Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):The uas driver in the     Linux kernel before 4.13.6 allows local users to cause     a denial of service (out-of-bounds read and system     crash), or possibly have unspecified other impacts via     a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)The     implementation of big key management in     security/keys/big_key.c in the Linux kernel before     4.8.7 mishandles unsuccessful crypto registration in     conjunction with successful key-type registration,     which allows local users to cause a denial of service     (NULL pointer dereference and panic) or possibly have     unspecified other impact via a crafted application that     uses the big_key data type.(CVE-2016-9313)The Linux     kernel allows remote attackers to execute arbitrary     code via UDP traffic that triggers an unsafe second     checksum calculation during execution of a recv system     call with the MSG_PEEK flag. This may create a kernel     panic or memory corruption leading to privilege     escalation.(CVE-2016-10229)Buffer overflow in the     exitcode_proc_write function in     arch/um/kernel/exitcode.c in the Linux kernel before     3.12 allows local users to cause a denial of service or     possibly have unspecified other impact by leveraging     root privileges for a write operation.(CVE-2013-4512)It     was found that unsharing a mount namespace could allow     a user to see data beneath their restricted     namespace.(CVE-2014-9717)A divide-by-zero flaw was     discovered in the Linux kernel built with KVM     virtualization support(CONFIG_KVM). The flaw occurs in     the KVM module's Programmable Interval Timer(PIT)     emulation, when PIT counters for channel 1 or 2 are set     to zero(0) and a privileged user inside the guest     attempts to read these counters. A privileged guest     user with access to PIT I/O ports could exploit this     issue to crash the host kernel (denial of     service).(CVE-2015-7513)The ims_pcu_parse_cdc_data     function in drivers/input/misc/ims-pcu.c in the Linux     kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (system crash)     via a USB device without both a master and a slave     interface.(CVE-2016-3689)Stack-based buffer overflow in     the brcmf_cfg80211_start_ap() function in     'driverset/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c' in the Linux kernel before 4.7.5 allows local     users to cause a denial of service (system crash) or     possibly have unspecified other impact via a long SSID     Information Element in a command to a Netlink     socket.(CVE-2016-8658)drivers/hid/hid-sony.c in the     Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_HID_SONY is enabled,     allows physically proximate attackers to cause a denial     of service (heap-based out-of-bounds write) via a     crafted device.(CVE-2013-2890)An issue where a provided     address with access_ok() is not checked was discovered     in i915_gem_execbuffer2_ioctl in     drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux     kernel through 4.19.13. A local attacker can craft a     malicious IOCTL function call to overwrite arbitrary     kernel memory, resulting in a Denial of Service or     privilege escalation.(CVE-2018-20669)It was found that     the permission checks performed by the Linux kernel     when a netlink message was received were not     sufficient. A local, unprivileged user could     potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged     process and altering the output of this     process.(CVE-2014-0181)An issue was discovered in the     XFS filesystem in fs/xfs/libxfs/xfs_attr_leaf.c in the     Linux kernel. A NULL pointer dereference may occur for     a corrupted xfs image after xfs_da_shrink_inode() is     called with a NULL bp. This can lead to a system crash     and a denial of service.(CVE-2018-13094)The     irda_setsockopt function in net/irda/af_irda.c in the     Linux kernel, through 4.16, allows local users to cause     a denial of service (due to a use-after-free of the     ias_object and a system crash) or possibly have     unspecified other impact by leveraging an AF_IRDA     socket.(CVE-2018-6555)The x86/fpu (Floating Point Unit)     subsystem in the Linux kernel, when a processor     supports the xsave feature but not the xsaves feature,     does not correctly handle attempts to set reserved bits     in the xstate header via the ptrace() or rt_sigreturn()     system call. This allows local users to read the FPU     registers of other processes on the system, related to     arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c.(CVE-2017-15537)The     fst_get_iface function in driverset/wan/farsync.c in     the Linux kernel before 3.11.7 does not properly     initialize a certain data structure, which allows local     users to obtain sensitive information from kernel     memory by leveraging the CAP_NET_ADMIN capability for     an SIOCWANDEV ioctl call.(CVE-2014-1444)In the Linux     kernel, through 4.15.4, the floppy driver reveals the     addresses of kernel functions and global variables     using printk calls within the function show_floppy in     drivers/block/floppy.c. An attacker can read this     information from dmesg and use the addresses to find     the locations of kernel code and data and bypass kernel     security protections such as KASLR.(CVE-2018-7273)A     flaw in 'arch/arm64/kernel/sys.c' in the Linux kernel     allows local users to bypass the 'strict page     permissions' protection mechanism and modify the     system-call table and, consequently, gain privileges by     leveraging write access.(CVE-2015-8967)The Linux kernel     before 3.11 on ARM platforms, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     properly consider user-space access to the TPIDRURW     register, which allows local users to gain privileges     via a crafted application, aka Android internal bug     28749743 and Qualcomm internal bug     CR561044.(CVE-2014-9870)A NULL pointer dereference     security flaw was found in the Linux kernel in the     vcpu_scan_ioapic() function in arch/x86/kvm/x86.c. This     allows local users with certain privileges to cause a     denial of service via a crafted system call to the KVM     subsystem.(CVE-2018-19407)It was found that current     implementation of kl5kusb105 driver failed to detect     short transfers when attempting to read the line state     and logged the content of the uninitialized heap     transfer buffer.(CVE-2017-5549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to 3.12.61 to receive various security and bugfixes. The following feature was implemented :

  - The ext2 filesystem got reenabled and supported to allow     support for 'XIP' (Execute In Place) (FATE#320805). The     following security bugs were fixed :

  - CVE-2017-5551: The tmpfs filesystem implementation in     the Linux kernel preserved the setgid bit during a     setxattr call, which allowed local users to gain group     privileges by leveraging the existence of a setgid     program with restrictions on execute permissions     (bsc#1021258).

  - CVE-2016-7097: The filesystem implementation in the     Linux kernel preserved the setgid bit during a setxattr     call, which allowed local users to gain group privileges     by leveraging the existence of a setgid program with     restrictions on execute permissions (bnc#995968).

  - CVE-2017-2583: A Linux kernel built with the     Kernel-based Virtual Machine (CONFIG_KVM) support was     vulnerable to an incorrect segment selector(SS) value     error. A user/process inside guest could have used this     flaw to crash the guest resulting in DoS or potentially     escalate their privileges inside guest. (bsc#1020602).

  - CVE-2017-2584: arch/x86/kvm/emulate.c in the Linux     kernel allowed local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt (bnc#1019851).

  - CVE-2016-10088: The sg implementation in the Linux     kernel did not properly restrict write operations in     situations where the KERNEL_DS option is set, which     allowed local users to read or write to arbitrary kernel     memory locations or cause a denial of service     (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c.
    NOTE: this vulnerability exists because of an incomplete     fix for CVE-2016-9576 (bnc#1017710).

  - CVE-2016-8645: The TCP stack in the Linux kernel     mishandled skb truncation, which allowed local users to     cause a denial of service (system crash) via a crafted     application that made sendto system calls, related to     net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c     (bnc#1009969).

  - CVE-2016-8399: An elevation of privilege vulnerability     in the kernel networking subsystem could enable a local     malicious application to execute arbitrary code within     the context of the kernel. This issue is rated as     Moderate because it first requires compromising a     privileged process and current compiler optimizations     restrict access to the vulnerable code. Product:
    Android. Versions: Kernel-3.10, Kernel-3.18. Android ID:
    A-31349935 (bnc#1014746).

  - CVE-2016-9806: Race condition in the netlink_dump     function in net/netlink/af_netlink.c in the Linux kernel     allowed local users to cause a denial of service (double     free) or possibly have unspecified other impact via a     crafted application that made sendmsg system calls,     leading to a free operation associated with a new dump     that started earlier than anticipated (bnc#1013540).

  - CVE-2016-9756: arch/x86/kvm/emulate.c in the Linux     kernel did not properly initialize Code Segment (CS) in     certain error cases, which allowed local users to obtain     sensitive information from kernel stack memory via a     crafted application (bnc#1013038).

  - CVE-2016-9793: The sock_setsockopt function in     net/core/sock.c in the Linux kernel mishandled negative     values of sk_sndbuf and sk_rcvbuf, which allowed local     users to cause a denial of service (memory corruption     and system crash) or possibly have unspecified other     impact by leveraging the CAP_NET_ADMIN capability for a     crafted setsockopt system call with the (1)     SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option     (bnc#1013531).

  - CVE-2016-7910: Use-after-free vulnerability in the     disk_seqf_stop function in block/genhd.c in the Linux     kernel allowed local users to gain privileges by     leveraging the execution of a certain stop operation     even if the corresponding start operation had failed     (bnc#1010716).

  - CVE-2015-8962: Double free vulnerability in the     sg_common_write function in drivers/scsi/sg.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (memory corruption and system     crash) by detaching a device during an SG_IO ioctl call     (bnc#1010501).

  - CVE-2016-7913: The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (use-after-free) via vectors involving     omission of the firmware name from a certain data     structure (bnc#1010478).

  - CVE-2016-7911: Race condition in the get_task_ioprio     function in block/ioprio.c in the Linux kernel allowed     local users to gain privileges or cause a denial of     service (use-after-free) via a crafted ioprio_get system     call (bnc#1010711).

  - CVE-2015-8964: The tty_set_termios_ldisc function in     drivers/tty/tty_ldisc.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory by reading a tty data structure (bnc#1010507).

  - CVE-2015-8963: Race condition in kernel/events/core.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (use-after-free) by     leveraging incorrect handling of an swevent data     structure during a CPU unplug operation (bnc#1010502).

  - CVE-2016-7914: The assoc_array_insert_into_terminal_node     function in lib/assoc_array.c in the Linux kernel did     not check whether a slot is a leaf, which allowed local     users to obtain sensitive information from kernel memory     or cause a denial of service (invalid pointer     dereference and out-of-bounds read) via an application     that uses associative-array data structures, as     demonstrated by the keyutils test suite (bnc#1010475).

  - CVE-2016-8633: drivers/firewire/net.c in the Linux     kernel allowed remote attackers to execute arbitrary     code via crafted fragmented packets (bnc#1008833).

  - CVE-2016-9083: drivers/vfio/pci/vfio_pci.c in the Linux     kernel allowed local users to bypass integer overflow     checks, and cause a denial of service (memory     corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a     VFIO_DEVICE_SET_IRQS ioctl call, aka a 'state machine     confusion bug (bnc#1007197).

  - CVE-2016-9084: drivers/vfio/pci/vfio_pci_intrs.c in the     Linux kernel misused the kzalloc function, which allowed     local users to cause a denial of service (integer     overflow) or have unspecified other impact by leveraging     access to a vfio PCI device file (bnc#1007197).

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel uses an     incorrect buffer size for certain timeout data, which     allowed local users to cause a denial of service (stack     memory corruption and panic) by reading the /proc/keys     file (bnc#1004517).

  - CVE-2015-8956: The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel allowed     local users to obtain sensitive information or cause a     denial of service (NULL pointer dereference) via vectors     involving a bind system call on a Bluetooth RFCOMM     socket (bnc#1003925).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-6327: drivers/infiniband/ulp/srpt/ib_srpt.c in     the Linux kernel allowed local users to cause a denial     of service (NULL pointer dereference and system crash)     by using an ABORT_TASK command to abort a device write     operation (bnc#994748).

  - CVE-2016-6828: The tcp_check_send_head function in     include/net/tcp.h in the Linux kernel did not properly     maintain certain SACK state after a failed data copy,     which allowed local users to cause a denial of service     (tcp_xmit_retransmit_queue use-after-free and system     crash) via a crafted SACK option (bnc#994296).

  - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel     did not properly determine the rate of challenge ACK     segments, which made it easier for remote attackers to     hijack TCP sessions via a blind in-window attack     (bnc#989152).

  - CVE-2016-6130: Race condition in the sclp_ctl_ioctl_sccb     function in drivers/s390/char/sclp_ctl.c in the Linux     kernel allowed local users to obtain sensitive     information from kernel memory by changing a certain     length value, aka a 'double fetch' vulnerability     (bnc#987542).

  - CVE-2016-6480: Race condition in the ioctl_send_fib     function in drivers/scsi/aacraid/commctrl.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds access or system crash) by changing a     certain size value, aka a 'double fetch' vulnerability     (bnc#991608).

  - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging     in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary     (bnc#986362 bnc#986365).

  - CVE-2016-5828: The start_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms mishandled transactional state, which     allowed local users to cause a denial of service     (invalid process state or TM Bad Thing exception, and     system crash) or possibly have unspecified other impact     by starting and suspending a transaction before an exec     system call (bnc#986569).

  - CVE-2014-9904: The snd_compress_check_input function in     sound/core/compress_offload.c in the ALSA subsystem in     the Linux kernel did not properly check for an integer     overflow, which allowed local users to cause a denial of     service (insufficient memory allocation) or possibly     have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl call (bnc#986811).

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allow     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3161-4 advisory.

    Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2015-8964)

    It was discovered that the Video For Linux Two (v4l2) implementation in the Linux kernel did not properly     handle multiple planes when processing a VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)

    CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without     restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of     service (system crash). (CVE-2016-6213)

    Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not     clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group     privileges. (CVE-2016-7097)

    Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly     validate control messages. A local attacker could use this to cause a denial of service (system crash) or     possibly gain privileges. (CVE-2016-7425)

    It was discovered that the KVM implementation for x86/x86_64 in the Linux kernel could dereference a null     pointer. An attacker in a guest virtual machine could use this to cause a denial of service (system crash)     in the KVM host. (CVE-2016-8630)

    Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation in the Linux kernel contained a     buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute     arbitrary code with administrative privileges. (CVE-2016-8633)

    Marco Grassi discovered that the TCP implementation in the Linux kernel mishandles socket buffer (skb)     truncation. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-8645)

    Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain     privileges. (CVE-2016-8658)

    Andrey Konovalov discovered that the SCTP implementation in the Linux kernel improperly handled validation     of incoming data. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2016-9555)

    It was discovered that the __get_user_asm_ex implementation in the Linux kernel for x86/x86_64 contained     extended asm statements that were incompatible with the exception table. A local attacker could use this     to gain administrative privileges. (CVE-2016-9644)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3161-3 advisory.

    Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2015-8964)

    It was discovered that the Video For Linux Two (v4l2) implementation in the Linux kernel did not properly     handle multiple planes when processing a VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)

    CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without     restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of     service (system crash). (CVE-2016-6213)

    Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a buffer overflow when     displaying timeout events via the /proc/keys interface. A local attacker could use this to cause a denial     of service (system crash). (CVE-2016-7042)

    Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not     clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group     privileges. (CVE-2016-7097)

    Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly     validate control messages. A local attacker could use this to cause a denial of service (system crash) or     possibly gain privileges. (CVE-2016-7425)

    It was discovered that the KVM implementation for x86/x86_64 in the Linux kernel could dereference a null     pointer. An attacker in a guest virtual machine could use this to cause a denial of service (system crash)     in the KVM host. (CVE-2016-8630)

    Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation in the Linux kernel contained a     buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute     arbitrary code with administrative privileges. (CVE-2016-8633)

    Marco Grassi discovered that the TCP implementation in the Linux kernel mishandles socket buffer (skb)     truncation. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-8645)

    Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain     privileges. (CVE-2016-8658)

    It was discovered that an information leak existed in __get_user_asm_ex() in the Linux kernel. A local     attacker could use this to expose sensitive information. (CVE-2016-9178)

    Andrey Konovalov discovered that the SCTP implementation in the Linux kernel improperly handled validation     of incoming data. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2016-9555)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3146-2 advisory.

    USN-3146-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    It was discovered that the __get_user_asm_ex implementation in the Linux kernel for x86/x86_64 contained     extended asm statements that were incompatible with the exception table. A local attacker could use this     to gain administrative privileges. (CVE-2016-9644)

    Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not     clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group     privileges. (CVE-2016-7097)

    Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly     validate control messages. A local attacker could use this to cause a denial of service (system crash) or     possibly gain privileges. (CVE-2016-7425)

    Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain     privileges. (CVE-2016-8658)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3146-1 advisory.

    It was discovered that the __get_user_asm_ex implementation in the Linux kernel for x86/x86_64 contained     extended asm statements that were incompatible with the exception table. A local attacker could use this     to gain administrative privileges. (CVE-2016-9644)

    Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not     clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group     privileges. (CVE-2016-7097)

    Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly     validate control messages. A local attacker could use this to cause a denial of service (system crash) or     possibly gain privileges. (CVE-2016-7425)

    Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain     privileges. (CVE-2016-8658)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-3145-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly validate control messages. A local attacker could use this to cause a denial of service (system crash) or possibly gain privileges. (CVE-2016-7425)

Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain privileges. (CVE-2016-8658).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3145-1 advisory.

    Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly     validate control messages. A local attacker could use this to cause a denial of service (system crash) or     possibly gain privileges. (CVE-2016-7425)

    Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain     privileges. (CVE-2016-8658)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.67 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel used an     incorrect buffer size for certain timeout data, which     allowed local users to cause a denial of service (stack     memory corruption and panic) by reading the /proc/keys     file (bsc#1004517).

  - CVE-2016-7097: The filesystem implementation in the     Linux kernel preserved the setgid bit during a setxattr     call, which allowed local users to gain group privileges     by leveraging the existence of a setgid program with     restrictions on execute permissions (bsc#995968).

  - CVE-2015-8956: The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel allowed     local users to obtain sensitive information or cause a     denial of service (NULL pointer dereference) via vectors     involving a bind system call on a Bluetooth RFCOMM     socket (bnc#1003925).

  - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel     did not properly determine the rate of challenge ACK     segments, which made it easier for man-in-the-middle     attackers to hijack TCP sessions via a blind in-window     attack (bnc#989152).

  - CVE-2016-6130: Race condition in the sclp_ctl_ioctl_sccb     function in drivers/s390/char/sclp_ctl.c in the Linux     kernel allowed local users to obtain sensitive     information from kernel memory by changing a certain     length value, aka a 'double fetch' vulnerability     (bnc#987542).

  - CVE-2016-6327: drivers/infiniband/ulp/srpt/ib_srpt.c in     the Linux kernel allowed local users to cause a denial     of service (NULL pointer dereference and system crash)     by using an ABORT_TASK command to abort a device write     operation (bnc#994748).

  - CVE-2016-6480: Race condition in the ioctl_send_fib     function in drivers/scsi/aacraid/commctrl.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds access or system crash) by changing a     certain size value, aka a 'double fetch' vulnerability     (bnc#991608).

  - CVE-2016-6828: The tcp_check_send_head function in     include/net/tcp.h in the Linux kernel did not properly     maintain certain SACK state after a failed data copy,     which allowed local users to cause a denial of service     (tcp_xmit_retransmit_queue use-after-free and system     crash) via a crafted SACK option (bnc#994296).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-8666: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for     packets with tunnel stacking, as demonstrated by     interleaved IPv4 headers and GRE headers, a related     issue to CVE-2016-7039 (bsc#1001486).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-8956: The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel allowed     local users to obtain sensitive information or cause a     denial of service (NULL pointer dereference) via vectors     involving a bind system call on a Bluetooth RFCOMM     socket (bnc#1003925).

  - CVE-2016-5195: A local privilege escalation using     MAP_PRIVATE was fixed, which is reportedly exploited in     the wild (bsc#1004418).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-7117: Use-after-free vulnerability in the
    __sys_recvmmsg function in net/socket.c in the Linux     kernel allowed remote attackers to execute arbitrary     code via vectors involving a recvmmsg system call that     is mishandled during error processing (bnc#1003077).

  - CVE-2016-0823: The pagemap_open function in     fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as     used in Android 6.0.1 before 2016-03-01, allowed local     users to obtain sensitive physical-address information     by reading a pagemap file, aka Android internal bug     25739721 (bnc#994759).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-6327: drivers/infiniband/ulp/srpt/ib_srpt.c in     the Linux kernel allowed local users to cause a denial     of service (NULL pointer dereference and system crash)     by using an ABORT_TASK command to abort a device write     operation (bnc#994748).

  - CVE-2016-6828: The tcp_check_send_head function in     include/net/tcp.h in the Linux kernel did not properly     maintain certain SACK state after a failed data copy,     which allowed local users to cause a denial of service     (tcp_xmit_retransmit_queue use-after-free and system     crash) via a crafted SACK option (bnc#994296).

  - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel     did not properly determine the rate of challenge ACK     segments, which made it easier for man-in-the-middle     attackers to hijack TCP sessions via a blind in-window     attack (bnc#989152)

  - CVE-2016-6480: Race condition in the ioctl_send_fib     function in drivers/scsi/aacraid/commctrl.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds access or system crash) by changing a     certain size value, aka a 'double fetch' vulnerability     (bnc#991608).

  - CVE-2015-7513: arch/x86/kvm/x86.c in the Linux kernel     did not reset the PIT counter values during state     restoration, which allowed guest OS users to cause a     denial of service (divide-by-zero error and host OS     crash) via a zero value, related to the     kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions     (bnc#960689).

  - CVE-2016-1237: nfsd in the Linux kernel allowed local     users to bypass intended file-permission restrictions by     setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c,     and nfs4acl.c (bnc#986570).

The following non-security bugs were fixed :

  - AF_VSOCK: Shrink the area influenced by prepare_to_wait     (bsc#994520).

  - xen: Fix refcnt regression in xen netback introduced by     changes made for bug#881008 (bnc#978094)

  - MSI-X: fix an error path (luckily none so far).

  - usb: fix typo in wMaxPacketSize validation (bsc#991665).

  - usb: validate wMaxPacketValue entries in endpoint     descriptors (bnc#991665).

  - Update     patches.fixes/0002-nfsd-check-permissions-when-setting-A     CLs.patch (bsc#986570 CVE#2016-1237).

  - Update     patches.fixes/0001-posix_acl-Add-set_posix_acl.patch     (bsc#986570 CVE#2016-1237).

  - apparmor: fix change_hat not finding hat after policy     replacement (bsc#1000287).

  - arm64: Honor __GFP_ZERO in dma allocations     (bsc#1004045).

  - arm64: __clear_user: handle exceptions on strb     (bsc#994752).

  - arm64: dma-mapping: always clear allocated buffers     (bsc#1004045).

  - arm64: perf: reject groups spanning multiple HW PMUs     (bsc#1003931).

  - blkfront: fix an error path memory leak (luckily none so     far).

  - blktap2: eliminate deadlock potential from shutdown path     (bsc#909994).

  - blktap2: eliminate race from deferred work queue     handling (bsc#911687).

  - btrfs: ensure that file descriptor used with subvol     ioctls is a dir (bsc#999600).

  - cdc-acm: added sanity checking for probe() (bsc#993891).

  - kaweth: fix firmware download (bsc#993890).

  - kaweth: fix oops upon failed memory allocation     (bsc#993890).

  - netback: fix flipping mode (bsc#996664).

  - netback: fix flipping mode (bsc#996664).

  - netfront: linearize SKBs requiring too many slots     (bsc#991247).

  - nfsd: check permissions when setting ACLs (bsc#986570).

  - posix_acl: Add set_posix_acl (bsc#986570).

  - ppp: defer netns reference release for ppp channel     (bsc#980371).

  - tunnels: Do not apply GRO to multiple layers of     encapsulation (bsc#1001486).

  - usb: hub: Fix auto-remount of safely removed or ejected     USB-3 devices (bsc#922634).

  - x86: suppress lazy MMU updates during vmalloc fault     processing (bsc#951155).

  - xen-netback-generalize.patch: Fold back into base patch.

  - xen3-patch-2.6.31.patch: Fold back into base patch.

  - xen3-patch-3.12.patch: Fold bac into base patch.

  - xen3-patch-3.15.patch: Fold back into base patch.

  - xen3-patch-3.3.patch: Fold back into base patch.

  - xen3-patch-3.9.patch: Fold bac into base patch.

  - xen3-patch-3.9.patch: Fold back into base patch.

  - xenbus: do not bail early from     xenbus_dev_request_and_reply() (luckily none so far).

  - xenbus: inspect the correct type in     xenbus_dev_request_and_reply().

The openSUSE Leap 42.1 kernel was updated to 4.1.34, fixing bugs and security issues.

The following security bugs were fixed :

  - CVE-2016-5195: A local privilege escalation using     MAP_PRIVATE was fixed, which is reportedly exploited in     the wild (bsc#1004418).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-7039: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for large     crafted packets, as demonstrated by packets that contain     only VLAN headers, a related issue to CVE-2016-8666     (bnc#1001486).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

The following non-security bugs were fixed :

  - 9p: use file_dentry() (bsc#1005101).

  - af_unix: Do not set err in unix_stream_read_generic     unless there was an error (bsc#1005101).

  - alsa: hda - Fix superfluous HDMI jack repoll     (bsc#1005101).

  - alsa: hda - Turn off loopback mixing as default     (bsc#1001462).

  - apparmor: add missing id bounds check on dfa     verification (bsc#1000304).

  - apparmor: check that xindex is in trans_table bounds     (bsc#1000304).

  - apparmor: do not check for vmalloc_addr if kvzalloc()     failed (bsc#1000304).

  - apparmor: do not expose kernel stack (bsc#1000304).

  - apparmor: ensure the target profile name is always     audited (bsc#1000304).

  - apparmor: exec should not be returning ENOENT when it     denies (bsc#1000304).

  - apparmor: fix audit full profile hname on successful     load (bsc#1000304).

  - apparmor: fix change_hat not finding hat after policy     replacement (bsc#1000287).

  - apparmor: fix disconnected bind mnts reconnection     (bsc#1000304).

  - apparmor: fix log failures for all profiles in a set     (bsc#1000304).

  - apparmor: fix module parameters can be changed after     policy is locked (bsc#1000304).

  - apparmor: fix oops in profile_unpack() when policy_db is     not present (bsc#1000304).

  - apparmor: fix put() parent ref after updating the active     ref (bsc#1000304).

  - apparmor: fix refcount bug in profile replacement     (bsc#1000304).

  - apparmor: fix refcount race when finding a child profile     (bsc#1000304).

  - apparmor: fix replacement bug that adds new child to old     parent (bsc#1000304).

  - apparmor: fix uninitialized lsm_audit member     (bsc#1000304).

  - apparmor: fix update the mtime of the profile file on     replacement (bsc#1000304).

  - apparmor: internal paths should be treated as     disconnected (bsc#1000304).

  - apparmor: use list_next_entry instead of list_entry_next     (bsc#1000304).

  - arm: orion5x: Fix legacy get_irqnr_and_base     (bsc#1005101).

  - batman-adv: Fix memory leak on tt add with invalid vlan     (bsc#1005101).

  - batman-adv: replace WARN with rate limited output on     non-existing VLAN (bsc#1005101).

  - blacklist.conf: add some commits (bsc#1005101)

  - blacklist.conf: add unaplicable IB/uverbs commit     (bsc#1005101)

  - blacklist.conf: Blacklist unsupported architectures

  - blkfront: fix an error path memory leak (luckily none so     far).

  - blktap2: eliminate deadlock potential from shutdown path     (bsc#909994).

  - blktap2: eliminate race from deferred work queue     handling (bsc#911687).

  - btrfs: ensure that file descriptor used with subvol     ioctls is a dir (bsc#999600).

  - cdc-acm: added sanity checking for probe() (bsc#993891).

  - cgroup: add seq_file forward declaration for struct     cftype (bsc#1005101).

  - do 'fold checks into iterate_and_advance()' right     (bsc#972460).

  - drm/i915: Wait up to 3ms for the pcu to ack the cdclk     change request on SKL (bsc#1005101).

  - drm/rockchip: unset pgoff when mmap'ing gems     (bsc#1005101).

  - fold checks into iterate_and_advance() (bsc#972460).

  - fs/cifs: cifs_get_root shouldn't use path with tree name     (bsc#963655, bsc#979681, bsc#1000907).

  - fs/cifs: Compare prepaths when comparing superblocks     (bsc#799133).

  - fs/cifs: Fix memory leaks in cifs_do_mount()     (bsc#799133).

  - fs/cifs: Fix regression which breaks DFS mounting     (bsc#799133).

  - fs/cifs: Move check for prefix path to within     cifs_get_root() (bsc#799133).

  - hid: multitouch: force retrieving of Win8 signature blob     (bsc#1005101).

  - input: ALPS - add touchstick support for SS5 hardware     (bsc#987703).

  - input: ALPS - allow touchsticks to report pressure     (bsc#987703).

  - input: ALPS - handle 0-pressure 1F events (bsc#987703).

  - input: ALPS - set DualPoint flag for 74 03 28 devices     (bsc#987703).

  - ipip: Properly mark ipip GRO packets as encapsulated     (bsc#1001486).

  - ipv6: suppress sparse warnings in IP6_ECN_set_ce()     (bsc#1005101).

  - kabi: hide name change of napi_gro_cb::udp_mark     (bsc#1001486).

  - kaweth: fix firmware download (bsc#993890).

  - kaweth: fix oops upon failed memory allocation     (bsc#993890).

  - kvm: x86: only channel 0 of the i8254 is linked to the     HPET (bsc#1005101).

  - memcg: fix thresholds for 32b architectures     (bsc#1005101).

  - msi-x: fix an error path (luckily none so far).

  - netback: fix flipping mode (bsc#996664).

  - netback: fix flipping mode (bsc#996664).

  - netem: fix a use after free (bsc#1005101).

  - net: fix warnings in 'make htmldocs' by moving macro     definition out of field declaration (bsc#1005101).

  - netfront: linearize SKBs requiring too many slots     (bsc#991247).

  - netlink: not trim skb for mmaped socket when dump     (bsc#1005101).

  - net_sched: fix pfifo_head_drop behavior vs backlog     (bsc#1005101).

  - net_sched: keep backlog updated with qlen (bsc#1005101).

  - nfs: use file_dentry() (bsc#1005101).

  - ovl: fix open in stacked overlay (bsc#1005101).

  - pci: Prevent out of bounds access in numa_node override     (bsc#1005101).

  - perf/core: Do not leak event in the syscall error path     (bsc#1005101).

  - perf: Fix PERF_EVENT_IOC_PERIOD deadlock (bsc#1005101).

  - Revive iov_iter_fault_in_multipages_readable() for     4.1.34.

  - sch_drr: update backlog as well (bsc#1005101).

  - sch_hfsc: always keep backlog updated (bsc#1005101).

  - sch_prio: update backlog as well (bsc#1005101).

  - sch_qfq: keep backlog updated with qlen (bsc#1005101).

  - sch_red: update backlog as well (bsc#1005101).

  - sch_sfb: keep backlog updated with qlen (bsc#1005101).

  - sch_tbf: update backlog as well (bsc#1005101).

  - tpm: fix: return rc when devm_add_action() fails     (bsc#1005101).

  - tunnels: Do not apply GRO to multiple layers of     encapsulation (bsc#1001486).

  - Update blacklisting documentation to contain     path-blacklisting

  - usb: fix typo in wMaxPacketSize validation (bsc#991665).

  - usb: hub: Fix auto-remount of safely removed or ejected     USB-3 devices (bsc#922634).

  - x86/LDT: Print the real LDT base address (bsc#1005101).

  - x86/PCI: Mark Broadwell-EP Home Agent 1 as having     non-compliant BARs (bsc#1005101).

  - xenbus: do not bail early from     xenbus_dev_request_and_reply() (luckily none so far).

  - xenbus: inspect the correct type in     xenbus_dev_request_and_reply().

  - xen: Fix refcnt regression in xen netback introduced by     changes made for bug#881008 (bnc#978094)

  - xen: Linux 4.1.28.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195652	RHEL 7 : kernel (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
124826	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1503)	Nessus	Huawei Local Security Checks	critical
97205	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0471-1)	Nessus	SuSE Local Security Checks	high
95998	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3161-4)	Nessus	Ubuntu Local Security Checks	critical
95997	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3161-3)	Nessus	Ubuntu Local Security Checks	critical
95592	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1410)	Nessus	SuSE Local Security Checks	high
95433	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3146-2)	Nessus	Ubuntu Local Security Checks	high
95432	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3146-1)	Nessus	Ubuntu Local Security Checks	high
95431	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3145-2)	Nessus	Ubuntu Local Security Checks	high
95430	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3145-1)	Nessus	Ubuntu Local Security Checks	high
95368	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2912-1)	Nessus	SuSE Local Security Checks	high
94303	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1227) (Dirty COW)	Nessus	SuSE Local Security Checks	critical
94219	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1212) (Dirty COW)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-8658

medium

Tenable Plugins

critical

critical

critical

high

critical

critical

high

high

high

high

high

high

critical

high