The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

Security Fix(es) :

  - It was found that the Linux kernel's IPv6 implementation     mishandled socket options. A local attacker could abuse     concurrent access to the socket options to escalate     their privileges, or cause a denial of service     (use-after-free and system crash) via a crafted sendmsg     system call. (CVE-2016-3841, Important)

(CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Additional Changes :

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - aacraid: Check size values after double-fetch from user     (Dave Carroll) [Orabug: 25060050] (CVE-2016-6480)     (CVE-2016-6480)

  - IB/srpt: Simplify srpt_handle_tsk_mgmt (Bart Van Assche)     [Orabug: 25060011] (CVE-2016-6327)

  - audit: fix a double fetch in audit_log_single_execve_arg     (Paul Moore) [Orabug: 25059945] (CVE-2016-6136)

  - ALSA: timer: Fix leak in events via     snd_timer_user_tinterrupt (Kangjie Lu) [Orabug:
    25059899] (CVE-2016-4578)

  - ALSA: timer: Fix leak in events via     snd_timer_user_ccallback (Kangjie Lu) [Orabug: 25059899]     (CVE-2016-4578)

  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS     (Kangjie Lu) [Orabug: 25059753] (CVE-2016-4569)

  - acpi: Disable ACPI table override if securelevel is set     (Linn Crosetto) [Orabug: 25058991] (CVE-2016-3699)

  - Bluetooth: Fix potential NULL dereference in RFCOMM bind     callback (Jaganath Kanakkassery) [Orabug: 25058903]     (CVE-2015-8956)

  - ASN.1: Fix non-match detection failure on data overrun     (David Howells) [Orabug: 25059046] (CVE-2016-2053)

  - mm: migrate dirty page without clear_page_dirty_for_io     etc (Hugh Dickins) [Orabug: 25059194] (CVE-2016-3070)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - acpi: Disable ACPI table override if securelevel is set     (Linn Crosetto) [Orabug: 25058966] (CVE-2016-3699)

  - aacraid: Check size values after double-fetch from user     (Dave Carroll) [Orabug: 25060060] (CVE-2016-6480)     (CVE-2016-6480)

  - audit: fix a double fetch in audit_log_single_execve_arg     (Paul Moore) [Orabug: 25059969] (CVE-2016-6136)

  - ecryptfs: don't allow mmap when the lower fs doesn't     support it (Jeff Mahoney) [Orabug: 25023269]     (CVE-2016-1583) (CVE-2016-1583)

  - Revert 'ecryptfs: forbid opening files without mmap     handler' (Chuck Anderson) [Orabug: 24971921]     (CVE-2016-1583)

  - percpu: fix synchronization between synchronous map     extension and chunk destruction (Tejun Heo) [Orabug:
    25060084] (CVE-2016-4794)

  - percpu: fix synchronization between     chunk->map_extend_work and chunk destruction (Tejun Heo)     [Orabug: 25060084] (CVE-2016-4794)

  - ALSA: timer: Fix leak in events via     snd_timer_user_tinterrupt (Kangjie Lu) [Orabug:
    25059898] (CVE-2016-4578)

  - ALSA: timer: Fix leak in events via     snd_timer_user_ccallback (Kangjie Lu) [Orabug: 25059898]     (CVE-2016-4578)

  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS     (Kangjie Lu) [Orabug: 25059752] (CVE-2016-4569)

  - Bluetooth: Fix potential NULL dereference in RFCOMM bind     callback (Jaganath Kanakkassery) [Orabug: 25058894]     (CVE-2015-8956)

  - ASN.1: Fix non-match detection failure on data overrun     (David Howells) [Orabug: 25059037] (CVE-2016-2053)

  - mm: migrate dirty page without clear_page_dirty_for_io     etc (Hugh Dickins) [Orabug: 25059188] (CVE-2016-3070)

  - uek-rpm ol7: change uek-rpm/ol7/update-el release value     from 7.1 to 7.3 (Chuck Anderson) [Orabug: 25050614]

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3645 advisory.

    - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060050]     {CVE-2016-6480} {CVE-2016-6480}
    - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche)  [Orabug: 25060011]  {CVE-2016-6327}
    - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059945]     {CVE-2016-6136}
    - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059899]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059899]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059753]  {CVE-2016-4569}
    - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058991]     {CVE-2016-3699}
    - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug:
    25058903]  {CVE-2015-8956}
    - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059046]     {CVE-2016-2053}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3644 advisory.

    - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058966]     {CVE-2016-3699}
    - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060060]     {CVE-2016-6480} {CVE-2016-6480}
    - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059969]     {CVE-2016-6136}
    - ecryptfs: don't allow mmap when the lower fs doesn't support it (Jeff Mahoney)  [Orabug: 25023269]     {CVE-2016-1583} {CVE-2016-1583}
    - Revert 'ecryptfs: forbid opening files without mmap handler' (Chuck Anderson)  [Orabug: 24971921]     {CVE-2016-1583}
    - percpu: fix synchronization between synchronous map extension and chunk destruction (Tejun Heo)     [Orabug: 25060084]  {CVE-2016-4794}
    - percpu: fix synchronization between chunk->map_extend_work and chunk destruction (Tejun Heo)  [Orabug:
    25060084]  {CVE-2016-4794}
    - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059898]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059898]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059752]  {CVE-2016-4569}
    - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug:
    25058894]  {CVE-2015-8956}
    - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059037]     {CVE-2016-2053}
    - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059188]     {CVE-2016-3070}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2574 advisory.

    - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Larry Woodman) [1385124] {CVE-2016-5195}
    - [net] add recursion limit to GRO (Sabrina Dubroca) [1374191] {CVE-2016-7039}
    - [kernel] audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore) [1359306]     {CVE-2016-6136}
    - [scsi] aacraid: Check size values after double-fetch from user (Maurizio Lombardi) [1369771]     {CVE-2016-6480}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

ID	Name	Product	Family	Severity
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
95841	Scientific Linux Security Update : kernel on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	critical
95321	CentOS 7 : kernel (CESA-2016:2574)	Nessus	CentOS Local Security Checks	critical
95046	OracleVM 3.3 : Unbreakable / etc (OVMSA-2016-0163)	Nessus	OracleVM Local Security Checks	high
95045	OracleVM 3.4 : Unbreakable / etc (OVMSA-2016-0162)	Nessus	OracleVM Local Security Checks	high
95043	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3645)	Nessus	Oracle Linux Local Security Checks	high
95042	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3644)	Nessus	Oracle Linux Local Security Checks	high
94697	Oracle Linux 7 : kernel (ELSA-2016-2574)	Nessus	Oracle Linux Local Security Checks	critical
94547	RHEL 7 : kernel-rt (RHSA-2016:2584)	Nessus	Red Hat Local Security Checks	critical
94537	RHEL 7 : kernel (RHSA-2016:2574)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2016-3699

high

Tenable Plugins

critical

critical

critical

high

high

high

high

critical

critical

critical