The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4316 advisory.

    - Copy secure_boot flag in boot params across kexec reboot (Dave Young)  [Orabug: 22066352]     {CVE-2015-7837}
    - ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Eric Dumazet)  [Orabug: 25059183]  {CVE-2016-3841}
    - ipv6: add complete rcu protection around np->opt (Eric Dumazet)  [Orabug: 25059183]  {CVE-2016-3841}
    - scsi: qla2xxx: Fix an integer overflow in sysfs code (Dan Carpenter)  [Orabug: 28220420]     {CVE-2017-14051}
    - ext4: fail ext4_iget for root directory if unallocated (Theodore Ts'o)  [Orabug: 28220433]     {CVE-2018-1092} {CVE-2018-1092}
    - ALSA: seq: Fix regression by incorrect ioctl_mutex usages (Takashi Iwai)  [Orabug: 29005190]     {CVE-2018-1000004}
    - netfilter: xt_osf: Add missing permission checks (Kevin Cernekee)  [Orabug: 29037832]  {CVE-2017-17450}
    - wil6210: missing length check in wmi_set_ie (Lior David)  [Orabug: 29060697]  {CVE-2018-5848}
    - HID: debug: check length before copy_to_user() (Daniel Rosenberg)  [Orabug: 29128167]  {CVE-2018-9516}
    - x86/MCE: Serialize sysfs changes (Seunghun Han)  [Orabug: 29152249]  {CVE-2018-7995}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4316)

critical Nessus Plugin ID 120977

Version 1.11

Version 1.10

Version 1.11 Oct 23, 2024, 10:51 PM CVE (set "CVE" coverage to "CVE-2014-9728,CVE-2015-7837,CVE-2016-3713,CVE-2016-3841,CVE-2017-13168,CVE-2017-14051,CVE-2017-17450,CVE-2017-17805,CVE-2017-17806,CVE-2017-18017,CVE-2017-18079,CVE-2018-1092,CVE-2018-18710,CVE-2018-5848,CVE-2018-7755,CVE-2018-7757,CVE-2018-7995,CVE-2018-9516,CVE-2018-1000004,CVE-2018-1000204,CVE-2018-10021,CVE-2018-10902") CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 score source (changed from "CVE-2018-9516" to "CVE-2017-18017") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202410232251
Version 1.10 Jun 27, 2024, 7:10 AM Exploit attributes ("Exploit available" set to "True") CVSSv2 score source (changed from "CVE-2017-18017" to "CVE-2018-9516") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") Plugin Feed: 202406270710