The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-03861 advisory.

  - Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain     privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to     change a socket version, related to the packet_set_ring and packet_setsockopt functions. (CVE-2016-8655)

  - The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is     enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M     byte in an undefined instruction. (CVE-2016-8630)

  - drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer     overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a state machine     confusion bug. (CVE-2016-9083)

  - drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which     allows local users to cause a denial of service (integer overflow) or have unspecified other impact by     leveraging access to a vfio PCI device file. (CVE-2016-9084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it is a duplicate of oraclelinux_ELSA-2017-0386-1.nasl (plugin ID 97547).

Plugin Deprecated

This plugin has been deprecated and is no longer functional.