net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000903 advisory.

    net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6     module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and     system crash) via certain types of fragmented IPv6 packets.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002337 advisory.

    net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6     module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and     system crash) via certain types of fragmented IPv6 packets.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001789 advisory.

    net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6     module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and     system crash) via certain types of fragmented IPv6 packets.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-829:07 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
     CVE-2012-2744     net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6     module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and     system crash) via certain types of fragmented IPv6 packets.
     CVE-2012-2745     The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement     session keyring to a child process, which allows local users to cause a denial of service (panic) via a     crafted application that uses the fork system call.
    Fixed bugs:
     r8169: fixed typo in firmware filenames      libata: Add 2GB ATA Flash Disk/ADMA428M to DMA blacklist      nfs: Map minor mismatch error to protocol not support error      ext4: Fix overflow caused by missing cast in ext4_fallocate()      futex:
     Fix regression with read only mappings      Fix uninterruptible loop due to gate_area      [net] bonding:
     Fix up refcounting issues with bond/vlan config      Always add vid to new slave group      Fixed regression on vlan module removal

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):An issue was discovered in     the Linux kernel before 4.20. There is a race condition     in smp_task_timedout() and smp_task_done() in     drivers/scsi/libsas/sas_expander.c, leading to a     use-after-free.(CVE-2018-20836)The Linux kernel before     4.8 allows local users to bypass ASLR on setuid     programs (such as /bin/su) because install_exec_creds()     is called too late in load_elf_binary() in     fs/binfmt_elf.c, and thus the ptrace_may_access() check     has a race condition when reading     /proc/pid/stat.(CVE-2019-11190)The Siemens R3964 line     discipline driver in drivers/tty_r3964.c in the Linux     kernel before 5.0.8 has multiple race     conditions.(CVE-2019-11486)The Linux kernel before     5.1-rc5 allows page-i1/4z_refcount reference count     overflow, with resultant use-after-free issues, if     about 140 GiB of RAM exists. This is related to     fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It     can occur with FUSE requests.(CVE-2019-11487)The     coredump implementation in the Linux kernel before     5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs,     which allows local users to obtain sensitive     information, cause a denial of service, or possibly     have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls.
    This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and     drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)A     n issue was discovered in the Linux kernel before     5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in     megasas_alloc_cmds() in     drivers/scsi/megaraid/megaraid_sas_base.c. This causes     a Denial of Service, related to a     use-after-free.(CVE-2019-11810)In the tun subsystem in     the Linux kernel before 4.13.14, dev_get_valid_name is     not called before register_netdevice. This allows local     users to cause a denial of service (NULL pointer     dereference and panic) via an ioctl(TUNSETIFF) call     with a dev name containing a / character. This is     similar to     CVE-2013-4343.(CVE-2018-7191)net/ipv6etfilterf_conntrac     k_reasm.c in the Linux kernel before 2.6.34, when the     nf_conntrack_ipv6 module is enabled, allows remote     attackers to cause a denial of service (NULL pointer     dereference and system crash) via certain types of     fragmented IPv6 packets.(CVE-2012-2744)Heap-based     buffer overflow in the udf_load_logicalvol function in     fs/udf/super.c in the Linux kernel before 3.4.5 allows     remote attackers to cause a denial of service (system     crash) or possibly have unspecified other impact via a     crafted UDF filesystem.(CVE-2012-3400)The     mmc_ioctl_cdrom_read_data function in     drivers/cdrom/cdrom.c in the Linux kernel through 3.10     allows local users to obtain sensitive information from     kernel memory via a read operation on a malfunctioning     CD-ROM drive.(CVE-2013-2164)The (1) get_user and (2)     put_user API functions in the Linux kernel before 3.5.5     on the v6k and v7 ARM platforms do not validate certain     addresses, which allows attackers to read or modify the     contents of arbitrary kernel memory locations via a     crafted application, as exploited in the wild against     Android devices in October and November     2013.(CVE-2013-6282)The sctp_sf_do_5_2_4_dupcook     function in net/sctp/sm_statefuns.c in the SCTP     implementation in the Linux kernel before 3.8.5 does     not properly handle associations during the processing     of a duplicate COOKIE ECHO chunk, which allows remote     attackers to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via crafted SCTP     traffic.(CVE-2013-2206)A elevation of privilege     vulnerability in the Broadcom wi-fi driver. Product:
    Android. Versions: Android kernel. Android ID:
    A-37351060. References: B-V2017060101.(CVE-2017-0786)An     issue was discovered in the Linux kernel before 5.0.4.
    There is a use-after-free upon attempted read access to     /proc/ioports after the ipmi_si module is removed,     related to drivers/char/ipmi/ipmi_si_intf.c,     drivers/char/ipmi/ipmi_si_mem_io.c, and     drivers/char/ipmi/ipmi_si_port_io.c.(CVE-2019-11811)Not     e1: kernel-4.19.36-vhulk1907.1.0.h529 and earlier     versions in EulerOS Virtualization for ARM 64 3.0.2.0     return incorrect time information when executing the     uname -a command.Note2: The kernel version number     naming format has been changed after     4.19.36-1.2.184.aarch64, the new version format is     4.19.36-vhulk1907.1.0.hxxx.aarch64, which may lead to     false positives of this security advisory.

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

The following security issues have been fixed :

CVE-2011-2494: kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another users password (a side channel attack).

CVE-2012-2744: net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel, when the nf_conntrack_ipv6 module is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

CVE-2012-3510: Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel allowed local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.

CVE-2011-4110: The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allowed local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and updating a negative key into a fully instantiated key.

CVE-2011-1044: The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel did not initialize a certain response buffer, which allowed local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.

CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

CVE-2012-2136: The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel did not properly validate a certain length value, which allowed local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.

CVE-2012-2663: A small denial of service leak in dropping syn+fin messages was fixed.

The following non-security issues have been fixed :

Packaging :

  - kbuild: Fix gcc -x syntax (bnc#773831).

NFS :

  - knfsd: An assortment of little fixes to the sunrpc cache     code (bnc#767766).

  - knfsd: Unexport cache_fresh and fix a small race     (bnc#767766).

  - knfsd: nfsd: do not drop silently on upcall deferral     (bnc#767766).

  - knfsd: svcrpc: remove another silent drop from deferral     code (bnc#767766).

  - sunrpc/cache: simplify cache_fresh_locked and     cache_fresh_unlocked (bnc#767766).

  - sunrpc/cache: recheck cache validity after     cache_defer_req (bnc#767766).

  - sunrpc/cache: use list_del_init for the list_head     entries in cache_deferred_req (bnc#767766).

  - sunrpc/cache: avoid variable over-loading in     cache_defer_req (bnc#767766).

  - sunrpc/cache: allow thread to block while waiting for     cache update (bnc#767766).

  - sunrpc/cache: Fix race in sunrpc/cache introduced by     patch to allow thread to block while waiting for cache     update (bnc#767766).

  - sunrpc/cache: Another fix for race problem with sunrpc     cache deferal (bnc#767766).

  - knfsd: nfsd: make all exp_finding functions return

-errnos on err (bnc#767766).

  - Fix kabi breakage in previous nfsd patch series     (bnc#767766).

  - nfsd: Work around incorrect return type for     wait_for_completion_interruptible_timeout (bnc#767766).

  - nfs: Fix a potential file corruption issue when writing     (bnc#773272).

  - nfs: Allow sync writes to be multiple pages     (bnc#763526).

  - nfs: fix reference counting for NFSv4 callback thread     (bnc#767504).

  - nfs: flush signals before taking down callback thread     (bnc#767504).

  - nfsv4: Ensure nfs_callback_down() calls svc_destroy()     (bnc#767504).

SCSI :

  - SCSI/ch: Check NULL for kmalloc() return (bnc#783058).
    drivers/scsi/aic94xx/aic94xx_init.c: correct the size     argument to kmalloc (bnc#783058).

    block: fail SCSI passthrough ioctls on partition devices     (bnc#738400).

    dm: do not forward ioctls from logical volumes to the     underlying device (bnc#738400).

    vmware: Fix VMware hypervisor detection (bnc#777575,     bnc#770507).

S/390 :

  - lgr: Make lgr_page static (bnc#772409,LTC#83520).

  - zfcp: Fix oops in _blk_add_trace()     (bnc#772409,LTC#83510). kernel: Add z/VM LGR detection     (bnc#767277,LTC#RAS1203).

    be2net: Fix EEH error reset before a flash dump     completes (bnc#755546).

  - mptfusion: fix msgContext in mptctl_hp_hostinfo     (bnc#767939).

  - PCI: Fix bus resource assignment on 32 bits with 64b     resources. (bnc#762581)

  - PCI: fix up setup-bus.c #ifdef. (bnc#762581) x86:
    powernow-k8: Fix indexing issue (bnc#758985).

    net: Fix race condition about network device name     allocation (bnc#747576).

XEN :

  - smpboot: adjust ordering of operations.

  - xen/x86-64: provide a memset() that can deal with 4Gb or     above at a time (bnc#738528).

  - xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53     (bnc#760974).

  - xen/gntdev: fix multi-page slot allocation (bnc#760974).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1064 advisory.

    - [kernel] Prevent keyctl new_session from causing a panic (David Howells) [833433 827424] {CVE-2012-2745}
    - [net] ipv6/netfilter: fix null pointer dereference in nf_ct_frag6_reasm() (Petr Matousek) [833410     833412] {CVE-2012-2744}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1148 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issue:

    * A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm()     function in the Linux kernel's netfilter IPv6 connection tracking     implementation. A remote attacker could use this flaw to send     specially-crafted packets to a target system that is using IPv6 and also     has the nf_conntrack_ipv6 kernel module loaded, causing it to crash.
    (CVE-2012-2744, Important)

    Red Hat would like to thank an anonymous contributor working with the     Beyond Security SecuriTeam Secure Disclosure program for reporting this     issue.

    Users should upgrade to these updated packages, which contain a backported     patch to resolve this issue. The system must be rebooted for this update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1129 advisory.

  - kernel: excessive in kernel CPU consumption when creating large nested epoll structures (CVE-2011-1083)

  - kernel: netfilter: null pointer dereference in nf_ct_frag6_reasm() (CVE-2012-2744)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 6.0 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash. (CVE-2012-2744, Important)

Red Hat would like to thank an anonymous contributor working with the Beyond Security SecuriTeam Secure Disclosure program for reporting this issue.

Users should upgrade to these updated packages, which contain a backported patch to resolve this issue. The system must be rebooted for this update to take effect.

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

The following security issues have been fixed :

  - kernel/taskstats.c in the Linux kernel allowed local     users to obtain sensitive I/O statistics by sending     taskstats commands to a netlink socket, as demonstrated     by discovering the length of another users password (a     side channel attack). (CVE-2011-2494)

  - net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux     kernel, when the nf_conntrack_ipv6 module is enabled,     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) via certain     types of fragmented IPv6 packets. (CVE-2012-2744)

  - Use-after-free vulnerability in the xacct_add_tsk     function in kernel/tsacct.c in the Linux kernel allowed     local users to obtain potentially sensitive information     from kernel memory or cause a denial of service (system     crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.
    (CVE-2012-3510)

  - The user_update function in security/keys/user_defined.c     in the Linux kernel 2.6 allowed local users to cause a     denial of service (NULL pointer dereference and kernel     oops) via vectors related to a user-defined key and     updating a negative key into a fully instantiated key.
    (CVE-2011-4110)

  - The ib_uverbs_poll_cq function in     drivers/infiniband/core/uverbs_cmd.c in the Linux kernel     did not initialize a certain response buffer, which     allowed local users to obtain potentially sensitive     information from kernel memory via vectors that cause     this buffer to be only partially filled, a different     vulnerability than CVE-2010-4649. (CVE-2011-1044)

  - Heap-based buffer overflow in the udf_load_logicalvol     function in fs/udf/super.c in the Linux kernel allowed     remote attackers to cause a denial of service (system     crash) or possibly have unspecified other impact via a     crafted UDF filesystem. (CVE-2012-3400)

  - The sock_alloc_send_pskb function in net/core/sock.c in     the Linux kernel did not properly validate a certain     length value, which allowed local users to cause a     denial of service (heap-based buffer overflow and system     crash) or possibly gain privileges by leveraging access     to a TUN/TAP device. (CVE-2012-2136)

  - A small denial of service leak in dropping syn+fin     messages was fixed. (CVE-2012-2663)

The following non-security issues have been fixed :

Packaging :

  - kbuild: Fix gcc -x syntax (bnc#773831). NFS :

  - knfsd: An assortment of little fixes to the sunrpc cache     code. (bnc#767766)

  - knfsd: Unexport cache_fresh and fix a small race.
    (bnc#767766)

  - knfsd: nfsd: do not drop silently on upcall deferral.
    (bnc#767766)

  - knfsd: svcrpc: remove another silent drop from deferral     code. (bnc#767766)

  - sunrpc/cache: simplify cache_fresh_locked and     cache_fresh_unlocked. (bnc#767766)

  - sunrpc/cache: recheck cache validity after     cache_defer_req. (bnc#767766)

  - sunrpc/cache: use list_del_init for the list_head     entries in cache_deferred_req. (bnc#767766)

  - sunrpc/cache: avoid variable over-loading in     cache_defer_req. (bnc#767766)

  - sunrpc/cache: allow thread to block while waiting for     cache update. (bnc#767766)

  - sunrpc/cache: Fix race in sunrpc/cache introduced by     patch to allow thread to block while waiting for cache     update. (bnc#767766)

  - sunrpc/cache: Another fix for race problem with sunrpc     cache deferal. (bnc#767766)

  - knfsd: nfsd: make all exp_finding functions return
    -errnos on err. (bnc#767766)

  - Fix kabi breakage in previous nfsd patch series.
    (bnc#767766)

  - nfsd: Work around incorrect return type for     wait_for_completion_interruptible_timeout. (bnc#767766)

  - nfs: Fix a potential file corruption issue when writing.
    (bnc#773272)

  - nfs: Allow sync writes to be multiple pages.
    (bnc#763526)

  - nfs: fix reference counting for NFSv4 callback thread.
    (bnc#767504)

  - nfs: flush signals before taking down callback thread.
    (bnc#767504)

  - nfsv4: Ensure nfs_callback_down() calls svc_destroy()     (bnc#767504). SCSI :

  - SCSI/ch: Check NULL for kmalloc() return. (bnc#783058)

  - drivers/scsi/aic94xx/aic94xx_init.c: correct the size     argument to kmalloc. (bnc#783058)

  - block: fail SCSI passthrough ioctls on partition     devices. (bnc#738400)

  - dm: do not forward ioctls from logical volumes to the     underlying device. (bnc#738400)

  - vmware: Fix VMware hypervisor detection (bnc#777575,     bnc#770507). S/390 :

  - lgr: Make lgr_page static (bnc#772409,LTC#83520).

  - zfcp: Fix oops in _blk_add_trace()     (bnc#772409,LTC#83510).

  - kernel: Add z/VM LGR detection (bnc#767277,LTC#RAS1203).

  - be2net: Fix EEH error reset before a flash dump     completes. (bnc#755546)

  - mptfusion: fix msgContext in mptctl_hp_hostinfo.
    (bnc#767939)

  - PCI: Fix bus resource assignment on 32 bits with 64b     resources. . (bnc#762581)

  - PCI: fix up setup-bus.c #ifdef. (bnc#762581)

  - x86: powernow-k8: Fix indexing issue. (bnc#758985)

  - net: Fix race condition about network device name     allocation. (bnc#747576)

XEN :

  - smpboot: adjust ordering of operations.

  - xen/x86-64: provide a memset() that can deal with 4Gb or     above at a time. (bnc#738528)

  - xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53.
    (bnc#760974)

  - xen/gntdev: fix multi-page slot allocation. (bnc#760974)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A NULL pointer dereference flaw was found in the     nf_ct_frag6_reasm() function in the Linux kernel's     netfilter IPv6 connection tracking implementation. A     remote attacker could use this flaw to send specially     crafted packets to a target system that is using IPv6     and also has the nf_conntrack_ipv6 kernel module loaded,     causing it to crash. (CVE-2012-2744, Important)

  - A flaw was found in the way the Linux kernel's key     management facility handled replacement session keyrings     on process forks. A local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2012-2745,     Moderate)

This update also fixes the following bugs :

  - Previously introduced firmware files required for new     Realtek chipsets contained an invalid prefix     ('rtl_nic_') in the file names, for example     '/lib/firmware/rtl_nic/rtl_nic_rtl8168d-1.fw'. This     update corrects these file names. For example, the     aforementioned file is now correctly named     '/lib/firmware/rtl_nic/rtl8168d-1.fw'.

  - This update blacklists the ADMA428M revision of the 2GB     ATA Flash Disk device. This is due to data corruption     occurring on the said device when the Ultra-DMA 66     transfer mode is used. When the     'libata.force=5:pio0,6:pio0' kernel parameter is set,     the aforementioned device works as expected.

  - On Scientific Linux 6, mounting an NFS export from a     server running Windows Server 2012 Release Candidate     returned the NFS4ERR_MINOR_VERS_MISMATCH error because     Windows Server 2012 Release Candidate supports NFSv4.1     only. Scientific Linux 6 did not properly handle the     returned error and did not fall back to using NFSv3,     which caused the mount operation to fail. With this     update, when the NFS4ERR_MINOR_VERS_MISMATCH error is     returned, the mount operation properly falls back to     using NFSv3 and no longer fails.

  - On ext4 file systems, when fallocate() failed to     allocate blocks due to the ENOSPC condition (no space     left on device) for a file larger than 4 GB, the size of     the file became corrupted and, consequently, caused file     system corruption. This was due to a missing cast     operator in the 'ext4_fallocate()' function. With this     update, the underlying source code has been modified to     address this issue, and file system corruption no longer     occurs.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

An error was found in the Linux kernel's IPv6 netfilter when connection tracking is enabled. A remote attacker could exploit this flaw to crash a system if it is using IPv6 with the nf_contrack_ipv6 kernel module loaded. (CVE-2012-2744).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash. (CVE-2012-2744, Important)

* A flaw was found in the way the Linux kernel's key management facility handled replacement session keyrings on process forks. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-2745, Moderate)

Red Hat would like to thank an anonymous contributor working with the Beyond Security SecuriTeam Secure Disclosure program for reporting CVE-2012-2744.

This update also fixes the following bugs :

* Previously introduced firmware files required for new Realtek chipsets contained an invalid prefix ('rtl_nic_') in the file names, for example '/lib/firmware/rtl_nic/rtl_nic_rtl8168d-1.fw'. This update corrects these file names. For example, the aforementioned file is now correctly named '/lib/firmware/rtl_nic/rtl8168d-1.fw'. (BZ#832359)

* This update blacklists the ADMA428M revision of the 2GB ATA Flash Disk device. This is due to data corruption occurring on the said device when the Ultra-DMA 66 transfer mode is used. When the 'libata.force=5:pio0,6:pio0' kernel parameter is set, the aforementioned device works as expected. (BZ#832363)

* On Red Hat Enterprise Linux 6, mounting an NFS export from a Windows 2012 server failed due to the fact that the Windows server contains support for the minor version 1 (v4.1) of the NFS version 4 protocol only, along with support for versions 2 and 3. The lack of the minor version 0 (v4.0) support caused Red Hat Enterprise Linux 6 clients to fail instead of rolling back to version 3 as expected. This update fixes this bug and mounting an NFS export works as expected.
(BZ#832365)

* On ext4 file systems, when fallocate() failed to allocate blocks due to the ENOSPC condition (no space left on device) for a file larger than 4 GB, the size of the file became corrupted and, consequently, caused file system corruption. This was due to a missing cast operator in the 'ext4_fallocate()' function. With this update, the underlying source code has been modified to address this issue, and file system corruption no longer occurs. (BZ#833034)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1064 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm()     function in the Linux kernel's netfilter IPv6 connection tracking     implementation. A remote attacker could use this flaw to send     specially-crafted packets to a target system that is using IPv6 and also     has the nf_conntrack_ipv6 kernel module loaded, causing it to crash.
    (CVE-2012-2744, Important)

    * A flaw was found in the way the Linux kernel's key management facility     handled replacement session keyrings on process forks. A local,     unprivileged user could use this flaw to cause a denial of service.
    (CVE-2012-2745, Moderate)

    Red Hat would like to thank an anonymous contributor working with the     Beyond Security SecuriTeam Secure Disclosure program for reporting     CVE-2012-2744.

    This update also fixes the following bugs:

    * Previously introduced firmware files required for new Realtek chipsets     contained an invalid prefix (rtl_nic_) in the file names, for example     /lib/firmware/rtl_nic/rtl_nic_rtl8168d-1.fw. This update corrects these     file names. For example, the aforementioned file is now correctly named     /lib/firmware/rtl_nic/rtl8168d-1.fw. (BZ#832359)

    * This update blacklists the ADMA428M revision of the 2GB ATA Flash Disk     device. This is due to data corruption occurring on the said device when     the Ultra-DMA 66 transfer mode is used. When the     libata.force=5:pio0,6:pio0 kernel parameter is set, the aforementioned     device works as expected. (BZ#832363)

    * On Red Hat Enterprise Linux 6, mounting an NFS export from a Windows 2012     server failed due to the fact that the Windows server contains support for     the minor version 1 (v4.1) of the NFS version 4 protocol only, along with     support for versions 2 and 3. The lack of the minor version 0 (v4.0)     support caused Red Hat Enterprise Linux 6 clients to fail instead of     rolling back to version 3 as expected. This update fixes this bug and     mounting an NFS export works as expected. (BZ#832365)

    * On ext4 file systems, when fallocate() failed to allocate blocks due to     the ENOSPC condition (no space left on device) for a file larger than 4 GB,     the size of the file became corrupted and, consequently, caused file system     corruption. This was due to a missing cast operator in the     ext4_fallocate() function. With this update, the underlying source code     has been modified to address this issue, and file system corruption no     longer occurs. (BZ#833034)

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The system must be rebooted for this     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
290583	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000903)	Nessus	Unity Linux Local Security Checks	high
287814	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002337)	Nessus	Unity Linux Local Security Checks	high
286737	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001789)	Nessus	Unity Linux Local Security Checks	high
284461	MiracleLinux 4 : kernel-2.6.32-279.2.1.el6 (AXSA:2012-829:07)	Nessus	Miracle Linux Local Security Checks	medium
125587	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1635)	Nessus	Huawei Local Security Checks	high
83563	SUSE SLED10 / SLES10 Security Update : kernel (SUSE-SU-2012:1391-1)	Nessus	SuSE Local Security Checks	high
68575	Oracle Linux 6 : kernel (ELSA-2012-1064)	Nessus	Oracle Linux Local Security Checks	medium
64051	RHEL 6 : kernel (RHSA-2012:1148)	Nessus	Red Hat Local Security Checks	high
64050	RHEL 6 : kernel (RHSA-2012:1129)	Nessus	Red Hat Local Security Checks	medium
64049	RHEL 6 : kernel (RHSA-2012:1114)	Nessus	Red Hat Local Security Checks	high
62676	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8325)	Nessus	SuSE Local Security Checks	high
62675	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8324)	Nessus	SuSE Local Security Checks	high
61361	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120710)	Nessus	Scientific Linux Local Security Checks	high
59985	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1507-1)	Nessus	Ubuntu Local Security Checks	high
59949	CentOS 6 : kernel (CESA-2012:1064)	Nessus	CentOS Local Security Checks	high
59947	RHEL 6 : kernel (RHSA-2012:1064)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2012-2744

high

Tenable Plugins

high

high

high

medium

high

high

medium

high

medium

high

high

high

high

high

high

medium