The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):** DISPUTED ** Multiple     integer overflows in the lzo1x_decompress_safe function     in lib/lzo/lzo1x_decompress_safe.c in the LZO     decompressor in the Linux kernel before 3.15.2 allow     context-dependent attackers to cause a denial of     service (memory corruption) via a crafted Literal Run.
    NOTE: the author of the LZO algorithms says 'the Linux     kernel is *not* affected media hype.'(CVE-2014-4608)A     certain backport in the TCP Fast Open implementation     for the Linux kernel before 3.18 does not properly     maintain a count value, which allow local users to     cause a denial of service (system crash) via the Fast     Open feature, as demonstrated by visiting the     chrome://flags/#enable-tcp-fast-open URL when using     certain 3.10.x through 3.16.x kernel builds, including     longterm-maintenance releases and ckt (aka Canonical     Kernel Team) builds.(CVE-2015-3332)An elevation of     privilege vulnerability in the kernel scsi driver.
    Product: Android. Versions: Android kernel. Android ID     A-65023233.(CVE-2017-13168)An issue was discovered in     drivers/i2c/i2c-core-smbus.c in the Linux kernel before     4.14.15. There is an out of bounds write in the     function i2c_smbus_xfer_emulated.(CVE-2017-18551)An     issue was discovered in net/ipv6/ip6mr.c in the Linux     kernel before 4.11. By setting a specific socket     option, an attacker can control a pointer in kernel     land and cause an inet_csk_listen_stop general     protection fault, or potentially execute arbitrary code     under certain circumstances. The issue can be triggered     as root (e.g., inside a default LXC container or with     the CAP_NET_ADMIN capability) or after namespace     unsharing. This occurs because sk_type and protocol are     not checked in the appropriate part of the ip6_mroute_*     functions. NOTE: this affects Linux distributions that     use 4.9.x longterm kernels before     4.9.187.(CVE-2017-18509)An issue was discovered in the     Linux kernel before 4.14.11. A double free may be     caused by the function allocate_trace_buffer in the     file kernel/trace/trace.c.(CVE-2017-18595)An issue was     discovered in the Linux kernel through 4.17.10. There     is a NULL pointer dereference and panic in     hfsplus_lookup() in fs/hfsplus/dir.c when opening a     file (that is purportedly a hard link) in an hfs+     filesystem that has malformed catalog data, and is     mounted read-only without a metadata     directory.(CVE-2018-14617)An issue was discovered in     write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in     the Linux kernel through 5.3.2. The cxgb4 driver is     directly calling dma_map_single (a DMA function) from a     stack variable. This could allow an attacker to trigger     a Denial of Service, exploitable if this driver is used     on an architecture for which this stack/DMA interaction     has security relevance.(CVE-2019-17075)Double free     vulnerability in the snd_usbmidi_create function in     sound/usb/midi.c in the Linux kernel before 4.5 allows     physically proximate attackers to cause a denial of     service (panic) or possibly have unspecified other     impact via vectors involving an invalid USB     descriptor.(CVE-2016-2384)fsamespace.c in the Linux     kernel through 3.16.1 does not properly restrict     clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and     changing MNT_ATIME_MASK during a remount of a bind     mount, which allows local users to gain privileges,     interfere with backups and auditing on systems that had     atime enabled, or cause a denial of service (excessive     filesystem updating) on systems that had atime disabled     via a 'mount -o remount' command within a user     namespace.(CVE-2014-5207)fs/overlayfs/dir.c in the     OverlayFS filesystem implementation in the Linux kernel     before 4.6 does not properly verify the upper dentry     before proceeding with unlink and rename system-call     processing, which allows local users to cause a denial     of service (system crash) via a rename system call that     specifies a self-hardlink.(CVE-2016-6197)In the Linux     kernel before 4.1.4, a buffer overflow occurs when     checking userspace params in     drivers/media/dvb-frontends/cx24116.c. The maximum size     for a DiSEqC command is 6, according to the userspace     API. However, the code allows larger values such as     23.(CVE-2015-9289)In the Linux kernel through 5.3.2,     cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c     does not reject a long SSID IE, leading to a Buffer     Overflow.(CVE-2019-17133)Insufficient access control in     the Intel(R) PROSet/Wireless WiFi Software driver     before version 21.10 may allow an unauthenticated user     to potentially enable denial of service via adjacent     access.(CVE-2019-0136)Linux distributions that have not     patched their long-term kernels with     https://git.kernel.org/linus/a87938b2e246b81b4fb713edb3     71a9fa3c5c3c86 (committed on April 14, 2015). This     kernel vulnerability was fixed in April 2015 by commit     a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to     Linux 3.10.77 in May 2015), but it was not recognized     as a security threat. With     CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a     normal top-down address allocation strategy,     load_elf_binary() will attempt to map a PIE binary into     an address range immediately below mm->mmap_base.
    Unfortunately, load_elf_ binary() does not take account     of the need to allocate sufficient space for the entire     binary which means that, while the first PT_LOAD     segment is mapped below mm->mmap_base, the subsequent     PT_LOAD segment(s) end up being mapped above     mm->mmap_base into the are that is supposed to be the     'gap' between the stack and the     binary.(CVE-2017-1000253)Race condition in the     sclp_ctl_ioctl_sccb function in     drivers/s390/char/sclp_ctl.c in the Linux kernel before     4.6 allows local users to obtain sensitive information     from kernel memory by changing a certain length value,     aka a 'double fetch'     vulnerability.(CVE-2016-6130)rtl_p2p_noa_ie in drivers     et/wireless/realtek/rtlwifi/ps.c in the Linux kernel     through 5.3.6 lacks a certain upper-bound check,     leading to a buffer     overflow.(CVE-2019-17666)sound/core/timer.c in the     Linux kernel through 4.6 does not initialize certain r1     data structures, which allows local users to obtain     sensitive information from kernel stack memory via     crafted use of the ALSA timer interface, related to the     (1) snd_timer_user_ccallback and (2)     snd_timer_user_tinterrupt     functions.(CVE-2016-4578)Systems with microprocessors     utilizing speculative execution and branch prediction     may allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis.(CVE-2017-5753)The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a USB device without both a control and a     data endpoint descriptor.(CVE-2016-3138)The     arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel     through 4.8.2 does not restrict a certain length field,     which allows local users to gain privileges or cause a     denial of service (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control     code.(CVE-2016-7425)The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2185)The     create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference or double free, and system crash) via a     crafted endpoints value in a USB device     descriptor.(CVE-2016-2184)The digi_port_init function     in drivers/usb/serial/digi_acceleport.c in the Linux     kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference and system crash) via a crafted endpoints     value in a USB device descriptor.(CVE-2016-3140)The     do_remount function in fsamespace.c in the Linux kernel     through 3.16.1 does not maintain the MNT_LOCK_READONLY     bit across a remount of a bind mount, which allows     local users to bypass an intended read-only restriction     and defeat certain sandbox protection mechanisms via a     'mount -o remount' command within a user     namespace.(CVE-2014-5206)The gtco_probe function in     drivers/input/tablet/gtco.c in the Linux kernel through     4.5.2 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device     descriptor.(CVE-2016-2187)The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel before 4.3.5     does not properly maintain a hub-interface data     structure, which allows physically proximate attackers     to cause a denial of service (invalid memory access and     system crash) or possibly have unspecified other impact     by unplugging a USB hub device.(CVE-2015-8816)The     ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (system crash) via a USB device     without both a master and a slave     interface.(CVE-2016-3689)The Linux Kernel running on     AMD64 systems will sometimes map the contents of PIE     executable, the heap or ld.so to where the stack is     mapped allowing attackers to more easily manipulate the     stack. Linux Kernel version 4.11.5 is     affected.(CVE-2017-1000379)The powermate_probe function     in drivers/input/misc/powermate.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2186)The signal     implementation in the Linux kernel before 4.3.5 on     powerpc platforms does not check for an MSR with both     the S and T bits set, which allows local users to cause     a denial of service (TM Bad Thing exception and panic)     via a crafted application.(CVE-2015-8844)The     snd_timer_user_params function in sound/core/timer.c in     the Linux kernel through 4.6 does not initialize a     certain data structure, which allows local users to     obtain sensitive information from kernel stack memory     via crafted use of the ALSA timer     interface.(CVE-2016-4569)The tm_reclaim_thread function     in arch/powerpc/kernel/process.c in the Linux kernel     before 4.4.1 on powerpc platforms does not ensure that     TM suspend mode exists before proceeding with a     tm_reclaim call, which allows local users to cause a     denial of service (TM Bad Thing exception and panic)     via a crafted application.(CVE-2015-8845)The VFS     subsystem in the Linux kernel 3.x provides an     incomplete set of requirements for setattr operations     that underspecifies removing extended privilege     attributes, which allows local users to cause a denial     of service (capability stripping) via a failed     invocation of a system call, as demonstrated by using     chown to remove a capability from the ping or Wireshark     dumpcap program.(CVE-2015-1350)The wacom_probe function     in drivers/input/tablet/wacom_sys.c in the Linux kernel     before 3.17 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-3139)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):The uas driver in the     Linux kernel before 4.13.6 allows local users to cause     a denial of service (out-of-bounds read and system     crash), or possibly have unspecified other impacts via     a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)The     implementation of big key management in     security/keys/big_key.c in the Linux kernel before     4.8.7 mishandles unsuccessful crypto registration in     conjunction with successful key-type registration,     which allows local users to cause a denial of service     (NULL pointer dereference and panic) or possibly have     unspecified other impact via a crafted application that     uses the big_key data type.(CVE-2016-9313)The Linux     kernel allows remote attackers to execute arbitrary     code via UDP traffic that triggers an unsafe second     checksum calculation during execution of a recv system     call with the MSG_PEEK flag. This may create a kernel     panic or memory corruption leading to privilege     escalation.(CVE-2016-10229)Buffer overflow in the     exitcode_proc_write function in     arch/um/kernel/exitcode.c in the Linux kernel before     3.12 allows local users to cause a denial of service or     possibly have unspecified other impact by leveraging     root privileges for a write operation.(CVE-2013-4512)It     was found that unsharing a mount namespace could allow     a user to see data beneath their restricted     namespace.(CVE-2014-9717)A divide-by-zero flaw was     discovered in the Linux kernel built with KVM     virtualization support(CONFIG_KVM). The flaw occurs in     the KVM module's Programmable Interval Timer(PIT)     emulation, when PIT counters for channel 1 or 2 are set     to zero(0) and a privileged user inside the guest     attempts to read these counters. A privileged guest     user with access to PIT I/O ports could exploit this     issue to crash the host kernel (denial of     service).(CVE-2015-7513)The ims_pcu_parse_cdc_data     function in drivers/input/misc/ims-pcu.c in the Linux     kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (system crash)     via a USB device without both a master and a slave     interface.(CVE-2016-3689)Stack-based buffer overflow in     the brcmf_cfg80211_start_ap() function in     'driverset/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c' in the Linux kernel before 4.7.5 allows local     users to cause a denial of service (system crash) or     possibly have unspecified other impact via a long SSID     Information Element in a command to a Netlink     socket.(CVE-2016-8658)drivers/hid/hid-sony.c in the     Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_HID_SONY is enabled,     allows physically proximate attackers to cause a denial     of service (heap-based out-of-bounds write) via a     crafted device.(CVE-2013-2890)An issue where a provided     address with access_ok() is not checked was discovered     in i915_gem_execbuffer2_ioctl in     drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux     kernel through 4.19.13. A local attacker can craft a     malicious IOCTL function call to overwrite arbitrary     kernel memory, resulting in a Denial of Service or     privilege escalation.(CVE-2018-20669)It was found that     the permission checks performed by the Linux kernel     when a netlink message was received were not     sufficient. A local, unprivileged user could     potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged     process and altering the output of this     process.(CVE-2014-0181)An issue was discovered in the     XFS filesystem in fs/xfs/libxfs/xfs_attr_leaf.c in the     Linux kernel. A NULL pointer dereference may occur for     a corrupted xfs image after xfs_da_shrink_inode() is     called with a NULL bp. This can lead to a system crash     and a denial of service.(CVE-2018-13094)The     irda_setsockopt function in net/irda/af_irda.c in the     Linux kernel, through 4.16, allows local users to cause     a denial of service (due to a use-after-free of the     ias_object and a system crash) or possibly have     unspecified other impact by leveraging an AF_IRDA     socket.(CVE-2018-6555)The x86/fpu (Floating Point Unit)     subsystem in the Linux kernel, when a processor     supports the xsave feature but not the xsaves feature,     does not correctly handle attempts to set reserved bits     in the xstate header via the ptrace() or rt_sigreturn()     system call. This allows local users to read the FPU     registers of other processes on the system, related to     arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c.(CVE-2017-15537)The     fst_get_iface function in driverset/wan/farsync.c in     the Linux kernel before 3.11.7 does not properly     initialize a certain data structure, which allows local     users to obtain sensitive information from kernel     memory by leveraging the CAP_NET_ADMIN capability for     an SIOCWANDEV ioctl call.(CVE-2014-1444)In the Linux     kernel, through 4.15.4, the floppy driver reveals the     addresses of kernel functions and global variables     using printk calls within the function show_floppy in     drivers/block/floppy.c. An attacker can read this     information from dmesg and use the addresses to find     the locations of kernel code and data and bypass kernel     security protections such as KASLR.(CVE-2018-7273)A     flaw in 'arch/arm64/kernel/sys.c' in the Linux kernel     allows local users to bypass the 'strict page     permissions' protection mechanism and modify the     system-call table and, consequently, gain privileges by     leveraging write access.(CVE-2015-8967)The Linux kernel     before 3.11 on ARM platforms, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     properly consider user-space access to the TPIDRURW     register, which allows local users to gain privileges     via a crafted application, aka Android internal bug     28749743 and Qualcomm internal bug     CR561044.(CVE-2014-9870)A NULL pointer dereference     security flaw was found in the Linux kernel in the     vcpu_scan_ioapic() function in arch/x86/kvm/x86.c. This     allows local users with certain privileges to cause a     denial of service via a crafted system call to the KVM     subsystem.(CVE-2018-19407)It was found that current     implementation of kl5kusb105 driver failed to detect     short transfers when attempting to read the line state     and logged the content of the uninitialized heap     transfer buffer.(CVE-2017-5549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The snd_timer_interrupt function in sound/core/timer.c     in the Linux kernel before 4.4.1 does not properly     maintain a certain linked list, which allows local     users to cause a denial of service (race condition and     system crash) via a crafted ioctl call.(CVE-2016-2545)

  - sound/core/timer.c in the Linux kernel before 4.4.1     uses an incorrect type of mutex, which allows local     users to cause a denial of service (race condition,     use-after-free, and system crash) via a crafted ioctl     call.(CVE-2016-2546)

  - sound/core/timer.c in the Linux kernel before 4.4.1     employs a locking approach that does not consider slave     timer instances, which allows local users to cause a     denial of service (race condition, use-after-free, and     system crash) via a crafted ioctl call.(CVE-2016-2547)

  - sound/core/timer.c in the Linux kernel before 4.4.1     retains certain linked lists after a close or stop     action, which allows local users to cause a denial of     service (system crash) via a crafted ioctl call,     related to the (1) snd_timer_close and (2)
    _snd_timer_stop functions.(CVE-2016-2548)

  - sound/core/hrtimer.c in the Linux kernel before 4.4.1     does not prevent recursive callback access, which     allows local users to cause a denial of service     (deadlock) via a crafted ioctl call.(CVE-2016-2549)

  - A resource-exhaustion vulnerability was found in the     kernel, where an unprivileged process could allocate     and accumulate far more file descriptors than the     process' limit. A local, unauthenticated user could     exploit this flaw by sending file descriptors over a     Unix socket and then closing them to keep the process'     fd count low, thereby creating kernel-memory or     file-descriptors exhaustion (denial of     service).(CVE-2016-2550)

  - It is possible for a single process to cause an OOM     condition by filling large pipes with data that are     never read. A typical process filling 4096 pipes with 1     MB of data will use 4 GB of memory and there can be     multiple such processes, up to a     per-user-limit.(CVE-2016-2847)

  - A security flaw was found in the Linux kernel that an     attempt to move page mapped by AIO ring buffer to the     other node triggers NULL pointer dereference at     trace_writeback_dirty_page(), because     aio_fs_backing_dev_info.dev is 0.(CVE-2016-3070)

  - A security flaw was found in the Linux kernel in the     mark_source_chains() function in     'net/ipv4/netfilter/ip_tables.c'. It is possible for a     user-supplied 'ipt_entry' structure to have a large     'next_offset' field. This field is not bounds checked     prior to writing to a counter value at the supplied     offset.(CVE-2016-3134)

  - An integer overflow vulnerability was found in the     Linux kernel in xt_alloc_table_info, which on 32-bit     systems can lead to small structure allocation and a     copy_from_user based heap corruption.(CVE-2016-3135)

  - The mct_u232_msr_to_state function in     drivers/usb/serial/mct_u232.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted USB device without two     interrupt-in endpoint descriptors.(CVE-2016-3136)

  - drivers/usb/serial/cypress_m8.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions.(CVE-2016-3137)

  - The acm_probe function in drivers/usb/class/cdc-acm.c     in the Linux kernel before 4.5.1 allows physically     proximate attackers to cause a denial of service (NULL     pointer dereference and system crash) via a USB device     without both a control and a data endpoint     descriptor.(CVE-2016-3138)

  - The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     before 3.17 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-3139)

  - The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux     kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference and system crash) via a crafted endpoints     value in a USB device descriptor.(CVE-2016-3140)

  - 'A security flaw was found in the Linux kernel's     networking subsystem that destroying the network     interface with huge number of ipv4 addresses assigned     keeps ''rtnl_lock'' spinlock for a very long time (up     to hour). This blocks many network-related operations,     including creation of new incoming ssh connections.

  - The problem is especially important for containers, as     the container owner has enough permissions to trigger     this and block a network access on a whole host,     outside the container.(CVE-2016-3156)'

  - A weakness was found in the Linux ASLR implementation.
    Any user able to running 32-bit applications in a x86     machine can disable ASLR by setting the RLIMIT_STACK     resource to unlimited.(CVE-2016-3672)

  - The ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (system crash) via a USB device     without both a master and a slave     interface.(CVE-2016-3689)

  - It was found that the Linux kernel's IPv6     implementation mishandled socket options. A local     attacker could abuse concurrent access to the socket     options to escalate their privileges, or cause a denial     of service (use-after-free and system crash) via a     crafted sendmsg system call.(CVE-2016-3841)

  - The usbip_recv_xbuff function in     drivers/usb/usbip/usbip_common.c in the Linux kernel     before 4.5.3 allows remote attackers to cause a denial     of service (out-of-bounds write) or possibly have     unspecified other impact via a crafted length value in     a USB/IP packet.(CVE-2016-3955)

  - A flaw was found in the Linux kernel's keyring handling     code: the key_reject_and_link() function could be     forced to free an arbitrary memory block. An attacker     could use this flaw to trigger a use-after-free     condition on the system, potentially allowing for     privilege escalation.(CVE-2016-4470)

  - The proc_connectinfo() function in     'drivers/usb/core/devio.c' in the Linux kernel through     4.6 does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel stack memory via a crafted USBDEVFS_CONNECTINFO     ioctl call. The stack object 'ci' has a total size of 8     bytes. Its last 3 bytes are padding bytes which are not     initialized and are leaked to userland.(CVE-2016-4482)

  - A flaw was found in the way certain interfaces of the     Linux kernel's Infiniband subsystem used write() as     bi-directional ioctl() replacement, which could lead to     insufficient memory security checks when being invoked     using the splice() system call. A local unprivileged     user on a system with either Infiniband hardware     present or RDMA Userspace Connection Manager Access     module explicitly loaded, could use this flaw to     escalate their privileges on the system.(CVE-2016-4565)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.59 to receive various security and bugfixes.

Main feature additions :

  - Improved support for Clustered File System (CephFS,     fate#318586).

  - Addition of kGraft patches now produces logging messages     to simplify auditing (fate#317827).

The following security bugs were fixed :

  - CVE-2016-1583: Prevent the usage of mmap when the lower     file system does not allow it. This could have lead to     local privilege escalation when ecryptfs-utils was     installed and /sbin/mount.ecryptfs_private was setuid     (bsc#983143).

  - CVE-2014-9717: fs/namespace.c in the Linux kernel     processes MNT_DETACH umount2 system calls without     verifying that the MNT_LOCKED flag is unset, which     allowed local users to bypass intended access     restrictions and navigate to filesystem locations     beneath a mount by calling umount2 within a user     namespace (bnc#928547).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bsc#970948).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126 971793).

  - CVE-2016-3136: The mct_u232_msr_to_state function in     drivers/usb/serial/mct_u232.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted USB device without two interrupt-in     endpoint descriptors (bnc#970955).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911 970970).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-3689: The ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) via a USB device without both a     master and a slave interface (bnc#971628).

  - CVE-2016-3951: Double free vulnerability in     drivers/net/usb/cdc_ncm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact by inserting a USB device with an invalid     USB descriptor (bnc#974418).

  - CVE-2016-4482: Fixed information leak in devio     (bnc#978401).

  - CVE-2016-4486: Fixed information leak in rtnetlink (     bsc#978822).

  - CVE-2016-4569: Fixed information leak in events via     snd_timer_user_tinterrupt (bsc#979213).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.60 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2014-9717: fs/namespace.c in the Linux kernel     processes MNT_DETACH umount2 system called without     verifying that the MNT_LOCKED flag is unset, which     allowed local users to bypass intended access     restrictions and navigate to filesystem locations     beneath a mount by calling umount2 within a user     namespace (bnc#928547).

  - CVE-2015-8816: The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel did not     properly maintain a hub-interface data structure, which     allowed physically proximate attackers to cause a denial     of service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device (bnc#968010).

  - CVE-2015-8845: The tm_reclaim_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms did not ensure that TM suspend mode     exists before proceeding with a tm_reclaim call, which     allowed local users to cause a denial of service (TM Bad     Thing exception and panic) via a crafted application     (bnc#975533).

  - CVE-2016-0758: Fix ASN.1 indefinite length object     parsing (bsc#979867).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-2143: The fork implementation in the Linux     kernel on s390 platforms mishandled the case of four     page-table levels, which allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a crafted application,     related to arch/s390/include/asm/mmu_context.h and     arch/s390/include/asm/pgalloc.h. (bnc#970504)

  - CVE-2016-2184: The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference or     double free, and system crash) via a crafted endpoints     value in a USB device descriptor (bnc#971125).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-2782: The treo_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint (bnc#968670).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bnc#970948).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-3136: The mct_u232_msr_to_state function in     drivers/usb/serial/mct_u232.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted USB device without two interrupt-in     endpoint descriptors (bnc#970955).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911).

  - CVE-2016-3139: The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970909).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-3156: The IPv4 implementation in the Linux     kernel mishandled destruction of device objects, which     allowed guest OS users to cause a denial of service     (host OS networking outage) by arranging for a large     number of IP addresses (bnc#971360).

  - CVE-2016-3672: The arch_pick_mmap_layout function in     arch/x86/mm/mmap.c in the Linux kernel did not properly     randomize the legacy base address, which made it easier     for local users to defeat the intended restrictions on     the ADDR_NO_RANDOMIZE flag, and bypass the ASLR     protection mechanism for a setuid or setgid program, by     disabling stack-consumption resource limits     (bnc#974308).

  - CVE-2016-3689: The ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) via a USB device without both a     master and a slave interface (bnc#971628).

  - CVE-2016-3951: Double free vulnerability in     drivers/net/usb/cdc_ncm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact by inserting a USB device with an invalid     USB descriptor (bnc#974418).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bnc#978401).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relied on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bnc#979213).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-5244: Fixed an infoleak in rds_inc_info_copy     (bsc#983213).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.2 kernel was updated to fix various bugs and security issues.

The following security bugs were fixed :

  - CVE-2016-1583: Prevent the usage of mmap when the lower     file system does not allow it. This could have lead to     local privilege escalation when ecryptfs-utils was     installed and /sbin/mount.ecryptfs_private was setuid     (bsc#983143).

  - CVE-2016-4913: The get_rock_ridge_filename function in     fs/isofs/rock.c in the Linux kernel mishandles NM (aka     alternate name) entries containing \0 characters, which     allowed local users to obtain sensitive information from     kernel memory or possibly have unspecified other impact     via a crafted isofs filesystem (bnc#980725).

  - CVE-2016-4580: The x25_negotiate_facilities function in     net/x25/x25_facilities.c in the Linux kernel did not     properly initialize a certain data structure, which     allowed attackers to obtain sensitive information from     kernel stack memory via an X.25 Call Request     (bnc#981267).

  - CVE-2016-0758: Tags with indefinite length could have     corrupted pointers in asn1_find_indefinite_length     (bsc#979867).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-2187: The gtco_probe function in     drivers/input/tablet/gtco.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#971919 971944).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bnc#978401 bsc#978445).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relies on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548 bsc#980363).

  - CVE-2016-3672: The arch_pick_mmap_layout function in     arch/x86/mm/mmap.c in the Linux kernel did not properly     randomize the legacy base address, which made it easier     for local users to defeat the intended restrictions on     the ADDR_NO_RANDOMIZE flag, and bypass the ASLR     protection mechanism for a setuid or setgid program, by     disabling stack-consumption resource limits     (bnc#974308).

  - CVE-2016-4581: fs/pnode.c in the Linux kernel did not     properly traverse a mount propagation tree in a certain     case involving a slave mount, which allowed local users     to cause a denial of service (NULL pointer dereference     and OOPS) via a crafted series of mount system calls     (bnc#979913).

  - CVE-2016-4485: The llc_cmsg_rcv function in     net/llc/af_llc.c in the Linux kernel did not initialize     a certain data structure, which allowed attackers to     obtain sensitive information from kernel stack memory by     reading a message (bnc#978821).

  - CVE-2015-3288: A security flaw was found in the Linux     kernel that there was a way to arbitrary change zero     page memory. (bnc#979021).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bnc#979213).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bnc#970948 974646).

  - CVE-2016-3136: The mct_u232_msr_to_state function in     drivers/usb/serial/mct_u232.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted USB device without two interrupt-in     endpoint descriptors (bnc#970955).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3951: Double free vulnerability in     drivers/net/usb/cdc_ncm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact by inserting a USB device with an invalid     USB descriptor (bnc#974418).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-3689: The ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) via a USB device without both a     master and a slave interface (bnc#971628).

  - CVE-2016-3156: The IPv4 implementation in the Linux     kernel mishandles destruction of device objects, which     allowed guest OS users to cause a denial of service     (host OS networking outage) by arranging for a large     number of IP addresses (bnc#971360).

  - CVE-2016-2184: The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference or     double free, and system crash) via a crafted endpoints     value in a USB device descriptor (bnc#971125).

  - CVE-2016-3139: The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970909).

  - CVE-2015-8830: Integer overflow in the     aio_setup_single_vector function in fs/aio.c in the     Linux kernel 4.0 allowed local users to cause a denial     of service or possibly have unspecified other impact via     a large AIO iovec. NOTE: this vulnerability exists     because of a CVE-2012-6701 regression (bnc#969354     bsc#969355).

  - CVE-2016-2782: The treo_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint (bnc#968670).

  - CVE-2015-8816: The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel did not     properly maintain a hub-interface data structure, which     allowed physically proximate attackers to cause a denial     of service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device (bnc#968010).

  - CVE-2015-7566: The clie_5_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a bulk-out endpoint (bnc#961512).

  - CVE-2016-2549: sound/core/hrtimer.c in the Linux kernel     did not prevent recursive callback access, which allowed     local users to cause a denial of service (deadlock) via     a crafted ioctl call (bnc#968013).

  - CVE-2016-2547: sound/core/timer.c in the Linux kernel     employs a locking approach that did not consider slave     timer instances, which allowed local users to cause a     denial of service (race condition, use-after-free, and     system crash) via a crafted ioctl call (bnc#968011).

  - CVE-2016-2548: sound/core/timer.c in the Linux kernel     retains certain linked lists after a close or stop     action, which allowed local users to cause a denial of     service (system crash) via a crafted ioctl call, related     to the (1) snd_timer_close and (2) _snd_timer_stop     functions (bnc#968012).

  - CVE-2016-2546: sound/core/timer.c in the Linux kernel     uses an incorrect type of mutex, which allowed local     users to cause a denial of service (race condition,     use-after-free, and system crash) via a crafted ioctl     call (bnc#967975).

  - CVE-2016-2545: The snd_timer_interrupt function in     sound/core/timer.c in the Linux kernel did not properly     maintain a certain linked list, which allowed local     users to cause a denial of service (race condition and     system crash) via a crafted ioctl call (bnc#967974).

  - CVE-2016-2544: Race condition in the queue_delete     function in sound/core/seq/seq_queue.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) by making an ioctl     call at a certain time (bnc#967973).

  - CVE-2016-2543: The snd_seq_ioctl_remove_events function     in sound/core/seq/seq_clientmgr.c in the Linux kernel     did not verify FIFO assignment before proceeding with     FIFO clearing, which allowed local users to cause a     denial of service (NULL pointer dereference and OOPS)     via a crafted ioctl call (bnc#967972).

  - CVE-2015-8709: ** DISPUTED ** kernel/ptrace.c in the     Linux kernel mishandles uid and gid mappings, which     allowed local users to gain privileges by establishing a     user namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the     ptrace system call. NOTE: the vendor states 'there is no     kernel bug here (bnc#959709 960561 ).

  - CVE-2015-8812: drivers/infiniband/hw/cxgb3/iwch_cm.c in     the Linux kernel did not properly identify error     conditions, which allowed remote attackers to execute     arbitrary code or cause a denial of service     (use-after-free) via crafted packets (bnc#966437).

  - CVE-2016-2384: Double free vulnerability in the     snd_usbmidi_create function in sound/usb/midi.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (panic) or possibly have     unspecified other impact via vectors involving an     invalid USB descriptor (bnc#966693).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2014-9904: The snd_compress_check_input function in     sound/core/compress_offload.c in the ALSA subsystem in     the Linux kernel did not properly check for an integer     overflow, which allowed local users to cause a denial of     service (insufficient memory allocation) or possibly     have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl call (bnc#986811).

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allow     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572 986573).

  - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (memory corruption) by leveraging     in-container root access to provide a crafted offset     value that triggers an unintended decrement (bnc#986362     986365 986377).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755 984764).

  - CVE-2015-6526: The perf_callchain_user_64 function in     arch/powerpc/perf/callchain.c in the Linux kernel on     ppc64 platforms allowed local users to cause a denial of     service (infinite loop) via a deep 64-bit userspace     backtrace (bnc#942702).

  - CVE-2016-5244: The rds_inc_info_copy function in     net/rds/recv.c in the Linux kernel did not initialize a     certain structure member, which allowed remote attackers     to obtain sensitive information from kernel stack memory     by reading an RDS message (bnc#983213).

The following non-security bugs were fixed :

  - ALSA: hrtimer: Handle start/stop more properly     (bsc#973378).

  - ALSA: pcm: Fix potential deadlock in OSS emulation     (bsc#968018).

  - ALSA: rawmidi: Fix race at copying & updating the     position (bsc#968018).

  - ALSA: rawmidi: Make snd_rawmidi_transmit() race-free     (bsc#968018).

  - ALSA: seq: Fix double port list deletion (bsc#968018).

  - ALSA: seq: Fix incorrect sanity check at     snd_seq_oss_synth_cleanup() (bsc#968018).

  - ALSA: seq: Fix leak of pool buffer at concurrent writes     (bsc#968018).

  - ALSA: seq: Fix lockdep warnings due to double mutex     locks (bsc#968018).

  - ALSA: seq: Fix race at closing in virmidi driver     (bsc#968018).

  - ALSA: seq: Fix yet another races among ALSA timer     accesses (bsc#968018).

  - ALSA: timer: Call notifier in the same spinlock     (bsc#973378).

  - ALSA: timer: Code cleanup (bsc#968018).

  - ALSA: timer: Fix leftover link at closing (bsc#968018).

  - ALSA: timer: Fix link corruption due to double start or     stop (bsc#968018).

  - ALSA: timer: Fix race between stop and interrupt     (bsc#968018).

  - ALSA: timer: Fix wrong instance passed to slave     callbacks (bsc#968018).

  - ALSA: timer: Protect the whole snd_timer_close() with     open race (bsc#973378).

  - ALSA: timer: Sync timer deletion at closing the system     timer (bsc#973378).

  - ALSA: timer: Use mod_timer() for rearming the system     timer (bsc#973378).

  - Bluetooth: vhci: Fix race at creating hci device     (bsc#971799,bsc#966849).

  - Bluetooth: vhci: fix open_timeout vs. hdev race     (bsc#971799,bsc#966849).

  - Bluetooth: vhci: purge unhandled skbs     (bsc#971799,bsc#966849).

  - Btrfs: do not use src fd for printk (bsc#980348).

  - Refresh     patches.drivers/ALSA-hrtimer-Handle-start-stop-more-prop     erly. Fix the build error on 32bit architectures.

  - Refresh patches.xen/xen-netback-coalesce: Restore     copying of SKBs with head exceeding page size     (bsc#978469).

  - Refresh patches.xen/xen3-patch-3.14: Suppress atomic     file position updates on /proc/xen/xenbus (bsc#970275).

  - Subject: [PATCH] USB: xhci: Add broken streams quirk for     Frescologic device id 1009 (bnc#982706).

  - USB: usbip: fix potential out-of-bounds write     (bnc#975945).

  - af_unix: Guard against other == sk in unix_dgram_sendmsg     (bsc#973570).

  - backends: guarantee one time reads of shared ring     contents (bsc#957988).

  - btrfs: do not go readonly on existing qgroup items     (bsc#957052).

  - btrfs: remove error message from search ioctl for     nonexistent tree.

  - drm/i915: Fix missing backlight update during panel     disablement (bsc#941113 boo#901754).

  - enic: set netdev->vlan_features (bsc#966245).

  - ext4: fix races between buffered IO and collapse /     insert range (bsc#972174).

  - ext4: fix races between page faults and hole punching     (bsc#972174).

  - ext4: fix races of writeback with punch hole and zero     range (bsc#972174).

  - ext4: move unlocked dio protection from     ext4_alloc_file_blocks() (bsc#972174).

  - ipv4/fib: do not warn when primary address is missing if     in_dev is dead (bsc#971360).

  - ipvs: count pre-established TCP states as active     (bsc#970114).

  - net: core: Correct an over-stringent device loop     detection (bsc#945219).

  - netback: do not use last request to determine minimum Tx     credit (bsc#957988).

  - pciback: Check PF instead of VF for PCI_COMMAND_MEMORY.

  - pciback: Save the number of MSI-X entries to be copied     later.

  - pciback: guarantee one time reads of shared ring     contents (bsc#957988).

  - series.conf: move cxgb3 patch to network drivers section

  - usb: quirk to stop runtime PM for Intel 7260     (bnc#984464).

  - x86: standardize mmap_rnd() usage (bnc#974308).

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3000-1 advisory.

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables     scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from     kernel memory. (CVE-2016-2117)

    Jann Horn discovered that eCryptfs improperly attempted to use the mmap() handler of a lower filesystem     that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could     use to cause a denial of service (system crash) or possibly execute arbitrary code with administrative     privileges. (CVE-2016-1583)

    Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB over wifi device drivers in the     Linux kernel. A remote attacker could use this to cause a denial of service (system crash) or obtain     potentially sensitive information from kernel memory. (CVE-2015-4004)

    Ralf Spenneberg discovered that the Linux kernel's GTCO digitizer USB device driver did not properly     validate endpoint descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2187)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    Hector Marco and Ismael Ripoll discovered that the Linux kernel would improperly disable Address Space     Layout Randomization (ASLR) for x86 processes running in 32 bit mode if stack-consumption resource limits     were disabled. A local attacker could use this to make it easier to exploit an existing vulnerability in a     setuid/setgid program. (CVE-2016-3672)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

    Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not     cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3951)

    It was discovered that an out-of-bounds write could occur when handling incoming packets in the USB/IP     implementation in the Linux kernel. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-3955)

    Kangjie Lu discovered an information leak in the ANSI/IEEE 802.2 LLC type 2 Support implementations in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-4485)

    Kangjie Lu discovered an information leak in the routing netlink socket interface (rtnetlink)     implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive     information from kernel memory. (CVE-2016-4486)

    It was discovered that in some situations the Linux kernel did not handle propagated mounts correctly. A     local unprivileged attacker could use this to cause a denial of service (system crash). (CVE-2016-4581)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2016-2847: Limit the per-user amount of pages     allocated in pipes (bsc#970948).

  - CVE-2016-3136: mct_u232: add sanity checking in probe     (bnc#970955).

  - CVE-2016-2188: iowarrior: fix oops with malicious USB     descriptors (bnc#970956).

  - CVE-2016-3138: cdc-acm: more sanity checking     (bnc#970911).

  - CVE-2016-3137: cypress_m8: add endpoint sanity check     (bnc#970970).

  - CVE-2016-3951: cdc_ncm: do not call usbnet_link_change     from cdc_ncm_bind (bnc#974418).

  - CVE-2016-3140: digi_acceleport: do sanity checking for     the number of ports (bnc#970892).

  - CVE-2016-2186: powermate: fix oops with malicious USB     descriptors (bnc#970958).

  - CVE-2016-2185: usb_driver_claim_interface: add sanity     checking (bnc#971124).

  - CVE-2016-3689: ims-pcu: sanity check against missing     interfaces (bnc#971628).

  - CVE-2016-3156: ipv4: Do not do expensive useless work     during inetdev destroy (bsc#971360).

The following non-security bugs were fixed :

  - ALSA: timer: Call notifier in the same spinlock     (bsc#973378).

  - ALSA: timer: Protect the whole snd_timer_close() with     open race (bsc#973378).

  - ALSA: timer: Sync timer deletion at closing the system     timer (bsc#973378).

  - ALSA: timer: Use mod_timer() for rearming the system     timer (bsc#973378).

  - Backport arm64 patches from SLE12-SP1-ARM

  - Fix kABI additions for pipe: limit the per-user amount     of pages allocated in pipes.

  - Revert 'drm/radeon: call hpd_irq_event on resume'     (boo#975868).

  - Update config files. Enable RTC_HCTOSYS, build     I2C_XGENE_SLIMPRO as a module.

  - backends: guarantee one time reads of shared ring     contents (bsc#957988).

  - ext4: fix races between buffered IO and collapse /     insert range (bsc#972174).

  - ext4: fix races between page faults and hole punching     (bsc#972174).

  - ext4: fix races of writeback with punch hole and zero     range (bsc#972174).

  - ext4: move unlocked dio protection from     ext4_alloc_file_blocks() (bsc#972174).

  - net: thunderx: Use napi_schedule_irqoff() 

  - netback: do not use last request to determine minimum Tx     credit (bsc#957988).

Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). (CVE-2015-7515)

Zach Riggle discovered that the Linux kernel's list poison feature did not take into account the mmap_min_addr value. A local attacker could use this to bypass the kernel's poison-pointer protection mechanism while attempting to exploit an existing kernel vulnerability.
(CVE-2016-0821)

Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2184)

Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2185)

Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2186)

Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2188)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3136)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash).
(CVE-2016-3137)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3138)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking outage) in the host OS. (CVE-2016-3156)

Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain privileges, or obtain sensitive information. (CVE-2016-3157)

It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not properly validate the device's interfaces. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3689).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2971-2 advisory.

    USN-2971-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04     LTS.

    Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly     validate the endpoints reported by the device. An attacker with physical access could cause a denial of     service (system crash). (CVE-2015-7515)

    Zach Riggle discovered that the Linux kernel's list poison feature did not take into account the     mmap_min_addr value. A local attacker could use this to bypass the kernel's poison-pointer protection     mechanism while attempting to exploit an existing kernel vulnerability. (CVE-2016-0821)

    Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2184)

    Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2185)

    Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2186)

    Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2188)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control     driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3138)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet     device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking     outage) in the host OS. (CVE-2016-3156)

    Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen     guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain     privileges, or obtain sensitive information. (CVE-2016-3157)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2970-1 advisory.

    Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly     validate the endpoints reported by the device. An attacker with physical access could cause a denial of     service (system crash). (CVE-2015-7515)

    Ben Hawkes discovered that the Linux kernel's AIO interface allowed single writes greater than 2GB, which     could cause an integer overflow when writing to certain filesystems, socket or device types. A local     attacker could this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2015-8830)

    Zach Riggle discovered that the Linux kernel's list poison feature did not take into account the     mmap_min_addr value. A local attacker could use this to bypass the kernel's poison-pointer protection     mechanism while attempting to exploit an existing kernel vulnerability. (CVE-2016-0821)

    Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2184)

    Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2185)

    Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2186)

    Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2188)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control     driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3138)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet     device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking     outage) in the host OS. (CVE-2016-3156)

    Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen     guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain     privileges, or obtain sensitive information. (CVE-2016-3157)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-2968-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). (CVE-2015-7515)

Ben Hawkes discovered that the Linux kernel's AIO interface allowed single writes greater than 2GB, which could cause an integer overflow when writing to certain filesystems, socket or device types. A local attacker could this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2015-8830)

It was discovered that the Linux kernel did not keep accurate track of pipe buffer details when error conditions occurred, due to an incomplete fix for CVE-2015-1805. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-0774)

Zach Riggle discovered that the Linux kernel's list poison feature did not take into account the mmap_min_addr value. A local attacker could use this to bypass the kernel's poison-pointer protection mechanism while attempting to exploit an existing kernel vulnerability.
(CVE-2016-0821)

Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2184)

Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2185)

Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2186)

Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2188)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3136)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash).
(CVE-2016-3137)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3138)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking outage) in the host OS. (CVE-2016-3156)

Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain privileges, or obtain sensitive information. (CVE-2016-3157)

It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not properly validate the device's interfaces. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3689).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2968-1 advisory.

    Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly     validate the endpoints reported by the device. An attacker with physical access could cause a denial of     service (system crash). (CVE-2015-7515)

    Ben Hawkes discovered that the Linux kernel's AIO interface allowed single writes greater than 2GB, which     could cause an integer overflow when writing to certain filesystems, socket or device types. A local     attacker could this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2015-8830)

    It was discovered that the Linux kernel did not keep accurate track of pipe buffer details when error     conditions occurred, due to an incomplete fix for CVE-2015-1805. A local attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
    (CVE-2016-0774)

    Zach Riggle discovered that the Linux kernel's list poison feature did not take into account the     mmap_min_addr value. A local attacker could use this to bypass the kernel's poison-pointer protection     mechanism while attempting to exploit an existing kernel vulnerability. (CVE-2016-0821)

    Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2184)

    Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2185)

    Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2186)

    Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2188)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control     driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3138)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet     device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking     outage) in the host OS. (CVE-2016-3156)

    Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen     guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain     privileges, or obtain sensitive information. (CVE-2016-3157)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2965-4 advisory.

    Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     did not properly reference count file descriptors, leading to a use-after-free. A local unprivileged     attacker could use this to gain administrative privileges.

    Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2184)

    Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2185)

    Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2186)

    Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2188)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control     driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3138)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet     device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking     outage) in the host OS. (CVE-2016-3156)

    Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen     guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain     privileges, or obtain sensitive information. (CVE-2016-3157)

    Hector Marco and Ismael Ripoll discovered that the Linux kernel would improperly disable Address Space     Layout Randomization (ASLR) for x86 processes running in 32 bit mode if stack-consumption resource limits     were disabled. A local attacker could use this to make it easier to exploit an existing vulnerability in a     setuid/setgid program. (CVE-2016-3672)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

    Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not     cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3951)

    It was discovered that an out-of-bounds write could occur when handling incoming packets in the USB/IP     implementation in the Linux kernel. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-3955)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2965-3 advisory.

    Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     did not properly reference count file descriptors, leading to a use-after-free. A local unprivileged     attacker could use this to gain administrative privileges. (CVE-2016-4557)

    Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2184)

    Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2185)

    Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2186)

    Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2188)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control     driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3138)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet     device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking     outage) in the host OS. (CVE-2016-3156)

    Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen     guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain     privileges, or obtain sensitive information. (CVE-2016-3157)

    Hector Marco and Ismael Ripoll discovered that the Linux kernel would improperly disable Address Space     Layout Randomization (ASLR) for x86 processes running in 32 bit mode if stack-consumption resource limits     were disabled. A local attacker could use this to make it easier to exploit an existing vulnerability in a     setuid/setgid program. (CVE-2016-3672)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

    Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not     cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3951)

    It was discovered that an out-of-bounds write could occur when handling incoming packets in the USB/IP     implementation in the Linux kernel. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-3955)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2965-2 advisory.

    USN-2965-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     did not properly reference count file descriptors, leading to a use-after-free. A local unprivileged     attacker could use this to gain administrative privileges. (CVE-2016-4557)

    Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2184)

    Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2185)

    Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2186)

    Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2188)

    It was discovered that the Linux kernel did not enforce limits on the amount of data allocated to buffer     pipes. A local attacker could use this to cause a denial of service (resource exhaustion). (CVE-2016-2847)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control     driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3138)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet     device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking     outage) in the host OS. (CVE-2016-3156)

    Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen     guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain     privileges, or obtain sensitive information. (CVE-2016-3157)

    Hector Marco and Ismael Ripoll discovered that the Linux kernel would improperly disable Address Space     Layout Randomization (ASLR) for x86 processes running in 32 bit mode if stack-consumption resource limits     were disabled. A local attacker could use this to make it easier to exploit an existing vulnerability in a     setuid/setgid program. (CVE-2016-3672)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

    Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not     cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3951)

    It was discovered that an out-of-bounds write could occur when handling incoming packets in the USB/IP     implementation in the Linux kernel. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-3955)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2965-1 advisory.

    Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     did not properly reference count file descriptors, leading to a use-after-free. A local unprivileged     attacker could use this to gain administrative privileges. (CVE-2016-4557)

    Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2184)

    Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2185)

    Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB     device descriptors. An attacker with physical access could use this to cause a denial of service (system     crash). (CVE-2016-2186)

    Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly     validate USB device descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2188)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device     driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3136)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver     in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access     could use this to cause a denial of service (system crash). (CVE-2016-3137)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control     driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical     access could use this to cause a denial of service (system crash). (CVE-2016-3138)

    Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for     Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

    It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet     device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking     outage) in the host OS. (CVE-2016-3156)

    Andy Lutomirski discovered that the Linux kernel did not properly context- switch IOPL on 64-bit PV Xen     guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain     privileges, or obtain sensitive information. (CVE-2016-3157)

    Hector Marco and Ismael Ripoll discovered that the Linux kernel would improperly disable Address Space     Layout Randomization (ASLR) for x86 processes running in 32 bit mode if stack-consumption resource limits     were disabled. A local attacker could use this to make it easier to exploit an existing vulnerability in a     setuid/setgid program. (CVE-2016-3672)

    It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not     properly validate the device's interfaces. An attacker with physical access could use this to cause a     denial of service (system crash). (CVE-2016-3689)

    Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not     cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with     physical access could use this to cause a denial of service (system crash). (CVE-2016-3951)

    It was discovered that an out-of-bounds write could occur when handling incoming packets in the USB/IP     implementation in the Linux kernel. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-3955)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
132134	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-2599)	Nessus	Huawei Local Security Checks	critical
131845	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-2353)	Nessus	Huawei Local Security Checks	critical
124826	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1503)	Nessus	Huawei Local Security Checks	critical
124816	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1492)	Nessus	Huawei Local Security Checks	critical
93168	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1696-1)	Nessus	SuSE Local Security Checks	high
93165	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1690-1)	Nessus	SuSE Local Security Checks	high
93104	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1015)	Nessus	SuSE Local Security Checks	critical
92007	openSUSE Security Update : the Linux Kernel (openSUSE-2016-862)	Nessus	SuSE Local Security Checks	high
91562	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-3000-1)	Nessus	Ubuntu Local Security Checks	critical
91306	openSUSE Security Update : the Linux Kernel (openSUSE-2016-629)	Nessus	SuSE Local Security Checks	medium
91094	Ubuntu 15.10 : linux-raspi2 vulnerabilities (USN-2971-3)	Nessus	Ubuntu Local Security Checks	high
91093	Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerabilities (USN-2971-2)	Nessus	Ubuntu Local Security Checks	high
91092	Ubuntu 15.10 : linux vulnerabilities (USN-2971-1)	Nessus	Ubuntu Local Security Checks	high
91091	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2970-1)	Nessus	Ubuntu Local Security Checks	high
91089	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2968-2)	Nessus	Ubuntu Local Security Checks	high
91088	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2968-1)	Nessus	Ubuntu Local Security Checks	high
91085	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerability (USN-2965-4)	Nessus	Ubuntu Local Security Checks	critical
91084	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-2965-3)	Nessus	Ubuntu Local Security Checks	critical
91083	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-2965-2)	Nessus	Ubuntu Local Security Checks	critical
91082	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-2965-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2016-3689

medium

Tenable Plugins

critical

critical

critical

critical

critical

high

high

critical

high

critical

medium

high

high

high

high

high

high

critical

critical

critical

critical