The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0152 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw was found in the Linux kernel's key management system where it was possible for an attacker to     escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is     cached in the payload area. A negatively instantiated key may be then be positively instantiated by     updating it with valid data. However, the ->update key type method must be aware that the error code may     be there. (CVE-2015-8539, Important)

    * It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6,     allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout     data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a     use-after-free bug. (CVE-2017-15649, Important)

    * A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the     thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS.
    (CVE-2017-7472, Moderate)

    Red Hat would like to thank Dmitry Vyukov of Google engineering for reporting CVE-2015-8539.

    Bug Fix(es):

    * The kernel-rt packages have been upgraded to 3.10.0-693.15.1 source tree, which provides a number of bug     fixes over the previous version. (BZ#1519506)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : kernel-rt (RHSA-2018:0152)

high Nessus Plugin ID 106331

Version 1.13

Version 1.12

Version 1.13 Nov 5, 2024, 12:50 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202411051250
Version 1.12 Apr 28, 2024, 3:17 AM CVSSv2 score source (set to "CVE-2015-8539") CVSSv3 score source (set to "CVE-2017-15649") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404280317