The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3583-1 advisory.

    It was discovered that an out-of-bounds write vulnerability existed in the Flash-Friendly File System     (f2fs) in the Linux kernel. An attacker could construct a malicious file system that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-0750)

    It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM     subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2017-0861)

    It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic     I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the     host OS. (CVE-2017-1000407)

    Bo Zhang discovered that the netlink wireless configuration interface in the Linux kernel did not properly     validate attributes when handling certain requests. A local attacker with the CAP_NET_ADMIN could use this     to cause a denial of service (system crash). (CVE-2017-12153)

    Vitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel did not properly track reference     counts when merging buffers. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2017-12190)

    It was discovered that the key management subsystem in the Linux kernel did not properly restrict key     reads on negatively instantiated keys. A local attacker could use this to cause a denial of service     (system crash). (CVE-2017-12192)

    It was discovered that an integer overflow existed in the sysfs interface for the QLogic 24xx+ series SCSI     driver in the Linux kernel. A local privileged attacker could use this to cause a denial of service     (system crash). (CVE-2017-14051)

    Otto Ebeling discovered that the memory manager in the Linux kernel did not properly check the effective     UID in some situations. A local attacker could use this to expose sensitive information. (CVE-2017-14140)

    It was discovered that the ATI Radeon framebuffer driver in the Linux kernel did not properly initialize a     data structure returned to user space. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14156)

    ChunYu Wang discovered that the iSCSI transport implementation in the Linux kernel did not properly     validate data structures. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-14489)

    James Patrick-Evans discovered a race condition in the LEGO USB Infrared Tower driver in the Linux kernel.
    A physically proximate attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-15102)

    ChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in     the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code, (CVE-2017-15115)

    It was discovered that the key management subsystem in the Linux kernel did not properly handle NULL     payloads with non-zero length values. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-15274)

    It was discovered that the Bluebooth Network Encapsulation Protocol (BNEP) implementation in the Linux     kernel did not validate the type of socket passed in the BNEPCONNADD ioctl(). A local attacker with the     CAP_NET_ADMIN privilege could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-15868)

    Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16525)

    It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform     access control checks. A local attacker could improperly modify the system-wide OS fingerprint list.
    (CVE-2017-17450)

    It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic     hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-17806)

    Denys Fedoryshchenko discovered a use-after-free vulnerability in the netfilter xt_TCPMSS filter of the     Linux kernel. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-18017)

    Gareth Evans discovered that the shm IPC subsystem in the Linux kernel did not properly restrict mapping     page zero. A local privileged attacker could use this to execute arbitrary code. (CVE-2017-5669)

    It was discovered that an integer overflow vulnerability existing in the IPv6 implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (infinite loop). (CVE-2017-7542)

    Tommi Rantala and Brad Spengler discovered that the memory manager in the Linux kernel did not properly     enforce the CONFIG_STRICT_DEVMEM protection mechanism. A local attacker with access to /dev/mem could use     this to expose sensitive information or possibly execute arbitrary code. (CVE-2017-7889)

    Mohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-8824)

    Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable Datagram Sockets) protocol     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-5333)

     discovered that a race condition existed in loop block device implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-5344)

    USN-3524-1 mitigated CVE-2017-5754 (Meltdown) for the amd64 architecture in Ubuntu 14.04 LTS. This update     provides the corresponding mitigations for the ppc64el architecture.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3583-1)

critical Nessus Plugin ID 107003

Version 3.14

Version 3.12

Version 3.11

Version 3.11

Version 3.14 Oct 29, 2024, 5:54 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202410291754
Version 3.12 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 3.11 Oct 21, 2023, 5:06 AM CVSSv2 score source (set to "CVE-2017-18017") Detection Plugin metadata Plugin Feed: 202310210506
Version 3.11 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856