The version of Citrix XenServer running on the remote host is affected by multiple denial of service vulnerabilities :

  - An infinite loop condition exists in the KVM subsystem     that is triggered when handling a stream of #AC     (Alignment Check) exceptions. A local attacker within a     virtualized guest can exploit this to cause a host OS     panic or hang, resulting in a denial of service     condition. (CVE-2015-5307)

  - An infinite loop condition exists in the KVM subsystem     that is triggered when handling a stream of #DB (Debug)     exceptions. A local attacker within a virtualized guest     can exploit this to cause a host OS panic or hang,     resulting in a denial of service condition.
    (CVE-2015-8104)

Updated kernel packages that fix two security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) and #DB (debug exception) is handled. A privileged user inside a guest could use these flaws to create denial of service conditions on the host kernel. (CVE-2015-5307, CVE-2015-8104, Important)

Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the CVE-2015-5307 issue.

This update also fixes the following bugs :

* On Intel Xeon v5 platforms, the processor frequency was always tied to the highest possible frequency. Switching p-states on these client platforms failed. This update sets the idle frequency, busy frequency, and processor frequency values by determining the range and adjusting the minimal and maximal percent limit values. Now, switching p-states on the aforementioned client platforms proceeds successfully.
(BZ#1273926)

* Due to a validation error of in-kernel memory-mapped I/O (MMIO) tracing, a VM became previously unresponsive when connected to Red Hat Enterprise Virtualization Hypervisor. The provided patch fixes this bug by dropping the check in MMIO handler, and a VM continues running as expected. (BZ#1275150)

* Due to retry-able command errors, the NVMe driver previously leaked I/O descriptors and DMA mappings. As a consequence, the kernel could become unresponsive during the hot-unplug operation if a driver was removed. This update fixes the driver memory leak bug on command retries, and the kernel no longer hangs in this situation.
(BZ#1279792)

* The hybrid_dma_data() function was not initialized before use, which caused an invalid memory access when hot-plugging a PCI card. As a consequence, a kernel oops occurred. The provided patch makes sure hybrid_dma_data() is initialized before use, and the kernel oops no longer occurs in this situation. (BZ#1279793)

* When running PowerPC (PPC) KVM guests and the host was experiencing a lot of page faults, for example because it was running low on memory, the host sometimes triggered an incorrect kind of interrupt in the guest: a data storage exception instead of a data segment exception. This caused a kernel panic of the PPC KVM guest. With this update, the host kernel synthesizes a segment fault if the corresponding Segment Lookaside Buffer (SLB) lookup fails, which prevents the kernel panic from occurring. (BZ#1281423)

* The kernel accessed an incorrect area of the khugepaged process causing Logical Partitioning (LPAR) to become unresponsive, and an oops occurred in medlp5. The backported upstream patch prevents an LPAR hang, and the oops no longer occurs. (BZ#1281424)

* When the sctp module was loaded and a route to an association endpoint was removed after receiving an Out-of-The-Blue (OOTB) chunk but before incrementing the 'dropped because of missing route' SNMP statistic, a Null Pointer Dereference kernel panic previously occurred. This update fixes the race condition between OOTB response and route removal. (BZ#1281426)

* The cpuscaling test of the certification test suite previously failed due to a rounding bug in the intel-pstate driver. This bug has been fixed and the cpuscaling test now passes. (BZ#1281491)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3107 advisory.

    - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)  [Orabug: 22333698]  {CVE-2015-8104}
    - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup)  [Orabug:
    22333689]  {CVE-2015-5307} {CVE-2015-5307}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)     [Orabug: 22333698] (CVE-2015-8104)

  - KVM: x86: work around infinite loop in microcode when     #AC is delivered (Eric Northup) [Orabug: 22333689]     (CVE-2015-5307) (CVE-2015-5307)

  - KVM: x86: Defining missing x86 vectors (Nadav Amit)     [Orabug: 22333689]

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2645 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * It was found that the x86 ISA (Instruction Set Architecture) is prone to     a denial of service attack inside a virtualized environment in the form of     an infinite loop in the microcode due to the way (sequential) delivering of     benign exceptions such as #AC (alignment check exception) and #DB (debug     exception) is handled. A privileged user inside a guest could use these     flaws to create denial of service conditions on the host kernel.
    (CVE-2015-5307, CVE-2015-8104, Important)

    Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the     CVE-2015-5307 issue.

    This update also fixes the following bugs:

    * With an IPv6 address on a bond and a slave failover, Unsolicited Neighbor     Advertisement (UNA) was previously sent using the link global IPv6 address     as source address. The underlying source code has been patched, and, after     the failover in bonding, UNA is sent using both the corresponding link IPv6     address and global IPv6 address of bond0 and bond0.vlan. (BZ#1258479)

    * Previously, Human Interface Device (HID) would run a report on an     unaligned buffer, which could cause a page fault interrupt and an oops when     the end of the report was read. This update fixes this bug by padding the     end of the report with extra bytes, so the reading of the report never     crosses a page boundary. As a result, a page fault and subsequent oops no     longer occur. (BZ#1268201)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in which     the source was inside and the destination was outside of     a bind mount. A privileged user inside a container could     use this flaw to escape the bind mount and, potentially,     escalate their privileges on the system. (CVE-2015-2925,     Important)

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as #AC     (alignment check exception) and #DB (debug exception) is     handled. A privileged user inside a guest could use     these flaws to create denial of service conditions on     the host kernel. (CVE-2015-5307, CVE-2015-8104,     Important)

  - A race condition flaw was found in the way the Linux     kernel's IPC subsystem initialized certain fields in an     IPC object structure that were later used for permission     checking before inserting the object into a globally     visible list. A local, unprivileged user could     potentially use this flaw to elevate their privileges on     the system. (CVE-2015-7613, Important)

  - It was found that the Linux kernel's keys subsystem did     not correctly garbage collect uninstantiated keyrings. A     local attacker could use this flaw to crash the system     or, potentially, escalate their privileges on the     system. (CVE-2015-7872, Important)

This update also fixes the following bugs :

  - Previously, Human Interface Device (HID) ran a report on     an unaligned buffer, which could cause a page fault     interrupt and an oops when the end of the report was     read. This update fixes this bug by padding the end of     the report with extra bytes, so the reading of the     report never crosses a page boundary. As a result, a     page fault and subsequent oops no longer occur.

  - The NFS client was previously failing to detect a     directory loop for some NFS server directory structures.
    This failure could cause NFS inodes to remain referenced     after attempting to unmount the file system, leading to     a kernel crash. Loop checks have been added to VFS,     which effectively prevents this problem from occurring.

  - Due to a race whereby the nfs_wb_pages_cancel() and     nfs_commit_release_pages() calls both removed a request     from the nfs_inode struct type, the kernel panicked with     negative nfs_inode.npages count. The provided upstream     patch performs the required serialization by holding the     inode i_lock over the check of PagePrivate and locking     the request, thus preventing the race and kernel panic     from occurring.

  - Due to incorrect URB_ISO_ASAP semantics, playing an     audio file using a USB sound card could previously fail     for some hardware configurations. This update fixes the     bug, and playing audio from a USB sound card now works     as expected.

  - Inside hugetlb, region data structures were protected by     a combination of a memory map semaphore and a single     hugetlb instance mutex. However, a page-fault     scalability improvement backported to the kernel on     previous releases removed the single hugetlb instance     mutex and introduced a new mutex table, making the     locking combination insufficient, leading to possible     race windows that could cause corruption and undefined     behavior. This update fixes the problem by introducing a     required spinlock to the region tracking functions for     proper serialization. The problem only affects software     using huge pages through hugetlb interface.

The system must be rebooted for this update to take effect.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2842-2 advisory.

    Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly     catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a     denial of service (system crash) in the host OS. (CVE-2015-8104)

     discovered that the ppp implementation in the Linux kernel did not ensure that certain slot     numbers are valid. A local attacker with the privilege to call ioctl() on /dev/ppp could cause a denial of     service (system crash). (CVE-2015-7799)

    It was discovered that the virtual video osd test driver in the Linux kernel did not properly initialize     data structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7884)

    It was discovered that the driver for Digi Neo and ClassicBoard devices did not properly initialize data     structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7885)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 6.4 Advanced Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) and #DB (debug exception) is handled. A privileged user inside a guest could use these flaws to create denial of service conditions on the host kernel. (CVE-2015-5307, CVE-2015-8104, Important)

Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the CVE-2015-5307 issue.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.6 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) and #DB (debug exception) is handled. A privileged user inside a guest could use these flaws to create denial of service conditions on the host kernel. (CVE-2015-5307, CVE-2015-8104, Important)

Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the CVE-2015-5307 issue.

This update also fixes the following bugs :

* When doing TSO/GSO in the presence of VLAN headers on a macvtap device, the header offsets were incorrectly calculated. As a consequence, when 2 guests on the same host communicated over a guest configured VLAN, performance dropped to about 1 Mbps. A set of patches has been provided to fix this bug, and network performance with VLAN tags now works with optimal performance. (BZ#1215914)

* Prior to this update, TSO acceleration features have been removed from the VLAN device which caused that VLAN performance on top of a virtio device was much lower than that of a virtio device itself. This update re-enables TSO acceleration features, and performance of VLAN devices on top of a virtio device has thus been restored. (BZ#1240988)

* With an IPv6 address on a bond and a slave failover, Unsolicited Neighbor Advertisement (UNA) was previously sent using the link global IPv6 address as source address. The underlying source code has been patched, and, after the failover in bonding, UNA is sent using both the corresponding link IPv6 address and global IPv6 address of bond0 and bond0.vlan. (BZ#1258480)

* Previously, Human Interface Device (HID) would run a report on an unaligned buffer, which could cause a page fault interrupt and an oops when the end of the report was read. This update fixes this bug by padding the end of the report with extra bytes, so the reading of the report never crosses a page boundary. As a result, a page fault and subsequent oops no longer occur. (BZ#1268202)

* Inside hugetlb, region data structures were protected by a combination of a memory map semaphore and a single hugetlb instance mutex. However, a page-fault scalability improvement backported to the kernel on previous releases removed the single hugetlb instance mutex and introduced a new mutex table, making the locking combination insufficient, leading to possible race windows that could cause corruption and undefined behavior. The problem could be seen for example with software mapping or re-mapping hugetlb areas with concurrent threads reading/writing to same areas causing page faults.
This update fixes the problem by introducing now a required spinlock to the region tracking functions for proper serialization. The problem only affects software using huge pages through hugetlb interface.
(BZ#1274597)

* Previously, VLAN stacked on the macvlan or macvtap device did not work for devices that implement and use VLAN filters. As a consequence, macvtap passthrough mode failed to transfer VLAN packets over the be2net driver. This update implements VLAN ndo calls to the macvlan driver to pass appropriate VLAN tag IDs to lower devices. As a result, macvtap transfers VLAN packets over be2net successfully.
(BZ#1280205)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 6.2 Advanced Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) and #DB (debug exception) is handled. A privileged user inside a guest could use these flaws to create denial of service conditions on the host kernel. (CVE-2015-5307, CVE-2015-8104, Important)

Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the CVE-2015-5307 issue.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix three security issues, multiple bugs, and one enhancement are now available for Red Hat Enterprise Linux 7.1 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #DB (debug exception) is handled. A privileged user inside a guest could use this flaw to create denial of service conditions on the host kernel.
(CVE-2015-8104, Important)

* A use-after-free flaw was found in the way the Linux kernel's key management subsystem handled keyring object reference counting in certain error path of the join_session_keyring() function. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2016-0728, Important)

* It was found that the fix for CVE-2015-1805 incorrectly kept buffer offset and buffer length in sync on a failed atomic read, potentially resulting in a pipe buffer state corruption. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space. (CVE-2016-0774, Moderate)

Red Hat would like to thank the Perception Point research team for reporting the CVE-2016-0728 issue. The security impact of the CVE-2016-0774 issue was discovered by Red Hat.

Bug fixes :

* NMI watchdog of guests using legacy LVT0-based NMI delivery did not work with APICv. Now, NMI works with LVT0 regardless of APICv.
(BZ#1244726)

* Parallel file-extending direct I/O writes could previously race to update the size of the file. If they executed out-of-order, the file size could move backwards and push a previously completed write beyond the end of the file, causing it to be lost. (BZ#1258942)

* The GHES NMI handler had a global spin lock that significantly increased the latency of each perf sample collection. This update simplifies locking inside the handler. (BZ#1280200)

* Sometimes, iptables rules are updated along with ip rules, and routes are reloaded. Previously, skb->sk was mistakenly attached to some IPv6 forwarding traffic packets, which could cause kernel panic.
Now, such packets are checked and not processed. (BZ#1281700)

* The NUMA node was not reported for PCI adapters, which affected every POWER system deployed with Red Hat Enterprise Linux 7 and caused significant decrease in the system performance. (BZ#1283525)

* Processing packets with a lot of different IPv6 source addresses caused the kernel to return warnings concerning soft-lockups due to high lock contention and latency increase. (BZ#1285369)

* Running edge triggered interrupts with an ack notifier when simultaneously reconfiguring the Intel I/O IOAPIC did not work correctly, so EOI in the interrupt did not cause a VM to exit if APICv was enabled. Consequently, the VM sometimes became unresponsive.
(BZ#1287001)

* Block device readahead was artificially limited, so the read performance was poor, especially on RAID devices. Now, per-device readahead limits are used for each device, which has improved read performance. (BZ#1287548)

* Identical expectations could not be tracked simultaneously even if they resided in different connection tracking zones. Now, an expectation insert attempt is rejected only if the zone is also identical. (BZ#1290093)

* The storvsc kernel driver for Microsoft Hyper-V storage was setting incorrect SRB flags, and Red Hat Enterprise Linux 7 guests running on Microsoft Hyper-V were experiencing slow I/O as well as I/O failures when they were connected to a virtual SAN. Now, SRB flags are set correctly. (BZ#1290095)

* When a NUMA system with no memory in node 0 was used, the system terminated unexpectedly during boot or when using OpenVSwitch. Now, the kernel tries to allocate memory from other nodes when node 0 is not present. (BZ#1300950)

Enhancement :

* IPsec has been updated to provide many fixes and some enhancements.
Of particular note is the ability to match on outgoing interfaces.
(BZ#1287407)

The 4.2.6 stable update contains a number of important fixes across the tree. kernel-4.2.6-300.fc23 - Fix incorrect size calculations in megaraid with 64K pages (rhbz 1269300) - CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) - CVE-2015-5307 kvm: DoS infinite loop in microcode AC exception (rhbz 1277172 1279688)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

kernel-4.1.13-100.fc21 - Linux v4.1.13 - CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) - CVE-2015-5307 kvm: DoS infinite loop in microcode AC exception (rhbz 1277172 1279688)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Solaris system is missing necessary patches to address critical security updates :

  - Vulnerability in the Oracle VM VirtualBox component of     Oracle Virtualization (subcomponent: Core). Supported     versions that are affected are VirtualBox prior to     4.0.36, prior to 4.1.44, prior to 4.2.36, prior to     4.3.34 and prior to 5.0.10. Difficult to exploit     vulnerability requiring logon to Operating System.
    Successful attack of this vulnerability can result in     unauthorized Operating System hang or frequently     repeatable crash (complete DOS). (CVE-2015-8104)

  - Vulnerability in the Solaris component of Oracle Sun     Systems Products Suite (subcomponent: Kernel). The     supported version that is affected is 11.3. Easily     exploitable vulnerability allows low privileged attacker     with logon to the infrastructure where Solaris executes     to compromise Solaris. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of Solaris. (CVE-2016-3497)

ID	Name	Product	Family	Published	Updated	Severity
87012	Citrix XenServer Multiple Infinite Loop Guest-to-Host DoS (CTX202583)	Nessus	Misc.	11/23/2015	11/20/2019	medium
87274	RHEL 7 : kernel (RHSA-2015:2552)	Nessus	Red Hat Local Security Checks	12/9/2015	10/24/2019	medium
87332	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3107)	Nessus	Oracle Linux Local Security Checks	12/14/2015	10/22/2024	critical
87333	OracleVM 3.3 : kernel-uek (OVMSA-2015-0154)	Nessus	OracleVM Local Security Checks	12/14/2015	1/4/2021	medium
87399	RHEL 6 : kernel (RHSA-2015:2645)	Nessus	Red Hat Local Security Checks	12/16/2015	11/4/2024	critical
87403	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20151215)	Nessus	Scientific Linux Local Security Checks	12/16/2015	1/14/2021	medium
87469	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2842-2)	Nessus	Ubuntu Local Security Checks	12/17/2015	8/27/2024	low
87804	RHEL 6 : kernel (RHSA-2016:0004)	Nessus	Red Hat Local Security Checks	1/8/2016	10/24/2019	medium
87886	RHEL 6 : kernel (RHSA-2016:0024)	Nessus	Red Hat Local Security Checks	1/13/2016	10/24/2019	medium
87999	RHEL 6 : kernel (RHSA-2016:0046)	Nessus	Red Hat Local Security Checks	1/20/2016	10/24/2019	medium
88558	RHEL 7 : kernel (RHSA-2016:0103)	Nessus	Red Hat Local Security Checks	2/3/2016	10/24/2019	high
89149	Fedora 23 : kernel-4.2.6-300.fc23 (2015-115c302856)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
89459	Fedora 21 : kernel-4.1.13-100.fc21 (2015-f2c534bc12)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
92454	Oracle Solaris Critical Patch Update : jul2016_SRU11_3_8_7_0	Nessus	Solaris Local Security Checks	7/20/2016	8/11/2022	medium

Detections

Analytics

Plugins Search

medium

medium

critical

medium

critical

medium

low

medium

medium

medium

high

medium

medium

medium