The remote OracleVM system is missing necessary patches to address security updates:

    [4.1.12-124.90.3]- SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int (Dai     Ngo)  [Orabug: 37055439][4.1.12-124.90.2]- scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()     (Justin Tee)  [Orabug: 36643241]  {CVE-2024-35930}- scsi: qla2xxx: Fix command flush on cable pull (Quinn     Tran)  [Orabug: 36596617]  {CVE-2024-26931}- VMCI: Fix use-after-free when removing resource in     vmci_resource_remove() (David Fernandez Gonzalez)  [Orabug: 33917166][4.1.12-124.90.1]- i40e: Do not use     WQ_MEM_RECLAIM flag for workqueue (Sindhu Devale)  [Orabug: 36643519]  {CVE-2024-36004}- dyndbg: fix old     BUG_ON in >control parser (Jim Cromie)  [Orabug: 36643340]  {CVE-2024-35947}- btrfs: send: handle path ref     underflow in header iterate_inode_ref() (David Sterba)  [Orabug: 36643269]  {CVE-2024-35935}- ipv6: Fix     infinite recursion in fib6_dump_done(). (Kuniyuki Iwashima)  [Orabug: 36643095]  {CVE-2024-35886}-     x86/mm/pat: fix VM_PAT handling in COW mappings (David Hildenbrand)  [Orabug: 36643059]  {CVE-2024-35877}

Tenable has extracted the preceding description block directly from the OracleVM security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

OracleVM 3.4 : kernel-uek (OVMSA-2024-0013)

medium Nessus Plugin ID 208092

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Nov 5, 2024, 12:50 PM CVSSv3 score source (changed from "CVE-2024-35877" to "CVE-2024-35947") Plugin Feed: 202411051250
Version 1.2 Nov 1, 2024, 3:44 PM CVSSv3 score source (set to "CVE-2024-35877") Plugin Feed: 202411011544
Version 1.1 Oct 3, 2024, 8:54 PM New Plugin Feed: 202410032054