openSUSE 13.2 核心已經更新，可修正各種錯誤和安全性問題。

已修正以下安全性錯誤：

- CVE-2016-1583：防止在較低檔案系統不允許時使用 mmap。這可在安裝 ecryptfs-utils 且 /sbin/mount.ecryptfs_private 為 setuid 時導致本機權限提升 (bsc#983143)。

- CVE-2016-4913：在 Linux 核心中，fs/isofs/rock.c 的 get_rock_ridge_filename 函式不當處理包含 \0 字元的 NM (即替代名稱) 項目，進而允許本機使用者透過特製的 isofs 檔案系統，從核心記憶體取得敏感資訊或可能造成其他不明影響 (bnc#980725)。

- CVE-2016-4580：在 Linux 核心中，net/x25/x25_facilities.c 的 x25_negotiate_facilities 函式未正確初始化特定資料結構，其允許攻擊者透過 X.25 呼叫要求，取得核心堆疊記憶體中的敏感資訊 (bnc#981267)。

- CVE-2016-0758：長度無限的標籤可損毀 asn1_find_indefinite_length 中的指標 (bsc#979867)。

- CVE-2016-2053：在 Linux 核心中，lib/asn1_decoder.c 中的 asn1_ber_decoder 函式允許攻擊者透過缺少公開金鑰的 ASN.1 BER 檔案造成拒絕服務 (錯誤)，進而導致 crypto/asymmetric_keys/public_key.c 中的 public_key_verify_signature 函式錯誤處理 (bnc#963762)。

- CVE-2016-2187：在 Linux 核心中，drivers/input/tablet/gtco.c 的 gtco_probe 函式允許實際位置靠近的攻擊者透過 USB 裝置描述符號中特製的端點值，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#971919 971944)。

- CVE-2016-4482：在 Linux 核心中，drivers/usb/core/devio.c 的 proc_connectinfo 函式並未初始化特定資料結構，進而讓本機使用者透過特製的 USBDEVFS_CONNECTINFO ioctl 呼叫，從核心堆疊記憶體取得敏感資訊 (bnc#978401 bsc#978445)。

- CVE-2016-4565：Linux 核心中的 InfiniBand (即 IB) 堆疊未正確依賴寫入系統呼叫，進而允許本機使用者透過 uAPI 介面造成拒絕服務 (核心記憶體寫入作業)，或可能造成其他不明影響 (bnc#979548 bsc#980363)。

- CVE-2016-3672：在 Linux 核心中，arch/x86/mm/mmap.c 中的 arch_pick_mmap_layout 函式未正確隨機化舊版基底位址，使本機使用者更容易突破 ADDR_NO_RANDOMIZE 旗標的預定限制，並透過停用堆疊消耗資源限制繞過 setuid 或 setgid 程式的 ASLR 保護機制 (bnc#974308)。

- CVE-2016-4581：Linux 核心的 fs/pnode.c 在涉及從屬掛載的特定情況下，並未正確遊走掛載傳播樹狀結構，其允許本機使用者透過一系列特製的掛載系統呼叫，造成拒絕服務 (NULL 指標解除參照和 OOPS) (bnc#979913)。

- CVE-2016-4485：在 Linux 核心中，net/llc/af_llc.c 的 llc_cmsg_rcv 函式並未初始化特定資料結構，進而讓攻擊者透過讀取訊息，從核心堆疊記憶體取得敏感資訊 (bnc#978821)。

- CVE-2015-3288：在 Linux 核心中發現一個安全性瑕疵，其允許任意變更零頁面記憶體。(bnc#979021)。

- CVE-2016-4578：Linux 核心中的 sound/core/timer.c 未初始化特定 r1 資料結構，其允許本機使用者透過使用特製的 ALSA 計時器介面，從核心堆疊記憶體取得敏感資訊，這與 (1) snd_timer_user_ccallback 和 (2) snd_timer_user_tinterrupt 函式相關 (bnc#979879)。

- CVE-2016-3134：Linux 核心中的 netfilter 子系統未驗證特定位移欄位，進而允許本機使用者透過 IPT_SO_SET_REPLACE setsockopt 呼叫取得權限或造成拒絕服務 (堆積記憶體損毀) (bnc#971126)。

- CVE-2016-4486：在 Linux 核心中，net/core/rtnetlink.c 內的 rtnl_fill_link_ifmap 函式並未初始化特定資料結構，進而允許本機使用者透過讀取 Netlink 訊息，從核心堆疊記憶體取得敏感資訊 (bnc#978822)。

- CVE-2013-7446：在 Linux 核心中，net/unix/af_unix.c 中的釋放後使用弱點允許本機使用者透過特製 epoll_ctl 呼叫，繞過預定的 AF_UNIX 通訊端權限或造成拒絕服務 (錯誤) (bnc#955654)。

- CVE-2016-4569：在 Linux 核心中，sound/core/timer.c 的 snd_timer_user_params 函式未初始化特定資料結構，其允許本機使用者透過使用特製的 ALSA 計時器介面，從核心堆疊記憶體取得敏感資訊 (bnc#979213)。

- CVE-2016-2847：在 Linux 核心中，fs/pipe.c 未限制管道中的未讀資料量，其允許本機使用者透過建立許多含有非預設大小的管道，造成拒絕服務 (記憶體消耗) (bnc#970948 974646)。

- CVE-2016-3136：在 Linux 核心中，drivers/usb/serial/mct_u232.c 的 mct_u232_msr_to_state 函式允許實際位置靠近的攻擊者透過沒有兩個中斷輸入端點描述符號的特製 USB 裝置，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#970955)。

- CVE-2016-2188：在 Linux 核心中，drivers/usb/misc/iowarrior.c 的 iowarrior_probe 函式允許實際位置靠近的攻擊者透過 USB 裝置描述符號中特製的端點值，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#970956)。

- CVE-2016-3138：在 Linux 核心中，drivers/usb/class/cdc-acm.c 的 acm_probe 函式允許實際位置靠近的攻擊者透過沒有控制和資料端點描述符號的 USB 裝置，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#970911)。

- CVE-2016-3137：在 Linux 核心中，drivers/usb/serial/cypress_m8.c 允許實際位置靠近的攻擊者透過沒有中斷輸入和中斷輸出端點描述符號的 USB 裝置，造成拒絕服務 (NULL 指標解除參照和系統當機)，這與 cypress_generic_port_probe 和 cypress_open 函式相關 (bnc#970970)。

- CVE-2016-3951：在 Linux 核心中，drivers/net/usb/cdc_ncm.c 中的重複釋放弱點允許實際位置靠近的攻擊者透過插入 USB 描述符號無效的 USB 裝置，造成拒絕服務 (系統當機) 或可能造成其他不明影響 (bnc#974418)。

- CVE-2016-3140：在 Linux 核心中，drivers/usb/serial/digi_acceleport.c 的 digi_port_init 函式允許實際位置靠近的攻擊者透過 USB 裝置描述符號中特製的端點值，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#970892)。

- CVE-2016-2186：在 Linux 核心中，drivers/input/misc/powermate.c 的 powermate_probe 函式允許實際位置靠近的攻擊者透過 USB 裝置描述符號中特製的端點值，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#970958)。

- CVE-2016-2185：在 Linux 核心中，drivers/input/misc/ati_remote2.c 的 ati_remote2_probe 函式允許實際位置靠近的攻擊者透過 USB 裝置描述符號中特製的端點值，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#971124)。

- CVE-2016-3689：在 Linux 核心中，drivers/input/misc/ims-pcu.c 的 ims_pcu_parse_cdc_data 函式允許實際位置靠近的攻擊者透過沒有主要和從屬介面的 USB 裝置，造成拒絕服務 (系統當機) (bnc#971628)。

- CVE-2016-3156：Linux 核心中的 IPv4 實作不當處理裝置物件的解構，進而允許來賓作業系統使用者透過針對大量 IP 位址進行安排，造成拒絕服務 (主機作業系統網路中斷) (bnc#971360)。

- CVE-2016-2184：在 Linux 核心中，snd-usb-audio 驅動程式之 sound/usb/quirks.c 的 create_fixed_stream_quirk 函式允許實際位置靠近的攻擊者透過 USB 裝置描述符號中特製的端點值，造成拒絕服務 (NULL 指標解除參照或重複釋放，以及系統當機) (bnc#971125)。

- CVE-2016-3139：在 Linux 核心中，drivers/input/tablet/wacom_sys.c 的 wacom_probe 函式允許實際位置靠近的攻擊者透過 USB 裝置描述符號中特製的端點值，造成拒絕服務 (NULL 指標解除參照和系統當機) (bnc#970909)。

- CVE-2015-8830：在 Linux 核心 4.0 版中，fs/aio.c 的 aio_setup_single_vector 函式有整數溢位，其允許本機使用者透過大型 AIO iovec，造成拒絕服務或可能造成其他不明影響。注意：此弱點之所以存在，是因為 CVE-2012-6701 迴歸 (bnc#969354 bsc#969355)。

- CVE-2016-2782：在 Linux 核心中，drivers/usb/serial/visor.c 的 treo_attach 函式允許實際位置靠近的攻擊者透過插入缺少 (1)大量輸入或 (2) 中斷輸入端點的 USB 裝置，造成拒絕服務 (NULL 指標解除參照和系統當機) 或可能造成其他不明影響 (bnc#968670)。

- CVE-2015-8816：在 Linux 核心中，drivers/usb/core/hub.c 的 hub_activate 函式未正確維護集線器介面資料結構，進而允許實際位置靠近的攻擊者透過拔除 USB 集線器裝置，造成拒絕服務 (無效的記憶體存取和系統當機) 或可能造成其他不明影響 (bnc#968010)。

- CVE-2015-7566：在 Linux 核心中，drivers/usb/serial/visor.c 的 clie_5_attach 函式允許實際位置靠近的攻擊者透過插入缺少大量輸出端點的 USB 裝置，造成拒絕服務 (NULL 指標解除參照和系統當機) 或可能造成其他不明影響 (bnc#961512)。

- CVE-2016-2549：在 Linux 核心中，sound/core/hrtimer.c 未防止遞迴回呼存取，進而允許本機使用者透過特製的 ioctl 呼叫造成拒絕服務 (鎖死) (bnc#968013)。

- CVE-2016-2547：Linux 核心中的 sound/core/timer.c 採用的鎖定方法未考量從屬計時器執行個體，其允許本機使用者透過特製的 ioctl 呼叫，造成拒絕服務 (爭用情形、釋放後使用和系統當機) (bnc#968011)。

- CVE-2016-2548：Linux 核心中的 sound/core/timer.c 在關閉或停止動作之後保留了特定的連結清單，其允許本機使用者透過特製的 ioctl 呼叫造成拒絕服務 (系統當機)，這與 (1) snd_timer_close 和 (2) _snd_timer_stop 函式有關 (bnc#968012)。

- CVE-2016-2546：Linux 核心中的 sound/core/timer.c 使用不正確的 mutex 類型，其允許本機使用者透過特製的 ioctl 呼叫，造成拒絕服務 (爭用情形、釋放後使用和系統當機) (bnc#967975)。

- CVE-2016-2545：在 Linux 核心中，sound/core/timer.c 的 snd_timer_interrupt 函式未正確維護特定連結清單，進而允許本機使用者透過特製的 ioctl 呼叫造成拒絕服務 (爭用情形和系統當機) (bnc#967974)。

- CVE-2016-2544：Linux 核心中 sound/core/seq/seq_queue.c 的 queue_delete 函式有一個爭用情形，其允許本機使用者透過在特定時間提出 ioctl 呼叫，進而造成拒絕服務 (釋放後使用和系統當機) (bnc#967973)。

- CVE-2016-2543：在 Linux 核心中，sound/core/seq/seq_clientmgr.c 的 snd_seq_ioctl_remove_events 函式未驗證 FIFO 指派，即繼續執行 FIFO 清除，進而允許本機使用者透過特製的 ioctl 呼叫造成拒絕服務 (NULL 指標解除參照和 OOPS) (bnc#967972)。

- CVE-2015-8709：** 有爭議 ** Linux 核心中的 kernel/ptrace.c 錯誤處理 uid 與 gid 對應，其允許本機使用者透過建立使用者命名空間，等待 root 處理程序以不安全的 uid 或 gid 進入該命名空間，然後使用 ptrace 系統呼叫，進而取得權限。注意：供應商表示「此處無核心錯誤」(bnc#959709 960561)。

- CVE-2015-8812：在 Linux 核心中，drivers/infiniband/hw/cxgb3/iwch_cm.c 未正確識別錯誤情形，進而允許遠端攻擊者透過特製的封包，執行任意程式碼或造成拒絕服務 (釋放後使用) (bnc#966437)。

- CVE-2016-2384：在 Linux 核心中，sound/usb/midi.c 之 snd_usbmidi_create 函式中的重複釋放弱點允許實際位置靠近的攻擊者透過涉及無效 USB 描述符號的向量，造成拒絕服務 (錯誤) 或可能造成其他不明影響 (bnc#966693)。

- CVE-2015-8785：在 Linux 核心中，fs/fuse/file.c 的 fuse_fill_write_pages 函式允許本機使用者透過 writev 系統呼叫，觸發 iov 第一個區段零長度，進而造成拒絕服務 (無限迴圈) (bnc#963765)。

- CVE-2014-9904：在 Linux 核心的 ALSA 子系統中，sound/core/compress_offload.c 中的 snd_compress_check_input 函式未正確檢查整數溢位，其允許本機使用者造成拒絕服務 (不充分的記憶體配置)，或可能透過特製的 SNDRV_COMPRESS_SET_PARAMS ioctl 呼叫造成其他不明影響 (bnc#986811)。

- CVE-2016-5829：在 Linux 核心中，drivers/hid/usbhid/hiddev.c 的 hiddev_ioctl_usage 函式有多個堆積型緩衝區溢位，其允許本機使用者透過特製的 (1) HIDIOCGUSAGES 或 (2) HIDIOCSUSAGES ioctl 呼叫，造成拒絕服務或其他不明影響 (bnc#986572 986573)。

- CVE-2016-4997：在 Linux 核心的 netfilter 子系統中，相容的 IPT_SO_SET_REPLACE setsockopt 實作允許本機使用者利用容器內的 root 存取權，提供可觸發非預定遞減的特製位移值，進而取得權限或造成拒絕服務 (記憶體損毀) (bnc#986362 986365 986377)。

- CVE-2016-4805：在 Linux 核心中，drivers/net/ppp/ppp_generic.c 中的釋放後使用弱點允許本機使用者造成拒絕服務 (記憶體損毀與系統當機，或執行緒同步鎖定)，或可能透過移除網路命名空間造成其他不明影響，這與 ppp_register_net_channel 和 ppp_unregister_channel 函式相關 (bnc#980371)。

- CVE-2016-4470：在 Linux 核心中，security/keys/key.c 的 key_reject_and_link 函式未確保特定資料結構經過初始化，其允許本機使用者透過涉及特製 keyctl request2 命令的向量，造成拒絕服務 (系統當機) (bnc#984755 984764)。

- CVE-2015-6526：在 ppc64 平台上的 Linux 核心中，arch/powerpc/perf/callchain.c 的 perf_callchain_user_64 函式允許本機使用者透過深度 64 位元使用者空間反向追蹤，進而造成拒絕服務 (無限迴圈) (bnc#942702)。

- CVE-2016-5244：在 Linux 核心中，net/rds/recv.c 內的 rds_inc_info_copy 函式並未初始化特定結構成員，進而允許遠端攻擊者讀取 RDS 訊息，從核心堆疊記憶體取得敏感資訊 (bnc#983213)。

下列非安全性錯誤已修正：

- ALSA：hrtimer：更正確地處理 start/stop (bsc#973378)。

- ALSA：pcm：修正 OSS 模擬中可能發生的鎖死 (bsc#968018)。

- ALSA：rawmidi：修正複製及更新位置時的爭用情形 (bsc#968018)。

- ALSA：rawmidi：使 snd_rawmidi_transmit() 無爭用情形 (bsc#968018)。

- ALSA：seq：修正雙重連接埠清單刪除 (bsc#968018)。

- ALSA：seq：修正 snd_seq_oss_synth_cleanup() 的不正確功能健全檢查 (bsc#968018)。

- ALSA：seq：修正並行寫入時的集區緩衝區洩漏 (bsc#968018)。

- ALSA：seq：修正因雙重 mutex 鎖定而產生的 lockdep 警告 (bsc#968018)。

- ALSA：seq：修正在 virmidi 驅動程式中關閉時的爭用情形 (bsc#968018)。

- ALSA：seq：修正 ALSA 計時器存取間的其他爭用情形 (bsc#968018)。

- ALSA：timer：在相同執行緒同步鎖定中呼叫通知程式 (bsc#973378)。

- ALSA：timer：程式碼清理 (bsc#968018)。

- ALSA：timer：修正關閉時尚未解決的連結 (bsc#968018)。

- ALSA：timer：修正因雙重啟動或停止導致的連結損毀 (bsc#968018)。

- ALSA：timer：修正停止和中斷間的爭用 (bsc#968018)。

- ALSA：timer：修正傳遞至從屬回呼的錯誤執行個體 (bsc#968018)。

- ALSA：timer：保護具有開啟爭用的整個 snd_timer_close() (bsc#973378)。

- ALSA：timer：在關閉系統計時器時同步計時器刪除 (bsc#973378)。

- ALSA：timer：使用 mod_timer() 加強系統計時器 (bsc#973378)。

- 藍牙：vhci：修正建立 hci 裝置時的爭用情形 (bsc#971799、bsc#966849)。

- 藍牙：vhci：修正 open_timeout 與 hdev 的爭用 (bsc#971799、bsc#966849)。

- 藍牙：vhci：清除未處理的 skbs (bsc#971799、bsc#966849)。

- Btrfs：不要針對 printk 使用 src fd (bsc#980348)。

- 重新整理 patches.drivers/ALSA-hrtimer-Handle-start-stop-more-prop erly。修正 32 位元架構上的構建錯誤。

- 重新整理 patches.xen/xen-netback-coalesce：還原對標題超出頁面大小之 SKB 的複製 (bsc#978469)。

- 重新整理 patches.xen/xen3-patch-3.14：在 /proc/xen/xenbus 隱藏不可部分完成的檔案位置更新 (bsc#970275)。

- Subject：[修補程式] USB：xhci：新增適用於 Frescologic 裝置 id 1009 的損毀資料流 quirk (bnc#982706)。

- USB：usbip：修正潛在的超出邊界寫入問題 (bnc#975945)。

- af_unix：防止 unix_dgram_sendmsg 中的 other == sk (bsc#973570)。

- backends：保證對共用環內容的一次性讀取 (bsc#957988)。

- btrfs：不使現有的 qgroup 項目執行唯讀 (bsc#957052)。

- btrfs：從搜尋 ioctl 移除不存在之樹狀結構的錯誤訊息。

- drm/i915：修正面板停用時遺漏的背光更新 (bsc#941113 boo#901754)。

- enic：設定 netdev->vlan_features (bsc#966245)。

- ext4：修正緩衝的 IO 和摺疊 / 插入範圍之間的爭用 (bsc#972174)。

- ext4：修正頁面錯誤和打洞之間的爭用 (bsc#972174)。

- ext4：修正打洞和零範圍之回寫的爭用問題 (bsc#972174)。

- ext4：移動 ext4_alloc_file_blocks() 中未鎖定的 dio 保護 (bsc#972174)。

- ipv4/fib：若 in_dev 無作用，不要在主要位址遺漏時發出警告 (bsc#971360)。

- ipvs：將預先建立的 TCP 狀態計算為已啟用 (bsc#970114)。

- net：core：更正過度緊迫的裝置迴圈偵測 (bsc#945219)。

- netback：不要使用最後的要求來決定最低 Tx 認可 (bsc#957988)。

- pciback：針對 PCI_COMMAND_MEMORY 檢查 PF 而非 VF。

- pciback：儲存 MSI-X 項目數以供稍後複製之用。

- pciback：保證共用的 ring 內容僅供一次性讀取 (bsc#957988)。

- series.conf：將 cxgb3 修補程式移至網路驅動程式區段

- usb：quirk 以停止 Intel 7260 的運行時間 PM (bnc#984464)。

- x86：標準化 mmap_rnd() 的使用 (bnc#974308)。

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017)

  - The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service     (stack consumption and system crash) via a crafted application that leverages the mishandling of invalid     Register Stack Engine (RSE) state. (CVE-2006-3635)

  - drivers/media/video/videobuf-vmalloc.c in the Linux kernel before 2.6.24 does not initialize     videobuf_mapping data structures, which allows local users to trigger an incorrect count value and     videobuf leak via unspecified vectors, a different vulnerability than CVE-2010-5321. (CVE-2007-6761)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: Buffer overflow due to unbounded strcpy in ISDN I4L driver (CVE-2017-12762)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group     ID of zero from reaching the swapper process, which allows local users to cause a denial of service     (system crash) by leveraging access to this process group. (CVE-2010-5328)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2965-1 advisory.

  - The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux     kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer     dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.
    (CVE-2016-2184)

  - The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2185)

  - The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2186)

  - The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2188)

  - The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted USB device without two interrupt-in endpoint descriptors. (CVE-2016-3136)

  - drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and     cypress_open functions. (CVE-2016-3137)

  - The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB     device without both a control and a data endpoint descriptor. (CVE-2016-3138)

  - The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device descriptor. (CVE-2016-3140)

  - The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which     allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large     number of IP addresses. (CVE-2016-3156)

  - The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-     switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial     of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.
    (CVE-2016-3157)

  - The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not     properly randomize the legacy base address, which makes it easier for local users to defeat the intended     restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or     setgid program, by disabling stack-consumption resource limits. (CVE-2016-3672)

  - The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (system crash) via a USB device without     both a master and a slave interface. (CVE-2016-3689)

  - Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact     by inserting a USB device with an invalid USB descriptor. (CVE-2016-3951)

  - The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows     remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other     impact via a crafted length value in a USB/IP packet. (CVE-2016-3955)

  - The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does     not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial     of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.
    (CVE-2016-4557)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2970-1 advisory.

  - The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted USB device that lacks endpoints. (CVE-2015-7515)

  - Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local     users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE:
    this vulnerability exists because of a CVE-2012-6701 regression. (CVE-2015-8830)

  - The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1     before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it     easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an     uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.
    (CVE-2016-0821)

  - The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux     kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer     dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.
    (CVE-2016-2184)

  - The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2185)

  - The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2186)

  - The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2188)

  - The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted USB device without two interrupt-in endpoint descriptors. (CVE-2016-3136)

  - drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and     cypress_open functions. (CVE-2016-3137)

  - The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB     device without both a control and a data endpoint descriptor. (CVE-2016-3138)

  - The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device descriptor. (CVE-2016-3140)

  - The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which     allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large     number of IP addresses. (CVE-2016-3156)

  - The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-     switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial     of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.
    (CVE-2016-3157)

  - The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (system crash) via a USB device without     both a master and a slave interface. (CVE-2016-3689)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2015-7515, CVE-2016-2184, CVE-2016-2185,     CVE-2016-2186, CVE-2016-2187, CVE-2016-3136,     CVE-2016-3137, CVE-2016-3138, CVE-2016-3140     Ralf Spenneberg of OpenSource Security reported that     various USB drivers do not sufficiently validate USB     descriptors. This allowed a physically present user with     a specially designed USB device to cause a denial of     service (crash).

  - CVE-2016-0821     Solar Designer noted that the list 'poisoning' feature,     intended to mitigate the effects of bugs in list     manipulation in the kernel, used poison values within     the range of virtual addresses that can be allocated by     user processes.

  - CVE-2016-1237     David Sinquin discovered that nfsd does not check     permissions when setting ACLs, allowing users to grant     themselves permissions to a file by setting the ACL.

  - CVE-2016-1583     Jann Horn of Google Project Zero reported that the     eCryptfs filesystem could be used together with the proc     filesystem to cause a kernel stack overflow. If the     ecryptfs-utils package is installed, local users could     exploit this, via the mount.ecryptfs_private program,     for denial of service (crash) or possibly for privilege     escalation.

  - CVE-2016-2117     Justin Yackoski of Cryptonite discovered that the     Atheros L2 ethernet driver incorrectly enables     scatter/gather I/O. A remote attacker could take     advantage of this flaw to obtain potentially sensitive     information from kernel memory.

  - CVE-2016-2143     Marcin Koscielnicki discovered that the fork     implementation in the Linux kernel on s390 platforms     mishandles the case of four page-table levels, which     allows local users to cause a denial of service (system     crash).

  - CVE-2016-3070     Jan Stancek of Red Hat discovered a local denial of     service vulnerability in AIO handling.

  - CVE-2016-3134     The Google Project Zero team found that the netfilter     subsystem does not sufficiently validate filter table     entries. A user with the CAP_NET_ADMIN capability could     use this for denial of service (crash) or possibly for     privilege escalation. Debian disables unprivileged user     namespaces by default, if locally enabled with the     kernel.unprivileged_userns_clone sysctl, this allows     privilege escalation.

  - CVE-2016-3156     Solar Designer discovered that the IPv4 implementation     in the Linux kernel did not perform the destruction of     inet device objects properly. An attacker in a guest OS     could use this to cause a denial of service (networking     outage) in the host OS.

  - CVE-2016-3157 / XSA-171     Andy Lutomirski discovered that the x86_64 (amd64) task     switching implementation did not correctly update the     I/O permission level when running as a Xen paravirtual     (PV) guest. In some configurations this would allow     local users to cause a denial of service (crash) or to     escalate their privileges within the guest.

  - CVE-2016-3672     Hector Marco and Ismael Ripoll noted that it was     possible to disable Address Space Layout Randomisation     (ASLR) for x86_32 (i386) programs by removing the stack     resource limit. This made it easier for local users to     exploit security flaws in programs that have the setuid     or setgid flag set.

  - CVE-2016-3951     It was discovered that the cdc_ncm driver would free     memory prematurely if certain errors occurred during its     initialisation. This allowed a physically present user     with a specially designed USB device to cause a denial     of service (crash) or possibly to escalate their     privileges.

  - CVE-2016-3955     Ignat Korchagin reported that the usbip subsystem did     not check the length of data received for a USB buffer.
    This allowed denial of service (crash) or privilege     escalation on a system configured as a usbip client, by     the usbip server or by an attacker able to impersonate     it over the network. A system configured as a usbip     server might be similarly vulnerable to physically     present users.

  - CVE-2016-3961 / XSA-174     Vitaly Kuznetsov of Red Hat discovered that Linux     allowed the use of hugetlbfs on x86 (i386 and amd64)     systems even when running as a Xen paravirtualised (PV)     guest, although Xen does not support huge pages. This     allowed users with access to /dev/hugepages to cause a     denial of service (crash) in the guest.

  - CVE-2016-4470     David Howells of Red Hat discovered that a local user     can trigger a flaw in the Linux kernel's handling of key     lookups in the keychain subsystem, leading to a denial     of service (crash) or possibly to privilege escalation.

  - CVE-2016-4482, CVE-2016-4485, CVE-2016-4486,     CVE-2016-4569, CVE-2016-4578, CVE-2016-4580,     CVE-2016-5243, CVE-2016-5244

    Kangjie Lu reported that the USB devio, llc, rtnetlink,     ALSA timer, x25, tipc, and rds facilities leaked     information from the kernel stack.

  - CVE-2016-4565     Jann Horn of Google Project Zero reported that various     components in the InfiniBand stack implemented unusual     semantics for the write() operation. On a system with     InfiniBand drivers loaded, local users could use this     for denial of service or privilege escalation.

  - CVE-2016-4581     Tycho Andersen discovered that in some situations the     Linux kernel did not handle propagated mounts correctly.
    A local user can take advantage of this flaw to cause a     denial of service (system crash).

  - CVE-2016-4805     Baozeng Ding discovered a use-after-free in the generic     PPP layer in the Linux kernel. A local user can take     advantage of this flaw to cause a denial of service     (system crash), or potentially escalate their     privileges.

  - CVE-2016-4913     Al Viro found that the ISO9660 filesystem implementation     did not correctly count the length of certain invalid     name entries. Reading a directory containing such name     entries would leak information from kernel memory. Users     permitted to mount disks or disk images could use this     to obtain sensitive information.

  - CVE-2016-4997 / CVE-2016-4998     Jesse Hertz and Tim Newsham discovered that missing     input sanitising in Netfilter socket handling may result     in denial of service. Debian disables unprivileged user     namespaces by default, if locally enabled with the     kernel.unprivileged_userns_clone sysctl, this also     allows privilege escalation.

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.59 to receive various security and bugfixes.

Main feature additions :

  - Improved support for Clustered File System (CephFS,     fate#318586).

  - Addition of kGraft patches now produces logging messages     to simplify auditing (fate#317827).

The following security bugs were fixed :

  - CVE-2016-1583: Prevent the usage of mmap when the lower     file system does not allow it. This could have lead to     local privilege escalation when ecryptfs-utils was     installed and /sbin/mount.ecryptfs_private was setuid     (bsc#983143).

  - CVE-2014-9717: fs/namespace.c in the Linux kernel     processes MNT_DETACH umount2 system calls without     verifying that the MNT_LOCKED flag is unset, which     allowed local users to bypass intended access     restrictions and navigate to filesystem locations     beneath a mount by calling umount2 within a user     namespace (bnc#928547).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bsc#970948).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126 971793).

  - CVE-2016-3136: The mct_u232_msr_to_state function in     drivers/usb/serial/mct_u232.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted USB device without two interrupt-in     endpoint descriptors (bnc#970955).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911 970970).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-3689: The ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) via a USB device without both a     master and a slave interface (bnc#971628).

  - CVE-2016-3951: Double free vulnerability in     drivers/net/usb/cdc_ncm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact by inserting a USB device with an invalid     USB descriptor (bnc#974418).

  - CVE-2016-4482: Fixed information leak in devio     (bnc#978401).

  - CVE-2016-4486: Fixed information leak in rtnetlink (     bsc#978822).

  - CVE-2016-4569: Fixed information leak in events via     snd_timer_user_tinterrupt (bsc#979213).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
93104	openSUSE 安全性更新：Linux 核心 (openSUSE-2016-1015)	Nessus	SuSE Local Security Checks	8/25/2016	1/19/2021	critical
199257	RHEL 5 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/4/2024	critical
199273	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/14/2024	critical
91082	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-2965-1)	Nessus	Ubuntu Local Security Checks	5/12/2016	1/9/2024	critical
91091	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2970-1)	Nessus	Ubuntu Local Security Checks	5/12/2016	1/9/2024	high
91886	Debian DSA-3607-1 : linux - security update	Nessus	Debian Local Security Checks	6/29/2016	1/11/2021	critical
93168	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1696-1)	Nessus	SuSE Local Security Checks	8/29/2016	1/6/2021	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

critical

high