The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0010 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A malicious CIFS (Common Internet File System) server could send a     specially-crafted response to a directory read request that would result in     a denial of service or privilege escalation on a system that has a CIFS     share mounted. (CVE-2011-3191, Important)

    * The way fragmented IPv6 UDP datagrams over the bridge with UDP     Fragmentation Offload (UFO) functionality on were handled could allow a     remote attacker to cause a denial of service. (CVE-2011-4326, Important)

    * GRO (Generic Receive Offload) fields could be left in an inconsistent     state. An attacker on the local network could use this flaw to cause a     denial of service. GRO is enabled by default in all network drivers that     support it. (CVE-2011-2723, Moderate)

    * IPv4 and IPv6 protocol sequence number and fragment ID generation could     allow a man-in-the-middle attacker to inject packets and possibly hijack     connections. Protocol sequence numbers and fragment IDs are now more     random. (CVE-2011-3188, Moderate)

    * A flaw in the FUSE (Filesystem in Userspace) implementation could allow     a local user in the fuse group who has access to mount a FUSE file system     to cause a denial of service. (CVE-2011-3353, Moderate)

    * A flaw in the b43 driver. If a system had an active wireless interface     that uses the b43 driver, an attacker able to send a specially-crafted     frame to that interface could cause a denial of service. (CVE-2011-3359,     Moderate)

    * A flaw in the way CIFS shares with DFS referrals at their root were     handled could allow an attacker on the local network, who is able to deploy     a malicious CIFS server, to create a CIFS network share that, when mounted,     would cause the client system to crash. (CVE-2011-3363, Moderate)

    * A flaw in the m_stop() implementation could allow a local, unprivileged     user to trigger a denial of service. (CVE-2011-3637, Moderate)

    * Flaws in ghash_update() and ghash_final() could allow a local,     unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)

    * A flaw in the key management facility could allow a local, unprivileged     user to cause a denial of service via the keyctl utility. (CVE-2011-4110,     Moderate)

    * A flaw in the Journaling Block Device (JBD) could allow a local attacker     to crash the system by mounting a specially-crafted ext3 or ext4 disk.
    (CVE-2011-4132, Moderate)

    * A flaw in the way memory containing security-related data was handled in     tpm_read() could allow a local, unprivileged user to read the results of a     previously run TPM command. (CVE-2011-1162, Low)

    * I/O statistics from the taskstats subsystem could be read without any     restrictions, which could allow a local, unprivileged user to gather     confidential information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

    * Flaws in tpacket_rcv() and packet_recvmsg() could allow a local,     unprivileged user to leak information to user-space. (CVE-2011-2898, Low)

    Red Hat would like to thank Darren Lavender for reporting CVE-2011-3191;
    Brent Meshier for reporting CVE-2011-2723; Dan Kaminsky for reporting     CVE-2011-3188; Yogesh Sharma for reporting CVE-2011-3363; Nick Bowler for     reporting CVE-2011-4081; Peter Huewe for reporting CVE-2011-1162; and     Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

    This update also fixes the following bugs:

    * Previously, a mismatch in the build-id of the kernel-rt and the one in     the related debuginfo package caused failures in SystemTap and perf.
    (BZ#768413)

    * IBM x3650m3 systems were not able to boot the MRG Realtime kernel because     they require a pmcraid driver that was not available. The pmcraid driver is     included in this update. (BZ#753992)

    Users should upgrade to these updated packages, which correct these issues.
    The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. (CVE-2011-2699 , Important)

A signedness issue was found in the Linux kernel's CIFS (Common Internet File System) implementation. A malicious CIFS server could send a specially crafted response to a directory read request that would result in a denial of service or privilege escalation on a system that has a CIFS share mounted. (CVE-2011-3191 , Important)

A flaw was found in the way the Linux kernel handled fragmented IPv6 UDP datagrams over the bridge with UDP Fragmentation Offload (UFO) functionality on. A remote attacker could use this flaw to cause a denial of service. (CVE-2011-4326 , Important)

The way IPv4 and IPv6 protocol sequence numbers and fragment IDs were generated could allow a man-in-the-middle attacker to inject packets and possibly hijack connections. Protocol sequence numbers and fragment IDs are now more random. (CVE-2011-3188 , Moderate)

A buffer overflow flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) implementation. A local user in the fuse group who has access to mount a FUSE file system could use this flaw to cause a denial of service. (CVE-2011-3353 , Moderate)

A flaw was found in the b43 driver in the Linux kernel. If a system had an active wireless interface that uses the b43 driver, an attacker able to send a specially crafted frame to that interface could cause a denial of service. (CVE-2011-3359 , Moderate)

A flaw was found in the way CIFS shares with DFS referrals at their root were handled. An attacker on the local network who is able to deploy a malicious CIFS server could create a CIFS network share that, when mounted, would cause the client system to crash. (CVE-2011-3363 , Moderate)

A flaw was found in the way the Linux kernel handled VLAN 0 frames with the priority tag set. When using certain network drivers, an attacker on the local network could use this flaw to cause a denial of service. (CVE-2011-3593 , Moderate)

A flaw in the way memory containing security-related data was handled in tpm_read() could allow a local, unprivileged user to read the results of a previously run TPM command. (CVE-2011-1162 , Low)

A heap overflow flaw was found in the Linux kernel's EFI GUID Partition Table (GPT) implementation. A local attacker could use this flaw to cause a denial of service by mounting a disk that contains specially crafted partition tables. (CVE-2011-1577 , Low)

The I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process. (CVE-2011-2494 , Low)

It was found that the perf tool, a part of the Linux kernel's Performance Events implementation, could load its configuration file from the current working directory. If a local user with access to the perf tool were tricked into running perf in a directory that contains a specially crafted configuration file, it could cause perf to overwrite arbitrary files and directories accessible to that user.
(CVE-2011-2905 , Low)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2033 advisory.

    - ipv6: make fragment identifications less predictable (Joe Jin) {CVE-2011-2699}
    - vlan: fix panic when handling priority tagged frames (Joe Jin) {CVE-2011-3593}
    - ipv6: udp: fix the wrong headroom check (Maxim Uvarov) {CVE-2011-4326}
    - b43: allocate receive buffers big enough for max frame len + offset (Maxim Uvarov) {CVE-2011-3359}
    - fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (Maxim Uvarov) {CVE-2011-3353}
    - cifs: fix possible memory corruption in CIFSFindNext (Maxim Uvarov) {CVE-2011-3191}
    - crypto: md5 - Add export support (Maxim Uvarov) {CVE-2011-2699}
    - fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops (Maxim Uvarov)     {CVE-2011-1577}
    - net: Compute protocol sequence numbers and fragment IDs using MD5. (Maxim Uvarov) {CVE-2011-3188}
    - crypto: Move md5_transform to lib/md5.c (Maxim Uvarov) {CVE-2011-3188}
    - perf tools: do not look at ./config for configuration (Maxim Uvarov) {CVE-2011-2905}
    - Make TASKSTATS require root access (Maxim Uvarov) {CVE-2011-2494}
    - TPM: Zero buffer after copying to userspace (Maxim Uvarov) {CVE-2011-1162}
    - TPM: Call tpm_transmit with correct size (Maxim Uvarov){CVE-2011-1161}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1479 advisory.

    - [fs] cifs: always do is_path_accessible check in cifs_mount (Jeff Layton) [738299 738300]     {CVE-2011-3363}
    - [fs] cifs: add fallback in is_path_accessible for old servers (Jeff Layton) [738299 738300]     {CVE-2011-3363}
    - [char] tpm: Zero buffer after copying to userspace (Jiri Benc) [732630 732631] {CVE-2011-1162}
    - [fs] hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops (Phillip Lougher) [712775 712776]     {CVE-2011-2203}
    - [misc] kernel: plug taskstats io infoleak (Jerome Marchand) [716845 716846] {CVE-2011-2494}
    - [xen] passthrough: block VT-d MSI trap injection (Paolo Bonzini) [716301 716302] {CVE-2011-1898}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1465 advisory.

    - [net] vlan: fix panic when handling priority tagged frames (Andy Gospodarek) [742849 714936]     {CVE-2011-3593}
    - [kernel] fix taskstats io infoleak (Jerome Marchand) [716847 716848] {CVE-2011-2494}
    - [tpm] Zero buffer after copying to userspace (Jiri Benc) [732632 732633] {CVE-2011-1162}
    - [fs] cifs: add fallback in is_path_accessible for old servers (Jeff Layton) [738301 692709]     {CVE-2011-3363}
    - [fs] cifs: always do is_path_accessible check in cifs_mount (Jeff Layton) [738301 692709]     {CVE-2011-3363}
    - [net] ipv6: make fragment identifications less predictable (Jiri Pirko) [723432 723433] {CVE-2011-2699}
    - [netdrv] b43: allocate receive buffers big enough for max frame len + offset (RuiRui Yang) [738204     738205] {CVE-2011-3359}
    - [fs] fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (RuiRui Yang) [736764 736765] {CVE-2011-3353}
    - [fs] cifs: fix possible memory corruption in CIFSFindNext (Jeff Layton) [737482 730354] {CVE-2011-3191}
    - [kernel] perf tools: do not look at ./config for configuration (Jiri Benc) [730203 730204]     {CVE-2011-2905}
    - [fs] corrupted GUID partition tables can cause kernel oops (Jerome Marchand) [695981 695982]     {CVE-2011-1577}
    - [net] Compute protocol sequence numbers and fragment IDs using MD5. (Jiri Pirko) [732664 732665]     {CVE-2011-3188}
    - [crypto] Move md5_transform to lib/md5.c (Jiri Pirko) [732664 732665] {CVE-2011-3188}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Using PCI passthrough without interrupt remapping support allowed Xen hypervisor guests to generate MSI interrupts and thus potentially inject traps. A privileged guest user could use this flaw to crash the host or possibly escalate their privileges on the host. The fix for this issue can prevent PCI passthrough working and guests starting.
Refer to Red Hat Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

* A flaw was found in the way CIFS (Common Internet File System) shares with DFS referrals at their root were handled. An attacker on the local network who is able to deploy a malicious CIFS server could create a CIFS network share that, when mounted, would cause the client system to crash. (CVE-2011-3363, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's key management facility handled user-defined key types. A local, unprivileged user could use the keyctl utility to cause a denial of service. (CVE-2011-4110, Moderate)

* A flaw in the way memory containing security-related data was handled in tpm_read() could allow a local, unprivileged user to read the results of a previously run TPM command. (CVE-2011-1162, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's HFS file system implementation. A local attacker could use this flaw to cause a denial of service by mounting a disk that contains a specially crafted HFS file system with a corrupted MDB extent record.
(CVE-2011-2203, Low)

* The I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process. (CVE-2011-2494, Low)

Red Hat would like to thank Yogesh Sharma for reporting CVE-2011-3363;
Peter Huewe for reporting CVE-2011-1162; Clement Lecigne for reporting CVE-2011-2203; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - Using PCI passthrough without interrupt remapping     support allowed Xen hypervisor guests to generate MSI     interrupts and thus potentially inject traps. A     privileged guest user could use this flaw to crash the     host or possibly escalate their privileges on the host.
    The fix for this issue can prevent PCI passthrough     working and guests starting.(CVE-2011-1898, Important)

  - A flaw was found in the way CIFS (Common Internet File     System) shares with DFS referrals at their root were     handled. An attacker on the local network who is able to     deploy a malicious CIFS server could create a CIFS     network share that, when mounted, would cause the client     system to crash. (CVE-2011-3363, Moderate)

  - A NULL pointer dereference flaw was found in the way the     Linux kernel's key management facility handled     user-defined key types. A local, unprivileged user could     use the keyctl utility to cause a denial of service.
    (CVE-2011-4110, Moderate)

  - A flaw in the way memory containing security-related     data was handled in tpm_read() could allow a local,     unprivileged user to read the results of a previously     run TPM command. (CVE-2011-1162, Low)

  - A NULL pointer dereference flaw was found in the Linux     kernel's HFS file system implementation. A local     attacker could use this flaw to cause a denial of     service by mounting a disk that contains a specially     crafted HFS file system with a corrupted MDB extent     record. (CVE-2011-2203, Low)

  - The I/O statistics from the taskstats subsystem could be     read without any restrictions. A local, unprivileged     user could use this flaw to gather confidential     information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

This update also fixes several bugs and adds one enhancement.

The system must be rebooted for this update to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - IPv6 fragment identification value generation could     allow a remote attacker to disrupt a target system's     networking, preventing legitimate users from accessing     its services. (CVE-2011-2699, Important)

  - A signedness issue was found in the Linux kernel's CIFS     (Common Internet File System) implementation. A     malicious CIFS server could send a specially crafted     response to a directory read request that would result     in a denial of service or privilege escalation on a     system that has a CIFS share mounted. (CVE-2011-3191,     Important)

  - A flaw was found in the way the Linux kernel handled     fragmented IPv6 UDP datagrams over the bridge with UDP     Fragmentation Offload (UFO) functionality on. A remote     attacker could use this flaw to cause a denial of     service. (CVE-2011-4326, Important)

  - The way IPv4 and IPv6 protocol sequence numbers and     fragment IDs were generated could allow a     man-in-the-middle attacker to inject packets and     possibly hijack connections. Protocol sequence numbers     and fragment IDs are now more random. (CVE-2011-3188,     Moderate)

  - A buffer overflow flaw was found in the Linux kernel's     FUSE (Filesystem in Userspace) implementation. A local     user in the fuse group who has access to mount a FUSE     file system could use this flaw to cause a denial of     service. (CVE-2011-3353, Moderate)

  - A flaw was found in the b43 driver in the Linux kernel.
    If a system had an active wireless interface that uses     the b43 driver, an attacker able to send a specially     crafted frame to that interface could cause a denial of     service. (CVE-2011-3359, Moderate)

  - A flaw was found in the way CIFS shares with DFS     referrals at their root were handled. An attacker on the     local network who is able to deploy a malicious CIFS     server could create a CIFS network share that, when     mounted, would cause the client system to crash.
    (CVE-2011-3363, Moderate)

  - A flaw was found in the way the Linux kernel handled     VLAN 0 frames with the priority tag set. When using     certain network drivers, an attacker on the local     network could use this flaw to cause a denial of     service. (CVE-2011-3593, Moderate)

  - A flaw in the way memory containing security-related     data was handled in tpm_read() could allow a local,     unprivileged user to read the results of a previously     run TPM command. (CVE-2011-1162, Low)

  - A heap overflow flaw was found in the Linux kernel's EFI     GUID Partition Table (GPT) implementation. A local     attacker could use this flaw to cause a denial of     service by mounting a disk that contains specially     crafted partition tables. (CVE-2011-1577, Low)

  - The I/O statistics from the taskstats subsystem could be     read without any restrictions. A local, unprivileged     user could use this flaw to gather confidential     information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

  - It was found that the perf tool, a part of the Linux     kernel's Performance Events implementation, could load     its configuration file from the current working     directory. If a local user with access to the perf tool     were tricked into running perf in a directory that     contains a specially crafted configuration file, it     could cause perf to overwrite arbitrary files and     directories accessible to that user. (CVE-2011-2905,     Low)

This update also fixes various bugs.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. (CVE-2011-3353)

A flaw was found in the b43 driver in the Linux kernel. An attacker could use this flaw to cause a denial of service if the system has an active wireless interface using the b43 driver. (CVE-2011-3359)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in the b43 driver in the Linux kernel. An attacker could use this flaw to cause a denial of service if the system has an active wireless interface using the b43 driver. (CVE-2011-3359)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. (CVE-2011-3353)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330).

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494)

Qianfeng Zhang discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-2942)

Yasuaki Ishimatsu discovered a flaw in the kernel's clock implementation. A local unprivileged attacker could exploit this causing a denial of service. (CVE-2011-3209)

Zheng Liu discovered a flaw in how the ext4 filesystem splits extents.
A local unprivileged attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-3638)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-4087)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1479 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * Using PCI passthrough without interrupt remapping support allowed Xen     hypervisor guests to generate MSI interrupts and thus potentially inject     traps. A privileged guest user could use this flaw to crash the host or     possibly escalate their privileges on the host. The fix for this issue can     prevent PCI passthrough working and guests starting. Refer to Red Hat     Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

    * A flaw was found in the way CIFS (Common Internet File System) shares     with DFS referrals at their root were handled. An attacker on the local     network who is able to deploy a malicious CIFS server could create a CIFS     network share that, when mounted, would cause the client system to crash.
    (CVE-2011-3363, Moderate)

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     key management facility handled user-defined key types. A local,     unprivileged user could use the keyctl utility to cause a denial of     service. (CVE-2011-4110, Moderate)

    * A flaw in the way memory containing security-related data was handled in     tpm_read() could allow a local, unprivileged user to read the results of a     previously run TPM command. (CVE-2011-1162, Low)

    * A NULL pointer dereference flaw was found in the Linux kernel's HFS file     system implementation. A local attacker could use this flaw to cause a     denial of service by mounting a disk that contains a specially-crafted HFS     file system with a corrupted MDB extent record. (CVE-2011-2203, Low)

    * The I/O statistics from the taskstats subsystem could be read without     any restrictions. A local, unprivileged user could use this flaw to gather     confidential information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

    Red Hat would like to thank Yogesh Sharma for reporting CVE-2011-3363;
    Peter Huewe for reporting CVE-2011-1162; Clement Lecigne for reporting     CVE-2011-2203; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

    This update also fixes several bugs and adds one enhancement. Documentation     for these changes will be available shortly from the Technical Notes     document linked to in the References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues, and fix the bugs and add the enhancement     noted in the Technical Notes. The system must be rebooted for this update     to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

and CVE-2011-4110 Fix CVE-2011-4326 and CVE-2011-4132

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1465 advisory.

  - kernel: tpm: infoleak (CVE-2011-1162)

  - kernel: corrupted GUID partition tables can cause kernel oops (CVE-2011-1577)

  - kernel: taskstats io infoleak (CVE-2011-2494)

  - kernel: ipv6: make fragment identifications less predictable (CVE-2011-2699)

  - kernel: perf tools: may parse user-controlled configuration file (CVE-2011-2905)

  - kernel: net: improve sequence number generation (CVE-2011-3188)

  - kernel: cifs: signedness issue in CIFSFindNext() (CVE-2011-3191)

  - kernel: fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (CVE-2011-3353)

  - kernel: b43: allocate receive buffers big enough for max frame len + offset (CVE-2011-3359)

  - kernel: cifs: always do is_path_accessible check in cifs_mount (CVE-2011-3363)

  - kernel: vlan: fix panic when handling priority tagged frames (CVE-2011-3593)

  - kernel: wrong headroom check in udp6_ufo_fragment() (CVE-2011-4326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494)

Mathieu Desnoyers discovered that the kernel sockets implementation incorrectly dereferenced user pointers. A local attacker could possibly exploit this to crash the system. (CVE-2011-4594).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security update for various issues.
----------------------------------------------------------------------
-----=

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Small number of obvious fixes from bugzilla.
----------------------------------------------------------------------
-----=

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
76635	RHEL 6 : kernel-rt (RHSA-2012:0010)	Nessus	Red Hat Local Security Checks	critical
69585	Amazon Linux AMI : kernel (ALAS-2011-26)	Nessus	Amazon Linux Local Security Checks	critical
68424	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2033)	Nessus	Oracle Linux Local Security Checks	critical
68394	Oracle Linux 5 : kernel (ELSA-2011-1479)	Nessus	Oracle Linux Local Security Checks	medium
68393	Oracle Linux 6 : kernel (ELSA-2011-1465)	Nessus	Oracle Linux Local Security Checks	critical
67086	CentOS 5 : kernel (CESA-2011:1479)	Nessus	CentOS Local Security Checks	high
61181	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
61179	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
57688	Ubuntu 11.04 : linux vulnerabilities (USN-1345-1)	Nessus	Ubuntu Local Security Checks	low
57665	Ubuntu 10.10 : linux vulnerabilities (USN-1341-1)	Nessus	Ubuntu Local Security Checks	high
57661	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1337-1)	Nessus	Ubuntu Local Security Checks	low
57535	Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1332-1)	Nessus	Ubuntu Local Security Checks	high
57497	USN-1325-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	medium
57495	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1323-1)	Nessus	Ubuntu Local Security Checks	medium
57448	USN-1319-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	medium
57447	USN-1318-1 : linux-fsl-imx51 vulnerabilities	Nessus	Ubuntu Local Security Checks	low
57342	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1311-1)	Nessus	Ubuntu Local Security Checks	high
57304	Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1303-1)	Nessus	Ubuntu Local Security Checks	high
57300	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1299-1)	Nessus	Ubuntu Local Security Checks	high
57058	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1294-1)	Nessus	Ubuntu Local Security Checks	high
56974	RHEL 5 : kernel (RHSA-2011:1479)	Nessus	Red Hat Local Security Checks	medium
56967	Fedora 14 : kernel-2.6.35.14-106.fc14 (2011-16346)	Nessus	Fedora Local Security Checks	high
56927	RHEL 6 : kernel (RHSA-2011:1465)	Nessus	Red Hat Local Security Checks	critical
56917	Ubuntu 11.10 : linux vulnerability (USN-1275-1)	Nessus	Ubuntu Local Security Checks	medium
56721	Fedora 14 : kernel-2.6.35.14-103.fc14 (2011-15241)	Nessus	Fedora Local Security Checks	medium
56673	Fedora 14 : kernel-2.6.35.14-100.fc14 (2011-14747)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1162

medium

Tenable Plugins

high

critical

critical

critical

medium

critical

high

high

critical

low

high

low

high

medium

medium

medium

low

high

high

high

high

medium

high

critical

medium

medium

medium