The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value). NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.

A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client. (CVE-2012-2375 , Moderate)

A divide-by-zero flaw was found in the TCP Illinois congestion control algorithm implementation in the Linux kernel. If the TCP Illinois congestion control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control variable set to 'illinois'), a local, unprivileged user could trigger this flaw and cause a denial of service. (CVE-2012-4565 , Moderate)

A NULL pointer dereference flaw was found in the way a new node's hot added memory was propagated to other nodes' zonelists. By utilizing this newly added memory from one of the remaining nodes, a local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2012-5517 , Moderate)

It was found that a prevoius kernel release did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service.
(CVE-2012-2100 , Low)

A flaw was found in the way the Linux kernel's IPv6 implementation handled overlapping, fragmented IPv6 packets. A remote attacker could potentially use this flaw to bypass protection mechanisms (such as a firewall or intrusion detection system (IDS)) when sending network packets to a target system. (CVE-2012-4444 , Low)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2048 advisory.

  - The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform     and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-     groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super     block with a large FLEX_BG group size (aka s_log_groups_per_flex value). NOTE: this vulnerability exists     because of an incomplete fix for CVE-2009-4307. (CVE-2012-2100)

  - The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote     attackers to bypass intended network restrictions via overlapping IPv6 fragments. (CVE-2012-4444)

  - The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the     net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of     service (divide-by-zero error and OOPS) by reading TCP stats. (CVE-2012-4565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1580 advisory.

  - The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform     and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-     groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super     block with a large FLEX_BG group size (aka s_log_groups_per_flex value). NOTE: this vulnerability exists     because of an incomplete fix for CVE-2009-4307. (CVE-2012-2100)

  - The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel     before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to     cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.
    NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131. (CVE-2012-2375)

  - The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote     attackers to bypass intended network restrictions via overlapping IPv6 fragments. (CVE-2012-4444)

  - The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the     net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of     service (divide-by-zero error and OOPS) by reading TCP stats. (CVE-2012-4565)

  - The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact in opportunistic circumstances by using memory that was hot-added by an administrator.
    (CVE-2012-5517)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2012:1445 :

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* It was found that the RHSA-2010:0178 update did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service.
(CVE-2012-2100, Low)

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct this issue, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

This update fixes the following security issues :

  - It was found that a previous update did not correctly     fix the CVE-2011-4131 issue. A malicious Network File     System version 4 (NFSv4) server could return a crafted     reply to a GETACL request, causing a denial of service     on the client. (CVE-2012-2375, Moderate)

  - A divide-by-zero flaw was found in the TCP Illinois     congestion control algorithm implementation in the Linux     kernel. If the TCP Illinois congestion control algorithm     were in use (the sysctl net.ipv4.tcp_congestion_control     variable set to 'illinois'), a local, unprivileged user     could trigger this flaw and cause a denial of service.
    (CVE-2012-4565, Moderate)

  - A NULL pointer dereference flaw was found in the way a     new node's hot added memory was propagated to other     nodes' zonelists. By utilizing this newly added memory     from one of the remaining nodes, a local, unprivileged     user could use this flaw to cause a denial of service.
    (CVE-2012-5517, Moderate)

  - It was found that the initial release of Scientific     Linux 6 did not correctly fix the CVE-2009-4307 issue, a     divide-by-zero flaw in the ext4 file system code. A     local, unprivileged user with the ability to mount an     ext4 file system could use this flaw to cause a denial     of service. (CVE-2012-2100, Low)

  - A flaw was found in the way the Linux kernel's IPv6     implementation handled overlapping, fragmented IPv6     packets. A remote attacker could potentially use this     flaw to bypass protection mechanisms (such as a firewall     or intrusion detection system (IDS)) when sending     network packets to a target system. (CVE-2012-4444, Low)

The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues, numerous bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* It was found that the RHSA-2012:0862 update did not correctly fix the CVE-2011-4131 issue. A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client. (CVE-2012-2375, Moderate)

* A divide-by-zero flaw was found in the TCP Illinois congestion control algorithm implementation in the Linux kernel. If the TCP Illinois congestion control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control variable set to 'illinois'), a local, unprivileged user could trigger this flaw and cause a denial of service. (CVE-2012-4565, Moderate)

* A NULL pointer dereference flaw was found in the way a new node's hot added memory was propagated to other nodes' zonelists. By utilizing this newly added memory from one of the remaining nodes, a local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-5517, Moderate)

* It was found that the initial release of Red Hat Enterprise Linux 6 did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service. (CVE-2012-2100, Low)

* A flaw was found in the way the Linux kernel's IPv6 implementation handled overlapping, fragmented IPv6 packets. A remote attacker could potentially use this flaw to bypass protection mechanisms (such as a firewall or intrusion detection system (IDS)) when sending network packets to a target system. (CVE-2012-4444, Low)

Red Hat would like to thank Antonios Atlasis working with Beyond Security's SecuriTeam Secure Disclosure program and Loganaden Velvindron of AFRINIC for reporting CVE-2012-4444. The CVE-2012-2375 issue was discovered by Jian Li of Red Hat, and CVE-2012-4565 was discovered by Rodrigo Freire of Red Hat.

This update also fixes numerous bugs and adds one enhancement. Space precludes documenting all of these changes in this advisory.
Documentation for these changes will be available shortly from the Red Hat Enterprise Linux 6.3 Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, fix these bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1580 advisory.

  - kernel: ext4: fix inconsistency in ext4_fill_flex_info() (CVE-2012-2100)

  - kernel: incomplete fix for CVE-2011-4131 (CVE-2012-2375)

  - kernel: net: acceptation of overlapping ipv6 fragments (CVE-2012-4444)

  - kernel: net: divide by zero in tcp algorithm illinois (CVE-2012-4565)

  - kernel: mm/hotplug: failure in propagating hot-added memory to other nodes (CVE-2012-5517)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

  - It was found that a previous update did not correctly     fix the CVE-2009-4307 issue, a divide-by-zero flaw in     the ext4 file system code. A local, unprivileged user     with the ability to mount an ext4 file system could use     this flaw to cause a denial of service. (CVE-2012-2100,     Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* It was found that the RHSA-2010:0178 update did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service.
(CVE-2012-2100, Low)

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct this issue, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-4086)

A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1090)

H. Peter Anvin reported a flaw in the Linux kernel that could crash the system. A local user could exploit this flaw to crash the system.
(CVE-2012-1097)

A flaw was discovered in the Linux kernel's cgroups subset. A local attacker could use this flaw to crash the system. (CVE-2012-1146)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100)

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-4086)

Sasha Levin discovered a flaw in the permission checking for device assignments requested via the kvm ioctl in the Linux kernel. A local user could use this flaw to crash the system causing a denial of service. (CVE-2011-4347)

Stephan Barwolf discovered a flaw in the KVM (kernel-based virtual machine) subsystem of the Linux kernel. A local unprivileged user can crash use this flaw to crash VMs causing a deny of service.
(CVE-2012-0045)

A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1090)

H. Peter Anvin reported a flaw in the Linux kernel that could crash the system. A local user could exploit this flaw to crash the system.
(CVE-2012-1097)

A flaw was discovered in the Linux kernel's cgroups subset. A local attacker could use this flaw to crash the system. (CVE-2012-1146)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100)

Tetsuo Handa reported a flaw in the OOM (out of memory) killer of the Linux kernel. A local unprivileged user can exploit this flaw to cause system unstability and denial of services. (CVE-2012-4398).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-4086)

A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1090)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100)

Tetsuo Handa reported a flaw in the OOM (out of memory) killer of the Linux kernel. A local unprivileged user can exploit this flaw to cause system unstability and denial of services. (CVE-2012-4398).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. (CVE-2011-4127)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. (CVE-2011-4127)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system.
(CVE-2011-4097)

Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. (CVE-2011-4127)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Andy Whitcroft discovered a that the Overlayfs filesystem was not doing the extended permission checks needed by cgroups and Linux Security Modules (LSMs). A local user could exploit this to by-pass security policy and access files that should not be accessible.
(CVE-2012-0055)

A flaw was found in the linux kernels IPv4 IGMP query processing. A remote attacker could exploit this to cause a denial of service.
(CVE-2012-0207)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-1580.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-1445.

ID	Name	Product	Family	Severity
69707	Amazon Linux AMI : kernel / nvidia (ALAS-2013-148)	Nessus	Amazon Linux Local Security Checks	high
68690	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2048)	Nessus	Oracle Linux Local Security Checks	high
68666	Oracle Linux 6 : kernel (ELSA-2012-1580)	Nessus	Oracle Linux Local Security Checks	high
68654	Oracle Linux 5 : kernel (ELSA-2012-1445)	Nessus	Oracle Linux Local Security Checks	high
68653	Oracle Linux 5 : kernel (ELSA-2012-1445-1)	Nessus	Oracle Linux Local Security Checks	high
63313	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20121218)	Nessus	Scientific Linux Local Security Checks	high
63305	CentOS 6 : kernel (CESA-2012:1580)	Nessus	CentOS Local Security Checks	high
63292	RHEL 6 : kernel (RHSA-2012:1580)	Nessus	Red Hat Local Security Checks	medium
62924	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20121113)	Nessus	Scientific Linux Local Security Checks	high
62920	CentOS 5 : kernel (CESA-2012:1445)	Nessus	CentOS Local Security Checks	high
62916	RHEL 5 : kernel (RHSA-2012:1445)	Nessus	Red Hat Local Security Checks	high
59322	USN-1458-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	critical
59034	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1440-1)	Nessus	Ubuntu Local Security Checks	critical
59032	Ubuntu 11.04 : linux vulnerabilities (USN-1432-1)	Nessus	Ubuntu Local Security Checks	high
58493	Ubuntu 11.10 : linux vulnerabilities (USN-1405-1)	Nessus	Ubuntu Local Security Checks	critical
58270	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1389-1)	Nessus	Ubuntu Local Security Checks	high
58269	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1388-1)	Nessus	Ubuntu Local Security Checks	high
58265	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1384-1)	Nessus	Ubuntu Local Security Checks	high
801532	CentOS RHSA-2012-1580 Security Check	Log Correlation Engine	Generic	high
801530	CentOS RHSA-2012-1445 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-2100

high

Tenable Plugins

high

high

high

high

high

high

high

medium

high

high

high

critical

critical

high

critical

high

high

high

high

high