Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the system.(CVE-2015-5157)

  - A denial of service vulnerability was found in the     WhiteHEAT USB Serial Driver (whiteheat_attach function     in drivers/usb/serial/whiteheat.c). In the driver, the     COMMAND_PORT variable was hard coded and set to 4 (5th     element). The driver assumed that the number of ports     would always be 5 and used port number 5 as the command     port. However, when using a USB device in which the     number of ports was set to a number less than 5 (for     example, 3), the driver triggered a kernel NULL-pointer     dereference. A non-privileged attacker could use this     flaw to panic the host.(CVE-2015-5257)

  - A NULL pointer dereference flaw was found in the SCTP     implementation. A local user could use this flaw to     cause a denial of service on the system by triggering a     kernel panic when creating multiple sockets in parallel     while the system did not have the SCTP module     loaded.(CVE-2015-5283)

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as     #AC (alignment check exception) is handled. A     privileged user inside a guest could use this flaw to     create denial of service conditions on the host     kernel.(CVE-2015-5307)

  - A flaw was found in the way the Linux kernel's     networking implementation handled UDP packets with     incorrect checksum values. A remote attacker could     potentially use this flaw to trigger an infinite loop     in the kernel, resulting in a denial of service on the     system, or cause a denial of service in applications     using the edge triggered epoll     functionality.(CVE-2015-5364)

  - A flaw was found in the way the Linux kernel's     networking implementation handled UDP packets with     incorrect checksum values. A remote attacker could     potentially use this flaw to trigger an infinite loop     in the kernel, resulting in a denial of service on the     system, or cause a denial of service in applications     using the edge triggered epoll     functionality.(CVE-2015-5366)

  - A cross-boundary flaw was discovered in the Linux     kernel software raid driver. The driver accessed a     disabled bitmap where only the first byte of the buffer     was initialized to zero. This meant that the rest of     the request (up to 4095 bytes) was left and copied into     user space. An attacker could use this flaw to read     private information from user space that would not     otherwise have been accessible.(CVE-2015-5697)

  - An integer-overflow vulnerability was found in the scsi     block-request handling code in function start_req(). A     local attacker could use specially crafted IOV requests     to overflow a counter used in bio_map_user_iov()'s page     calculation, and write past the end of the array that     contains kernel-page pointers.(CVE-2015-5707)

  - A flaw was found in the way the Linux kernel's vhost     driver treated userspace provided log file descriptor     when processing the VHOST_SET_LOG_FD ioctl command. The     file descriptor was never released and continued to     consume kernel memory. A privileged local user with     access to the /dev/vhost-net files could use this flaw     to create a denial-of-service attack.(CVE-2015-6252)

  - A flaw was found in the way the Linux kernel's perf     subsystem retrieved userlevel stack traces on PowerPC     systems. A local, unprivileged user could use this flaw     to cause a denial of service on the system by creating     a special stack layout that would force the     perf_callchain_user_64() function into an infinite     loop.(CVE-2015-6526)

  - A NULL-pointer dereference vulnerability was discovered     in the Linux kernel. The kernel's Reliable Datagram     Sockets (RDS) protocol implementation did not verify     that an underlying transport existed before creating a     connection to a remote server. A local system user     could exploit this flaw to crash the system by creating     sockets at specific times to trigger a NULL pointer     dereference.(CVE-2015-6937)

  - Multiple race conditions in the Advanced Union     Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch     patches for the Linux kernel 3.x and 4.x allow local     users to cause a denial of service (use-after-free and     BUG) or possibly gain privileges via a (1) madvise or     (2) msync system call, related to mm/madvise.c and     mm/msync.c.(CVE-2015-7312)

  - A divide-by-zero flaw was discovered in the Linux     kernel built with KVM virtualization     support(CONFIG_KVM). The flaw occurs in the KVM     module's Programmable Interval Timer(PIT) emulation,     when PIT counters for channel 1 or 2 are set to zero(0)     and a privileged user inside the guest attempts to read     these counters. A privileged guest user with access to     PIT I/O ports could exploit this issue to crash the     host kernel (denial of service).(CVE-2015-7513)

  - An out-of-bounds memory access flaw was found in the     Linux kernel's aiptek USB tablet driver (aiptek_probe()     function in drivers/input/tablet/aiptek.c). The driver     assumed that the interface always had at least one     endpoint. By using a specially crafted USB device with     no endpoints on one of its interfaces, an unprivileged     user with physical access to the system could trigger a     kernel NULL pointer dereference, causing the system to     panic.(CVE-2015-7515)

  - A NULL-pointer dereference flaw was found in the     kernel, which is caused by a race between revoking a     user-type key and reading from it. The issue could be     triggered by an unprivileged user with a local account,     causing the kernel to crash (denial of     service).(CVE-2015-7550)

  - A flaw was found in the way the Linux kernel visor     driver handles certain invalid USB device descriptors.
    The driver assumes that the device always has at least     one bulk OUT endpoint. By using a specially crafted USB     device (without a bulk OUT endpoint), an unprivileged     user with physical access could trigger a kernel     NULL-pointer dereference and cause a system panic     (denial of service).(CVE-2015-7566)

  - A race condition flaw was found in the way the Linux     kernel's IPC subsystem initialized certain fields in an     IPC object structure that were later used for     permission checking before inserting the object into a     globally visible list. A local, unprivileged user could     potentially use this flaw to elevate their privileges     on the system.(CVE-2015-7613)

  - A flaw was discovered in the Linux kernel where issuing     certain ioctl() -s commands to the '/dev/ppp' device     file could lead to a NULL pointer dereference. A     privileged user could use this flaw to cause a kernel     crash and denial of service.(CVE-2015-7799)

  - It was found that the Linux kernel's keys subsystem did     not correctly garbage collect uninstantiated keyrings.
    A local attacker could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-7872)

  - A denial of service flaw was discovered in the Linux     kernel, where a race condition caused a NULL pointer     dereference in the RDS socket-creation code. A local     attacker could use this flaw to create a situation in     which a NULL pointer crashed the kernel.(CVE-2015-7990)

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as     #DB (debug exception) is handled. A privileged user     inside a guest could use this flaw to create denial of     service conditions on the host kernel.(CVE-2015-8104)

  - It was found that the Linux kernel's IPv6 network stack     did not properly validate the value of the MTU variable     when it was set. A remote attacker could potentially     use this flaw to disrupt a target system's networking     (packet loss) by setting an invalid MTU value, for     example, via a NetworkManager daemon that is processing     router advertisement packets running on the target     system.(CVE-2015-8215)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space daemon like NetworkManager would honor and apply to the kernel, causing a denial of service. (CVE-2015-0272)

It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service (system crash) or possibly execute code with administrative privileges.
(CVE-2015-5156)

It was discovered that the Reliable Datagram Sockets (RDS) implementation in the Linux kernel did not verify sockets were properly bound before attempting to send a message, which could cause a NULL pointer dereference. An attacker could use this to cause a denial of service (system crash). (CVE-2015-6937)

Ben Hutchings discovered that the Advanced Union Filesystem (aufs) for the Linux kernel did not correctly handle references of memory mapped files from an aufs mount. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2015-7312).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2778-1 advisory.

    It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application     was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space     daemon like NetworkManager would honor and apply to the kernel, causing a denial of service.
    (CVE-2015-0272)

    It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading     to kernel memory corruption. A remote attacker could use this to cause a denial of service (system crash)     or possibly execute code with administrative privileges. (CVE-2015-5156)

    It was discovered that the Reliable Datagram Sockets (RDS) implementation in the Linux kernel did not     verify sockets were properly bound before attempting to send a message, which could cause a NULL pointer     dereference. An attacker could use this to cause a denial of service (system crash). (CVE-2015-6937)

    Ben Hutchings discovered that the Advanced Union Filesystem (aufs) for the Linux kernel did not correctly     handle references of memory mapped files from an aufs mount. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
    (CVE-2015-7312)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2777-1 advisory.

    It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading     to kernel memory corruption. A remote attacker could use this to cause a denial of service (system crash)     or possibly execute code with administrative privileges. (CVE-2015-5156)

    Benjamin Randazzo discovered an information leak in the md (multiple device) driver when the     bitmap_info.file is disabled. A local privileged attacker could use this to obtain sensitive information     from the kernel. (CVE-2015-5697)

    Marc-Andr Lureau discovered that the vhost driver did not properly release the userspace provided log     file descriptor. A privileged attacker could use this to cause a denial of service (resource exhaustion).
    (CVE-2015-6252)

    It was discovered that the Reliable Datagram Sockets (RDS) implementation in the Linux kernel did not     verify sockets were properly bound before attempting to send a message, which could cause a NULL pointer     dereference. An attacker could use this to cause a denial of service (system crash). (CVE-2015-6937)

    Ben Hutchings discovered that the Advanced Union Filesystem (aufs) for the Linux kernel did not correctly     handle references of memory mapped files from an aufs mount. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
    (CVE-2015-7312)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2776-1 advisory.

    It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application     was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space     daemon like NetworkManager would honor and apply to the kernel, causing a denial of service.
    (CVE-2015-0272)

    It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading     to kernel memory corruption. A remote attacker could use this to cause a denial of service (system crash)     or possibly execute code with administrative privileges. (CVE-2015-5156)

    It was discovered that the Reliable Datagram Sockets (RDS) implementation in the Linux kernel did not     verify sockets were properly bound before attempting to send a message, which could cause a NULL pointer     dereference. An attacker could use this to cause a denial of service (system crash). (CVE-2015-6937)

    Ben Hutchings discovered that the Advanced Union Filesystem (aufs) for the Linux kernel did not correctly     handle references of memory mapped files from an aufs mount. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
    (CVE-2015-7312)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service.

  - CVE-2015-8215     It was discovered that NetworkManager would set IPv6     MTUs based on the values received in IPv6 RAs (Router     Advertisements), without sufficiently validating these     values. A remote attacker could exploit this attack to     disable IPv6 connectivity. This has been mitigated by     adding validation in the kernel.

  - CVE-2015-2925     Jann Horn discovered that when a subdirectory of a     filesystem is bind-mounted into a container that has its     own user and mount namespaces, a process with     CAP_SYS_ADMIN capability in the user namespace can     access files outside of the subdirectory. The default     Debian configuration mitigated this as it does not allow     unprivileged users to create new user namespaces.

  - CVE-2015-5156     Jason Wang discovered that when a virtio_net device is     connected to a bridge in the same VM, a series of TCP     packets forwarded through the bridge may cause a heap     buffer overflow. A remote attacker could use this to     cause a denial of service (crash) or possibly for     privilege escalation.

  - CVE-2015-6252     Michael S. Tsirkin of Red Hat Engineering found that the     vhost driver leaked file descriptors passed to it with     the VHOST_SET_LOG_FD ioctl command. A privileged local     user with access to the /dev/vhost-net file, either     directly or via libvirt, could use this to cause a     denial of service (hang or crash).

  - CVE-2015-6937     It was found that the Reliable Datagram Sockets (RDS)     protocol implementation did not verify that an     underlying transport exists when creating a connection.
    Depending on how a local RDS application initialised its     sockets, a remote attacker might be able to cause a     denial of service (crash) by sending a crafted packet.

  - CVE-2015-7312     Xavier Chantry discovered that the patch provided by the     aufs project to correct behaviour of memory-mapped files     from an aufs mount introduced a race condition in the     msync() system call. Ben Hutchings found that it also     introduced a similar bug in the madvise_remove()     function. A local attacker could use this to cause a     denial of service or possibly for privilege escalation.

ID	Name	Product	Family	Severity
124812	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1488)	Nessus	Huawei Local Security Checks	medium
86493	Ubuntu 15.04 : linux vulnerabilities (USN-2779-1)	Nessus	Ubuntu Local Security Checks	medium
86492	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2778-1)	Nessus	Ubuntu Local Security Checks	high
86468	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2777-1)	Nessus	Ubuntu Local Security Checks	high
86467	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2776-1)	Nessus	Ubuntu Local Security Checks	high
86466	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2775-1)	Nessus	Ubuntu Local Security Checks	medium
86050	Debian DSA-3364-1 : linux - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-7312

high

Tenable Plugins

medium

medium

high

high

high

medium

medium