The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU already exists.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix bug number for commit 'cciss: Update HPSA_BOUNDARY'     (Joe Jin) [Orabug: 14681166]

  - cciss: Update HPSA_BOUNDARY. (Joe Jin) [Orabug:
    14319765]

  - KVM: introduce kvm_for_each_memslot macro (Maxim Uvarov)     [Bugdb: 13966]

  - dl2k: Clean up rio_ioctl (Jeff Mahoney) [Orabug:
    14126896] (CVE-2012-2313)

  - NFSv4: include bitmap in nfsv4 get acl data (Andy     Adamson) (CVE-2011-4131)

  - KVM: Fix buffer overflow in kvm_set_irq (Avi Kivity)     [Bugdb: 13966] (CVE-2012-2137)

  - net: sock: validate data_len before allocating skb in     sock_alloc_send_pskb (Jason Wang) [Bugdb: 13966]     (CVE-2012-2136)

  - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs     pmd_populate SMP race condition (Andrea Arcangeli)     [Bugdb: 13966] (CVE-2012-2373)

  - KVM: lock slots_lock around device assignment (Alex     Williamson) [Bugdb: 13966] (CVE-2012-2121)

  - KVM: unmap pages from the iommu when slots are removed     (Maxim Uvarov) [Bugdb: 13966] (CVE-2012-2121)

  - fcaps: clear the same personality flags as suid when     fcaps are used (Eric Paris) [Bugdb: 13966]     (CVE-2012-2123)

  - tilegx: enable SYSCALL_WRAPPERS support (Chris Metcalf)     (CVE-2009-0029)

  - drm/i915: fix integer overflow in i915_gem_do_execbuffer     (Xi Wang) [Orabug: 14107456] (CVE-2012-2384)

  - drm/i915: fix integer overflow in i915_gem_execbuffer2     (Xi Wang) [Orabug: 14107445] (CVE-2012-2383)

  - [dm] do not forward ioctls from logical volumes to the     underlying device (Joe Jin) (CVE-2011-4127)

  - [block] fail SCSI passthrough ioctls on partition     devices (Joe Jin) (CVE-2011-4127)

  - [block] add and use scsi_blk_cmd_ioctl (Joe Jin)     [Orabug: 14056755] (CVE-2011-4127)

  - KVM: Ensure all vcpus are consistent with in-kernel     irqchip settings (Avi Kivity) [Bugdb: 13871]     (CVE-2012-1601)

  - regset: Return -EFAULT, not -EIO, on host-side memory     fault (H. Peter Anvin) (CVE-2012-1097)

  - regset: Prevent null pointer reference on readonly     regsets (H. Peter Anvin) (CVE-2012-1097)

  - cifs: fix dentry refcount leak when opening a FIFO on     lookup (Jeff Layton) (CVE-2012-1090)

  - mm: thp: fix pmd_bad triggering in code paths holding     mmap_sem read mode (Andrea Arcangeli) (CVE-2012-1179)

  - ext4: fix undefined behavior in ext4_fill_flex_info (Xi     Wang) (CVE-2009-4307)

  - ocfs2: clear unaligned io flag when dio fails (Junxiao     Bi) [Orabug: 14063941]

  - aio: make kiocb->private NUll in init_sync_kiocb     (Junxiao Bi) [Orabug: 14063941]

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices (Carolyn Wyborny) [Orabug: 14258706]

  - igb: Alternate MAC Address Updates for Func2&3 (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - igb: Alternate MAC Address EEPROM Updates (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - cciss: only enable cciss_allow_hpsa when for ol5 (Joe     Jin) [Orabug: 14106006]

  - Revert 'cciss: remove controllers supported by hpsa'     (Joe Jin) [Orabug: 14106006]

  - [scsi] hpsa: add all support devices for ol5 (Joe Jin)     [Orabug: 14106006]

  - Disable VLAN 0 tagging for none VLAN traffic (Adnan     Misherfi) [Orabug: 14406424]

  - x86: Add Xen kexec control code size check to linker     script (Daniel Kiper)

  - drivers/xen: Export vmcoreinfo through sysfs (Daniel     Kiper)

  - x86/xen/enlighten: Add init and crash kexec/kdump hooks     (Maxim Uvarov)

  - x86/xen: Add kexec/kdump makefile rules (Daniel Kiper)

  - x86/xen: Add x86_64 kexec/kdump implementation (Daniel     Kiper)

  - x86/xen: Add placeholder for i386 kexec/kdump     implementation (Daniel Kiper)

  - x86/xen: Register resources required by kexec-tools     (Daniel Kiper)

  - x86/xen: Introduce architecture dependent data for     kexec/kdump (Daniel Kiper)

  - xen: Introduce architecture independent data for     kexec/kdump (Daniel Kiper)

  - x86/kexec: Add extra pointers to transition page table     PGD, PUD, PMD and PTE (Daniel Kiper)

  - kexec: introduce kexec_ops struct (Daniel Kiper)

  - SPEC: replace DEFAULTKERNEL from kernel-ovs to     kernel-uek

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2013 advisory.

  - The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not     properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial     of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a     journal. (CVE-2011-4086)

  - The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service     (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU     already exists. (CVE-2012-1601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2012:0676 :

Updated kvm packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Red Hat Enterprise Linux kernel.

A flaw was found in the way the KVM_CREATE_IRQCHIP ioctl was handled.
Calling this ioctl when at least one virtual CPU (VCPU) already existed could lead to a NULL pointer dereference later when the VCPU is scheduled to run. A malicious user in the kvm group on the host could use this flaw to crash the host. (CVE-2012-1601)

A flaw was found in the way device memory was handled during guest device removal. Upon successful device removal, memory used by the device was not properly unmapped from the corresponding IOMMU or properly released from the kernel, leading to a memory leak. A malicious user in the kvm group on the host who has the ability to assign a device to a guest could use this flaw to crash the host.
(CVE-2012-2121)

This update also fixes the following bug :

* An off-by-one error in the QEMU guest's memory management could, in rare cases, cause QEMU-KVM to crash due to a segmentation fault in tb_invalidate_phys_page_range() if a device initiated DMA into a specific guest address. In a reported case, this issue presented on a system that had a guest using the 8139cp network driver. (BZ#816207)

All users of kvm are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Note that the procedure in the Solution section must be performed before this update will take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0571 advisory.

  - The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not     properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial     of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a     journal. (CVE-2011-4086)

  - The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service     (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU     already exists. (CVE-2012-1601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP2 kernel has been updated to 3.0.51 which fixes various bugs and security issues.

It contains the following feature enhancements :

  - The cachefiles framework is now supported (FATE#312793,     bnc#782369). The userland utilities were published     seperately to support this feature.

  - The ipset netfilter modules are now supported     (FATE#313309) The ipset userland utility will be     published seperately to support this feature.

  - The tipc kernel module is now externally supported     (FATE#305033).

  - Hyper-V KVP IP injection was implemented (FATE#314441).
    A seperate hyper-v package will be published to support     this feature.

  - Intel Lynx Point PCH chipset support was added.
    (FATE#313409)

  - Enable various md/raid10 and DASD enhancements.
    (FATE#311379) These make it possible for RAID10 to cope     with DASD devices being slow for various reasons - the     affected device will be temporarily removed from the     array.

    Also added support for reshaping of RAID10 arrays.

    mdadm changes will be published to support this feature.

The following security issues have been fixed :

  - A race condition on hot adding memory could be used by     local attackers to crash the system during hot adding     new memory. (CVE-2012-5517)

  - A flaw has been found in the way Linux kernels KVM     subsystem handled vcpu->arch.cr4 X86_CR4_OSXSAVE bit set     upon guest enter. On hosts without the XSAVE feature and     using qemu userspace an unprivileged local user could     have used this flaw to crash the system. (CVE-2012-4461)

  - The KVM implementation in the Linux kernel allowed host     OS users to cause a denial of service (NULL pointer     dereference and host OS crash) by making a     KVM_CREATE_IRQCHIP ioctl call after a virtual CPU     already exists. (CVE-2012-1601)

  - Attempting an rds connection from the IP address of an     IPoIB interface to itself causes a kernel panic due to a     BUG_ON() being triggered. Making the test less strict     allows rds-ping to work without crashing the machine. A     local unprivileged user could use this flaw to crash the     sytem. (CVE-2012-2372)

  - Dimitry Monakhov, one of the ext4 developers, has     discovered a race involving asynchronous I/O and     fallocate which can lead to the exposure of stale data
    --- that is, an extent which should have had the     'uninitialized' bit set indicating that its blocks have     not yet been written and thus contain data from a     deleted file will get exposed to anyone with read access     to the file. (CVE-2012-4508)

  - The rds_recvmsg function in net/rds/recv.c in the Linux     kernel did not initialize a certain structure member,     which allows local users to obtain potentially sensitive     information from kernel stack memory via a (1) recvfrom     or (2) recvmsg system call on an RDS socket.
    (CVE-2012-3430)

  - The sfc (aka Solarflare Solarstorm) driver in the Linux     kernel allowed remote attackers to cause a denial of     service (DMA descriptor consumption and     network-controller outage) via crafted TCP packets that     trigger a small MSS value. (CVE-2012-3412)

The following non-security issues have been fixed :

BTRFS :

  - btrfs: fix double mntput() in mount_subvol().

  - btrfs: use common work instead of delayed work

  - btrfs: limit fallocate extent reservation to 256MB

  - btrfs: fix a double free on pending snapshots in error     handling

  - btrfs: Do not trust the superblock label and simply     printk('%s') it

  - patches.suse/btrfs-update-message-levels.patch: Refresh.

  - patches.suse/btrfs-enospc-debugging-messages.patch:
    Minor updates.

  - patches.suse/btrfs-update-message-levels.patch: Minor     updates.

  - btrfs: continue after abort during snapshot drop.
    (bnc#752067)

  - btrfs: Return EINVAL when length to trim is less than     FSB.

  - btrfs: fix unnecessary while loop when search the free     space, cache.

  - btrfs: Use btrfs_update_inode_fallback when creating a     snapshot.

  - btrfs: do not bug when we fail to commit the     transaction.

  - btrfs: fill the global reserve when unpinning space.

  - btrfs: do not allow degraded mount if too many devices     are missing.

  -     patches.suse/btrfs-8112-resume-balance-on-rw-re-mounts-p     roperly.patch: fix mismerge.

  - btrfs: do not allocate chunks as agressively.

  - btrfs: btrfs_drop_extent_cache should never fail.

  - btrfs: fix full backref problem when inserting shared     block reference.

  - btrfs: wait on async pages when shrinking delalloc.

  - btrfs: remove bytes argument from do_chunk_alloc.

  - btrfs: cleanup of error processing in     btree_get_extent().

  - btrfs: remove unnecessary code in btree_get_extent().

  - btrfs: kill obsolete arguments in     btrfs_wait_ordered_extents.

  - btrfs: do not do anything in our ->freeze_fs and
    ->unfreeze_fs.

  - btrfs: do not async metadata csumming in certain     situations.

  - btrfs: do not hold the file extent leaf locked when     adding extent item.

  - btrfs: cache extent state when writing out dirty     metadata pages.

  - btrfs: do not lookup csums for prealloc extents.

  - btrfs: be smarter about dropping things from the tree     log.

  - btrfs: confirmation of value is added before     trace_btrfs_get_extent() is called.

  - btrfs: make filesystem read-only when submitting barrier     fails.

  - btrfs: cleanup pages properly when ENOMEM in     compression.

  - btrfs: do not bug on enomem in readpage.

  - btrfs: do not warn_on when we cannot alloc a page for an     extent buffer.

  - btrfs: enospc debugging messages. S/390 :

  - smsgiucv: reestablish IUCV path after resume     (bnc#786976,LTC#86245).

  - dasd: move wake_up call (bnc#786976,LTC#86252).

  - kernel: fix get_user_pages_fast() page table walk     (bnc#786976,LTC#86307).

  - qeth: Fix IPA_CMD_QIPASSIST return code handling     (bnc#785851,LTC#86101).

  - mm: Fix XFS oops due to dirty pages without buffers on     s390. (bnc#762259)

  - zfcp: only access zfcp_scsi_dev for valid scsi_device     (bnc#781484,LTC#85285).

  - dasd: check count address during online setting     (bnc#781484,LTC#85346).

  - hugetlbfs: fix deadlock in unmap_hugepage_range()     (bnc#781484,LTC#85449).

  - kernel: make user-access pagetable walk code huge page     aware (bnc#781484,LTC#85455).

  - hugetlbfs: add missing TLB invalidation     (bnc#781484,LTC#85463).

  - zfcp: fix adapter (re)open recovery while link to SAN is     down (bnc#789010,LTC#86283).

  - qeth: set new mac even if old mac is gone     (bnc#789010,LTC#86643).

  - qdio: fix kernel panic for zfcp 31-bit     (bnc#789010,LTC#86623).

  - crypto: msgType50 (RSA-CRT) Fix (bnc#789010,LTC#86378).
    DRM :

  - drm/915: Update references, fixed a missing patch chunk.
    (bnc#725355)

  - drm/dp: Document DP spec versions for various DPCD     registers. (bnc#780461)

  - drm/dp: Make sink count DP 1.2 aware. (bnc#780461)

  - DRM/i915: Restore sdvo_flags after dtd->mode->dtd     Roundrtrip. (bnc#775577)

  - DRM/i915: Do not clone SDVO LVDS with analog.
    (bnc#766410)

  - DRM/radeon: For single CRTC GPUs move handling of     CRTC_CRT_ON to crtc_dpms(). (bnc#725152)

  - DRM/Radeon: Fix TV DAC Load Detection for single CRTC     chips. (bnc#725152)

  - DRM/Radeon: Clean up code in TV DAC load detection.
    (bnc#725152)

  - DRM/Radeon: On DVI-I use Load Detection when EDID is     bogus. (bnc#725152)

  - DRM/Radeon: Fix primary DAC Load Detection for RV100     chips. (bnc#725152)

  - DRM/Radeon: Fix Load Detection on legacy primary DAC.
    (bnc#725152)

  - drm/i915: enable plain RC6 on Sandy Bridge by default     (bnc#725355). Hyper-V :

  - Hyper-V KVP IP injection (fate#31441) :

  - drivers: net: Remove casts to same type.

  - drivers: hv: remove IRQF_SAMPLE_RANDOM which is now a     no-op.

  - hyperv: Move wait completion msg code into     rndis_filter_halt_device().

  - hyperv: Add comments for the extended buffer after RNDIS     message.

  - Drivers: hv: Cleanup the guest ID computation.

  - Drivers: hv: vmbus: Use the standard format string to     format GUIDs.

  - Drivers: hv: Add KVP definitions for IP address     injection.

  - Drivers: hv: kvp: Cleanup error handling in KVP.

  - Drivers: hv: kvp: Support the new IP injection messages.

  - Tools: hv: Prepare to expand kvp_get_ip_address()     functionality.

  - Tools: hv: Further refactor kvp_get_ip_address().

  - Tools: hv: Gather address family information.

  - Tools: hv: Gather subnet information.

  - Tools: hv: Represent the ipv6 mask using CIDR notation.

  - Tools: hv: Gather ipv[4,6] gateway information.

  - hv: fail the probing immediately when we are not in     hyperv platform.

  - hv: vmbus_drv: detect hyperv through x86_hyper.

  - Tools: hv: Get rid of some unused variables.

  - Tools: hv: Correctly type string variables.

  - Tools: hv: Add an example script to retrieve DNS     entries.

  - Tools: hv: Gather DNS information.

  - Drivers: hv: kvp: Copy the address family information.

  - Tools: hv: Add an example script to retrieve dhcp state.

  - Tools: hv: Gather DHCP information.

  - Tools: hv: Add an example script to configure an     interface.

  - Tools: hv: Implement the KVP verb - KVP_OP_SET_IP_INFO.

  - Tools: hv: Rename the function kvp_get_ip_address().

  - Tools: hv: Implement the KVP verb - KVP_OP_GET_IP_INFO.

  - tools/hv: Fix file handle leak.

  - tools/hv: Fix exit() error code.

  - tools/hv: Check for read/write errors.

  - tools/hv: Parse /etc/os-release.

  - hyperv: Fix the max_xfer_size in RNDIS initialization.

  - hyperv: Fix the missing return value in     rndis_filter_set_packet_filter().

  - hyperv: Fix page buffer handling in     rndis_filter_send_request().

  - hyperv: Remove extra allocated space for recv_pkt_list     elements.

  - hyperv: Report actual status in receive completion     packet.

  - hyperv: Add buffer for extended info after the RNDIS     response message. Other :

  - net: prevent NULL dereference in check_peer_redir().
    (bnc#776044 / bnc#784576)

  -     patches.fixes/mm-hotplug-correctly-add-zone-to-other-nod     es-list.patch: Refresh.

  - igb: fix recent VLAN changes that would leave VLANs     disabled after reset. (bnc#787168)

  - md: Change goto target to avoid pointless bug messages     in normal error cases. (bnc#787848)

  - intel_idle: IVB support (fate#313719).

  - x86 cpufreq: Do not complain on missing cpufreq tables     on ProLiants. (bnc#787202)

  - hpilo: remove pci_disable_device. (bnc#752544)

  - ixgbe: Address fact that RSC was not setting GSO size     for incoming frames. (bnc#776144)

  - hv: Cleanup error handling in vmbus_open().

  - [SCSI] storvsc: Account for in-transit packets in the     RESET path.

  - sg: remove sg_mutex. (bnc#785496)

  - perf: Do no try to schedule task events if there are     none. (bnc#781574)

  - perf: Do not set task_ctx pointer in cpuctx if there are     no events in the context. (bnc#781574)

  - mm: swap: Implement generic handlers for swap-related     address ops fix. (bnc#778334)

  - hpwdt: Only BYTE reads/writes to WD Timer port 0x72.

  - xenbus: fix overflow check in xenbus_dev_write().

  - xen/x86: do not corrupt %eip when returning from a     signal handler.

  - Update Xen patches to 3.0.46.

  - Update Xen patches to 3.0.51.

  - mm: Check if PTE is already allocated during page fault.

  - rpm/kernel-binary.spec.in: Revert f266e647f to allow     building with icecream again, as     patches.rpmify/kbuild-fix-gcc-x-syntax.patch is a real     fix now.

  - ipmi: decrease the IPMI message transaction time in     interrupt mode. (bnc#763654)

  - ipmi: simplify locking. (bnc#763654)

  - ipmi: use a tasklet for handling received messages.
    (bnc#763654)

  - cxgb3: Set vlan_feature on net_device (bnc#776127,     LTC#84260).

  - qlge: Add offload features to vlan interfaces     (bnc#776081,LTC#84322).

  - mlx4_en: Added missing iounmap upon releasing a device     (bnc#774964,LTC#82768).

  - mlx4: allow device removal by fixing dma unmap size     (bnc#774964,LTC#82768).

  - qeth: fix deadlock between recovery and bonding driver     (bnc#785100,LTC#85905).

  - SCSI st: add st_nowait_eof param to module. (bnc#775394)

  -     patches.fixes/sched-fix-migration-thread-accounting-woes     .patch: Update references. (bnc#773699, bnc#769251)

  - memcg: oom: fix totalpages calculation for     swappiness==0. (bnc#783965)

  - fs: cachefiles: add support for large files in     filesystem caching (FATE#312793, bnc#782369).

  - mm/mempolicy.c: use enum value MPOL_REBIND_ONCE in     mpol_rebind_policy().

  - mm, mempolicy: fix mbind() to do synchronous migration.

  - revert 'mm: mempolicy: Let vma_merge and vma_split     handle vma->vm_policy linkages'.

  - mempolicy: fix a race in shared_policy_replace().

  - mempolicy: fix refcount leak in     mpol_set_shared_policy().

  - mempolicy: fix a memory corruption by refcount imbalance     in alloc_pages_vma().

  - mempolicy: remove mempolicy sharing. Memory policy     enhancements for robustness against fuzz attacks and     force mbind to use synchronous migration.

  - Update scsi_dh_alua to mainline version (bnc#708296,     bnc#784334) :

  - scsi_dh_alua: Enable STPG for unavailable ports

  - scsi_dh_alua: Re-enable STPG for unavailable ports

  - scsi_dh_alua: backoff alua rtpg retry linearly vs.
    geometrically

  - scsi_dh_alua: implement implied transition timeout

  - scsi_dh_alua: retry alua rtpg extended header for     illegal request response

  - Revert removal of ACPI procfs entries. (bnc#777283)

  - x86: Clear HPET configuration registers on startup.
    (bnc#748896)

  - mlx4: Fixed build warning, update references     (bnc#774500,LTC#83966).

  - xen/frontends: handle backend CLOSED without CLOSING.

  - xen/pciback: properly clean up after calling     pcistub_device_find().

  - xen/netfront: add netconsole support (bnc#763858     fate#313830).

  - netfilter: nf_conntrack_ipv6: fix tracking of ICMPv6     error messages containing fragments. (bnc#779750)

  - ipv6, xfrm: use conntrack-reassembled packet for policy     lookup. (bnc#780216)

  - inetpeer: add namespace support for inetpeer.
    (bnc#779969)

  - inetpeer: add parameter net for inet_getpeer_v4,v6.
    (bnc#779969)

  - inetpeer: make unused_peers list per-netns. (bnc#779969)

  - kABI: use net_generic to protect struct netns_ipv{4,6}.
    (bnc#779969)

  - patches.rpmify/kbuild-fix-gcc-x-syntax.patch: kbuild:
    Fix gcc -x syntax. (bnc#773831)

  - patches.suse/supported-flag: Re-enabled warning on     unsupported module loading.

  - nbd: clear waiting_queue on shutdown. (bnc#778630)

  - nohz: fix idle ticks in cpu summary line of /proc/stat     (follow up fix for bnc#767469, bnc#705551).

  - fix TAINT_NO_SUPPORT handling on module load.

  - NFS: Fix Oopses in nfs_lookup_revalidate and     nfs4_lookup_revalidate. (bnc#780008)

  - svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping     (bnc@779462).

  - net: do not disable sg for packets requiring no     checksum. (bnc#774859)

  - sfc: prevent extreme TSO parameters from stalling TX     queues. (bnc#774523 / CVE-2012-3412)

  - X86 MCE: Fix correct ring/severity identification in V86     case. (bnc#773267)

  - scsi_dh_rdac: Add a new netapp vendor/product string.
    (bnc#772483)

  - scsi_dh_rdac : Consolidate rdac strings together.
    (bnc#772483)

  - scsi_dh_rdac : minor return fix for rdac. (bnc#772483)

  - dh_rdac: Associate HBA and storage in rdac_controller to     support partitions in storage. (bnc#772454)

  - scsi_dh_rdac: Fix error path. (bnc#772454)

  - scsi_dh_rdac: Fix for unbalanced reference count.
    (bnc#772454)

  - sd: Ensure we correctly disable devices with unknown     protection type. (bnc#780876)

  - netfilter: ipset: timeout can be modified for already     added elements. (bnc#790457)

  - netfilter: ipset: fix adding ranges to hash types.
    (bnc#790498)

  - workqueue: exit rescuer_thread() as TASK_RUNNING.
    (bnc#789993)

  - xhci: Add Lynx Point LP to list of Intel switchable     hosts. (bnc#791853)

  - tg3: Introduce separate functions to allocate/free RX/TX     rings. (bnc#785554)

  - net-next: Add netif_get_num_default_rss_queues.
    (bnc#785554)

  - tg3: set maximal number of default RSS queues.
    (bnc#785554)

  - tg3: Allow number of rx and tx rings to be set     independently. (bnc#785554)

  - tg3: Separate coalescing setup for rx and tx.
    (bnc#785554)

  - tg3: Refactor tg3_open(). (bnc#785554)

  - tg3: Refactor tg3_close(). (bnc#785554)

  - tg3: Add support for ethtool -L|-l to get/set the number     of rings. (bnc#785554)

  - tg3: Disable multiple TX rings by default due to     hardware flaw. (bnc#785554)

  - x86, microcode, AMD: Add support for family 16h     processors (bnc#791498,fate#314145).

  - scsi_remove_target: fix softlockup regression on hot     remove. (bnc#789836)

  - autofs4: allow autofs to work outside the initial PID     namespace. (bnc#779294)

  - autofs4: translate pids to the right namespace for the     daemon. (bnc#779294)

  - vfs: dont chain pipe/anon/socket on superblock s_inodes     list. (bnc#789703)

  - reiserfs: fix problems with chowning setuid file w/     xattrs. (bnc#790920)

  - reiserfs: fix double-lock while chowning setuid file w/     xattrs. (bnc#790920)

  - ALSA: hda - Fix SSYNC register value for non-Intel     controllers (fate#313409,bnc#760833).

  - ALSA: hda: option to enable arbitrary buffer/period     sizes (fate#313409,bnc#760833).

  - ALSA: hda - Fix buffer-alignment regression with Nvidia     HDMI (fate#313409,bnc#760833).

  - ALSA: hda - explicitly set buffer-align flag for Nvidia     controllers (fate#313409,bnc#760833).

  - ALSA: hda - Add Lynx Point HD Audio Controller DeviceIDs     (fate#313409,bnc#760833).

  - ALSA: hda_intel: Add Device IDs for Intel Lynx Point-LP     PCH (fate#313409,bnc#760833).

  - USB: OHCI: workaround for hardware bug: retired TDs not     added to the Done Queue. (bnc#762158)

  - watchdog: iTCO_wdt: clean-up PCI device IDs     (fate#313409, bnc#760833).

  - watchdog: iTCO_wdt: add Intel Lynx Point DeviceIDs     (fate#313409, bnc#760833).

  - ahci: AHCI-mode SATA patch for Intel Lynx Point     DeviceIDs (fate#313409, bnc#760833).

  - ata_piix: IDE-mode SATA patch for Intel Lynx Point     DeviceIDs (fate#313409, bnc#760833).

  - i2c-i801: Add device IDs for Intel Lynx Point     (fate#313409, bnc#760833).

  - jbd: Fix lock ordering bug in journal_unmap_buffer().
    (bnc#790935)

  - usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP     Hardware. (bnc#788277)

  - usb: host: xhci: Fix NULL pointer dereferencing with     71c731a for non-x86 systems. (bnc#788277)

  - Do not remove fillup from the buildsystem. (bnc#781327)

  - ibmvfc: Fix double completion on abort timeout.
    (bnc#788452)

  - ibmvfc: Ignore fabric RSCNs when link is dead.
    (bnc#788452)

  - fs: only send IPI to invalidate LRU BH when needed.
    (bnc#763628 / bnc#744692)

  - smp: add func to IPI cpus based on parameter func.
    (bnc#763628 / bnc#744692)

  - smp: introduce a generic on_each_cpu_mask() function.
    (bnc#763628 / bnc#744692)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0676 advisory.

  - kernel: kvm: irqchip_in_kernel() and vcpu->arch.apic inconsistency (CVE-2012-1601)

  - kvm: device assignment page leak (CVE-2012-2121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Scientific Linux kernel.

A flaw was found in the way the KVM_CREATE_IRQCHIP ioctl was handled.
Calling this ioctl when at least one virtual CPU (VCPU) already existed could lead to a NULL pointer dereference later when the VCPU is scheduled to run. A malicious user in the kvm group on the host could use this flaw to crash the host. (CVE-2012-1601)

A flaw was found in the way device memory was handled during guest device removal. Upon successful device removal, memory used by the device was not properly unmapped from the corresponding IOMMU or properly released from the kernel, leading to a memory leak. A malicious user in the kvm group on the host who has the ability to assign a device to a guest could use this flaw to crash the host.
(CVE-2012-2121)

This update also fixes the following bug :

  - An off-by-one error in the QEMU guest's memory     management could, in rare cases, cause QEMU-KVM to crash     due to a segmentation fault in     tb_invalidate_phys_page_range() if a device initiated     DMA into a specific guest address. In a reported case,     this issue presented on a system that had a guest using     the 8139cp network driver.

All users of kvm are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Note that the procedure in the Solution section must be performed before this update will take effect.

This update fixes the following security issues :

  - A flaw was found in the way the Linux kernel's     journal_unmap_buffer() function handled buffer head     states. On systems that have an ext4 file system with a     journal mounted, a local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2011-4086,     Moderate)

  - A flaw was found in the way the KVM_CREATE_IRQCHIP ioctl     was handled. Calling this ioctl when at least one     virtual CPU (VCPU) already existed could lead to a NULL     pointer dereference later when the VCPU is scheduled to     run. A local, unprivileged user on a KVM host could use     this flaw to crash the host. (CVE-2012-1601, Moderate)

The system must be rebooted for this update to take effect.

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

An error was found in the Linux kernel's IPv6 netfilter when connection tracking is enabled. A remote attacker could exploit this flaw to crash a system if it is using IPv6 with the nf_contrack_ipv6 kernel module loaded. (CVE-2012-2744).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andy Adamson discovered a flaw in the Linux kernel's NFSv4 implementation. A remote NFS server (attacker) could exploit this flaw to cause a denial of service. (CVE-2011-4131)

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

A flaw was discovered in the Linux kernel's KVM (kernel virtual machine). An administrative user in the guest OS could leverage this flaw to cause a denial of service in the host OS. (CVE-2012-2121)

Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. (CVE-2012-2123)

Schacher Raindel discovered a flaw in the Linux kernel's memory handling when hugetlb is enabled. An unprivileged local attacker could exploit this flaw to cause a denial of service and potentially gain higher privileges. (CVE-2012-2133).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. (CVE-2012-2123)

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. (CVE-2012-2123)

A flaw was found in how the Linux kernel passed the replacement session keyring to a child process. An unprivileged local user could exploit this flaw to cause a denial of service (panic).
(CVE-2012-2745).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-4086)

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. (CVE-2012-2123).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kvm packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Red Hat Enterprise Linux kernel.

A flaw was found in the way the KVM_CREATE_IRQCHIP ioctl was handled.
Calling this ioctl when at least one virtual CPU (VCPU) already existed could lead to a NULL pointer dereference later when the VCPU is scheduled to run. A malicious user in the kvm group on the host could use this flaw to crash the host. (CVE-2012-1601)

A flaw was found in the way device memory was handled during guest device removal. Upon successful device removal, memory used by the device was not properly unmapped from the corresponding IOMMU or properly released from the kernel, leading to a memory leak. A malicious user in the kvm group on the host who has the ability to assign a device to a guest could use this flaw to crash the host.
(CVE-2012-2121)

This update also fixes the following bug :

* An off-by-one error in the QEMU guest's memory management could, in rare cases, cause QEMU-KVM to crash due to a segmentation fault in tb_invalidate_phys_page_range() if a device initiated DMA into a specific guest address. In a reported case, this issue presented on a system that had a guest using the 8139cp network driver. (BZ#816207)

All users of kvm are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Note that the procedure in the Solution section must be performed before this update will take effect.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way the Linux kernel's journal_unmap_buffer() function handled buffer head states. On systems that have an ext4 file system with a journal mounted, a local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2011-4086, Moderate)

* A flaw was found in the way the KVM_CREATE_IRQCHIP ioctl was handled. Calling this ioctl when at least one virtual CPU (VCPU) already existed could lead to a NULL pointer dereference later when the VCPU is scheduled to run. A local, unprivileged user on a KVM host could use this flaw to crash the host. (CVE-2012-1601, Moderate)

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0571 advisory.

  - kernel: jbd2: unmapped buffer with _Unwritten or _Delay flags set can lead to DoS (CVE-2011-4086)

  - kernel: kvm: irqchip_in_kernel() and vcpu->arch.apic inconsistency (CVE-2012-1601)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-4086     Eric Sandeen reported an issue in the journaling layer     for ext4 filesystems (jbd2). Local users can cause     buffers to be accessed after they have been torn down,     resulting in a denial of service (DoS) due to a system     crash.

  - CVE-2012-0879     Louis Rilling reported two reference counting issues in     the CLONE_IO feature of the kernel. Local users can     prevent io context structures from being freed,     resulting in a denial of service.

  - CVE-2012-1601     Michael Ellerman reported an issue in the KVM subsystem.
    Local users could cause a denial of service (NULL     pointer dereference) by creating VCPUs before a call to     KVM_CREATE_IRQCHIP.

  - CVE-2012-2123     Steve Grubb reported an issue in fcaps, a     filesystem-based capabilities system. Personality flags     set using this mechanism, such as the disabling of     address space randomization, may persist across suid     calls.

  - CVE-2012-2133     Shachar Raindel discovered a use-after-free bug in the     hugepages quota implementation. Local users with     permission to use hugepages via the hugetlbfs     implementation may be able to cause a denial of service     (system crash).

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-0571.

ID	Name	Product	Family	Severity
83611	SUSE SLES11 Security Update : kernel (SUSE-SU-2014:0287-1)	Nessus	SuSE Local Security Checks	high
79484	OracleVM 3.1 : kernel-uek (OVMSA-2012-0042)	Nessus	OracleVM Local Security Checks	high
68673	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2013)	Nessus	Oracle Linux Local Security Checks	medium
68527	Oracle Linux 5 : kvm (ELSA-2012-0676)	Nessus	Oracle Linux Local Security Checks	medium
68526	Oracle Linux 6 : kernel (ELSA-2012-0571)	Nessus	Oracle Linux Local Security Checks	medium
64180	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 7123 / 7127)	Nessus	SuSE Local Security Checks	high
64037	RHEL 5 : kvm (RHSA-2012:0676)	Nessus	Red Hat Local Security Checks	medium
61315	Scientific Linux Security Update : kvm on SL5.x x86_64 (20120521)	Nessus	Scientific Linux Local Security Checks	medium
61313	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120515)	Nessus	Scientific Linux Local Security Checks	medium
59985	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1507-1)	Nessus	Ubuntu Local Security Checks	high
59474	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1470-1)	Nessus	Ubuntu Local Security Checks	high
59324	USN-1460-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
59323	USN-1459-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
59321	Ubuntu 11.04 : linux vulnerabilities (USN-1457-1)	Nessus	Ubuntu Local Security Checks	high
59309	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1455-1)	Nessus	Ubuntu Local Security Checks	high
59291	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1453-1)	Nessus	Ubuntu Local Security Checks	high
59290	Ubuntu 11.10 : linux vulnerabilities (USN-1452-1)	Nessus	Ubuntu Local Security Checks	high
59226	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1448-1)	Nessus	Ubuntu Local Security Checks	high
59212	CentOS 5 : kvm (CESA-2012:0676)	Nessus	CentOS Local Security Checks	medium
59188	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1445-1)	Nessus	Ubuntu Local Security Checks	high
59165	CentOS 6 : kernel (CESA-2012:0571)	Nessus	CentOS Local Security Checks	medium
59106	RHEL 6 : kernel (RHSA-2012:0571)	Nessus	Red Hat Local Security Checks	medium
59070	Debian DSA-2469-1 : linux-2.6 - privilege escalation/denial of service	Nessus	Debian Local Security Checks	high
801516	CentOS RHSA-2012-0571 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-1601

medium

Tenable Plugins

high

high

medium

medium

medium

high

medium

medium

medium

high

high

high

high

high

high

high

high

high

medium

high

medium

medium

high

high