The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-282:05 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2011-0726     The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an     expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by     reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE     binary.
    CVE-2011-1093     The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint,     which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending     a DCCP-Close packet followed by a DCCP-Reset packet.
    CVE-2011-1170     net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1171     net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1172     net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1163     The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing.
    CVE-2011-1494     Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    CVE-2011-1495     drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2010-4346     The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an     expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr     restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language     application.
    CVE-2011-0521     The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2     does not check the sign of a certain integer field, which allows local users to cause a denial of service     (memory corruption) or possibly have unspecified other impact via a negative value.
    CVE-2011-0710     The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before     2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of     an arbitrary process by reading a status file under /proc/.
    CVE-2011-1010     Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2     allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a     malformed Mac OS partition table.
    CVE-2011-1090     The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL     data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a     denial of service (panic) via a crafted attempt to set an ACL.
    CVE-2010-4249     The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125     does not properly select times for garbage collection of inflight sockets, which allows local users to     cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for     SOCK_SEQPACKET sockets.
    CVE-2010-4251     The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a     backlog of received packets, which allows remote attackers to cause a denial of service (memory     consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
    CVE-2010-4655     net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which     allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the     CAP_NET_ADMIN capability for an ethtool ioctl call.
    CVE-2010-4526     Race condition in the Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of     service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes     the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function.
    CVE-2010-3296     The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5     does not properly initialize a certain structure member, which allows local users to obtain potentially     sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
    CVE-2010-3877     The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory by reading a copy of this structure.
    CVE-2010-4072     The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory via vectors related to the shmctl system call and the old shm interface.
    CVE-2010-4073     The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which     allows local users to obtain potentially sensitive information from kernel stack memory via vectors     related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in     ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in     ipc/compat_mq.c.
    CVE-2010-4075     The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel before 2.6.37-rc1 does not     properly initialize a certain structure member, which allows local users to obtain potentially sensitive     information from kernel stack memory via a TIOCGICOUNT ioctl call.
    CVE-2010-4080     The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4081     The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4158     The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether     a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM     instruction, which allows local users to obtain potentially sensitive information from kernel stack memory     via a crafted socket filter.
    CVE-2010-4238     The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is     used, allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a     virtual CD-ROM device through the blkback driver. NOTE: some of these details are obtained from third     party information.
    CVE-2010-4243     fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory     by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial     of service (memory consumption) via a crafted exec system call, aka an OOM dodging issue, a related issue     to CVE-2010-3858.
    CVE-2010-4255     The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when     paravirtualization is enabled, does not verify that kernel mode is used to call the     handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS     BUG_ON) via a crafted memory access.
    CVE-2010-4263     The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb)     subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous     mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL     pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.
    CVE-2010-4343     drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data     structure, which allows local users to cause a denial of service (system crash) via read operations on an     fc_host statistics file.
    CVE-2011-1078     CVE-2011-1079     CVE-2011-1080     CVE-2011-1166     CVE-2011-1763     CVE-2011-1478     No description available at the time of writing, please refer to the CVE links below.
    Fixed bugs:
    Too many to list here but here are some of the main ones:
    - Changed the value of debug parameter from 0 to 1 to provide kernel-debug-devel.
    - Merged patches from 2.6.18-194.11.AXS3
    - Modified all i686, x86_64 and ia64 kernel config files
    - Modified config-rhel-generic to enable ocfs2

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-143:02 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2010-3296     The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5     does not properly initialize a certain structure member, which allows local users to obtain potentially     sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
    CVE-2010-3877     The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory by reading a copy of this structure.
    CVE-2010-4072     The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory via vectors related to the shmctl system call and the 'old shm interface.'     CVE-2010-4073     The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which     allows local users to obtain potentially sensitive information from kernel stack memory via vectors     related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in     ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in     ipc/compat_mq.c.
    CVE-2010-4075     The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel before 2.6.37-rc1 does not     properly initialize a certain structure member, which allows local users to obtain potentially sensitive     information from kernel stack memory via a TIOCGICOUNT ioctl call.
    CVE-2010-4080     The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4081     The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4158     The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether     a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM     instruction, which allows local users to obtain potentially sensitive information from kernel stack memory     via a crafted socket filter.
    CVE-2010-4238     The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Asianux Server 3 is used, allows     guest OS users to cause a denial of service (host OS panic) via an attempted access to a virtual CD-ROM     device through the blkback driver. NOTE: some of these details are obtained from third party information.
    CVE-2010-4243     fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory     by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial     of service (memory consumption) via a crafted exec system call, aka an OOM dodging issue, a related issue     to CVE-2010-3858.
    CVE-2010-4255     The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when     paravirtualization is enabled, does not verify that kernel mode is used to call the     handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS     BUG_ON) via a crafted memory access.
    CVE-2010-4263     The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb)     subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous     mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL     pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.
    CVE-2010-4343     drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data     structure, which allows local users to cause a denial of service (system crash) via read operations on an     fc_host statistics file.
    CVE-2010-4526     Race condition in the Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of     service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes     the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function.
    CVE-2010-4249     The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125     does not properly select times for garbage collection of inflight sockets, which allows local users to     cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for     SOCK_SEQPACKET sockets.
    CVE-2010-4251     CVE-2010-4655     No information available at the time of writing, please refer to the CVE links below.
    Fixed bugs:
     - An off-by-one error would make gfs2_grow fail to take the very last 'rgrp' parameter into account when     adding up the new free space. This has been fixed and the GFS2 kernel properly counts all the new resource     groups and fixes the 'statfs' file correctly.
     - Previously, a multi-threaded application internally invoking popen(3) could cause a thread stall by     FILE lock corruption. The lock  corruption was due to a race condition in the Copy on Write (COW) logic.
    This has been fixed.
     - If an error occurred during I/O, the SCSI driver reset the 'megaraid_sas' controller to restore it to     normal state. However, on Asianux Server 3, the waiting time to allow a full reset completion for the     'megaraid_sas' controller was too short, causing the driver to incorrectly recognize the the controller as     stalled, and in turn the system would stall too. This has been fixed by giving more time to the controller     to restart.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0017 advisory.

    - [scsi] bfa: fix crash reading driver sysfs statistics (Rob Evers) [659880] {CVE-2010-4343}
    - [net] cxgb3: fix read of uninitialized stack memory (Jay Fenlason) [633155] {CVE-2010-3296}
    - [net] igb: only use vlan_gro_receive if vlans registered (Stefan Assmann) [660190] {CVE-2010-4263}
    - [misc] kernel: fix address limit override in OOPS path (Dave Anderson) [659571] {CVE-2010-4258}
    - [fs] exec: copy fixes into compat_do_execve paths (Oleg Nesterov) [625694] {CVE-2010-4243}
    - [fs] exec: make argv/envp memory visible to oom-killer (Oleg Nesterov) [625694] {CVE-2010-4243}
    - [misc] binfmts: kill bprm->argv_len (Oleg Nesterov) [625694] {CVE-2010-4243}
    - [net] tipc: fix information leak to userland (Jiri Pirko) [649892] {CVE-2010-3877}
    - [virt] xen: dont allow blkback virtual CDROM device (Andrew Jones) [635638] {CVE-2010-4238}
    - Revert: [xen] cd-rom drive does not recognize new media (Andrew Jones) [635638] {CVE-2010-4238}
    - [xen] fix 64-bit PV guest user mode segv crashing host (Paolo Bonzini) [658354] {CVE-2010-4255}
    - [net] filter: make sure filters dont read uninit memory (Jiri Pirko) [651703] {CVE-2010-4158}
    - [net] limit sendto/recvfrom/iovec total length to INT_MAX (Jiri Pirko) [645872] {CVE-2010-3859}
    - [ipc] shm: fix information leak to userland (Danny Feng) [648687] {CVE-2010-4072}
    - [ipc] initialize struct memory to 0 for compat functions (Danny Feng) [648693] {CVE-2010-4073}
    - [serial] serial_core: clean data before filling it (Mauro Carvalho Chehab) [648701] {CVE-2010-4075}
    - [virt] xen: add bounds req-process loop in blkback/blktap (Laszlo Ersek) [654546] {CVE-2010-4247}
    - [virt] xen: dont leak dev refs on bad xenbus transitions (Laszlo Ersek) [635999] {CVE-2010-3699}
    - [misc] futex: replace LOCK_PREFIX in futex.h (Jiri Pirko) [633176] {CVE-2010-3086}
    - [sound] rme9652: prevent reading uninitialized stack mem (Stanislaw Gruszka) [648709 648714]     {CVE-2010-4080 CVE-2010-4081}
    - [ipc] sys_semctl: fix kernel stack leakage (Danny Feng) [648722] {CVE-2010-4083}
    - [sound] core: prevent heap corruption in snd_ctl_new (Jerome Marchand) [638484] {CVE-2010-3442}
    - [media] video: remove compat code for VIDIOCSMICROCODE (Mauro Carvalho Chehab) [642471] {CVE-2010-2963}
    - [net] rds: fix local privilege escalation (Eugene Teo) [642898] {CVE-2010-3904}
    - [xen] fix guest crash on non-EPT machine may crash host (Paolo Bonzini) [621430] {CVE-2010-2938}
    - [fs] aio: check for multiplication overflow in io_submit (Jeff Moyer) [629449] {CVE-2010-3067}
    - [misc] make compat_alloc_user_space incorporate access_ok (Don Howard) [634464] {CVE-2010-3081}
    - [fs] xfs: prevent reading uninitialized stack memory (Dave Chinner) [630807] {CVE-2010-3078}
    - [fs] aio: fix cleanup in io_submit_one (Jeff Moyer) [631721] {CVE-2010-3066}
    - [mm] accept an abutting stack segment (Jiri Pirko) [607858] {CVE-2010-2240}
    - [net] sched: fix some kernel memory leaks (Jiri Pirko) [624638] {CVE-2010-2942}
    - [usb] fix usbfs information leak (Eugene Teo) [566629] {CVE-2010-1083}
    - [mm] pass correct mm when growing stack (Jiri Pirko) [607858] {CVE-2010-2240}
    - [mm] fix up some user-visible effects of stack guard page (Jiri Pirko) [607858] {CVE-2010-2240}
    - [mm] fix page table unmap for stack guard page properly (Jiri Pirko) [607858] {CVE-2010-2240}
    - [mm] fix missing unmap for stack guard page failure case (Jiri Pirko) [607858] {CVE-2010-2240}
    - [mm] keep a guard page below a grow-down stack segment (Jiri Pirko) [607858] {CVE-2010-2240}
    - [fs] ext4: consolidate in_range definitions (Eric Sandeen) [624332] {CVE-2010-3015}
    - [fs] ecryptfs: fix ecryptfs_uid_hash buffer overflow (Jerome Marchand) [611387] {CVE-2010-2492}
    - [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612171] {CVE-2010-2524}
    - [security] keys: new key flag for add_key from userspace (Jeff Layton) [612171] {CVE-2010-2524}
    - Revert: [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612171] {CVE-2010-2524}
    - Revert: [security] keys: new key flag for add_key from userspace (Jeff Layton) [612171] {CVE-2010-2524}
    - [fs] xfs: dont let swapext operate on write-only files (Jiri Pirko) [605161] {CVE-2010-2226}
    - [fs] nfs: fix bug in nfsd4 read_buf (Jiri Olsa) [612035] {CVE-2010-2521}
    - [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612171] {CVE-2010-2524}
    - [security] keys: new key flag for add_key from userspace (Jeff Layton) [612171] {CVE-2010-2524}
    - [fs] cifs: fix kernel BUG with remote OS/2 server (Jeff Layton) [608588] {CVE-2010-2248}
    - [net] bluetooth: fix possible bad memory access via sysfs (Mauro Carvalho Chehab) [576021]     {CVE-2010-1084}
    - [xen] ia64: unset be from the task psr (Andrew Jones) [587477] {CVE-2010-2070}
    - [fs] ext4: MOVE_EXT cant overwrite append-only files (Eric Sandeen) [601008] {CVE-2010-2066}
    - [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595399] {CVE-2010-1641}
    - [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585100] {CVE-2010-1437}
    - [misc] futex: handle futex value corruption gracefully (Jerome Marchand) [480396] {CVE-2010-0622}
    - [misc] futex: handle user space corruption gracefully (Jerome Marchand) [480396] {CVE-2010-0622}
    - [misc] futex: fix fault handling in futex_lock_pi (Jerome Marchand) [480396] {CVE-2010-0622}
    - [net] sctp: fix skb_over_panic w/too many unknown params (Neil Horman) [584658] {CVE-2010-1173}
    - [xen] arpl on MMIO area crashes the guest (Paolo Bonzini) [572982] {CVE-2010-0730}
    - [net] tipc: fix various oopses in uninitialized code (Neil Horman) [558693] {CVE-2010-1187}
    - [fs] vfs: fix LOOKUP_FOLLOW on automount symlinks (Jeff Layton) [567816] {CVE-2010-1088}
    - [nfs] fix an oops when truncating a file (Jeff Layton) [567195] {CVE-2010-1087}
    - [fs] fix kernel oops while copying from ext3 to gfs2 (Abhijith Das) [555754] {CVE-2010-1436}
    - [mm] keep get_unmapped_area_prot functional (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] switch do_brk to get_unmapped_area (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] take arch_mmap_check into get_unmapped_area (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] get rid of open-coding in ia64_brk (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] unify sys_mmap* functions (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] kill ancient cruft in s390 compat mmap (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] fix pgoff in have to relocate case of mremap (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] fix the arch checks in MREMAP_FIXED case (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] fix checks for expand-in-place mremap (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] add new vma_expandable helper function (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] move MREMAP_FIXED into its own header (Danny Feng) [556710] {CVE-2010-0291}
    - [mm] move locating vma code and checks on it (Danny Feng) [556710] {CVE-2010-0291}
    - [misc] kernel: fix elf load DoS on x86_64 (Danny Feng) [560553] {CVE-2010-0307}
    - [netlink] connector: delete buggy notification code (Jiri Olsa) [561685] {CVE-2010-0410}
    - [sound] hda_intel: avoid divide by zero in azx devices (Jaroslav Kysela) [567172] {CVE-2010-1085}
    - [dvb] fix endless loop when decoding ULE at dvb-core (Mauro Carvalho Chehab) [569242] {CVE-2010-1086}
    - [fs] gfs2: locking fix for potential dos (Steven Whitehouse) [572390] {CVE-2010-0727}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - Kernel
  - krb5
  - glibc
  - mtp2sas
  - mptsas
  - mptspi

a. ESX third-party update for Service Console kernel

   This update takes the console OS kernel package to    kernel-2.6.18-238.9.1 which resolves multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798,    CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015,    CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086,    CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477,    CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865,    CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904,    CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080,    CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158,    CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243,    CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251,    CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346,    CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710,    CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues.

b. ESX third-party update for Service Console krb5 RPMs

   This patch updates the krb5-libs and krb5-workstation RPMs of the    console OS to version 1.6.1-55.el5_6.1, which resolves multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282    to these issues.

c. ESXi and ESX update to third-party component glibc

   The glibc third-party library is updated to resolve multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071,    CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues.

d. ESX update to third-party drivers mptsas, mpt2sas, and mptspi

   The mptsas, mpt2sas, and mptspi drivers are updated which addresses    multiple security issues in the mpt2sas driver.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.

Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the sixth regular update.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A NULL pointer dereference flaw was found in the igb driver in the Linux kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and promiscuous mode were enabled on an interface using igb, it could result in a denial of service when a tagged VLAN packet is received on that interface. (CVE-2010-4263, Important)

* A missing sanity check was found in vbd_create() in the Xen hypervisor implementation. As CD-ROM drives are not supported by the blkback back-end driver, attempting to use a virtual CD-ROM drive with blkback could trigger a denial of service (crash) on the host system running the Xen hypervisor. (CVE-2010-4238, Moderate)

* A flaw was found in the Linux kernel execve() system call implementation. A local, unprivileged user could cause large amounts of memory to be allocated but not visible to the OOM (Out of Memory) killer, triggering a denial of service. (CVE-2010-4243, Moderate)

* A flaw was found in fixup_page_fault() in the Xen hypervisor implementation. If a 64-bit para-virtualized guest accessed a certain area of memory, it could cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-4255, Moderate)

* A missing initialization flaw was found in the bfa driver used by Brocade Fibre Channel Host Bus Adapters. A local, unprivileged user could use this flaw to cause a denial of service by reading a file in the '/sys/class/fc_host/host#/statistics/' directory. (CVE-2010-4343, Moderate)

* Missing initialization flaws in the Linux kernel could lead to information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158, Low)

Red Hat would like to thank Kosuke Tatsukawa for reporting CVE-2010-4263; Vladymyr Denysov for reporting CVE-2010-4238; Brad Spengler for reporting CVE-2010-4243; Dan Rosenberg for reporting CVE-2010-3296, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, and CVE-2010-4158; Vasiliy Kulikov for reporting CVE-2010-3877; and Kees Cook for reporting CVE-2010-4072.

These updated packages also include several hundred bug fixes for and enhancements to the Linux kernel. Space precludes documenting each of these changes in this advisory and users are directed to the Red Hat Enterprise Linux 5.6 Release Notes for information on the most significant of these changes :

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/ 5.6_Release_Notes/index.html

Refer to the kernel chapter in the Red Hat Enterprise Linux 5.6 Technical Notes for further information :

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/ 5.6_Technical_Notes/kernel.html

All Red Hat Enterprise Linux 5 users are advised to install these updated packages, which address these vulnerabilities as well as fixing the bugs and adding the enhancements noted in the Red Hat Enterprise Linux 5.6 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.

ID	Name	Product	Family	Severity
284391	MiracleLinux 3 : kernel-2.6.18-238.2.AXS3 (AXSA:2011-282:05)	Nessus	Miracle Linux Local Security Checks	medium
284189	MiracleLinux 3 : kernel-2.6.18-194.11.AXS3 (AXSA:2011-143:02)	Nessus	Miracle Linux Local Security Checks	medium
181032	Oracle Linux 5 : kernel (ELSA-2011-0017)	Nessus	Oracle Linux Local Security Checks	medium
89680	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)	Nessus	Misc.	high
56508	VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console	Nessus	VMware ESX Local Security Checks	high
51522	RHEL 5 : kernel (RHSA-2011:0017)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2010-4255

medium

Tenable Plugins

medium

medium

medium

high

high

medium