Use-after-free vulnerability in a certain Red Hat patch for the RPC server sockets functionality in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 might allow remote attackers to cause a denial of service (crash) via malformed data in a packet, related to lockd and the svc_xprt_received function.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-105:03 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2011-0714     No information available at the time of writing, please refer to the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0329 advisory.

    [2.6.32-71.18.2.el6]
    - [fs] sunrpc: Correct a misapplied patch (J. Bruce Fields) [678094 678146]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0329 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issue:

    * A use-after-free flaw was found in the Linux kernel's RPC server sockets     implementation. A remote attacker could use this flaw to trigger a denial     of service by sending a corrupted packet to a target system.
    (CVE-2011-0714, Important)

    Red Hat would like to thank Adam Prince for reporting this issue.

    Users should upgrade to these updated packages, which contain a backported     patch to correct this issue. The system must be rebooted for this update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
284339	MiracleLinux 4 : kernel-2.6.32-71.18.2.el6 (AXSA:2011-105:03)	Nessus	Miracle Linux Local Security Checks	high
68222	Oracle Linux 6 : kernel (ELSA-2011-0329)	Nessus	Oracle Linux Local Security Checks	high
52596	RHEL 6 : kernel (RHSA-2011:0329)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-0714

high

Tenable Plugins

high

high

high