The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4575 advisory.

    - ext4: only look at the bg_flags field if it is valid (Theodore Tso)  [Orabug: 29316684]     {CVE-2018-10876} {CVE-2018-10876}
    - net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch)  [Orabug: 29422739]     {CVE-2018-9568}
    - ext4: always check block group bounds in ext4_init_block_bitmap() (Theodore Tso)  [Orabug: 29428607]     {CVE-2018-10878}
    - ext4: make sure bitmaps and the inode table dont overlap with bg descriptors (Theodore Tso)  [Orabug:
    29428607]  {CVE-2018-10878}
    - vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags (David Howells)  [Orabug: 29428607]     {CVE-2018-10878}
    - KEYS: add missing permission check for request_key() destination (Eric Biggers)  [Orabug: 29304551]     {CVE-2017-17807}
    - KEYS: Dont permit request_key() to construct a new keyring (David Howells)  [Orabug: 29304551]     {CVE-2017-17807}
    - mm: cleancache: fix corruption on missed inode invalidation (Pavel Tikhomirov)  [Orabug: 29364670]     {CVE-2018-16862}
    - net/packet: fix a race in packet_bind() and packet_notifier() (Eric Dumazet)  [Orabug: 29385593]     {CVE-2018-18559}
    - ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Tso)  [Orabug: 29396712]     {CVE-2018-10877} {CVE-2018-10877}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4575)

high Nessus Plugin ID 122803

Version 1.13

Version 1.12

Version 1.13 Oct 23, 2024, 10:51 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202410232251
Version 1.12 Jun 14, 2024, 8:08 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202406140808