symlink component of type 2 as / (Jan Kara)     [Orabug: 25871104] (CVE-2015-9731)

  - udp: properly support MSG_PEEK with truncated buffers     (Eric Dumazet) [Orabug: 25874741] (CVE-2016-10229)

  - block: fix use-after-free in seq file (Vegard Nossum)     [Orabug: 25877531] (CVE-2016-7910)

  - RHEL: complement upstream workaround for CVE-2016-10142.
    (Quentin Casasnovas) [Orabug: 25765786] (CVE-2016-10142)     (CVE-2016-10142)

  - net: ping: check minimum size on ICMP header length     (Kees Cook) [Orabug: 25766914] (CVE-2016-8399)

  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen     Paul Pfeifer) [Orabug: 25765786] (CVE-2016-10142)

  - sg_write/bsg_write is not fit to be called under     KERNEL_DS (Al Viro) [Orabug: 25765448] (CVE-2016-10088)

  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter     chang) [Orabug: 25752011] (CVE-2017-7187)

  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander     Popov) [Orabug: 25696689] (CVE-2017-2636)

  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)     [Orabug: 25696689] (CVE-2017-2636)

  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc     (Fabian Frederick) [Orabug: 25696689] (CVE-2017-2636)

  - list: introduce list_first_entry_or_null (Jiri Pirko)     [Orabug: 25696689] (CVE-2017-2636)

  - firewire: net: guard against rx buffer overflows (Stefan     Richter) [Orabug: 25451538] (CVE-2016-8633)

  - x86/mm/32: Enable full randomization on i386 and X86_32     (Hector Marco-Gisbert) [Orabug: 25463929]     (CVE-2016-3672)

  - x86 get_unmapped_area: Access mmap_legacy_base through     mm_struct member (Radu Caragea) [Orabug: 25463929]     (CVE-2016-3672)

  - sg_start_req: make sure that there's not too many     elements in iovec (Al Viro) [Orabug: 25490377]     (CVE-2015-5707)

  - tcp: take care of truncations done by sk_filter (Eric     Dumazet) [Orabug: 25507232] (CVE-2016-8645)

  - rose: limit sk_filter trim to payload (Willem de Bruijn)     [Orabug: 25507232] (CVE-2016-8645)

  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer     (Dan Carpenter) [Orabug: 25507330] (CVE-2016-7425)

  - x86: bpf_jit: fix compilation of large bpf programs     (Alexei Starovoitov) [Orabug: 25507375] (CVE-2015-4700)

  - net: fix a kernel infoleak in x25 module (Kangjie Lu)     [Orabug: 25512417] (CVE-2016-4580)

  - USB: digi_acceleport: do sanity checking for the number     of ports (Oliver Neukum) [Orabug: 25512472]     (CVE-2016-3140)

  - net/llc: avoid BUG_ON in skb_orphan (Eric Dumazet)     [Orabug: 25682437] (CVE-2017-6345)

  - dccp: fix freeing skb too early for IPV6_RECVPKTINFO     (Andrey Konovalov) [Orabug: 25598277] (CVE-2017-6074)

  - vfs: read file_handle only once in handle_to_path (Sasha     Levin) [Orabug: 25388709] (CVE-2015-1420)

  - crypto: algif_hash - Only export and import on sockets     with data (Herbert Xu) [Orabug: 25417807]

  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)     [Orabug: 25462763] (CVE-2016-4482)

  - net: fix infoleak in llc (Kangjie Lu) [Orabug: 25462811]     (CVE-2016-4485)

  - af_unix: Guard against other == sk in unix_dgram_sendmsg     (Rainer Weikusat) [Orabug: 25464000] (CVE-2013-7446)

  - unix: avoid use-after-free in ep_remove_wait_queue     (Rainer Weikusat) [Orabug: 25464000] (CVE-2013-7446)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - RHEL: complement upstream workaround for CVE-2016-10142.
    (Quentin Casasnovas) [Orabug: 25765786] (CVE-2016-10142)     (CVE-2016-10142)

  - net: ping: check minimum size on ICMP header length     (Kees Cook) [Orabug: 25766914] (CVE-2016-8399)

  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen     Paul Pfeifer) [Orabug: 25765786] (CVE-2016-10142)

  - sg_write/bsg_write is not fit to be called under     KERNEL_DS (Al Viro) [Orabug: 25765448] (CVE-2016-10088)

  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter     chang) [Orabug: 25752011] (CVE-2017-7187)

  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander     Popov) [Orabug: 25696689] (CVE-2017-2636)

  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)     [Orabug: 25696689] (CVE-2017-2636)

  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc     (Fabian Frederick) [Orabug: 25696689] (CVE-2017-2636)

  - list: introduce list_first_entry_or_null (Jiri Pirko)     [Orabug: 25696689] (CVE-2017-2636)

  - firewire: net: guard against rx buffer overflows (Stefan     Richter) [Orabug: 25451538] (CVE-2016-8633)

  - x86/mm/32: Enable full randomization on i386 and X86_32     (Hector Marco-Gisbert) [Orabug: 25463929]     (CVE-2016-3672)

  - x86 get_unmapped_area: Access mmap_legacy_base through     mm_struct member (Radu Caragea) [Orabug: 25463929]     (CVE-2016-3672)

  - sg_start_req: make sure that there's not too many     elements in iovec (Al Viro) [Orabug: 25490377]     (CVE-2015-5707)

  - tcp: take care of truncations done by sk_filter (Eric     Dumazet) [Orabug: 25507232] (CVE-2016-8645)

  - rose: limit sk_filter trim to payload (Willem de Bruijn)     [Orabug: 25507232] (CVE-2016-8645)

  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer     (Dan Carpenter) [Orabug: 25507330] (CVE-2016-7425)

  - x86: bpf_jit: fix compilation of large bpf programs     (Alexei Starovoitov) [Orabug: 25507375] (CVE-2015-4700)

  - net: fix a kernel infoleak in x25 module (Kangjie Lu)     [Orabug: 25512417] (CVE-2016-4580)

  - USB: digi_acceleport: do sanity checking for the number     of ports (Oliver Neukum) [Orabug: 25512472]     (CVE-2016-3140)

  - net/llc: avoid BUG_ON in skb_orphan (Eric Dumazet)     [Orabug: 25682437] (CVE-2017-6345)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3535 advisory.

    - RHEL: complement upstream workaround for CVE-2016-10142. (Quentin Casasnovas)  [Orabug: 25765786]     {CVE-2016-10142} {CVE-2016-10142}
    - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766914]  {CVE-2016-8399}
    - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765786]  {CVE-2016-10142}
    - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765448]     {CVE-2016-10088}
    - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25752011]  {CVE-2017-7187}
    - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696689]  {CVE-2017-2636}
    - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696689]  {CVE-2017-2636}
    - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc (Fabian Frederick)  [Orabug: 25696689]     {CVE-2017-2636}
    - list: introduce list_first_entry_or_null (Jiri Pirko)  [Orabug: 25696689]  {CVE-2017-2636}
    - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451538]  {CVE-2016-8633}
    - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463929]     {CVE-2016-3672}
    - x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member (Radu Caragea)  [Orabug:
    25463929]  {CVE-2016-3672}
    - sg_start_req(): make sure that there's not too many elements in iovec (Al Viro)  [Orabug: 25490377]     {CVE-2015-5707}
    - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507232]  {CVE-2016-8645}
    - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507232]  {CVE-2016-8645}
    - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507330]     {CVE-2016-7425}
    - x86: bpf_jit: fix compilation of large bpf programs (Alexei Starovoitov)  [Orabug: 25507375]     {CVE-2015-4700}
    - net: fix a kernel infoleak in x25 module (Kangjie Lu)  [Orabug: 25512417]  {CVE-2016-4580}
    - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512472]     {CVE-2016-3140}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3534 advisory.

    - Revert 'fix minor infoleak in get_user_ex()' (Brian Maly)  [Orabug: 25790392]  {CVE-2016-9644}
    - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766911]  {CVE-2016-8399}
    - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765776]  {CVE-2016-10142}
    - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765445]     {CVE-2016-10088}
    - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751996]  {CVE-2017-7187}
    - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696686]  {CVE-2017-2636}
    - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696686]  {CVE-2017-2636}
    - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc (Fabian Frederick)  [Orabug: 25696686]     {CVE-2017-2636}
    - x86: bpf_jit: fix compilation of large bpf programs (Alexei Starovoitov)  [Orabug: 21305080]     {CVE-2015-4700}
    - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451530]  {CVE-2016-8633}
    - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463927]     {CVE-2016-3672}
    - x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member (Radu Caragea)  [Orabug:
    25463927]  {CVE-2016-3672}
    - pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (WANG Cong)  [Orabug: 25490335]     {CVE-2015-8569}
    - sg_start_req(): make sure that there's not too many elements in iovec (Al Viro)  [Orabug: 25490372]     {CVE-2015-5707}
    - kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (Jim Mattson)  [Orabug: 25507195]     {CVE-2016-9588}
    - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507230]  {CVE-2016-8645}
    - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507230]  {CVE-2016-8645}
    - fix minor infoleak in get_user_ex() (Al Viro)  [Orabug: 25507281]  {CVE-2016-9178}
    - scsi: arcmsr: Simplify user_len checking (Borislav Petkov)  [Orabug: 25507328]  {CVE-2016-7425}
    - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507328]     {CVE-2016-7425}
    - net: fix a kernel infoleak in x25 module (Kangjie Lu)  [Orabug: 25512413]  {CVE-2016-4580}
    - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512471]     {CVE-2016-3140}
    - ipv4: keep skb->dst around in presence of IP options (Eric Dumazet)  [Orabug: 25543892]  {CVE-2017-5970}
    - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682430]  {CVE-2017-6345}
    - dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Andrey Konovalov)   {CVE-2017-6074}
    - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417805]     {CVE-2016-8646}
    - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462760]  {CVE-2016-4482}
    - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462807]  {CVE-2016-4485}
    - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25463996]     {CVE-2013-7446}
    - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25463996]     {CVE-2013-7446}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE 13.1 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2014-8989: The Linux kernel did not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allowed local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c (bnc#906545).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandles IRET faults in     processing NMIs that occurred during userspace     execution, which might allow local users to gain     privileges by triggering an NMI (bnc#937969).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel through     4.2.3 did not ensure that certain slot numbers are     valid, which allowed local users to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #DB (aka Debug)     exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #AC (aka Alignment     Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key     (bnc#912202).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2015-6937 (bnc#952384     953052).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-7885: The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 did not initialize a certain structure     member, which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951627).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Disable 64bit address for Creative HDA     controllers (bnc#814440).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y     (boo#956934).

  - KVM: x86: update masterclock values on TSC writes     (bsc#961739).

  - NFS: Fix a NULL pointer dereference of migration     recovery ops for v4.2 client (bsc#960839).

  - apparmor: allow SYS_CAP_RESOURCE to be sufficient to     prlimit another task (bsc#921949).

  - blktap: also call blkif_disconnect() when frontend     switched to closed (bsc#952976).

  - blktap: refine mm tracking (bsc#952976).

  - cdrom: Random writing support for BD-RE media     (bnc#959568).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - ipv4: Do not increase PMTU with Datagram Too Big message     (bsc#955224).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - ipv6: fix tunnel error handling (bsc#952579).

  - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224).

  - uas: Add response iu handling (bnc#954138).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/evtchn: make use of PHYSDEVOP_map_pirq.

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the kernel's implementation of the Berkeley Packet Filter (BPF). A local attacker could craft BPF code to crash the system by creating a situation in which the JIT compiler would fail to correctly optimize the JIT image on the last pass. This would lead to the CPU executing instructions that were not part of the JIT code. (CVE-2015-4700, Important)

* Two flaws were found in the way the Linux kernel's networking implementation handled UDP packets with incorrect checksum values. A remote attacker could potentially use these flaws to trigger an infinite loop in the kernel, resulting in a denial of service on the system, or cause a denial of service in applications using the edge triggered epoll functionality. (CVE-2015-5364, CVE-2015-5366, Important)

* A flaw was found in the way the Linux kernel's ext4 file system handled the 'page size > block size' condition when the fallocate zero range functionality was used. A local attacker could use this flaw to crash the system. (CVE-2015-0275, Moderate)

* It was found that the Linux kernel's keyring implementation would leak memory when adding a key to a keyring via the add_key() function.
A local attacker could use this flaw to exhaust all available memory on the system. (CVE-2015-1333, Moderate)

* A race condition flaw was found in the way the Linux kernel's SCTP implementation handled Address Configuration lists when performing Address Configuration Change (ASCONF). A local attacker could use this flaw to crash the system via a race condition triggered by setting certain ASCONF options on a socket. (CVE-2015-3212, Moderate)

* An information leak flaw was found in the way the Linux kernel's Virtual Dynamic Shared Object (vDSO) implementation performed address randomization. A local, unprivileged user could use this flaw to leak kernel memory addresses to user-space. (CVE-2014-9585, Low)

Red Hat would like to thank Daniel Borkmann for reporting CVE-2015-4700, and Canonical for reporting the CVE-2015-1333 issue.
The CVE-2015-0275 issue was discovered by Xiong Zhou of Red Hat, and the CVE-2015-3212 issue was discovered by Ji Jianwen of Red Hat Engineering.

This update also fixes several bugs. Refer to the following Knowledgebase article for further information :

https://access.redhat.com/articles/1614563

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-6252: Possible file descriptor leak for each     VHOST_SET_LOG_FDcommand issued, this could eventually     wasting available system resources and creating a denial     of service (bsc#942367).

  - CVE-2015-5707: Possible integer overflow in the     calculation of total number of pages in     bio_map_user_iov() (bsc#940338).

  - CVE-2015-5364: The (1) udp_recvmsg and (2) udpv6_recvmsg     functions in the Linux kernel before 4.0.6 do not     properly consider yielding a processor, which allowed     remote attackers to cause a denial of service (system     hang) via incorrect checksums within a UDP packet flood     (bsc#936831).

  - CVE-2015-5366: The (1) udp_recvmsg and (2) udpv6_recvmsg     functions in the Linux kernel before 4.0.6 provide     inappropriate -EAGAIN return values, which allowed     remote attackers to cause a denial of service (EPOLLET     epoll application read outage) via an incorrect checksum     in a UDP packet, a different vulnerability than     CVE-2015-5364 (bsc#936831).

  - CVE-2015-1420: Race condition in the handle_to_path     function in fs/fhandle.c in the Linux kernel through     3.19.1 allowed local users to bypass intended size     restrictions and trigger read operations on additional     memory locations by changing the handle_bytes value of a     file handle during the execution of this function     (bsc#915517).

  - CVE-2015-1805: The (1) pipe_read and (2) pipe_write     implementations in fs/pipe.c in the Linux kernel before     3.16 do not properly consider the side effects of failed
    __copy_to_user_inatomic and __copy_from_user_inatomic     calls, which allows local users to cause a denial of     service (system crash) or possibly gain privileges via a     crafted application, aka an 'I/O' vector array overrun.
    (bsc#933429)

  - CVE-2015-2150: Xen 3.3.x through 4.5.x and the Linux     kernel through 3.19.1 do not properly restrict access to     PCI command registers, which might allow local guest     users to cause a denial of service (non-maskable     interrupt and host crash) by disabling the (1) memory or     (2) I/O decoding for a PCI Express device and then     accessing the device, which triggers an Unsupported     Request (UR) response. (bsc#919463)

  - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux     kernel before 3.19.2 does not prevent the TS_COMPAT flag     from reaching a user-mode task, which might allow local     users to bypass the seccomp or audit protection     mechanism via a crafted application that uses the (1)     fork or (2) close system call, as demonstrated by an     attack against seccomp before 3.16. (bsc#926240)

  - CVE-2015-4700: The bpf_int_jit_compile function in     arch/x86/net/bpf_jit_comp.c in the Linux kernel before     4.0.6 allowed local users to cause a denial of service     (system crash) by creating a packet filter and then     loading crafted BPF instructions that trigger late     convergence by the JIT compiler (bsc#935705).

  - CVE-2015-4167: The udf_read_inode function in     fs/udf/inode.c in the Linux kernel before 3.19.1 did not     validate certain length values, which allowed local     users to cause a denial of service (incorrect data     representation or integer overflow, and OOPS) via a     crafted UDF filesystem (bsc#933907).

  - CVE-2015-0777: drivers/xen/usbback/usbback.c in     linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support     patches for the Linux kernel 2.6.18), as used in the     Linux kernel 2.6.x and 3.x in SUSE Linux distributions,     allows guest OS users to obtain sensitive information     from uninitialized locations in host OS kernel memory     via unspecified vectors. (bsc#917830)

  - CVE-2014-9728: The UDF filesystem implementation in the     Linux kernel before 3.18.2 did not validate certain     lengths, which allowed local users to cause a denial of     service (buffer over-read and system crash) via a     crafted filesystem image, related to fs/udf/inode.c and     fs/udf/symlink.c (bsc#933904).

  - CVE-2014-9730: The udf_pc_to_char function in     fs/udf/symlink.c in the Linux kernel before 3.18.2     relies on component lengths that are unused, which     allowed local users to cause a denial of service (system     crash) via a crafted UDF filesystem image (bsc#933904).

  - CVE-2014-9729: The udf_read_inode function in     fs/udf/inode.c in the Linux kernel before 3.18.2 did not     ensure a certain data-structure size consistency, which     allowed local users to cause a denial of service (system     crash) via a crafted UDF filesystem image (bsc#933904).

  - CVE-2014-9731: The UDF filesystem implementation in the     Linux kernel before 3.18.2 did not ensure that space is     available for storing a symlink target's name along with     a trailing \0 character, which allowed local users to     obtain sensitive information via a crafted filesystem     image, related to fs/udf/symlink.c and fs/udf/unicode.c     (bsc#933896).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-5707: An integer overflow in the SCSI generic     driver could be potentially used by local attackers to     crash the kernel or execute code (bsc#940338).

  - CVE-2015-5364: A remote denial of service (hang) via UDP     flood with incorrect package checksums was fixed.
    (bsc#936831).

  - CVE-2015-5366: A remote denial of service (unexpected     error returns) via UDP flood with incorrect package     checksums was fixed. (bsc#936831).

  - CVE-2015-1420: A race condition in the handle_to_path     function in fs/fhandle.c in the Linux kernel allowed     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function (bnc#915517).

  - CVE-2015-4700: A local user could have created a bad     instruction in the JIT processed BPF code, leading to a     kernel crash (bnc#935705).

  - CVE-2015-4167: The UDF filesystem in the Linux kernel     was vulnerable to a crash which could occur while     fetching inode information from a corrupted/malicious     udf file system image. (bsc#933907).

  - CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731:
    Various issues in handling UDF filesystems in the Linux     kernel allowed the corruption of kernel memory and other     issues. An attacker able to mount a corrupted/malicious     UDF file system image could cause the kernel to crash.
    (bsc#933904 bsc#933896)

  - CVE-2015-2150: The Linux kernel did not properly     restrict access to PCI command registers, which might     have allowed local guest users to cause a denial of     service (non-maskable interrupt and host crash) by     disabling the (1) memory or (2) I/O decoding for a PCI     Express device and then accessing the device, which     triggers an Unsupported Request (UR) response     (bsc#919463).

  - CVE-2015-0777: drivers/xen/usbback/usbback.c as used in     the Linux kernel 2.6.x and 3.x in SUSE Linux     distributions, allowed guest OS users to obtain     sensitive information from uninitialized locations in     host OS kernel memory via unspecified vectors     (bnc#917830).

  - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux     kernel did not prevent the TS_COMPAT flag from reaching     a user-mode task, which might have allowed local users     to bypass the seccomp or audit protection mechanism via     a crafted application that uses the (1) fork or (2)     close system call, as demonstrated by an attack against     seccomp before 3.16 (bnc#926240).

  - CVE-2015-1805: The Linux kernels implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already processed     when retrying after a failed atomic access operation,     potentially resulting in memory corruption due to an I/O     vector array overrun. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system. (bsc#933429).

Also 

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1788 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the kernel's implementation of the Berkeley Packet     Filter (BPF). A local attacker could craft BPF code to crash the system by     creating a situation in which the JIT compiler would fail to correctly     optimize the JIT image on the last pass. This would lead to the CPU     executing instructions that were not part of the JIT code. (CVE-2015-4700,     Important)

    * Two flaws were found in the way the Linux kernel's networking     implementation handled UDP packets with incorrect checksum values. A remote     attacker could potentially use these flaws to trigger an infinite loop in     the kernel, resulting in a denial of service on the system, or cause a     denial of service in applications using the edge triggered epoll     functionality. (CVE-2015-5364, CVE-2015-5366, Important)

    * A flaw was found in the way the Linux kernel's ext4 file system handled     the page size > block size condition when the fallocate zero range     functionality was used. A local attacker could use this flaw to crash the     system. (CVE-2015-0275, Moderate)

    * It was found that the Linux kernel's keyring implementation would leak     memory when adding a key to a keyring via the add_key() function. A local     attacker could use this flaw to exhaust all available memory on the system.
    (CVE-2015-1333, Moderate)

    * A race condition flaw was found in the way the Linux kernel's SCTP     implementation handled Address Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could use this flaw to     crash the system via a race condition triggered by setting certain ASCONF     options on a socket. (CVE-2015-3212, Moderate)

    * An information leak flaw was found in the way the Linux kernel's Virtual     Dynamic Shared Object (vDSO) implementation performed address     randomization. A local, unprivileged user could use this flaw to leak     kernel memory addresses to user-space. (CVE-2014-9585, Low)

    Red Hat would like to thank Daniel Borkmann for reporting CVE-2015-4700,     and Canonical for reporting the CVE-2015-1333 issue. The CVE-2015-0275     issue was discovered by Xiong Zhou of Red Hat, and the CVE-2015-3212 issue     was discovered by Ji Jianwen of Red Hat Engineering.

    The kernel-rt packages have been upgraded to version 3.10.0-229.13.1, which     provides a number of bug fixes and enhancements over the previous version,     including:

    * Fix regression in scsi_send_eh_cmnd()

    * boot hangs at Console: switching to colour dummy device 80x25

    * Update tcp stack to 3.17 kernel

    * Missing some code from patch (...) Fix VGA switcheroo problem related to     hotplug

    * ksoftirqd high CPU usage due to stray tasklet from ioatdma driver

    * During Live Partition Mobility (LPM) testing, RHEL 7.1 LPARs will crash     in kmem_cache_alloc

    (BZ#1253809)

    This update also fixes the following bug:

    * The hwlat_detector.ko module samples the clock and records any intervals     between reads that exceed a specified threshold. However, the module     previously tracked the maximum interval seen for the inner interval but     did not record when the outer interval was greater. A patch has been     applied to fix this bug, and hwlat_detector.ko now correctly records if the     outer interval is the maximal interval encountered during the run.
    (BZ#1252365)

    All kernel-rt users are advised to upgrade to these updated packages, which     correct these issues and add these enhancements. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

* A flaw was found in the kernel's implementation of the Berkeley Packet Filter (BPF). A local attacker could craft BPF code to crash the system by creating a situation in which the JIT compiler would fail to correctly optimize the JIT image on the last pass. This would lead to the CPU executing instructions that were not part of the JIT code. (CVE-2015-4700, Important)

* Two flaws were found in the way the Linux kernel's networking implementation handled UDP packets with incorrect checksum values. A remote attacker could potentially use these flaws to trigger an infinite loop in the kernel, resulting in a denial of service on the system, or cause a denial of service in applications using the edge triggered epoll functionality. (CVE-2015-5364, CVE-2015-5366, Important)

* A flaw was found in the way the Linux kernel's ext4 file system handled the 'page size > block size' condition when the fallocate zero range functionality was used. A local attacker could use this flaw to crash the system. (CVE-2015-0275, Moderate)

* It was found that the Linux kernel's keyring implementation would leak memory when adding a key to a keyring via the add_key() function.
A local attacker could use this flaw to exhaust all available memory on the system. (CVE-2015-1333, Moderate)

* A race condition flaw was found in the way the Linux kernel's SCTP implementation handled Address Configuration lists when performing Address Configuration Change (ASCONF). A local attacker could use this flaw to crash the system via a race condition triggered by setting certain ASCONF options on a socket. (CVE-2015-3212, Moderate)

* An information leak flaw was found in the way the Linux kernel's Virtual Dynamic Shared Object (vDSO) implementation performed address randomization. A local, unprivileged user could use this flaw to leak kernel memory addresses to user-space. (CVE-2014-9585, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1778 advisory.

  - The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose     memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection     mechanism by guessing a location at the end of a PMD. (CVE-2014-9585)

  - The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly     consider yielding a processor, which allows remote attackers to cause a denial of service (system hang)     via incorrect checksums within a UDP packet flood. (CVE-2015-5364)

  - The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate
    -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll     application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than     CVE-2015-5364. (CVE-2015-5366)

  - The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to     cause a denial of service (BUG) via a crafted fallocate zero-range request. (CVE-2015-0275)

  - Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4     allows local users to cause a denial of service (memory consumption) via many add_key system calls that     refer to existing keys. (CVE-2015-1333)

  - Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial     of service (list corruption and panic) via a rapid series of system calls related to sockets, as     demonstrated by setsockopt calls. (CVE-2015-3212)

  - The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows     local users to cause a denial of service (system crash) by creating a packet filter and then loading     crafted BPF instructions that trigger late convergence by the JIT compiler. (CVE-2015-4700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise Server 11 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-5707: An integer overflow in the SCSI generic     driver could be potentially used by local attackers to     crash the kernel or execute code.

  - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux     kernel did not prevent the TS_COMPAT flag from reaching     a user-mode task, which might have allowed local users     to bypass the seccomp or audit protection mechanism via     a crafted application that uses the (1) fork or (2)     close system call, as demonstrated by an attack against     seccomp before 3.16 (bnc#926240).

  - CVE-2015-0777: drivers/xen/usbback/usbback.c in the     Linux kernel allowed guest OS users to obtain sensitive     information from uninitialized locations in host OS     kernel memory via unspecified vectors (bnc#917830).

  - CVE-2015-2150: Xen and the Linux kernel did not properly     restrict access to PCI command registers, which might     have allowed local guest users to cause a denial of     service (non-maskable interrupt and host crash) by     disabling the (1) memory or (2) I/O decoding for a PCI     Express device and then accessing the device, which     triggers an Unsupported Request (UR) response     (bnc#919463).

  - CVE-2015-5364: A remote denial of service (hang) via UDP     flood with incorrect package checksums was fixed.
    (bsc#936831).

  - CVE-2015-5366: A remote denial of service (unexpected     error returns) via UDP flood with incorrect package     checksums was fixed. (bsc#936831).

  - CVE-2015-1420: CVE-2015-1420: Race condition in the     handle_to_path function in fs/fhandle.c in the Linux     kernel allowed local users to bypass intended size     restrictions and trigger read operations on additional     memory locations by changing the handle_bytes value of a     file handle during the execution of this function     (bnc#915517).

  - CVE-2015-4700: A local user could have created a bad     instruction in the JIT processed BPF code, leading to a     kernel crash (bnc#935705).

  - CVE-2015-1805: The (1) pipe_read and (2) pipe_write     implementations in fs/pipe.c in the Linux kernel did not     properly consider the side effects of failed
    __copy_to_user_inatomic and __copy_from_user_inatomic     calls, which allowed local users to cause a denial of     service (system crash) or possibly gain privileges via a     crafted application, aka an 'I/O vector array overrun'     (bnc#933429).

  - CVE-2015-3331: The __driver_rfc4106_decrypt function in     arch/x86/crypto/aesni-intel_glue.c in the Linux kernel     did not properly determine the memory locations used for     encrypted data, which allowed context-dependent     attackers to cause a denial of service (buffer overflow     and system crash) or possibly execute arbitrary code by     triggering a crypto API call, as demonstrated by use of     a libkcapi test program with an AF_ALG(aead) socket     (bnc#927257).

  - CVE-2015-2922: The ndisc_router_discovery function in     net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol     implementation in the IPv6 stack in the Linux kernel     allowed remote attackers to reconfigure a hop-limit     setting via a small hop_limit value in a Router     Advertisement (RA) message (bnc#922583).

  - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux     kernel used an incorrect data type in a sysctl table,     which allowed local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry (bnc#919007).

  - CVE-2015-3636: The ping_unhash function in     net/ipv4/ping.c in the Linux kernel did not initialize a     certain list data structure during an unhash operation,     which allowed local users to gain privileges or cause a     denial of service (use-after-free and system crash) by     leveraging the ability to make a SOCK_DGRAM socket     system call for the IPPROTO_ICMP or IPPROTO_ICMPV6     protocol, and then making a connect system call after a     disconnect (bnc#929525).

  - CVE-2014-8086: Race condition in the     ext4_file_write_iter function in fs/ext4/file.c in the     Linux kernel allowed local users to cause a denial of     service (file unavailability) via a combination of a     write action and an F_SETFL fcntl operation for the     O_DIRECT flag (bnc#900881).

  - CVE-2014-8159: The InfiniBand (IB) implementation in the     Linux kernel did not properly restrict use of User Verbs     for registration of memory regions, which allowed local     users to access arbitrary physical memory locations, and     consequently cause a denial of service (system crash) or     gain privileges, by leveraging permissions on a uverbs     device under /dev/infiniband/ (bnc#914742).

  - CVE-2014-9683: Off-by-one error in the     ecryptfs_decode_from_filename function in     fs/ecryptfs/crypto.c in the eCryptfs subsystem in the     Linux kernel allowed local users to cause a denial of     service (buffer overflow and system crash) or possibly     gain privileges via a crafted filename (bnc#918333).

  - CVE-2015-2042: net/rds/sysctl.c in the Linux kernel used     an incorrect data type in a sysctl table, which allowed     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry (bnc#919018).

  - CVE-2015-1421: Use-after-free vulnerability in the     sctp_assoc_update function in net/sctp/associola.c in     the Linux kernel allowed remote attackers to cause a     denial of service (slab corruption and panic) or     possibly have unspecified other impact by triggering an     INIT collision that leads to improper handling of     shared-key data (bnc#915577).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.2 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-3290: A flaw was found in the way the Linux     kernels nested NMI handler and espfix64 functionalities     interacted during NMI processing. A local, unprivileged     user could use this flaw to crash the system or,     potentially, escalate their privileges on the system.

  - CVE-2015-3212: A race condition flaw was found in the     way the Linux kernels SCTP implementation handled     Address Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could     use this flaw to crash the system via a race condition     triggered by setting certain ASCONF options on a socket.

  - CVE-2015-5364: A remote denial of service (hang) via UDP     flood with incorrect package checksums was fixed.
    (bsc#936831).

  - CVE-2015-5366: A remote denial of service (unexpected     error returns) via UDP flood with incorrect package     checksums was fixed. (bsc#936831).

  - CVE-2015-4700: A local user could have created a bad     instruction in the JIT processed BPF code, leading to a     kernel crash (bnc#935705).

  - CVE-2015-1420: Race condition in the handle_to_path     function in fs/fhandle.c in the Linux kernel allowed     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function (bnc#915517).

  - CVE-2015-4692: The kvm_apic_has_events function in     arch/x86/kvm/lapic.h in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by leveraging /dev/kvm access     for an ioctl call (bnc#935542).

  - CVE-2015-4167 CVE-2014-9728 CVE-2014-9730 CVE-2014-9729     CVE-2014-9731: Various problems in the UDF filesystem     were fixed that could lead to crashes when mounting     prepared udf filesystems.

  - CVE-2015-4002: drivers/staging/ozwpan/ozusbsvc1.c in the     OZWPAN driver in the Linux kernel did not ensure that     certain length values are sufficiently large, which     allowed remote attackers to cause a denial of service     (system crash or large loop) or possibly execute     arbitrary code via a crafted packet, related to the (1)     oz_usb_rx and (2) oz_usb_handle_ep_data functions     (bnc#933934).

  - CVE-2015-4003: The oz_usb_handle_ep_data function in     drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel allowed remote attackers to cause a     denial of service (divide-by-zero error and system     crash) via a crafted packet (bnc#933934).

  - CVE-2015-4001: Integer signedness error in the     oz_hcd_get_desc_cnf function in     drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in     the Linux kernel allowed remote attackers to cause a     denial of service (system crash) or possibly execute     arbitrary code via a crafted packet (bnc#933934).

  - CVE-2015-4036: A potential memory corruption in     vhost/scsi was fixed.

  - CVE-2015-2922: The ndisc_router_discovery function in     net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol     implementation in the IPv6 stack in the Linux kernel     allowed remote attackers to reconfigure a hop-limit     setting via a small hop_limit value in a Router     Advertisement (RA) message (bnc#922583).

  - CVE-2015-3636: It was found that the Linux kernels ping     socket implementation did not properly handle socket     unhashing during spurious disconnects, which could lead     to a use-after-free flaw. On x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to crash the system. On non-x86-64     architecture systems, a local user able to create ping     sockets could use this flaw to escalate their privileges     on the system.

  - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux     kernel used an incorrect data type in a sysctl table,     which allowed local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry (bnc#919007).

  - CVE-2015-3339: Race condition in the prepare_binprm     function in fs/exec.c in the Linux kernel allowed local     users to gain privileges by executing a setuid program     at a time instant when a chown to root is in progress,     and the ownership is changed but the setuid bit is not     yet stripped.

  - CVE-2015-1465: The IPv4 implementation in the Linux     kernel did not properly consider the length of the     Read-Copy Update (RCU) grace period for redirecting     lookups in the absence of caching, which allowed remote     attackers to cause a denial of service (memory     consumption or system crash) via a flood of packets     (bnc#916225).

The following non-security bugs were fixed :

  - ALSA: ak411x: Fix stall in work callback (boo#934755).

  - ALSA: emu10k1: Emu10k2 32 bit DMA mode (boo#934755).

  - ALSA: emu10k1: Fix card shortname string buffer overflow     (boo#934755).

  - ALSA: emu10k1: do not deadlock in proc-functions     (boo#934755).

  - ALSA: emux: Fix mutex deadlock at unloading     (boo#934755).

  - ALSA: emux: Fix mutex deadlock in OSS emulation     (boo#934755).

  - ALSA: hda - Add AZX_DCAPS_SNOOP_OFF (and refactor snoop     setup) (boo#934755).

  - ALSA: hda - Add Conexant codecs CX20721, CX20722,     CX20723 and CX20724 (boo#934755).

  - ALSA: hda - Add common pin macros for ALC269 family     (boo#934755).

  - ALSA: hda - Add dock support for ThinkPad X250     (17aa:2226) (boo#934755).

  - ALSA: hda - Add dock support for Thinkpad T450s     (17aa:5036) (boo#934755).

  - ALSA: hda - Add headphone quirk for Lifebook E752     (boo#934755).

  - ALSA: hda - Add headset mic quirk for Dell Inspiron 5548     (boo#934755).

  - ALSA: hda - Add mute-LED mode control to Thinkpad     (boo#934755).

  - ALSA: hda - Add one more node in the EAPD supporting     candidate list (boo#934755).

  - ALSA: hda - Add pin configs for ASUS mobo with IDT     92HD73XX codec (boo#934755).

  - ALSA: hda - Add ultra dock support for Thinkpad X240     (boo#934755).

  - ALSA: hda - Add workaround for CMI8888 snoop behavior     (boo#934755).

  - ALSA: hda - Add workaround for MacBook Air 5,2 built-in     mic (boo#934755).

  - ALSA: hda - Disable runtime PM for Panther Point again     (boo#934755).

  - ALSA: hda - Do not access stereo amps for mono channel     widgets (boo#934755).

  - ALSA: hda - Fix Dock Headphone on Thinkpad X250 seen as     a Line Out (boo#934755).

  - ALSA: hda - Fix headphone pin config for Lifebook T731     (boo#934755).

  - ALSA: hda - Fix noise on AMD radeon 290x controller     (boo#934755).

  - ALSA: hda - Fix probing and stuttering on CMI8888     HD-audio controller (boo#934755).

  - ALSA: hda - One more Dell macine needs     DELL1_MIC_NO_PRESENCE quirk (boo#934755).

  - ALSA: hda - One more HP machine needs to change mute led     quirk (boo#934755).

  - ALSA: hda - Set GPIO 4 low for a few HP machines     (boo#934755).

  - ALSA: hda - Set single_adc_amp flag for CS420x codecs     (boo#934755).

  - ALSA: hda - Treat stereo-to-mono mix properly     (boo#934755).

  - ALSA: hda - change three SSID quirks to one pin quirk     (boo#934755).

  - ALSA: hda - fix 'num_steps = 0' error on ALC256     (boo#934755).

  - ALSA: hda - fix a typo by changing mute_led_nid to     cap_mute_led_nid (boo#934755).

  - ALSA: hda - fix headset mic detection problem for one     more machine (boo#934755).

  - ALSA: hda - fix mute led problem for three HP laptops     (boo#934755).

  - ALSA: hda - set proper caps for newer AMD hda audio in     KB/KV (boo#934755).

  - ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450     (boo#934755).

  - ALSA: hda/realtek - Add a fixup for another Acer Aspire     9420 (boo#934755).

  - ALSA: hda/realtek - Enable the ALC292 dock fixup on the     Thinkpad T450 (boo#934755).

  - ALSA: hda/realtek - Fix Headphone Mic does not recording     for ALC256 (boo#934755).

  - ALSA: hda/realtek - Make more stable to get pin sense     for ALC283 (boo#934755).

  - ALSA: hda/realtek - Support Dell headset mode for ALC256     (boo#934755).

  - ALSA: hda/realtek - Support HP mute led for output and     input (boo#934755).

  - ALSA: hda/realtek - move HP_LINE1_MIC1_LED quirk for     alc282 (boo#934755).

  - ALSA: hda/realtek - move HP_MUTE_LED_MIC1 quirk for     alc282 (boo#934755).

  - ALSA: hdspm - Constrain periods to 2 on older cards     (boo#934755).

  - ALSA: pcm: Do not leave PREPARED state after draining     (boo#934755).

  - ALSA: snd-usb: add quirks for Roland UA-22 (boo#934755).

  - ALSA: usb - Creative USB X-Fi Pro SB1095 volume knob     support (boo#934755).

  - ALSA: usb-audio: Add mic volume fix quirk for Logitech     Quickcam Fusion (boo#934755).

  - ALSA: usb-audio: Add quirk for MS LifeCam HD-3000     (boo#934755).

  - ALSA: usb-audio: Add quirk for MS LifeCam Studio     (boo#934755).

  - ALSA: usb-audio: Do not attempt to get Lifecam HD-5000     sample rate (boo#934755).

  - ALSA: usb-audio: Do not attempt to get Microsoft Lifecam     Cinema sample rate (boo#934755).

  - ALSA: usb-audio: add MAYA44 USB+ mixer control names     (boo#934755).

  - ALSA: usb-audio: do not try to get Benchmark DAC1 sample     rate (boo#934755).

  - ALSA: usb-audio: do not try to get Outlaw RR2150 sample     rate (boo#934755).

  - ALSA: usb-audio: fix missing input volume controls in     MAYA44 USB(+) (boo#934755).

  - Automatically Provide/Obsolete all subpackages of old     flavors (bnc#925567)

  - Fix kABI for ak411x structs (boo#934755).

  - Fix kABI for snd_emu10k1 struct (boo#934755).

  - HID: add ALWAYS_POLL quirk for a Logitech 0xc007     (bnc#929624).

  - HID: add HP OEM mouse to quirk ALWAYS_POLL (bnc#929624).

  - HID: add quirk for PIXART OEM mouse used by HP     (bnc#929624).

  - HID: usbhid: add always-poll quirk (bnc#929624).

  - HID: usbhid: add another mouse that needs     QUIRK_ALWAYS_POLL (bnc#929624).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen (bnc#929624).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 009b (bnc#929624).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 0103 (bnc#929624).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 016f (bnc#929624).

  - HID: usbhid: fix PIXART optical mouse (bnc#929624).

  - HID: usbhid: more mice with ALWAYS_POLL (bnc#929624).

  - HID: usbhid: yet another mouse with ALWAYS_POLL     (bnc#929624).

  - HID: yet another buggy ELAN touchscreen (bnc#929624).

  - Input: synaptics - handle spurious release of trackstick     buttons (bnc#928693).

  - Input: synaptics - re-route tracksticks buttons on the     Lenovo 2015 series (bnc#928693).

  - Input: synaptics - remove TOPBUTTONPAD property for     Lenovos 2015 (bnc#928693).

  - Input: synaptics - retrieve the extended capabilities in     query $10 (bnc#928693).

  - NFSv4: When returning a delegation, do not reclaim an     incompatible open mode (bnc#934202).

  - Refresh patches.xen/xen-blkfront-indirect (bsc#922235).

  - Update config files: extend CONFIG_DPM_WATCHDOG_TIMEOUT     to 60 (bnc#934397)

  - arm64: mm: Remove hack in mmap randomized layout Fix     commit id and mainlined information

  - bnx2x: Fix kdump when iommu=on (bug#921769).

  - client MUST ignore EncryptionKeyLength if     CAP_EXTENDED_SECURITY is set (bnc#932348).

  - config/armv7hl: Disable AMD_XGBE_PHY The AMD XGBE     ethernet chip is only used on ARM64 systems.

  - config: disable XGBE on non-ARM hardware It is     documented as being present only on AMD SoCs.

  - cpufreq: fix a NULL pointer dereference in
    __cpufreq_governor() (bsc#924664).

  - drm/i915/bdw: PCI IDs ending in 0xb are ULT     (boo#935913).

  - drm/i915/chv: Remove Wait for a previous gfx force-off     (boo#935913).

  - drm/i915/dp: only use training pattern 3 on platforms     that support it (boo#935913).

  - drm/i915/dp: there is no audio on port A (boo#935913).

  - drm/i915/hsw: Fix workaround for server AUX channel     clock divisor (boo#935913).

  - drm/i915/vlv: remove wait for previous GFX clk disable     request (boo#935913).

  - drm/i915/vlv: save/restore the power context base reg     (boo#935913).

  - drm/i915: Add missing MacBook Pro models with dual     channel LVDS (boo#935913).

  - drm/i915: BDW Fix Halo PCI IDs marked as ULT     (boo#935913).

  - drm/i915: Ban Haswell from using RCS flips (boo#935913).

  - drm/i915: Check obj->vma_list under the struct_mutex     (boo#935913).

  - drm/i915: Correct the IOSF Dev_FN field for IOSF     transfers (boo#935913).

  - drm/i915: Dell Chromebook 11 has PWM backlight     (boo#935913).

  - drm/i915: Disable caches for Global GTT (boo#935913).

  - drm/i915: Do a dummy DPCD read before the actual read     (bnc#907714).

  - drm/i915: Do not complain about stolen conflicts on gen3     (boo#935913).

  - drm/i915: Do not leak pages when freeing userptr objects     (boo#935913).

  - drm/i915: Dont enable CS_PARSER_ERROR interrupts at all     (boo#935913).

  - drm/i915: Evict CS TLBs between batches (boo#935913).

  - drm/i915: Fix DDC probe for passive adapters     (boo#935913).

  - drm/i915: Fix and clean BDW PCH identification     (boo#935913).

  - drm/i915: Force the CS stall for invalidate flushes     (boo#935913).

  - drm/i915: Handle failure to kick out a conflicting fb     driver (boo#935913).

  - drm/i915: Ignore SURFLIVE and flip counter when the GPU     gets reset (boo#935913).

  - drm/i915: Ignore VBT backlight check on Macbook 2, 1     (boo#935913).

  - drm/i915: Invalidate media caches on gen7 (boo#935913).

  - drm/i915: Kick fbdev before vgacon (boo#935913).

  - drm/i915: Only fence tiled region of object     (boo#935913).

  - drm/i915: Only warn the first time we attempt to mmio     whilst suspended (boo#935913).

  - drm/i915: Unlock panel even when LVDS is disabled     (boo#935913).

  - drm/i915: Use IS_HSW_ULT() in a HSW specific code path     (boo#935913).

  - drm/i915: cope with large i2c transfers (boo#935913).

  - drm/i915: do not warn if backlight unexpectedly enabled     (boo#935913).

  - drm/i915: drop WaSetupGtModeTdRowDispatch:snb     (boo#935913).

  - drm/i915: save/restore GMBUS freq across suspend/resume     on gen4 (boo#935913).

  - drm/i915: vlv: fix IRQ masking when uninstalling     interrupts (boo#935913).

  - drm/i915: vlv: fix save/restore of GFX_MAX_REQ_COUNT reg     (boo#935913).

  - drm/radeon: retry dcpd fetch (bnc#931580).

  - ftrace/x86/xen: use kernel identity mapping only when     really needed (bsc#873195, bsc#886272, bsc#903727,     bsc#927725)

  - guards: Add support for an external filelist in --check     mode This will allow us to run --check without a     kernel-source.git work tree.

  - guards: Include the file name also in the 'Not found'     error

  - guards: Simplify help text

  - hyperv: Add processing of MTU reduced by the host     (bnc#919596).

  - ideapad_laptop: Lenovo G50-30 fix rfkill reports     wireless blocked (boo#939394).

  - ipv6: do not delete previously existing ECMP routes if     add fails (bsc#930399).

  - ipv6: fix ECMP route replacement (bsc#930399).

  - ipv6: replacing a rt6_info needs to purge possible     propagated rt6_infos too (bsc#930399).

  - kABI: protect linux/slab.h include in of/address.

  - kabi/severities: ignore already-broken but acceptable     kABI changes - SYSTEM_TRUSTED_KEYRING=n change removed     system_trusted_keyring - Commits 3688875f852 and     ea5ed8c70e9 changed iov_iter_get_pages prototype - KVM     changes are intermodule dependencies

  - kabi: Fix CRC for dma_get_required_mask.

  - kabi: add kABI reference files

  - libata: Blacklist queued TRIM on Samsung SSD 850 Pro     (bsc#926156).

  - libata: Blacklist queued TRIM on all Samsung 800-series     (bnc#930599).

  - net: ppp: Do not call bpf_prog_create() in ppp_lock     (bnc#930488).

  - rpm/kernel-obs-qa.spec.in: Do not fail if the kernel     versions do not match

  - rt2x00: do not align payload on modern H/W (bnc#932844).

  - rtlwifi: rtl8192cu: Fix kernel deadlock (bnc#927786).

  - thermal: step_wise: Revert optimization (boo#925961).

  - tty: Fix pty master poll() after slave closes v2     (bsc#937138). arm64: mm: Remove hack in mmap randomize     layout (bsc#937033)

  - udf: Remove repeated loads blocksize (bsc#933907).

  - usb: core: Fix USB 3.0 devices lost in NOTATTACHED state     after a hub port reset (bnc#937226).

  - x86, apic: Handle a bad TSC more gracefully     (boo#935530).

  - x86/PCI: Use host bridge _CRS info on Foxconn     K8M890-8237A (bnc#907092).

  - x86/PCI: Use host bridge _CRS info on systems with >32     bit addressing (bnc#907092).

  - x86/microcode/amd: Do not overwrite final patch levels     (bsc#913996).

  - x86/microcode/amd: Extract current patch level read to a     function (bsc#913996).

  - x86/mm: Improve AMD Bulldozer ASLR workaround     (bsc#937032).

  - xenbus: add proper handling of XS_ERROR from Xenbus for     transactions.

  - xhci: Calculate old endpoints correctly on device reset     (bnc#938976).

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak.

  - CVE-2015-1333     Colin Ian King discovered a flaw in the add_key function     of the Linux kernel's keyring subsystem. A local user     can exploit this flaw to cause a denial of service due     to memory exhaustion.

  - CVE-2015-3212     Ji Jianwen of Red Hat Engineering discovered a flaw in     the handling of the SCTPs automatic handling of dynamic     multi-homed connections. A local attacker could use this     flaw to cause a crash or potentially for privilege     escalation.

  - CVE-2015-4692     A NULL pointer dereference flaw was found in the     kvm_apic_has_events function in the KVM subsystem. A     unprivileged local user could exploit this flaw to crash     the system kernel resulting in denial of service.

  - CVE-2015-4700     Daniel Borkmann discovered a flaw in the Linux kernel     implementation of the Berkeley Packet Filter which can     be used by a local user to crash the system.

  - CVE-2015-5364     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     could exploit this flaw to cause a denial of service     using a flood of UDP packets with invalid checksums.

  - CVE-2015-5366     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     can cause a denial of service against applications that     use epoll by injecting a single packet with an invalid     checksum.

  - CVE-2015-5697     A flaw was discovered in the md driver in the Linux     kernel leading to an information leak.

  - CVE-2015-5706     An user triggerable use-after-free vulnerability in path     lookup in the Linux kernel could potentially lead to     privilege escalation.

  - CVE-2015-5707     An integer overflow in the SCSI generic driver in the     Linux kernel was discovered. A local user with write     permission on a SCSI generic device could potentially     exploit this flaw for privilege escalation.

A flaw was discovered in the kvm (kernel virtual machine) subsystem's kvm_apic_has_events function. A unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4692)

Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker could exploit this flaw to cause a denial of service using a flood of UDP packets with invalid checksums.
(CVE-2015-5364)

A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker can cause a denial of service against applications that use epoll by injecting a single packet with an invalid checksum. (CVE-2015-5366).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2683-1 advisory.

    A flaw was discovered in the kvm (kernel virtual machine) subsystem's kvm_apic_has_events function. A     unprivileged local user could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4692)

    Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local     attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

    A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker could     exploit this flaw to cause a denial of service using a flood of UDP packets with invalid checksums.
    (CVE-2015-5364)

    A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker can cause a     denial of service against applications that use epoll by injecting a single packet with an invalid     checksum. (CVE-2015-5366)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2681-1 advisory.

    A flaw was discovered in the user space memory copying for the pipe iovecs in the Linux kernel. An     unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially     escalate their privileges. (CVE-2015-1805)

    A flaw was discovered in the kvm (kernel virtual machine) subsystem's kvm_apic_has_events function. A     unprivileged local user could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4692)

    Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local     attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

    A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker could     exploit this flaw to cause a denial of service using a flood of UDP packets with invalid checksums.
    (CVE-2015-5364)

    A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker can cause a     denial of service against applications that use epoll by injecting a single packet with an invalid     checksum. (CVE-2015-5366)

    A double free flaw was discovered in the Linux kernel's path lookup. A local user could cause a denial of     service (Oops). (CVE-2015-5706)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the user space memory copying for the pipe iovecs in the Linux kernel. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges. (CVE-2015-1805)

A flaw was discovered in the kvm (kernel virtual machine) subsystem's kvm_apic_has_events function. A unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4692)

Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker could exploit this flaw to cause a denial of service using a flood of UDP packets with invalid checksums.
(CVE-2015-5364)

A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker can cause a denial of service against applications that use epoll by injecting a single packet with an invalid checksum. (CVE-2015-5366).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in the user space memory copying for the pipe iovecs in the Linux kernel. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges. (CVE-2015-1805)

Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A race condition was discovered in the Linux kernel's file_handle size verification. A local user could exploit this flaw to read potentially sensative memory locations. (CVE-2015-1420)

A underflow error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4001)

A bounds check error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4002)

A division by zero error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver. A remote attacker could exploit this flaw to cause a denial of service (system crash).
(CVE-2015-4003)

Carl H Lunde discovered missing sanity checks in the the Linux kernel's UDF file system (CONFIG_UDF_FS). A local attacker could exploit this flaw to cause a denial of service (system crash) by using a corrupted file system image. (CVE-2015-4167)

Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2664-1 advisory.

    A race condition was discovered in the Linux kernel's file_handle size verification. A local user could     exploit this flaw to read potentially sensative memory locations. (CVE-2015-1420)

    A underflow error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver.
    A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     execute arbitrary code via a specially crafted packet. (CVE-2015-4001)

    A bounds check error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or     potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4002)

    A division by zero error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4003)

    Carl H Lunde discovered missing consistency checks in the Linux kernel's UDF file system (CONFIG_UDF_FS).
    A local attacker could exploit this flaw to cause a denial of service (system crash) by using a corrupted     file system image. (CVE-2015-4167)

    Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local     attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

    A double free flaw was discovered in the Linux kernel's path lookup. A local user could cause a denial of     service (Oops). (CVE-2015-5706)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
124829	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1506)	Nessus	Huawei Local Security Checks	high
124811	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1487)	Nessus	Huawei Local Security Checks	high
100238	OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0106)	Nessus	OracleVM Local Security Checks	critical
99164	OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0058)	Nessus	OracleVM Local Security Checks	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
99161	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3535)	Nessus	Oracle Linux Local Security Checks	high
99160	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3534)	Nessus	Oracle Linux Local Security Checks	high
88545	openSUSE Security Update : the Linux Kernel (openSUSE-2016-124)	Nessus	SuSE Local Security Checks	high
86702	RHEL 7 : kernel (RHSA-2015:1778)	Nessus	Red Hat Local Security Checks	high
86511	CentOS 7 : kernel (CESA-2015:1778)	Nessus	CentOS Local Security Checks	high
86290	SUSE SLED11 / SLES11 Security Update : kernel-source (SUSE-SU-2015:1678-1)	Nessus	SuSE Local Security Checks	high
86121	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2015:1611-1)	Nessus	SuSE Local Security Checks	high
85980	RHEL 7 : kernel-rt (RHSA-2015:1788)	Nessus	Red Hat Local Security Checks	critical
85960	Scientific Linux Security Update : kernel on SL7.x x86_64 (20150915)	Nessus	Scientific Linux Local Security Checks	high
85958	Oracle Linux 7 : kernel (ELSA-2015-1778)	Nessus	Oracle Linux Local Security Checks	high
85764	SUSE SLES11 Security Update : kernel (SUSE-SU-2015:1478-1)	Nessus	SuSE Local Security Checks	medium
85432	openSUSE Security Update : the Linux Kernel (openSUSE-2015-543)	Nessus	SuSE Local Security Checks	high
85281	Debian DSA-3329-1 : linux - security update	Nessus	Debian Local Security Checks	high
84985	Ubuntu 15.04 : linux vulnerabilities (USN-2684-1)	Nessus	Ubuntu Local Security Checks	high
84984	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2683-1)	Nessus	Ubuntu Local Security Checks	critical
84982	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2681-1)	Nessus	Ubuntu Local Security Checks	critical
84981	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2680-1)	Nessus	Ubuntu Local Security Checks	high
84980	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2678-1)	Nessus	Ubuntu Local Security Checks	high
84617	Ubuntu 14.10 : linux vulnerabilities (USN-2666-1)	Nessus	Ubuntu Local Security Checks	high
84615	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2664-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-4700

medium

Tenable Plugins

high

high

critical

high

critical

high

high

high

high

high

high

high

critical

high

high

medium

high

high

high

critical

critical

high

high

high

medium