The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in Linux kernel. There is an     information leak in file 'sound/core/timer.c' of the     latest mainline Linux kernel, the stack object     aEURoetreadaEUR has a total size of 32 bytes. It contains a     8-bytes padding, which is not initialized but sent to     user via copy_to_user(), resulting a kernel     leak.(CVE-2016-4569)

  - A vulnerability was found in Linux kernel. There is an     information leak in file sound/core/timer.c of the     latest mainline Linux kernel. The stack object aEURoer1aEUR     has a total size of 32 bytes. Its field aEURoeeventaEUR and     aEURoevalaEUR both contain 4 bytes padding. These 8 bytes     padding bytes are sent to user without being     initialized.(CVE-2016-4578)

  - The x25_negotiate_facilities function in     net/x25/x25_facilities.c in the Linux kernel before     4.5.5 does not properly initialize a certain data     structure, which allows attackers to obtain sensitive     information from kernel stack memory via an X.25 Call     Request.(CVE-2016-4580)

  - fs/pnode.c in the Linux kernel before 4.5.4 does not     properly traverse a mount propagation tree in a certain     case involving a slave mount, which allows local users     to cause a denial of service (NULL pointer dereference     and OOPS) via a crafted series of mount system     calls.(CVE-2016-4581)

  - Use after free vulnerability was found in percpu using     previously allocated memory in bpf. First
    __alloc_percpu_gfp() is called, then the memory is     freed with free_percpu() which triggers async     pcpu_balance_work and then pcpu_extend_area_map could     use a chunk after it has been freed.(CVE-2016-4794)

  - Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     before 4.5.2 allows local users to cause a denial of     service (memory corruption and system crash, or     spinlock) or possibly have unspecified other impact by     removing a network namespace, related to the     ppp_register_net_channel and ppp_unregister_channel     functions.(CVE-2016-4805)

  - A vulnerability was found in the Linux kernel. Payloads     of NM entries are not supposed to contain NUL. When     such entry is processed, only the part prior to the     first NUL goes into the concatenation (i.e. the     directory entry name being encoded by a bunch of NM     entries). The process stops when the amount collected     so far + the claimed amount in the current NM entry     exceed 254. However, the value returned as the total     length is the sum of *claimed* sizes, not the actual     amount collected. And that's what will be passed to     readdir() callback as the name length - 8Kb
    __copy_to_user() from a buffer allocated by
    __get_free_page().(CVE-2016-4913)

  - A flaw was discovered in processing setsockopt for 32     bit processes on 64 bit systems. This flaw will allow     attackers to alter arbitrary kernel memory when     unloading a kernel module. This action is usually     restricted to root-privileged users but can also be     leveraged if the kernel is compiled with CONFIG_USER_NS     and CONFIG_NET_NS and the user is granted elevated     privileges.(CVE-2016-4997)

  - An out-of-bounds heap memory access leading to a Denial     of Service, heap disclosure, or further impact was     found in setsockopt(). The function call is normally     restricted to root, however some processes with     cap_sys_admin may also be able to trigger this flaw in     privileged container environments.(CVE-2016-4998)

  - A race condition was found in the way the Linux     kernel's memory subsystem handled the copy-on-write     (COW) breakage of private read-only memory mappings. An     unprivileged, local user could use this flaw to gain     write access to otherwise read-only memory mappings and     thus increase their privileges on the     system.(CVE-2016-5195)

  - It was found that the RFC 5961 challenge ACK rate     limiting as implemented in the Linux kernel's     networking subsystem allowed an off-path attacker to     leak certain information about a given connection by     creating congestion on the global challenge ACK rate     limit counter and then measuring the changes by probing     packets. An off-path attacker could use this flaw to     either terminate TCP connection and/or inject payload     into non-secured TCP connection between two endpoints     on the network.(CVE-2016-5696)

  - A heap-based buffer overflow vulnerability was found in     the Linux kernel's hiddev driver. This flaw could allow     a local attacker to corrupt kernel memory, possible     privilege escalation or crashing the     system.(CVE-2016-5829)

  - When creating audit records for parameters to executed     children processes, an attacker can convince the Linux     kernel audit subsystem can create corrupt records which     may allow an attacker to misrepresent or evade logging     of executing commands.(CVE-2016-6136)

  - It was found that the unlink and rename functionality     in overlayfs did not verify the upper dentry for     staleness. A local, unprivileged user could use the     rename syscall on overlayfs on top of xfs to panic or     crash the system.(CVE-2016-6197)

  - A flaw was found that the vfs_rename() function did not     detect hard links on overlayfs. A local, unprivileged     user could use the rename syscall on overlayfs on top     of xfs to crash the system.(CVE-2016-6198)

  - System using the infiniband support module ib_srpt were     vulnerable to a denial of service by system crash by a     local attacker who is able to abort writes to a device     using this initiator.(CVE-2016-6327)

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation.
    A local attacker could use this flaw to cause a denial     of service (out-of-bounds access or system crash) by     changing a certain size value.(CVE-2016-6480)

  - kernel/events/core.c in the performance subsystem in     the Linux kernel before 4.0 mismanages locks during     certain migrations, which allows local users to gain     privileges via a crafted application, aka Android     internal bug 30955111.(CVE-2016-6786)

  - kernel/events/core.c in the performance subsystem in     the Linux kernel before 4.0 mismanages locks during     certain migrations, which allows local users to gain     privileges via a crafted application, aka Android     internal bug 31095224.(CVE-2016-6787)

  - A use-after-free vulnerability was found in     tcp_xmit_retransmit_queue and other tcp_* functions.
    This condition could allow an attacker to send an     incorrect selective acknowledgment to existing     connections, possibly resetting a     connection.(CVE-2016-6828)

  - Linux kernel built with the 802.1Q/802.1ad     VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local     Area Network(CONFIG_VXLAN) with Transparent Ethernet     Bridging(TEB) GRO support, is vulnerable to a stack     overflow issue. It could occur while receiving large     packets via GRO path, as an unlimited recursion could     unfold in both VLAN and TEB modules, leading to a stack     corruption in the kernel.(CVE-2016-7039)

  - It was found that when the gcc stack protector was     enabled, reading the /proc/keys file could cause a     panic in the Linux kernel due to stack corruption. This     happened because an incorrect buffer size was used to     hold a 64-bit timeout value rendered as     weeks.(CVE-2016-7042)

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way. This     could allow a local user to gain group privileges via     certain setgid applications.(CVE-2016-7097)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The NFSv2 and NFSv3 server implementations in the Linux     kernel through 4.10.13 lacked certain checks for the     end of a buffer. A remote attacker could trigger a     pointer-arithmetic error or possibly cause other     unspecified impacts using crafted requests related to     fs/nfsd/nfs3xdr.c and     fs/nfsd/nfsxdr.c.(CVE-2017-7895i1/4%0

  - A flaw was found in the Linux kernel's ACPI subsystem     where a function does not flush the operand cache and     causes a kernel stack dump. This allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism when using a     specially crafted ACPI table.(CVE-2017-13695i1/4%0

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649i1/4%0

  - Race condition in kernel/ucount.c in the Linux kernel     through 4.10.2 allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via crafted system calls     that leverage certain decrement behavior that causes     incorrect interaction between put_ucounts and     get_ucounts.(CVE-2017-6874i1/4%0

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7825i1/4%0

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial     of service (uninitialized-memory free and kernel crash)     or have an unspecified other impact by executing a     crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable.(CVE-2017-17805i1/4%0

  - The msm_ipc_router_bind_control_port function in     net/ipc_router/ipc_router_core.c in the IPC router     kernel module for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, does not verify     that a port is a client port, which allows attackers to     gain privileges or cause a denial of service (race     condition and list corruption) by making many     BIND_CONTROL_PORT ioctl calls.(CVE-2016-2059i1/4%0

  - The do_remount function in fs/namespace.c in the Linux     kernel through 3.16.1 does not maintain the     MNT_LOCK_READONLY bit across a remount of a bind mount,     which allows local users to bypass an intended     read-only restriction and defeat certain sandbox     protection mechanisms via a 'mount -o remount' command     within a user namespace.(CVE-2014-5206i1/4%0

  - The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2185i1/4%0

  - It was found that the fix for CVE-2014-3601 was     incomplete: the Linux kernel's kvm_iommu_map_pages()     function still handled IOMMU mapping failures     incorrectly. A privileged user in a guest with an     assigned host device could use this flaw to crash the     host.(CVE-2014-8369i1/4%0

  - A NULL pointer dereference was found in     net/rds/rdma.c:__rds_rdma_map() function in the Linux     kernel allowing local attackers to cause a system panic     and a denial-of-service.(CVE-2018-7492i1/4%0

  - An issue was discovered in the XFS filesystem in     fs/xfs/xfs_icache.c in the Linux kernel. There is a     NULL pointer dereference leading to a system panic in     lookup_slow() on a NULL inode-i1/4zi_ops pointer when     doing pathwalks on a corrupted xfs image. This occurs     because of a lack of proper validation that cached     inodes are free during an allocation.(CVE-2018-13093i1/4%0

  - The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device     descriptor.(CVE-2016-2188i1/4%0

  - Linux kernel built with the 802.1Q/802.1ad     VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local     Area Network(CONFIG_VXLAN) with Transparent Ethernet     Bridging(TEB) GRO support, is vulnerable to a stack     overflow issue. It could occur while receiving large     packets via GRO path, as an unlimited recursion could     unfold in both VLAN and TEB modules, leading to a stack     corruption in the kernel.(CVE-2016-7039i1/4%0

  - The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in     the Linux kernel before 4.6.1 supports MSR 0x2f8, which     allows guest OS users to read or write to the     kvm_arch_vcpu data structure, and consequently obtain     sensitive information or cause a denial of service     (system crash), via a crafted ioctl     call.(CVE-2016-3713i1/4%0

  - A flaw was found in the way the Linux kernel's VFS     subsystem handled reference counting when performing     unmount operations on symbolic links. A local,     unprivileged user could use this flaw to exhaust all     available memory on the system or, potentially, trigger     a use-after-free error, resulting in a system crash or     privilege escalation.(CVE-2014-5045i1/4%0

  - The KEYS subsystem in the Linux kernel before 4.13.10     does not correctly synchronize the actions of updating     versus finding a key in the 'negative' state to avoid a     race condition, which allows local users to cause a     denial of service or possibly have unspecified other     impact via crafted system calls.(CVE-2017-15951i1/4%0

  - The skb_flow_dissect function in     net/core/flow_dissector.c in the Linux kernel through     3.12 allows remote attackers to cause a denial of     service (infinite loop) via a small value in the IHL     field of a packet with IPIP     encapsulation.(CVE-2013-4348i1/4%0

  - The Linux kernel through 3.17.4 does not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allows local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c.(CVE-2014-8989i1/4%0

  - An infinite-loop flaw was found in the kernel. When a     local user calls the sys_writev syscall with a     specially crafted sequence of iov structs, the     fuse_fill_write_pages kernel function might never     terminate, instead continuing in a tight loop. This     process cannot be terminated and requires a     reboot.(CVE-2015-8785i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.38 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x     provides an incomplete set of requirements for setattr     operations that underspecifies removing extended     privilege attributes, which allowed local users to cause     a denial of service (capability stripping) via a failed     invocation of a system call, as demonstrated by using     chown to remove a capability from the ping or Wireshark     dumpcap program (bnc#914939).

  - CVE-2015-8964: The tty_set_termios_ldisc function in     drivers/tty/tty_ldisc.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory by reading a tty data structure (bnc#1010507).

  - CVE-2016-7039: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for large     crafted packets, as demonstrated by packets that contain     only VLAN headers, a related issue to CVE-2016-8666     (bnc#1001486).

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel through 4.8.2,     when the GNU Compiler Collection (gcc) stack protector     is enabled, uses an incorrect buffer size for certain     timeout data, which allowed local users to cause a     denial of service (stack memory corruption and panic) by     reading the /proc/keys file (bnc#1004517).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-7913: The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (use-after-free) via vectors involving     omission of the firmware name from a certain data     structure (bnc#1010478).

  - CVE-2016-7917: The nfnetlink_rcv_batch function in     net/netfilter/nfnetlink.c in the Linux kernel did not     check whether a batch message's length field is large     enough, which allowed local users to obtain sensitive     information from kernel memory or cause a denial of     service (infinite loop or out-of-bounds read) by     leveraging the CAP_NET_ADMIN capability (bnc#1010444).

  - CVE-2016-8645: The TCP stack in the Linux kernel     mishandled skb truncation, which allowed local users to     cause a denial of service (system crash) via a crafted     application that made sendto system calls, related to     net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c     (bnc#1009969).

  - CVE-2016-8666: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for     packets with tunnel stacking, as demonstrated by     interleaved IPv4 headers and GRE headers, a related     issue to CVE-2016-7039 (bnc#1003964).

  - CVE-2016-9083: drivers/vfio/pci/vfio_pci.c in the Linux     kernel allowed local users to bypass integer overflow     checks, and cause a denial of service (memory     corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a     VFIO_DEVICE_SET_IRQS ioctl call, aka a 'state machine     confusion bug (bnc#1007197).

  - CVE-2016-9084: drivers/vfio/pci/vfio_pci_intrs.c in the     Linux kernel misuses the kzalloc function, which allowed     local users to cause a denial of service (integer     overflow) or have unspecified other impact by leveraging     access to a vfio PCI device file (bnc#1007197).

  - CVE-2016-9793: A bug in SO_{SND|RCV}BUFFORCE     setsockopt() implementation was fixed, which allowed     CAP_NET_ADMIN users to cause memory corruption.
    (bsc#1013531).

  - CVE-2016-9919: The icmp6_send function in     net/ipv6/icmp.c in the Linux kernel omits a certain     check of the dst data structure, which allowed remote     attackers to cause a denial of service (panic) via a     fragmented IPv6 packet (bnc#1014701).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.67 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel used an     incorrect buffer size for certain timeout data, which     allowed local users to cause a denial of service (stack     memory corruption and panic) by reading the /proc/keys     file (bsc#1004517).

  - CVE-2016-7097: The filesystem implementation in the     Linux kernel preserved the setgid bit during a setxattr     call, which allowed local users to gain group privileges     by leveraging the existence of a setgid program with     restrictions on execute permissions (bsc#995968).

  - CVE-2015-8956: The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel allowed     local users to obtain sensitive information or cause a     denial of service (NULL pointer dereference) via vectors     involving a bind system call on a Bluetooth RFCOMM     socket (bnc#1003925).

  - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel     did not properly determine the rate of challenge ACK     segments, which made it easier for man-in-the-middle     attackers to hijack TCP sessions via a blind in-window     attack (bnc#989152).

  - CVE-2016-6130: Race condition in the sclp_ctl_ioctl_sccb     function in drivers/s390/char/sclp_ctl.c in the Linux     kernel allowed local users to obtain sensitive     information from kernel memory by changing a certain     length value, aka a 'double fetch' vulnerability     (bnc#987542).

  - CVE-2016-6327: drivers/infiniband/ulp/srpt/ib_srpt.c in     the Linux kernel allowed local users to cause a denial     of service (NULL pointer dereference and system crash)     by using an ABORT_TASK command to abort a device write     operation (bnc#994748).

  - CVE-2016-6480: Race condition in the ioctl_send_fib     function in drivers/scsi/aacraid/commctrl.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds access or system crash) by changing a     certain size value, aka a 'double fetch' vulnerability     (bnc#991608).

  - CVE-2016-6828: The tcp_check_send_head function in     include/net/tcp.h in the Linux kernel did not properly     maintain certain SACK state after a failed data copy,     which allowed local users to cause a denial of service     (tcp_xmit_retransmit_queue use-after-free and system     crash) via a crafted SACK option (bnc#994296).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-8666: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for     packets with tunnel stacking, as demonstrated by     interleaved IPv4 headers and GRE headers, a related     issue to CVE-2016-7039 (bsc#1001486).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039 .
(CVE-2016-8666)

Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path, as an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel. (CVE-2016-7039)

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important)

* Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path; As an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel. (CVE-2016-7039, Important)

Red Hat would like to thank Phil Oester for reporting CVE-2016-5195.

An update for kernel-rt is now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important)

* Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path; As an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel. (CVE-2016-7039, Important)

Red Hat would like to thank Phil Oester for reporting CVE-2016-5195.

The openSUSE 13.1 kernel was updated to fix bugs and security issues.

The following security bugs were fixed :

  - CVE-2016-8666: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for     packets with tunnel stacking, as demonstrated by     interleaved IPv4 headers and GRE headers, a related     issue to CVE-2016-7039 (bnc#1001486).

  - CVE-2016-5195: A local privilege escalation using     MAP_PRIVATE was fixed, which is reportedly exploited in     the wild (bsc#1004418).

The following non-security bugs were fixed :

  - sched/core: Fix a race between try_to_wake_up() and a     woken up task (bsc#1002165, bsc#1001419).

  - sched/core: Fix an SMP ordering race in try_to_wake_up()     vs. schedule() (bnc#1001419).

  - tunnels: Do not apply GRO to multiple layers of     encapsulation (bsc#1001486).

The openSUSE Leap 42.1 kernel was updated to 4.1.34, fixing bugs and security issues.

The following security bugs were fixed :

  - CVE-2016-5195: A local privilege escalation using     MAP_PRIVATE was fixed, which is reportedly exploited in     the wild (bsc#1004418).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-7039: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for large     crafted packets, as demonstrated by packets that contain     only VLAN headers, a related issue to CVE-2016-8666     (bnc#1001486).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

The following non-security bugs were fixed :

  - 9p: use file_dentry() (bsc#1005101).

  - af_unix: Do not set err in unix_stream_read_generic     unless there was an error (bsc#1005101).

  - alsa: hda - Fix superfluous HDMI jack repoll     (bsc#1005101).

  - alsa: hda - Turn off loopback mixing as default     (bsc#1001462).

  - apparmor: add missing id bounds check on dfa     verification (bsc#1000304).

  - apparmor: check that xindex is in trans_table bounds     (bsc#1000304).

  - apparmor: do not check for vmalloc_addr if kvzalloc()     failed (bsc#1000304).

  - apparmor: do not expose kernel stack (bsc#1000304).

  - apparmor: ensure the target profile name is always     audited (bsc#1000304).

  - apparmor: exec should not be returning ENOENT when it     denies (bsc#1000304).

  - apparmor: fix audit full profile hname on successful     load (bsc#1000304).

  - apparmor: fix change_hat not finding hat after policy     replacement (bsc#1000287).

  - apparmor: fix disconnected bind mnts reconnection     (bsc#1000304).

  - apparmor: fix log failures for all profiles in a set     (bsc#1000304).

  - apparmor: fix module parameters can be changed after     policy is locked (bsc#1000304).

  - apparmor: fix oops in profile_unpack() when policy_db is     not present (bsc#1000304).

  - apparmor: fix put() parent ref after updating the active     ref (bsc#1000304).

  - apparmor: fix refcount bug in profile replacement     (bsc#1000304).

  - apparmor: fix refcount race when finding a child profile     (bsc#1000304).

  - apparmor: fix replacement bug that adds new child to old     parent (bsc#1000304).

  - apparmor: fix uninitialized lsm_audit member     (bsc#1000304).

  - apparmor: fix update the mtime of the profile file on     replacement (bsc#1000304).

  - apparmor: internal paths should be treated as     disconnected (bsc#1000304).

  - apparmor: use list_next_entry instead of list_entry_next     (bsc#1000304).

  - arm: orion5x: Fix legacy get_irqnr_and_base     (bsc#1005101).

  - batman-adv: Fix memory leak on tt add with invalid vlan     (bsc#1005101).

  - batman-adv: replace WARN with rate limited output on     non-existing VLAN (bsc#1005101).

  - blacklist.conf: add some commits (bsc#1005101)

  - blacklist.conf: add unaplicable IB/uverbs commit     (bsc#1005101)

  - blacklist.conf: Blacklist unsupported architectures

  - blkfront: fix an error path memory leak (luckily none so     far).

  - blktap2: eliminate deadlock potential from shutdown path     (bsc#909994).

  - blktap2: eliminate race from deferred work queue     handling (bsc#911687).

  - btrfs: ensure that file descriptor used with subvol     ioctls is a dir (bsc#999600).

  - cdc-acm: added sanity checking for probe() (bsc#993891).

  - cgroup: add seq_file forward declaration for struct     cftype (bsc#1005101).

  - do 'fold checks into iterate_and_advance()' right     (bsc#972460).

  - drm/i915: Wait up to 3ms for the pcu to ack the cdclk     change request on SKL (bsc#1005101).

  - drm/rockchip: unset pgoff when mmap'ing gems     (bsc#1005101).

  - fold checks into iterate_and_advance() (bsc#972460).

  - fs/cifs: cifs_get_root shouldn't use path with tree name     (bsc#963655, bsc#979681, bsc#1000907).

  - fs/cifs: Compare prepaths when comparing superblocks     (bsc#799133).

  - fs/cifs: Fix memory leaks in cifs_do_mount()     (bsc#799133).

  - fs/cifs: Fix regression which breaks DFS mounting     (bsc#799133).

  - fs/cifs: Move check for prefix path to within     cifs_get_root() (bsc#799133).

  - hid: multitouch: force retrieving of Win8 signature blob     (bsc#1005101).

  - input: ALPS - add touchstick support for SS5 hardware     (bsc#987703).

  - input: ALPS - allow touchsticks to report pressure     (bsc#987703).

  - input: ALPS - handle 0-pressure 1F events (bsc#987703).

  - input: ALPS - set DualPoint flag for 74 03 28 devices     (bsc#987703).

  - ipip: Properly mark ipip GRO packets as encapsulated     (bsc#1001486).

  - ipv6: suppress sparse warnings in IP6_ECN_set_ce()     (bsc#1005101).

  - kabi: hide name change of napi_gro_cb::udp_mark     (bsc#1001486).

  - kaweth: fix firmware download (bsc#993890).

  - kaweth: fix oops upon failed memory allocation     (bsc#993890).

  - kvm: x86: only channel 0 of the i8254 is linked to the     HPET (bsc#1005101).

  - memcg: fix thresholds for 32b architectures     (bsc#1005101).

  - msi-x: fix an error path (luckily none so far).

  - netback: fix flipping mode (bsc#996664).

  - netback: fix flipping mode (bsc#996664).

  - netem: fix a use after free (bsc#1005101).

  - net: fix warnings in 'make htmldocs' by moving macro     definition out of field declaration (bsc#1005101).

  - netfront: linearize SKBs requiring too many slots     (bsc#991247).

  - netlink: not trim skb for mmaped socket when dump     (bsc#1005101).

  - net_sched: fix pfifo_head_drop behavior vs backlog     (bsc#1005101).

  - net_sched: keep backlog updated with qlen (bsc#1005101).

  - nfs: use file_dentry() (bsc#1005101).

  - ovl: fix open in stacked overlay (bsc#1005101).

  - pci: Prevent out of bounds access in numa_node override     (bsc#1005101).

  - perf/core: Do not leak event in the syscall error path     (bsc#1005101).

  - perf: Fix PERF_EVENT_IOC_PERIOD deadlock (bsc#1005101).

  - Revive iov_iter_fault_in_multipages_readable() for     4.1.34.

  - sch_drr: update backlog as well (bsc#1005101).

  - sch_hfsc: always keep backlog updated (bsc#1005101).

  - sch_prio: update backlog as well (bsc#1005101).

  - sch_qfq: keep backlog updated with qlen (bsc#1005101).

  - sch_red: update backlog as well (bsc#1005101).

  - sch_sfb: keep backlog updated with qlen (bsc#1005101).

  - sch_tbf: update backlog as well (bsc#1005101).

  - tpm: fix: return rc when devm_add_action() fails     (bsc#1005101).

  - tunnels: Do not apply GRO to multiple layers of     encapsulation (bsc#1001486).

  - Update blacklisting documentation to contain     path-blacklisting

  - usb: fix typo in wMaxPacketSize validation (bsc#991665).

  - usb: hub: Fix auto-remount of safely removed or ejected     USB-3 devices (bsc#922634).

  - x86/LDT: Print the real LDT base address (bsc#1005101).

  - x86/PCI: Mark Broadwell-EP Home Agent 1 as having     non-compliant BARs (bsc#1005101).

  - xenbus: do not bail early from     xenbus_dev_request_and_reply() (luckily none so far).

  - xenbus: inspect the correct type in     xenbus_dev_request_and_reply().

  - xen: Fix refcnt regression in xen netback introduced by     changes made for bug#881008 (bnc#978094)

  - xen: Linux 4.1.28.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - net: add recursion limit to GRO (Sabrina Dubroca)     [Orabug: 24829133] (CVE-2016-7039)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3626 advisory.

    kernel-uek     [4.1.12-61.1.14]
    - net: add recursion limit to GRO (Sabrina Dubroca)  [Orabug: 24829133]  {CVE-2016-7039}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Linux kernel built with the 802.1Q/802.1ad     VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area     Network(CONFIG_VXLAN) with Transparent Ethernet     Bridging(TEB) GRO support, is vulnerable to a stack     overflow issue. It could occur while receiving large     packets via GRO path as an unlimited recursion could     unfold in both VLAN and TEB modules leading to a stack     corruption in the kernel. (CVE-2016-7039, Important)

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path as an unlimited recursion could unfold in both VLAN and TEB modules leading to a stack corruption in the kernel. (CVE-2016-7039, Important)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3099-4 advisory.

    Vladimr Bene discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO)     processing implementations in the Linux kernel, A remote attacker could use this to cause a stack     corruption, leading to a denial of service (system crash). (CVE-2016-7039)

    Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2016-6828)

    Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller driver in the Linux kernel     when handling ioctl()s. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2016-6480)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3099-3 advisory.

    Vladimr Bene discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO)     processing implementations in the Linux kernel, A remote attacker could use this to cause a stack     corruption, leading to a denial of service (system crash). (CVE-2016-7039)

    Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2016-6828)

    Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller driver in the Linux kernel     when handling ioctl()s. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2016-6480)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3099-2 advisory.

    USN-3099-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    Vladimr Bene discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO)     processing implementations in the Linux kernel, A remote attacker could use this to cause a stack     corruption, leading to a denial of service (system crash). (CVE-2016-7039)

    Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2016-6828)

    Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller driver in the Linux kernel     when handling ioctl()s. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2016-6480)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3099-1 advisory.

    Vladimr Bene discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO)     processing implementations in the Linux kernel, A remote attacker could use this to cause a stack     corruption, leading to a denial of service (system crash). (CVE-2016-7039)

    Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2016-6828)

    Pengfei Wang discovered a race condition in the s390 SCLP console driver for the Linux kernel when     handling ioctl()s. A local attacker could use this to obtain sensitive information from kernel memory.
    (CVE-2016-6130)

    Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller driver in the Linux kernel     when handling ioctl()s. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2016-6480)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-3098-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-6828)

Vladimir Benes discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO) processing implementations in the Linux kernel, A remote attacker could use this to cause a stack corruption, leading to a denial of service (system crash). (CVE-2016-7039)

Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker could use this to corrupt audit logs or disrupt system-call auditing. (CVE-2016-6136)

Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller driver in the Linux kernel when handling ioctl()s. A local attacker could use this to cause a denial of service (system crash).
(CVE-2016-6480).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3098-1 advisory.

    Vladimr Bene discovered an unbounded recursion in the VLAN and TEB Generic Receive Offload (GRO)     processing implementations in the Linux kernel, A remote attacker could use this to cause a stack     corruption, leading to a denial of service (system crash). (CVE-2016-7039)

    Marco Grassi discovered a use-after-free condition could occur in the TCP retransmit queue handling code     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2016-6828)

    Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker     could use this to corrupt audit logs or disrupt system-call auditing. (CVE-2016-6136)

    Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller driver in the Linux kernel     when handling ioctl()s. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2016-6480)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2047 advisory.

    - [3.10.0-327.36.2.OL7]
    - Oracle Linux certificates (Alexey Petrenko)

    [3.10.0-327.36.2]
    - [net] add recursion limit to GRO (Sabrina Dubroca) [1378405 1374191] {CVE-2016-7039}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
125100	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1494)	Nessus	Huawei Local Security Checks	high
124974	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1521)	Nessus	Huawei Local Security Checks	critical
96603	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:0181-1)	Nessus	SuSE Local Security Checks	high
95701	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1426)	Nessus	SuSE Local Security Checks	critical
95368	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2912-1)	Nessus	SuSE Local Security Checks	high
94682	Amazon Linux AMI : kernel (ALAS-2016-762)	Nessus	Amazon Linux Local Security Checks	high
94316	RHEL 7 : kernel-rt (RHSA-2016:2110) (Dirty COW)	Nessus	Red Hat Local Security Checks	high
94315	RHEL 6 : MRG (RHSA-2016:2107) (Dirty COW)	Nessus	Red Hat Local Security Checks	high
94239	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1211) (Dirty COW)	Nessus	SuSE Local Security Checks	high
94219	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1212) (Dirty COW)	Nessus	SuSE Local Security Checks	high
94065	OracleVM 3.4 : Unbreakable / etc (OVMSA-2016-0140)	Nessus	OracleVM Local Security Checks	high
94064	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3626)	Nessus	Oracle Linux Local Security Checks	high
94003	Scientific Linux Security Update : kernel on SL7.x x86_64 (20161010)	Nessus	Scientific Linux Local Security Checks	high
93967	CentOS 7 : kernel (CESA-2016:2047)	Nessus	CentOS Local Security Checks	high
93959	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3099-4)	Nessus	Ubuntu Local Security Checks	high
93958	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3099-3)	Nessus	Ubuntu Local Security Checks	high
93957	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3099-2)	Nessus	Ubuntu Local Security Checks	high
93956	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3099-1)	Nessus	Ubuntu Local Security Checks	medium
93955	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3098-2)	Nessus	Ubuntu Local Security Checks	high
93954	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3098-1)	Nessus	Ubuntu Local Security Checks	medium
93952	RHEL 7 : kernel (RHSA-2016:2047)	Nessus	Red Hat Local Security Checks	high
93949	Oracle Linux 7 : kernel (ELSA-2016-2047)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2016-7039

high

Tenable Plugins

high

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

medium

high

high