Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2802 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was     built as Position Independent Executable (PIE), the loader could allow part of that application's data     segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system. (CVE-2017-1000253, Important)

    Red Hat would like to thank Qualys Research Labs for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2801 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was     built as Position Independent Executable (PIE), the loader could allow part of that application's data     segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system. (CVE-2017-1000253, Important)

    Red Hat would like to thank Qualys Research Labs for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2801 advisory.

    - [fs] fix bug in loading of PIE binaries (Michael Davidson) [orabug 26916951] {CVE-2017-1000253}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):** DISPUTED ** Multiple     integer overflows in the lzo1x_decompress_safe function     in lib/lzo/lzo1x_decompress_safe.c in the LZO     decompressor in the Linux kernel before 3.15.2 allow     context-dependent attackers to cause a denial of     service (memory corruption) via a crafted Literal Run.
    NOTE: the author of the LZO algorithms says 'the Linux     kernel is *not* affected media hype.'(CVE-2014-4608)A     certain backport in the TCP Fast Open implementation     for the Linux kernel before 3.18 does not properly     maintain a count value, which allow local users to     cause a denial of service (system crash) via the Fast     Open feature, as demonstrated by visiting the     chrome://flags/#enable-tcp-fast-open URL when using     certain 3.10.x through 3.16.x kernel builds, including     longterm-maintenance releases and ckt (aka Canonical     Kernel Team) builds.(CVE-2015-3332)An elevation of     privilege vulnerability in the kernel scsi driver.
    Product: Android. Versions: Android kernel. Android ID     A-65023233.(CVE-2017-13168)An issue was discovered in     drivers/i2c/i2c-core-smbus.c in the Linux kernel before     4.14.15. There is an out of bounds write in the     function i2c_smbus_xfer_emulated.(CVE-2017-18551)An     issue was discovered in net/ipv6/ip6mr.c in the Linux     kernel before 4.11. By setting a specific socket     option, an attacker can control a pointer in kernel     land and cause an inet_csk_listen_stop general     protection fault, or potentially execute arbitrary code     under certain circumstances. The issue can be triggered     as root (e.g., inside a default LXC container or with     the CAP_NET_ADMIN capability) or after namespace     unsharing. This occurs because sk_type and protocol are     not checked in the appropriate part of the ip6_mroute_*     functions. NOTE: this affects Linux distributions that     use 4.9.x longterm kernels before     4.9.187.(CVE-2017-18509)An issue was discovered in the     Linux kernel before 4.14.11. A double free may be     caused by the function allocate_trace_buffer in the     file kernel/trace/trace.c.(CVE-2017-18595)An issue was     discovered in the Linux kernel through 4.17.10. There     is a NULL pointer dereference and panic in     hfsplus_lookup() in fs/hfsplus/dir.c when opening a     file (that is purportedly a hard link) in an hfs+     filesystem that has malformed catalog data, and is     mounted read-only without a metadata     directory.(CVE-2018-14617)An issue was discovered in     write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in     the Linux kernel through 5.3.2. The cxgb4 driver is     directly calling dma_map_single (a DMA function) from a     stack variable. This could allow an attacker to trigger     a Denial of Service, exploitable if this driver is used     on an architecture for which this stack/DMA interaction     has security relevance.(CVE-2019-17075)Double free     vulnerability in the snd_usbmidi_create function in     sound/usb/midi.c in the Linux kernel before 4.5 allows     physically proximate attackers to cause a denial of     service (panic) or possibly have unspecified other     impact via vectors involving an invalid USB     descriptor.(CVE-2016-2384)fsamespace.c in the Linux     kernel through 3.16.1 does not properly restrict     clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and     changing MNT_ATIME_MASK during a remount of a bind     mount, which allows local users to gain privileges,     interfere with backups and auditing on systems that had     atime enabled, or cause a denial of service (excessive     filesystem updating) on systems that had atime disabled     via a 'mount -o remount' command within a user     namespace.(CVE-2014-5207)fs/overlayfs/dir.c in the     OverlayFS filesystem implementation in the Linux kernel     before 4.6 does not properly verify the upper dentry     before proceeding with unlink and rename system-call     processing, which allows local users to cause a denial     of service (system crash) via a rename system call that     specifies a self-hardlink.(CVE-2016-6197)In the Linux     kernel before 4.1.4, a buffer overflow occurs when     checking userspace params in     drivers/media/dvb-frontends/cx24116.c. The maximum size     for a DiSEqC command is 6, according to the userspace     API. However, the code allows larger values such as     23.(CVE-2015-9289)In the Linux kernel through 5.3.2,     cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c     does not reject a long SSID IE, leading to a Buffer     Overflow.(CVE-2019-17133)Insufficient access control in     the Intel(R) PROSet/Wireless WiFi Software driver     before version 21.10 may allow an unauthenticated user     to potentially enable denial of service via adjacent     access.(CVE-2019-0136)Linux distributions that have not     patched their long-term kernels with     https://git.kernel.org/linus/a87938b2e246b81b4fb713edb3     71a9fa3c5c3c86 (committed on April 14, 2015). This     kernel vulnerability was fixed in April 2015 by commit     a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to     Linux 3.10.77 in May 2015), but it was not recognized     as a security threat. With     CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a     normal top-down address allocation strategy,     load_elf_binary() will attempt to map a PIE binary into     an address range immediately below mm->mmap_base.
    Unfortunately, load_elf_ binary() does not take account     of the need to allocate sufficient space for the entire     binary which means that, while the first PT_LOAD     segment is mapped below mm->mmap_base, the subsequent     PT_LOAD segment(s) end up being mapped above     mm->mmap_base into the are that is supposed to be the     'gap' between the stack and the     binary.(CVE-2017-1000253)Race condition in the     sclp_ctl_ioctl_sccb function in     drivers/s390/char/sclp_ctl.c in the Linux kernel before     4.6 allows local users to obtain sensitive information     from kernel memory by changing a certain length value,     aka a 'double fetch'     vulnerability.(CVE-2016-6130)rtl_p2p_noa_ie in drivers     et/wireless/realtek/rtlwifi/ps.c in the Linux kernel     through 5.3.6 lacks a certain upper-bound check,     leading to a buffer     overflow.(CVE-2019-17666)sound/core/timer.c in the     Linux kernel through 4.6 does not initialize certain r1     data structures, which allows local users to obtain     sensitive information from kernel stack memory via     crafted use of the ALSA timer interface, related to the     (1) snd_timer_user_ccallback and (2)     snd_timer_user_tinterrupt     functions.(CVE-2016-4578)Systems with microprocessors     utilizing speculative execution and branch prediction     may allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis.(CVE-2017-5753)The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a USB device without both a control and a     data endpoint descriptor.(CVE-2016-3138)The     arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel     through 4.8.2 does not restrict a certain length field,     which allows local users to gain privileges or cause a     denial of service (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control     code.(CVE-2016-7425)The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2185)The     create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference or double free, and system crash) via a     crafted endpoints value in a USB device     descriptor.(CVE-2016-2184)The digi_port_init function     in drivers/usb/serial/digi_acceleport.c in the Linux     kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference and system crash) via a crafted endpoints     value in a USB device descriptor.(CVE-2016-3140)The     do_remount function in fsamespace.c in the Linux kernel     through 3.16.1 does not maintain the MNT_LOCK_READONLY     bit across a remount of a bind mount, which allows     local users to bypass an intended read-only restriction     and defeat certain sandbox protection mechanisms via a     'mount -o remount' command within a user     namespace.(CVE-2014-5206)The gtco_probe function in     drivers/input/tablet/gtco.c in the Linux kernel through     4.5.2 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device     descriptor.(CVE-2016-2187)The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel before 4.3.5     does not properly maintain a hub-interface data     structure, which allows physically proximate attackers     to cause a denial of service (invalid memory access and     system crash) or possibly have unspecified other impact     by unplugging a USB hub device.(CVE-2015-8816)The     ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (system crash) via a USB device     without both a master and a slave     interface.(CVE-2016-3689)The Linux Kernel running on     AMD64 systems will sometimes map the contents of PIE     executable, the heap or ld.so to where the stack is     mapped allowing attackers to more easily manipulate the     stack. Linux Kernel version 4.11.5 is     affected.(CVE-2017-1000379)The powermate_probe function     in drivers/input/misc/powermate.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2186)The signal     implementation in the Linux kernel before 4.3.5 on     powerpc platforms does not check for an MSR with both     the S and T bits set, which allows local users to cause     a denial of service (TM Bad Thing exception and panic)     via a crafted application.(CVE-2015-8844)The     snd_timer_user_params function in sound/core/timer.c in     the Linux kernel through 4.6 does not initialize a     certain data structure, which allows local users to     obtain sensitive information from kernel stack memory     via crafted use of the ALSA timer     interface.(CVE-2016-4569)The tm_reclaim_thread function     in arch/powerpc/kernel/process.c in the Linux kernel     before 4.4.1 on powerpc platforms does not ensure that     TM suspend mode exists before proceeding with a     tm_reclaim call, which allows local users to cause a     denial of service (TM Bad Thing exception and panic)     via a crafted application.(CVE-2015-8845)The VFS     subsystem in the Linux kernel 3.x provides an     incomplete set of requirements for setattr operations     that underspecifies removing extended privilege     attributes, which allows local users to cause a denial     of service (capability stripping) via a failed     invocation of a system call, as demonstrated by using     chown to remove a capability from the ping or Wireshark     dumpcap program.(CVE-2015-1350)The wacom_probe function     in drivers/input/tablet/wacom_sys.c in the Linux kernel     before 3.17 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-3139)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities:

  - It was found that the fix for CVE-2016-9576 was     incomplete: the Linux kernel's sg implementation did not     properly restrict write operations in situations where     the KERNEL_DS option is set. A local attacker to read or     write to arbitrary kernel memory locations or cause a     denial of service (use-after-free) by leveraging write     access to a /dev/sg device. (CVE-2016-10088)

  - When creating audit records for parameters to executed     children processes, an attacker can convince the Linux     kernel audit subsystem can create corrupt records which     may allow an attacker to misrepresent or evade logging     of executing commands. (CVE-2016-6136)

  - A flaw was found in the Linux kernel's implementation of     seq_file where a local attacker could manipulate memory     in the put() function pointer. This could lead to memory     corruption and possible privileged escalation.
    (CVE-2016-7910)

  - It was found that the blk_rq_map_user_iov() function in     the Linux kernel's block device implementation did not     properly restrict the type of iterator, which could     allow a local attacker to read or write to arbitrary     kernel memory locations or cause a denial of service     (use-after-free) by leveraging write access to a /dev/sg     device. (CVE-2016-9576)

  - A stack buffer overflow flaw was found in the way the     Bluetooth subsystem of the Linux kernel processed     pending L2CAP configuration responses from a client. On     systems with the stack protection feature enabled in the     kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on     all architectures other than s390x and ppc64[le]), an     unauthenticated attacker able to initiate a connection     to a system via Bluetooth could use this flaw to crash     the system. Due to the nature of the stack protection     feature, code execution cannot be fully ruled out,     although we believe it is unlikely. On systems without     the stack protection feature (ppc64[le]; the Bluetooth     modules are not built on s390x), an unauthenticated     attacker able to initiate a connection to a system via     Bluetooth could use this flaw to remotely execute     arbitrary code on the system with ring 0 (kernel)     privileges. (CVE-2017-1000251)

  - A flaw was found in the way the Linux kernel loaded ELF     executables. Provided that an application was built as     Position Independent Executable (PIE), the loader could     allow part of that application's data segment to map     over the memory area reserved for its stack, potentially     resulting in memory corruption. An unprivileged local     user with access to SUID (or otherwise privileged) PIE     binary could use this flaw to escalate their privileges     on the system. (CVE-2017-1000253)

  - A use-after-free flaw was found in the way the Linux     kernel's Datagram Congestion Control Protocol (DCCP)     implementation freed SKB (socket buffer) resources for a     DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option     is set on the socket. A local, unprivileged user could     use this flaw to alter the kernel memory, allowing them     to escalate their privileges on the system.
    (CVE-2017-6074)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel loaded ELF     executables. Provided that an application was built as     Position Independent Executable (PIE), the loader could     allow part of that application's data segment to map     over the memory area reserved for its stack,     potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or     otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system.

  - A stack buffer overflow flaw was found in the way the     Bluetooth subsystem of the Linux kernel processed     pending L2CAP configuration responses from a client. On     systems with the stack protection feature enabled in     the kernel an unauthenticated attacker able to initiate     a connection to a system via Bluetooth could use this     flaw to crash the system. Due to the nature of the     stack protection feature, code execution cannot be     fully ruled out, although we believe it is unlikely.

  - The prepare_vmcs02 function in arch/x86/kvm/vmx.c in     the Linux kernel through 4.13.3 does not ensure that     the 'CR8-load exiting' and 'CR8-store exiting' L0     vmcs02 controls exist in cases where L1 omits the 'use     TPR shadow' vmcs12 control, which allows KVM L2 guest     OS users to obtain read and write access to the     hardware CR8 register.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 kernel was updated to fix the following issues :

  - Stack corruption could have lead to local privilege     escalation (bsc#1059525, CVE-2017-1000253).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix the following issues :

  - Stack corruption could have lead to local privilege     escalation (bsc#1059525, CVE-2017-1000253).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way the Linux kernel loaded ELF     executables. Provided that an application was built as     Position Independent Executable (PIE), the loader could     allow part of that application's data segment to map     over the memory area reserved for its stack,     potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or     otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3626 advisory.

    [2.6.39-400.297.9]
    - fs/binfmt_elf.c: fix bug in loading of PIE binaries (Michael Davidson)  [Orabug: 26870958]     {CVE-2017-1000253}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2795 advisory.

    - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Petr Matousek) [1492959     1492961] {CVE-2017-1000253}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw was found in the way the Linux kernel loaded ELF executables.
Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.
(CVE-2017-1000253, Important)

Red Hat would like to thank Qualys Research Labs for reporting this issue.

Security Fix(es) :

  - A flaw was found in the way the Linux kernel loaded ELF     executables. Provided that an application was built as     Position Independent Executable (PIE), the loader could     allow part of that application's data segment to map     over the memory area reserved for its stack, potentially     resulting in memory corruption. An unprivileged local     user with access to SUID (or otherwise privileged) PIE     binary could use this flaw to escalate their privileges     on the system. (CVE-2017-1000253, Important)

An update for kernel is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw was found in the way the Linux kernel loaded ELF executables.
Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.
(CVE-2017-1000253, Important)

Red Hat would like to thank Qualys Research Labs for reporting this issue.

An update for kernel is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw was found in the way the Linux kernel loaded ELF executables.
Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.
(CVE-2017-1000253, Important)

Red Hat would like to thank Qualys Research Labs for reporting this issue.

An update for kernel is now available for Red Hat Enterprise Linux 6.5 Advanced Update Support and Red Hat Enterprise Linux 6.5 Telco Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw was found in the way the Linux kernel loaded ELF executables.
Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.
(CVE-2017-1000253, Important)

Red Hat would like to thank Qualys Research Labs for reporting this issue.

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw was found in the way the Linux kernel loaded ELF executables.
Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.
(CVE-2017-1000253, Important)

Red Hat would like to thank Qualys Research Labs for reporting this issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2796 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was     built as Position Independent Executable (PIE), the loader could allow part of that application's data     segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system. (CVE-2017-1000253, Important)

    Red Hat would like to thank Qualys Research Labs for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2795 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was     built as Position Independent Executable (PIE), the loader could allow part of that application's data     segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system. (CVE-2017-1000253, Important)

    Red Hat would like to thank Qualys Research Labs for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2794 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was     built as Position Independent Executable (PIE), the loader could allow part of that application's data     segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system. (CVE-2017-1000253, Important)

    Red Hat would like to thank Qualys Research Labs for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2793 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was     built as Position Independent Executable (PIE), the loader could allow part of that application's data     segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An     unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to     escalate their privileges on the system. (CVE-2017-1000253, Important)

    Red Hat would like to thank Qualys Research Labs for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1842 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * An use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system.
    (CVE-2016-10200, Important)

    * A flaw was found that can be triggered in keyring_search_iterator in keyring.c if type->match is NULL. A     local user could use this flaw to crash the system or, potentially, escalate their privileges.
    (CVE-2017-2647, Important)

    * It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when     processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-     lockup the system and thus cause denial of service. (CVE-2017-8797, Important)

    This update also fixes multiple Moderate and Low impact security issues:

    * CVE-2015-8839, CVE-2015-8970, CVE-2016-9576, CVE-2016-7042, CVE-2016-7097, CVE-2016-8645, CVE-2016-9576,     CVE-2016-9588, CVE-2016-9806, CVE-2016-10088, CVE-2016-10147, CVE-2017-2596, CVE-2017-2671, CVE-2017-5970,     CVE-2017-6001, CVE-2017-6951, CVE-2017-7187, CVE-2017-7616, CVE-2017-7889, CVE-2017-8890, CVE-2017-9074,     CVE-2017-8890, CVE-2017-9075, CVE-2017-8890, CVE-2017-9076, CVE-2017-8890, CVE-2017-9077, CVE-2017-9242,     CVE-2014-7970, CVE-2014-7975, CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

    Documentation for these issues is available from the Release Notes document linked from the References     section.

    Red Hat would like to thank Igor Redko (Virtuozzo) and Andrey Ryabinin (Virtuozzo) for reporting     CVE-2017-2647; Igor Redko (Virtuozzo) and Vasily Averin (Virtuozzo) for reporting CVE-2015-8970; Marco     Grassi for reporting CVE-2016-8645; and Dmitry Vyukov (Google Inc.) for reporting CVE-2017-2596. The     CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat); the CVE-2016-7097 issue was discovered by     Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE); the CVE-2016-6213 and CVE-2016-9685 issues were     discovered by Qian Cai (Red Hat); and the CVE-2016-9604 issue was discovered by David Howells (Red Hat).

    Additional Changes:

    For detailed information on other changes in this release, see the Red Hat Enterprise Linux 7.4 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.
(CVE-2015-7613)

Linux kernels built with the name spaces support(CONFIG_NAMESPACE) is vulnerable to a potential privilege escalation flaw. It could occur when a process within a container escapes the intended bind mounts to access the full file system. A privileged user inside a container could use this flaw to potentially gain full privileges on a system.
(CVE-2015-2925)

A NULL pointer dereference vulnerability was found in the Linux kernel's TCP stack, in net/netfilter/nf_nat_redirect.c in the nf_nat_redirect_ipv4() function. A remote, unauthenticated user could exploit this flaw to create a system crash (denial of service).
(CVE-2015-8787)

ID	Name	Product	Family	Severity
210304	RHEL 5 : kernel (RHSA-2017:2802)	Nessus	Red Hat Local Security Checks	high
194071	RHEL 5 : kernel (RHSA-2017:2801)	Nessus	Red Hat Local Security Checks	high
180878	Oracle Linux 5 : kernel (ELSA-2017-2801)	Nessus	Oracle Linux Local Security Checks	high
132134	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-2599)	Nessus	Huawei Local Security Checks	critical
127351	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0113)	Nessus	NewStart CGSL Local Security Checks	high
104703	Virtuozzo 7 : readykernel-patch (VZA-2017-086)	Nessus	Virtuozzo Local Security Checks	high
103853	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:2725-1)	Nessus	SuSE Local Security Checks	high
103852	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:2723-1)	Nessus	SuSE Local Security Checks	high
103571	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-090)	Nessus	Virtuozzo Local Security Checks	high
103560	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3626)	Nessus	Oracle Linux Local Security Checks	high
103525	Oracle Linux 6 : kernel (ELSA-2017-2795)	Nessus	Oracle Linux Local Security Checks	high
103517	CentOS 6 : kernel (CESA-2017:2795)	Nessus	CentOS Local Security Checks	high
103502	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20170926)	Nessus	Scientific Linux Local Security Checks	high
103499	RHEL 6 : kernel (RHSA-2017:2800)	Nessus	Red Hat Local Security Checks	high
103498	RHEL 6 : kernel (RHSA-2017:2799)	Nessus	Red Hat Local Security Checks	high
103497	RHEL 6 : kernel (RHSA-2017:2798)	Nessus	Red Hat Local Security Checks	high
103496	RHEL 6 : kernel (RHSA-2017:2797)	Nessus	Red Hat Local Security Checks	high
103495	RHEL 6 : kernel (RHSA-2017:2796)	Nessus	Red Hat Local Security Checks	high
103494	RHEL 6 : kernel (RHSA-2017:2795)	Nessus	Red Hat Local Security Checks	high
103493	RHEL 7 : kernel (RHSA-2017:2794)	Nessus	Red Hat Local Security Checks	high
103492	RHEL 7 : kernel (RHSA-2017:2793)	Nessus	Red Hat Local Security Checks	high
102143	RHEL 7 : kernel (RHSA-2017:1842)	Nessus	Red Hat Local Security Checks	high
86634	Amazon Linux AMI : kernel (ALAS-2015-603)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2017-1000253

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical