The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3880-1 advisory.

    It was discovered that the CIFS client implementation in the Linux kernel did not properly handle setup     negotiation during session recovery, leading to a NULL pointer exception. An attacker could use this to     create a malicious CIFS server that caused a denial of service (client system crash). (CVE-2018-1066)

    Jann Horn discovered that the procfs file system implementation in the Linux kernel did not properly     restrict the ability to inspect the kernel stack of an arbitrary task. A local attacker could use this to     expose sensitive information. (CVE-2018-17972)

    Jann Horn discovered that the mremap() system call in the Linux kernel did not properly flush the TLB when     completing, potentially leaving access to a physical page after it has been released to the page     allocator. A local attacker could use this to cause a denial of service (system crash), expose sensitive     information, or possibly execute arbitrary code. (CVE-2018-18281)

    It was discovered that the socket implementation in the Linux kernel contained a type confusion error that     could lead to memory corruption. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-9568)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3880-1)

high Nessus Plugin ID 121598

Version 1.8

Version 1.7

Version 1.8 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.7 Oct 21, 2023, 5:06 AM CVSSv2 score source (set to "CVE-2018-9568") Detection Plugin metadata Plugin Feed: 202310210506