The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2516-1 advisory.

    A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of the SYSTENTER instruction when     the guest OS does not initialize the SYSENTER MSRs. A guest OS user could exploit this flaw to cause a     denial of service of the guest OS (crash) or potentially gain privileges on the guest OS. (CVE-2015-0239)

    Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS)     implementation allowing users to bypass the espfix to obtain information that could be used to bypass the     Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to     obtain potentially sensitive information from kernel memory. (CVE-2014-8133)

    A restriction bypass was discovered in iptables when conntrack rules are specified and the conntrack     protocol handler module is not loaded into the Linux kernel. This flaw can cause the firewall rules on the     system to be bypassed when conntrack rules are used. (CVE-2014-8160)

    A flaw was discovered with file renaming in the linux kernel. A local user could exploit this flaw to     cause a denial of service (deadlock and system hang). (CVE-2014-8559)

    A flaw was discovered in how supplemental group memberships are handled in certain namespace scenarios. A     local user could exploit this flaw to bypass file permission restrictions. (CVE-2014-8989)

    A flaw was discovered in how Thread Local Storage (TLS) is handled by the task switching function in the     Linux kernel for x86_64 based machines. A local user could exploit this flaw to bypass the Address Space     Layout Radomization (ASLR) protection mechanism. (CVE-2014-9419)

    Prasad J Pandit reported a flaw in the rock_continue function of the Linux kernel's ISO 9660 CDROM file     system. A local user could exploit this flaw to cause a denial of service (system crash or hang).
    (CVE-2014-9420)

    A flaw was discovered in the fragment handling of the B.A.T.M.A.N. Advanced Meshing Protocol in the Linux     kernel. A remote attacker could exploit this flaw to cause a denial of service (mesh-node system crash)     via fragmented packets. (CVE-2014-9428)

    A race condition was discovered in the Linux kernel's key ring. A local user could cause a denial of     service (memory corruption or panic) or possibly have unspecified impact via the keyctl commands.
    (CVE-2014-9529)

    A memory leak was discovered in the ISO 9660 CDROM file system when parsing rock ridge ER records. A local     user could exploit this flaw to obtain sensitive information from kernel memory via a crafted iso9660     image. (CVE-2014-9584)

    A flaw was discovered in the Address Space Layout Randomization (ASLR) of the Virtual Dynamically linked     Shared Objects (vDSO) location. This flaw makes it easier for a local user to bypass the ASLR protection     mechanism. (CVE-2014-9585)

    Dmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file name decoding. A local     unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain     administrative privileges. (CVE-2014-9683)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2516-1)

medium Nessus Plugin ID 81569

Version 1.22

Version 1.21

Version 1.20

Version 1.22 Aug 28, 2024, 11:02 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408282302
Version 1.21 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.20 Oct 21, 2023, 5:06 AM CVSS metrics ("CVSSv2 score" changed from 7.8 to 6.9. "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C" to "CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2014-9529") CVSSv2 severity (based on CVE-2014-9529, severity decreased from "High" to "Medium") CVSSv3 score source (set to "CVE-2014-8559") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210506