The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2446-1 advisory.

    Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack     Segment (SS) register in the x86 architecture. A local attacker could exploit this flaw to gain     administrative privileges. (CVE-2014-9322)

    An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel     stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit     this leak to obtain information that could potentially be used to aid in attacking the kernel.
    (CVE-2014-8134)

    Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does     not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of     service (OOPS). (CVE-2014-7826)

    A flaw in the handling of malformed ASCONF chunks by SCTP (Stream Control Transmission Protocol)     implementation in the Linux kernel was discovered. A remote attacker could exploit this flaw to cause a     denial of service (system crash). (CVE-2014-3673)

    A flaw in the handling of duplicate ASCONF chunks by SCTP (Stream Control Transmission Protocol)     implementation in the Linux kernel was discovered. A remote attacker could exploit this flaw to cause a     denial of service (panic). (CVE-2014-3687)

    It was discovered that excessive queuing by SCTP (Stream Control Transmission Protocol) implementation in     the Linux kernel can cause memory pressure. A remote attacker could exploit this flaw to cause a denial of     service. (CVE-2014-3688)

    Rabin Vincent, Robert Swiecki, Russell Kinglaw discovered a flaw in how the perf subsystem of the Linux     kernel handles private systecall numbers. A local user could exploit this to cause a denial of service     (OOPS) or bypass ASLR protections via a crafted application. (CVE-2014-7825)

    The KVM (kernel virtual machine) subsystem of the Linux kernel miscalculates the number of memory pages     during the handling of a mapping failure. A guest OS user could exploit this to cause a denial of service     (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges.
    (CVE-2014-8369)

    Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack     Segment (SS) register on the x86 architecture. A local attacker could exploit this flaw to cause a denial     of service (panic). (CVE-2014-9090)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2446-1)

high Nessus Plugin ID 80032

Version 1.21