The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2337-1 advisory.

    A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq).
    A guest OS user could exploit this flaw to cause a denial of service (host OS crash). (CVE-2014-0155)

    Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is     passed to a process of more privilege. A local user could exploit this flaw to bypass access restrictions     by having a privileged executable do something it was not intended to do. (CVE-2014-0181)

    An information leak was discovered in the Linux kernels aio_read_events_ring function. A local user could     exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-0206)

    A flaw was discovered in the Linux kernel's implementation of user namespaces with respect to inode     permissions. A local user could exploit this flaw by creating a user namespace to gain administrative     privileges. (CVE-2014-4014)

    An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux     kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by     leveraging access to a SCSI initiator. (CVE-2014-4027)

    Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range     notifications and hole punching. A local user could exploit this flaw to cause a denial of service.
    (CVE-2014-4171)

    Toralf Frster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local     user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

    An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture     (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information     from kernel memory. (CVE-2014-4652)

    A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control     implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service     (system crash). (CVE-2014-4653)

    A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound     Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service     (remove kernel controls). (CVE-2014-4654)

    A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled     a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and     limit bypass). (CVE-2014-4655)

    An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound     Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash).
    (CVE-2014-4656)

    An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain     SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a     crafted SCTP packet. (CVE-2014-4667)

    Vasily Averin discover a reference count flaw during attempts to umount in conjunction with a symlink. A     local user could exploit this flaw to cause a denial of service (memory consumption or use after free) or     possibly have other unspecified impact. (CVE-2014-5045)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2337-1)

medium Nessus Plugin ID 77492

Version 1.25

Version 1.24

Version 1.23

Version 1.23

Version 1.25 Aug 28, 2024, 11:02 PM CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 severity (based on CVE-2014-0181, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408282302
Version 1.24 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.23 Oct 23, 2023, 4:39 PM CVSS metrics ("CVSSv3 score" set to 7.8. "CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") CVSSv2 score source (set to "CVE-2014-5045") CVSSv3 score source (set to "CVE-2014-0181") Detection Plugin metadata Plugin Feed: 202310231639
Version 1.23 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856