The remote OracleVM system is missing necessary patches to address critical security updates :

  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)     [Orabug: 22333698] (CVE-2015-8104)

  - KVM: x86: work around infinite loop in microcode when     #AC is delivered (Eric Northup) [Orabug: 22333689]     (CVE-2015-5307) (CVE-2015-5307)

  - KVM: x86: Defining missing x86 vectors (Nadav Amit)     [Orabug: 22333689]

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2645 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * It was found that the x86 ISA (Instruction Set Architecture) is prone to     a denial of service attack inside a virtualized environment in the form of     an infinite loop in the microcode due to the way (sequential) delivering of     benign exceptions such as #AC (alignment check exception) and #DB (debug     exception) is handled. A privileged user inside a guest could use these     flaws to create denial of service conditions on the host kernel.
    (CVE-2015-5307, CVE-2015-8104, Important)

    Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the     CVE-2015-5307 issue.

    This update also fixes the following bugs:

    * With an IPv6 address on a bond and a slave failover, Unsolicited Neighbor     Advertisement (UNA) was previously sent using the link global IPv6 address     as source address. The underlying source code has been patched, and, after     the failover in bonding, UNA is sent using both the corresponding link IPv6     address and global IPv6 address of bond0 and bond0.vlan. (BZ#1258479)

    * Previously, Human Interface Device (HID) would run a report on an     unaligned buffer, which could cause a page fault interrupt and an oops when     the end of the report was read. This update fixes this bug by padding the     end of the report with extra bytes, so the reading of the report never     crosses a page boundary. As a result, a page fault and subsequent oops no     longer occur. (BZ#1268201)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in which     the source was inside and the destination was outside of     a bind mount. A privileged user inside a container could     use this flaw to escape the bind mount and, potentially,     escalate their privileges on the system. (CVE-2015-2925,     Important)

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as #AC     (alignment check exception) and #DB (debug exception) is     handled. A privileged user inside a guest could use     these flaws to create denial of service conditions on     the host kernel. (CVE-2015-5307, CVE-2015-8104,     Important)

  - A race condition flaw was found in the way the Linux     kernel's IPC subsystem initialized certain fields in an     IPC object structure that were later used for permission     checking before inserting the object into a globally     visible list. A local, unprivileged user could     potentially use this flaw to elevate their privileges on     the system. (CVE-2015-7613, Important)

  - It was found that the Linux kernel's keys subsystem did     not correctly garbage collect uninstantiated keyrings. A     local attacker could use this flaw to crash the system     or, potentially, escalate their privileges on the     system. (CVE-2015-7872, Important)

This update also fixes the following bugs :

  - Previously, Human Interface Device (HID) ran a report on     an unaligned buffer, which could cause a page fault     interrupt and an oops when the end of the report was     read. This update fixes this bug by padding the end of     the report with extra bytes, so the reading of the     report never crosses a page boundary. As a result, a     page fault and subsequent oops no longer occur.

  - The NFS client was previously failing to detect a     directory loop for some NFS server directory structures.
    This failure could cause NFS inodes to remain referenced     after attempting to unmount the file system, leading to     a kernel crash. Loop checks have been added to VFS,     which effectively prevents this problem from occurring.

  - Due to a race whereby the nfs_wb_pages_cancel() and     nfs_commit_release_pages() calls both removed a request     from the nfs_inode struct type, the kernel panicked with     negative nfs_inode.npages count. The provided upstream     patch performs the required serialization by holding the     inode i_lock over the check of PagePrivate and locking     the request, thus preventing the race and kernel panic     from occurring.

  - Due to incorrect URB_ISO_ASAP semantics, playing an     audio file using a USB sound card could previously fail     for some hardware configurations. This update fixes the     bug, and playing audio from a USB sound card now works     as expected.

  - Inside hugetlb, region data structures were protected by     a combination of a memory map semaphore and a single     hugetlb instance mutex. However, a page-fault     scalability improvement backported to the kernel on     previous releases removed the single hugetlb instance     mutex and introduced a new mutex table, making the     locking combination insufficient, leading to possible     race windows that could cause corruption and undefined     behavior. This update fixes the problem by introducing a     required spinlock to the region tracking functions for     proper serialization. The problem only affects software     using huge pages through hugetlb interface.

The system must be rebooted for this update to take effect.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2842-2 advisory.

    Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly     catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a     denial of service (system crash) in the host OS. (CVE-2015-8104)

     discovered that the ppp implementation in the Linux kernel did not ensure that certain slot     numbers are valid. A local attacker with the privilege to call ioctl() on /dev/ppp could cause a denial of     service (system crash). (CVE-2015-7799)

    It was discovered that the virtual video osd test driver in the Linux kernel did not properly initialize     data structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7884)

    It was discovered that the driver for Digi Neo and ClassicBoard devices did not properly initialize data     structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7885)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 6.4 Advanced Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) and #DB (debug exception) is handled. A privileged user inside a guest could use these flaws to create denial of service conditions on the host kernel. (CVE-2015-5307, CVE-2015-8104, Important)

Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the CVE-2015-5307 issue.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.6 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) and #DB (debug exception) is handled. A privileged user inside a guest could use these flaws to create denial of service conditions on the host kernel. (CVE-2015-5307, CVE-2015-8104, Important)

Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the CVE-2015-5307 issue.

This update also fixes the following bugs :

* When doing TSO/GSO in the presence of VLAN headers on a macvtap device, the header offsets were incorrectly calculated. As a consequence, when 2 guests on the same host communicated over a guest configured VLAN, performance dropped to about 1 Mbps. A set of patches has been provided to fix this bug, and network performance with VLAN tags now works with optimal performance. (BZ#1215914)

* Prior to this update, TSO acceleration features have been removed from the VLAN device which caused that VLAN performance on top of a virtio device was much lower than that of a virtio device itself. This update re-enables TSO acceleration features, and performance of VLAN devices on top of a virtio device has thus been restored. (BZ#1240988)

* With an IPv6 address on a bond and a slave failover, Unsolicited Neighbor Advertisement (UNA) was previously sent using the link global IPv6 address as source address. The underlying source code has been patched, and, after the failover in bonding, UNA is sent using both the corresponding link IPv6 address and global IPv6 address of bond0 and bond0.vlan. (BZ#1258480)

* Previously, Human Interface Device (HID) would run a report on an unaligned buffer, which could cause a page fault interrupt and an oops when the end of the report was read. This update fixes this bug by padding the end of the report with extra bytes, so the reading of the report never crosses a page boundary. As a result, a page fault and subsequent oops no longer occur. (BZ#1268202)

* Inside hugetlb, region data structures were protected by a combination of a memory map semaphore and a single hugetlb instance mutex. However, a page-fault scalability improvement backported to the kernel on previous releases removed the single hugetlb instance mutex and introduced a new mutex table, making the locking combination insufficient, leading to possible race windows that could cause corruption and undefined behavior. The problem could be seen for example with software mapping or re-mapping hugetlb areas with concurrent threads reading/writing to same areas causing page faults.
This update fixes the problem by introducing now a required spinlock to the region tracking functions for proper serialization. The problem only affects software using huge pages through hugetlb interface.
(BZ#1274597)

* Previously, VLAN stacked on the macvlan or macvtap device did not work for devices that implement and use VLAN filters. As a consequence, macvtap passthrough mode failed to transfer VLAN packets over the be2net driver. This update implements VLAN ndo calls to the macvlan driver to pass appropriate VLAN tag IDs to lower devices. As a result, macvtap transfers VLAN packets over be2net successfully.
(BZ#1280205)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The 4.2.6 stable update contains a number of important fixes across the tree. kernel-4.2.6-300.fc23 - Fix incorrect size calculations in megaraid with 64K pages (rhbz 1269300) - CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) - CVE-2015-5307 kvm: DoS infinite loop in microcode AC exception (rhbz 1277172 1279688)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156) CVE-2015-5307-xsa156.patch

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)     563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)     xsa153-libxl.patch xend-xsa153.patch

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - bsc#955399 - Fix xm migrate --log_progress. Due to logic     error progress was not logged when requested.

  - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100:
    infinite loop in processing command block list

  - bsc#956592 - xen: virtual PMU is unsupported (XSA-163)

  - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen:
    XENMEM_exchange error handling issues (XSA-159)

  - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel     and initrd on error (XSA-160)

  - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow     vulnerability in pcnet emulator (XSA-162)

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#955399 - Fix xm migrate --live. The options were not     passed due to a merge error. As a result the migration     was not live, instead the suspended guest was migrated.

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

  - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand     balloon size inaccuracy can crash guests (XSA-153)

  - Drop     5604f239-x86-PV-properly-populate-descriptor-tables.patc     h

  - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain     vcpu pointer array (DoS) (XSA-149)

  - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain     profiling-related vcpu pointer array (DoS) (XSA-151)

  - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and     profiling hypercalls log without rate limiting (XSA-152)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0037 for details.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.51 to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers were valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-5283: The sctp_init function in     net/sctp/protocol.c in the Linux kernel had an incorrect     sequence of protocol-initialization steps, which allowed     local users to cause a denial of service (panic or     memory corruption) by creating SCTP sockets before all     of the steps have finished (bnc#947155).

  - CVE-2015-2925: The prepend_path function in fs/dcache.c     in the Linux kernel did not properly handle rename     actions inside a bind mount, which allowed local users     to bypass an intended container protection mechanism by     renaming a directory, related to a 'double-chroot attack     (bnc#926238).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #DB (aka     Debug) exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #AC (aka     Alignment Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2015-7990: RDS: There was no verification that an     underlying transport exists when creating a connection,     causing usage of a NULL pointer (bsc#952384).

  - CVE-2015-7872: The key_gc_unused_keys function in     security/keys/gc.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) via crafted     keyctl commands (bnc#951440).

  - CVE-2015-0272: Missing checks allowed remote attackers     to cause a denial of service (IPv6 traffic disruption)     via a crafted MTU value in an IPv6 Router Advertisement     (RA) message, a different vulnerability than     CVE-2015-8215 (bnc#944296).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0046 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * It was found that the x86 ISA (Instruction Set Architecture) is prone to     a denial of service attack inside a virtualized environment in the form of     an infinite loop in the microcode due to the way (sequential) delivering of     benign exceptions such as #AC (alignment check exception) and #DB (debug     exception) is handled. A privileged user inside a guest could use these     flaws to create denial of service conditions on the host kernel.
    (CVE-2015-5307, CVE-2015-8104, Important)

    Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the     CVE-2015-5307 issue.

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE Leap 42.1 kernel was updated to 4.1.20 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-1339: A memory leak in cuse could be used to     exhaust kernel memory. (bsc#969356).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936 951638).

  - CVE-2015-7872: The key_gc_unused_keys function in     security/keys/gc.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) via crafted     keyctl commands (bnc#951440).

  - CVE-2015-7884: The vivid_fb_ioctl function in     drivers/media/platform/vivid/vivid-osd.c in the Linux     kernel did not initialize a certain structure member,     which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951626).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #DB (aka     Debug) exceptions, related to svm.c (bnc#954404).

  - CVE-2015-8709: kernel/ptrace.c in the Linux kernel     mishandled uid and gid mappings, which allowed local     users to gain privileges by establishing a user     namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the     ptrace system call. NOTE: the vendor states 'there is no     kernel bug here (bnc#959709).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call. (bsc#961509)

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8787: The nf_nat_redirect_ipv4 function in     net/netfilter/nf_nat_redirect.c in the Linux kernel     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact by sending certain IPv4     packets to an incompletely configured interface, a     related issue to CVE-2003-1604 (bnc#963931).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario. (bsc#966437).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: When Linux invalidated a paging structure     that is not in use locally, it could, in principle, race     against another CPU that is switching to a process that     uses the paging structure in question. (bsc#963767)

  - CVE-2016-2184: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#971125)

  - CVE-2016-2383: Incorrect branch fixups for eBPF allow     arbitrary read of kernel memory. (bsc#966684)

  - CVE-2016-2384: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#966693)

The following non-security bugs were fixed :

  - alsa: hda - Apply clock gate workaround to Skylake, too     (bsc#966137).

  - alsa: hda - disable dynamic clock gating on Broxton     before reset (bsc#966137).

  - alsa: hda - Fix playback noise with 24/32 bit sample     size on BXT (bsc#966137).

  - alsa: seq: Fix double port list deletion (bsc#968018).

  - alsa: seq: Fix leak of pool buffer at concurrent writes     (bsc#968018).

  - alsa: timer: Fix race between stop and interrupt     (bsc#968018).

  - alsa: timer: Fix wrong instance passed to slave     callbacks (bsc#968018).

  - arm64: Add workaround for Cavium erratum 27456.

  - arm64: Backport arm64 patches from SLE12-SP1-ARM

  - btrfs: teach backref walking about backrefs with     underflowed (bsc#966259).

  - cgroup kabi fix for 4.1.19.

  - config: Disable CONFIG_DDR. CONFIG_DDR is selected     automatically by drivers which need it.

  - config: Disable MFD_TPS65218 The TPS65218 is a power     management IC for 32-bit ARM systems.

  - config: Modularize NF_REJECT_IPV4/V6 There is no reason     why these helper modules should be built-in when the     rest of netfilter is built as modules.

  - config: Update x86 config files: Enable Intel RAPL This     driver is useful when power caping is needed. It was     enabled in the SLE kernel 2 years ago.

  - Delete patches.fixes/bridge-module-get-put.patch. As     discussed in     http://lists.opensuse.org/opensuse-kernel/2015-11/msg000     46.html

  - drm/i915: Fix double unref in intelfb_alloc failure path     (boo#962866, boo#966179).

  - drm/i915: Fix failure paths around initial fbdev     allocation (boo#962866, boo#966179).

  - drm/i915: Pin the ifbdev for the info->system_base GGTT     mmapping (boo#962866, boo#966179).

  - e1000e: Avoid divide by zero error (bsc#965125).

  - e1000e: fix division by zero on jumbo MTUs (bsc#965125).

  - e1000e: fix systim issues (bsc#965125).

  - e1000e: Fix tight loop implementation of systime read     algorithm (bsc#965125).

  - ibmvnic: Fix ibmvnic_capability struct.

  - intel: Disable Skylake support in intel_idle driver     again (boo#969582) This turned out to bring a regression     on some machines, unfortunately. It should be addressed     in the upstream at first.

  - intel_idle: allow idle states to be freeze-mode specific     (boo#969582).

  - intel_idle: Skylake Client Support (boo#969582).

  - intel_idle: Skylake Client Support - updated     (boo#969582).

  - libceph: fix scatterlist last_piece calculation     (bsc#963746).

  - lio: Add LIO clustered RBD backend (fate#318836)

  - net kabi fixes for 4.1.19.

  - numa patches updated to v15

  - ocfs2: fix dlmglue deadlock issue(bnc#962257)

  - pci: thunder: Add driver for ThunderX-pass(1,2) on-chip     devices

  - pci: thunder: Add PCIe host driver for ThunderX     processors

  - sd: Optimal I/O size is in bytes, not sectors     (boo#961263).

  - sd: Reject optimal transfer length smaller than page     size (boo#961263).

  - series.conf: move cxgb3 patch to network drivers section

Updated kernel packages that fix three security issues, multiple bugs, and one enhancement are now available for Red Hat Enterprise Linux 7.1 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #DB (debug exception) is handled. A privileged user inside a guest could use this flaw to create denial of service conditions on the host kernel.
(CVE-2015-8104, Important)

* A use-after-free flaw was found in the way the Linux kernel's key management subsystem handled keyring object reference counting in certain error path of the join_session_keyring() function. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2016-0728, Important)

* It was found that the fix for CVE-2015-1805 incorrectly kept buffer offset and buffer length in sync on a failed atomic read, potentially resulting in a pipe buffer state corruption. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space. (CVE-2016-0774, Moderate)

Red Hat would like to thank the Perception Point research team for reporting the CVE-2016-0728 issue. The security impact of the CVE-2016-0774 issue was discovered by Red Hat.

Bug fixes :

* NMI watchdog of guests using legacy LVT0-based NMI delivery did not work with APICv. Now, NMI works with LVT0 regardless of APICv.
(BZ#1244726)

* Parallel file-extending direct I/O writes could previously race to update the size of the file. If they executed out-of-order, the file size could move backwards and push a previously completed write beyond the end of the file, causing it to be lost. (BZ#1258942)

* The GHES NMI handler had a global spin lock that significantly increased the latency of each perf sample collection. This update simplifies locking inside the handler. (BZ#1280200)

* Sometimes, iptables rules are updated along with ip rules, and routes are reloaded. Previously, skb->sk was mistakenly attached to some IPv6 forwarding traffic packets, which could cause kernel panic.
Now, such packets are checked and not processed. (BZ#1281700)

* The NUMA node was not reported for PCI adapters, which affected every POWER system deployed with Red Hat Enterprise Linux 7 and caused significant decrease in the system performance. (BZ#1283525)

* Processing packets with a lot of different IPv6 source addresses caused the kernel to return warnings concerning soft-lockups due to high lock contention and latency increase. (BZ#1285369)

* Running edge triggered interrupts with an ack notifier when simultaneously reconfiguring the Intel I/O IOAPIC did not work correctly, so EOI in the interrupt did not cause a VM to exit if APICv was enabled. Consequently, the VM sometimes became unresponsive.
(BZ#1287001)

* Block device readahead was artificially limited, so the read performance was poor, especially on RAID devices. Now, per-device readahead limits are used for each device, which has improved read performance. (BZ#1287548)

* Identical expectations could not be tracked simultaneously even if they resided in different connection tracking zones. Now, an expectation insert attempt is rejected only if the zone is also identical. (BZ#1290093)

* The storvsc kernel driver for Microsoft Hyper-V storage was setting incorrect SRB flags, and Red Hat Enterprise Linux 7 guests running on Microsoft Hyper-V were experiencing slow I/O as well as I/O failures when they were connected to a virtual SAN. Now, SRB flags are set correctly. (BZ#1290095)

* When a NUMA system with no memory in node 0 was used, the system terminated unexpectedly during boot or when using OpenVSwitch. Now, the kernel tries to allocate memory from other nodes when node 0 is not present. (BZ#1300950)

Enhancement :

* IPsec has been updated to provide many fixes and some enhancements.
Of particular note is the ability to match on outgoing interfaces.
(BZ#1287407)

ID	Name	Product	Family	Published	Updated	Severity
87333	OracleVM 3.3 : kernel-uek (OVMSA-2015-0154)	Nessus	OracleVM Local Security Checks	12/14/2015	1/4/2021	medium
87399	RHEL 6 : kernel (RHSA-2015:2645)	Nessus	Red Hat Local Security Checks	12/16/2015	11/4/2024	critical
87403	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20151215)	Nessus	Scientific Linux Local Security Checks	12/16/2015	1/14/2021	medium
87469	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2842-2)	Nessus	Ubuntu Local Security Checks	12/17/2015	8/27/2024	low
87804	RHEL 6 : kernel (RHSA-2016:0004)	Nessus	Red Hat Local Security Checks	1/8/2016	10/24/2019	medium
87886	RHEL 6 : kernel (RHSA-2016:0024)	Nessus	Red Hat Local Security Checks	1/13/2016	10/24/2019	medium
89149	Fedora 23 : kernel-4.2.6-300.fc23 (2015-115c302856)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
87591	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:2328-1)	Nessus	SuSE Local Security Checks	12/22/2015	1/6/2021	high
87650	SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2338-1)	Nessus	SuSE Local Security Checks	12/29/2015	1/6/2021	high
90019	OracleVM 3.2 : kernel-uek (OVMSA-2016-0037)	Nessus	OracleVM Local Security Checks	3/18/2016	1/4/2021	critical
87214	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:2194-1)	Nessus	SuSE Local Security Checks	12/7/2015	1/6/2021	medium
87999	RHEL 6 : kernel (RHSA-2016:0046)	Nessus	Red Hat Local Security Checks	1/20/2016	3/21/2025	critical
90482	openSUSE Security Update : the Linux Kernel (openSUSE-2016-445)	Nessus	SuSE Local Security Checks	4/13/2016	1/19/2021	critical
88558	RHEL 7 : kernel (RHSA-2016:0103)	Nessus	Red Hat Local Security Checks	2/3/2016	10/24/2019	high

Detections

Analytics

Plugins Search

medium

critical

medium

low

medium

medium

medium

high

high

critical

medium

critical

critical

high