The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - kmod: make __request_module killable (Oleg Nesterov)     [Orabug: 16286305] (CVE-2012-4398)

  - kmod: introduce call_modprobe helper (Oleg Nesterov)     [Orabug: 16286305] (CVE-2012-4398)

  - usermodehelper: implement UMH_KILLABLE (Oleg Nesterov)     [Orabug: 16286305] (CVE-2012-4398)

  - usermodehelper: introduce umh_complete(sub_info) (Oleg     Nesterov) [Orabug: 16286305] (CVE-2012-4398)

  - KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE     bit set (CVE-2012-4461) (Jerry Snitselaar) [Orabug:
    16286290] (CVE-2012-4461)

  - exec: do not leave bprm->interp on stack (Kees Cook)     [Orabug: 16286267] (CVE-2012-4530)

  - exec: use -ELOOP for max recursion depth (Kees Cook)     [Orabug: 16286267] (CVE-2012-4530)

  - xen-pciback: rate limit error messages from     xen_pcibk_enable_msi[,x] (Jan Beulich) [Orabug:
    16243736] (CVE-2013-0231)

  - Xen: Fix stack corruption in xen_failsafe_callback for     32bit PVOPS guests. (Frediano Ziglio) [Orabug: 16274171]     (CVE-2013-0190)

  - netback: correct netbk_tx_err to handle wrap around.
    (Ian Campbell) [Orabug: 16243309]

  - xen/netback: free already allocated memory on failure in     xen_netbk_get_requests (Ian Campbell) [Orabug: 16243309]

  - xen/netback: don't leak pages on failure in     xen_netbk_tx_check_gop. (Ian Campbell) [Orabug:
    16243309]

  - xen/netback: shutdown the ring if it contains garbage.
    (Ian Campbell) [Orabug: 16243309]

  - ixgbevf fix typo in Makefile (Maxim Uvarov) [Orabug:
    16179639 16168292]

It was found that a deadlock could occur in the Out of Memory (OOM) killer. A process could trigger this deadlock by consuming a large amount of memory, and then causing request_module() to be called. A local, unprivileged user could use this flaw to cause a denial of service (excessive memory consumption). (CVE-2012-4398)

A flaw was found in the way the KVM (Kernel-based Virtual Machine) subsystem handled guests attempting to run with the X86_CR4_OSXSAVE CPU feature flag set. On hosts without the XSAVE CPU feature, a local, unprivileged user could use this flaw to crash the host system. (The 'grep --color xsave /proc/cpuinfo' command can be used to verify if your system has the XSAVE CPU feature.) (CVE-2012-4461)

A memory disclosure flaw was found in the way the load_script() function in the binfmt_script binary format handler handled excessive recursions. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space by executing specially crafted scripts. (CVE-2012-4530)

A race condition was found in the way the Linux kernel's ptrace implementation handled PTRACE_SETREGS requests when the debuggee was woken due to a SIGKILL signal instead of being stopped. A local, unprivileged user could use this flaw to escalate their privileges.
(CVE-2013-0871)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2507 advisory.

  - arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used,     does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service     (system crash) via a crafted application. (CVE-2013-0309)

  - The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call. (CVE-2013-0310)

  - The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly     handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging     KVM guest OS privileges. (CVE-2013-0311)

  - The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen     paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows     guest OS users to gain guest OS privileges via a crafted application. (CVE-2013-0228)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2503 advisory.

  - The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain     killable attribute, which allows local users to cause a denial of service (memory consumption) via a     crafted application. (CVE-2012-4398)

  - The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without     XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to     set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl. (CVE-2012-4461)

  - The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle     recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted     application. (CVE-2012-4530)

  - The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a     32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret     fault, leading to use of an incorrect stack pointer and stack corruption. (CVE-2013-0190)

  - The pciback_enable_msi function in the PCI backend driver     (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest     OS users with PCI device access to cause a denial of service via a large number of kernel log messages.
    NOTE: some of these details are obtained from third party information. (CVE-2013-0231)

  - The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of     service (loop) by triggering ring pointer corruption. (CVE-2013-0216)

  - Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel     before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain     error conditions. (CVE-2013-0217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0223 advisory.

  - The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain     killable attribute, which allows local users to cause a denial of service (memory consumption) via a     crafted application. (CVE-2012-4398)

  - The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without     XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to     set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl. (CVE-2012-4461)

  - The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle     recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted     application. (CVE-2012-4530)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.2 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way the vhost kernel module handled descriptors that spanned multiple regions. A privileged guest user in a KVM (Kernel-based Virtual Machine) guest could use this flaw to crash the host or, potentially, escalate their privileges on the host.
(CVE-2013-0311, Important)

* A flaw was found in the way the KVM subsystem handled guests attempting to run with the X86_CR4_OSXSAVE CPU feature flag set. On hosts without the XSAVE CPU feature, a local, unprivileged user could use this flaw to crash the host system. (The 'grep --color xsave /proc/cpuinfo' command can be used to verify if your system has the XSAVE CPU feature.) (CVE-2012-4461, Moderate)

* It was found that the default SCSI command filter does not accommodate commands that overlap across device classes. A privileged guest user could potentially use this flaw to write arbitrary data to a LUN that is passed-through as read-only. (CVE-2012-4542, Moderate)

* A use-after-free flaw was found in the tmpfs implementation. A local user able to mount and unmount a tmpfs file system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1767, Low)

Red Hat would like to thank Jon Howell for reporting CVE-2012-4461.
CVE-2012-4542 was discovered by Paolo Bonzini of Red Hat.

This update also fixes the following bugs :

* Previously, when open(2) system calls were processed, the GETATTR routine did not check to see if valid attributes were also returned.
As a result, the open() call succeeded with invalid attributes instead of failing in such a case. This update adds the missing check, and the open() call succeeds only when valid attributes are returned.
(BZ#960409)

* Previously, the fsync(2) system call incorrectly returned the EIO (Input/Output) error instead of the ENOSPC (No space left on device) error. This was due to incorrect error handling in the page cache.
This problem has been fixed and the correct error value is now returned. (BZ#960418)

* In the RPC code, when a network socket backed up due to high network traffic, a timer was set causing a retransmission, which in turn could cause an even larger amount of network traffic to be generated. To prevent this problem, the RPC code now waits for the socket to empty instead of setting the timer. (BZ#960423)

* This update fixes a number of bugs in the be2iscsi driver for ServerEngines BladeEngine 2 Open iSCSI devices. (BZ#955502)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-2121     Benjamin Herrenschmidt and Jason Baron discovered issues     with the IOMMU mapping of memory slots used in KVM     device assignment. Local users with the ability to     assign devices could cause a denial of service due to a     memory page leak.

  - CVE-2012-3552     Hafid Lin reported an issue in the IP networking     subsystem. A remote user can cause a denial of service     (system crash) on servers running applications that set     options on sockets which are actively being processed.

  - CVE-2012-4461     Jon Howell reported a denial of service issue in the KVM     subsystem. On systems that do not support the XSAVE     feature, local users with access to the /dev/kvm     interface can cause a system crash.

  - CVE-2012-4508     Dmitry Monakhov and Theodore Ts'o reported a race     condition in the ext4 filesystem. Local users could gain     access to sensitive kernel memory.

  - CVE-2012-6537     Mathias Krause discovered information leak issues in the     Transformation user configuration interface. Local users     with the CAP_NET_ADMIN capability can gain access to     sensitive kernel memory.

  - CVE-2012-6539     Mathias Krause discovered an issue in the networking     subsystem. Local users on 64-bit systems can gain access     to sensitive kernel memory.

  - CVE-2012-6540     Mathias Krause discovered an issue in the Linux virtual     server subsystem. Local users can gain access to     sensitive kernel memory. Note: this issue does not     affect Debian provided kernels, but may affect custom     kernels built from Debian's linux-source-2.6.32 package.

  - CVE-2012-6542     Mathias Krause discovered an issue in the LLC protocol     support code. Local users can gain access to sensitive     kernel memory.

  - CVE-2012-6544     Mathias Krause discovered issues in the Bluetooth     subsystem. Local users can gain access to sensitive     kernel memory.

  - CVE-2012-6545     Mathias Krause discovered issues in the Bluetooth RFCOMM     protocol support. Local users can gain access to     sensitive kernel memory.

  - CVE-2012-6546     Mathias Krause discovered issues in the ATM networking     support. Local users can gain access to sensitive kernel     memory.

  - CVE-2012-6548     Mathias Krause discovered an issue in the UDF file     system support. Local users can obtain access to     sensitive kernel memory.

  - CVE-2012-6549     Mathias Krause discovered an issue in the isofs file     system support. Local users can obtain access to     sensitive kernel memory.

  - CVE-2013-0349     Anderson Lizardo discovered an issue in the Bluetooth     Human Interface Device Protocol (HIDP) stack. Local     users can obtain access to sensitive kernel memory.

  - CVE-2013-0914     Emese Revfy discovered an issue in the signal     implementation. Local users may be able to bypass the     address space layout randomization (ASLR) facility due     to a leaking of information to child processes.

  - CVE-2013-1767     Greg Thelen reported an issue in the tmpfs virtual     memory filesystem. Local users with sufficient privilege     to mount filesystems can cause a denial of service or     possibly elevated privileges due to a use-after free     defect.

  - CVE-2013-1773     Alan Stern provided a fix for a defect in the     UTF8->UTF16 string conversion facility used by the VFAT     filesystem. A local user could cause a buffer overflow     condition, resulting in a denial of service or     potentially elevated privileges.

  - CVE-2013-1774     Wolfgang Frisch provided a fix for a NULL pointer     dereference defect in the driver for some serial USB     devices from Inside Out Networks. Local users with     permission to access these devices can create a denial     of service (kernel oops) by causing the device to be     removed while it is in use.

  - CVE-2013-1792     Mateusz Guzik of Red Hat EMEA GSS SEG Team discovered a     race condition in the access key retention support in     the kernel. A local user could cause a denial of service     (NULL pointer dereference).

  - CVE-2013-1796     Andrew Honig of Google reported an issue in the KVM     subsystem. A user in a guest operating system could     corrupt kernel memory, resulting in a denial of service.

  - CVE-2013-1798     Andrew Honig of Google reported an issue in the KVM     subsystem. A user in a guest operating system could     cause a denial of service due to a use after-free     defect.

  - CVE-2013-1826     Mathias Krause discovered an issue in the Transformation     (XFRM) user configuration interface of the networking     stack. A user with the CAP_NET_ADMIN capability may be     able to gain elevated privileges.

  - CVE-2013-1860     Oliver Neukum discovered an issue in the USB CDC WCM     Device Management driver. Local users with the ability     to attach devices can cause a denial of service (kernel     crash) or potentially gain elevated privileges.

  - CVE-2013-1928     Kees Cook provided a fix for an information leak in the     VIDEO_SET_SPU_PALETTE ioctl for 32-bit applications     running on a 64-bit kernel. Local users can gain access     to sensitive kernel memory.

  - CVE-2013-1929     Oded Horovitz and Brad Spengler reported an issue in the     device driver for Broadcom Tigon3 based gigabit     Ethernet. Users with the ability to attach untrusted     devices can create an overflow condition, resulting in a     denial of service or elevated privileges.

  - CVE-2013-2015     Theodore Ts'o provided a fix for an issue in the ext4     filesystem. Local users with the ability to mount a     specially crafted filesystem can cause a denial of     service (infinite loop).

  - CVE-2013-2634     Mathias Krause discovered a few issues in the Data     Center Bridging (DCB) netlink interface. Local users can     gain access to sensitive kernel memory.

  - CVE-2013-3222     Mathias Krause discovered an issue in the Asynchronous     Transfer Mode (ATM) protocol support. Local users can     gain access to sensitive kernel memory.

  - CVE-2013-3223     Mathias Krause discovered an issue in the Amateur Radio     AX.25 protocol support. Local users can gain access to     sensitive kernel memory.

  - CVE-2013-3224     Mathias Krause discovered an issue in the Bluetooth     subsystem. Local users can gain access to sensitive     kernel memory.

  - CVE-2013-3225     Mathias Krause discovered an issue in the Bluetooth     RFCOMM protocol support. Local users can gain access to     sensitive kernel memory.

  - CVE-2013-3228     Mathias Krause discovered an issue in the IrDA     (infrared) subsystem support. Local users can gain     access to sensitive kernel memory.

  - CVE-2013-3229     Mathias Krause discovered an issue in the IUCV support     on s390 systems. Local users can gain access to     sensitive kernel memory.

  - CVE-2013-3231     Mathias Krause discovered an issue in the ANSI/IEEE     802.2 LLC type 2 protocol support. Local users can gain     access to sensitive kernel memory.

  - CVE-2013-3234     Mathias Krause discovered an issue in the Amateur Radio     X.25 PLP (Rose) protocol support. Local users can gain     access to sensitive kernel memory.

  - CVE-2013-3235     Mathias Krause discovered an issue in the Transparent     Inter Process Communication (TIPC) protocol support.
    Local users can gain access to sensitive kernel memory.

Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* It was found that a deadlock could occur in the Out of Memory (OOM) killer. A process could trigger this deadlock by consuming a large amount of memory, and then causing request_module() to be called. A local, unprivileged user could use this flaw to cause a denial of service (excessive memory consumption). (CVE-2012-4398, Moderate)

* A flaw was found in the way the KVM (Kernel-based Virtual Machine) subsystem handled guests attempting to run with the X86_CR4_OSXSAVE CPU feature flag set. On hosts without the XSAVE CPU feature, a local, unprivileged user could use this flaw to crash the host system. (The 'grep --color xsave /proc/cpuinfo' command can be used to verify if your system has the XSAVE CPU feature.) (CVE-2012-4461, Moderate)

* A memory disclosure flaw was found in the way the load_script() function in the binfmt_script binary format handler handled excessive recursions. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space by executing specially crafted scripts. (CVE-2012-4530, Low)

Red Hat would like to thank Tetsuo Handa for reporting CVE-2012-4398, and Jon Howell for reporting CVE-2012-4461.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

This update fixes the following security issues :

  - It was found that a deadlock could occur in the Out of     Memory (OOM) killer. A process could trigger this     deadlock by consuming a large amount of memory, and then     causing request_module() to be called. A local,     unprivileged user could use this flaw to cause a denial     of service (excessive memory consumption).
    (CVE-2012-4398, Moderate)

  - A flaw was found in the way the KVM (Kernel-based     Virtual Machine) subsystem handled guests attempting to     run with the X86_CR4_OSXSAVE CPU feature flag set. On     hosts without the XSAVE CPU feature, a local,     unprivileged user could use this flaw to crash the host     system. (The 'grep --color xsave /proc/cpuinfo' command     can be used to verify if your system has the XSAVE CPU     feature.) (CVE-2012-4461, Moderate)

  - A memory disclosure flaw was found in the way the     load_script() function in the binfmt_script binary     format handler handled excessive recursions. A local,     unprivileged user could use this flaw to leak kernel     stack memory to user-space by executing specially     crafted scripts. (CVE-2012-4530, Low)

The system must be rebooted for this update to take effect.

USN-1704-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated regression inotify/fanotify stopped working after upgrading.
This update fixes the problem.

We apologize for the inconvenience.

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An unprivileged user could exploit this flaw to read kernel stack memory. (CVE-2012-0957)

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE feature. On hosts, using qemu userspace, without the XSAVE feature an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem that can expose stale data. An unprivileged user could exploit this flaw to cause an information leak.
(CVE-2012-4508)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents. (CVE-2012-4530)

Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois congestion control algorithm. A local attacker could use this to cause a denial of service. (CVE-2012-4565)

A flaw was discovered in the Linux kernel's handling of new hot-plugged memory. An unprivileged local user could exploit this flaw to cause a denial of service by crashing the system. (CVE-2012-5517)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1699-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated regression inotify/fanotify stopped working after upgrading.
This update fixes the problem.

We apologize for the inconvenience.

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE CPU feature. On hosts without the XSAVE CPU feature, using qemu userspace, an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents. (CVE-2012-4530)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1696-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated regression inotify/fanotify stopped working after upgrading.
This update fixes the problem.

We apologize for the inconvenience.

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE feature. On hosts, using qemu userspace, without the XSAVE feature an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents. (CVE-2012-4530)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP2 kernel has been updated to 3.0.51 which fixes various bugs and security issues.

It contains the following feature enhancements :

  - The cachefiles framework is now supported (FATE#312793,     bnc#782369). The userland utilities were published     seperately to support this feature.

  - The ipset netfilter modules are now supported     (FATE#313309) The ipset userland utility will be     published seperately to support this feature.

  - The tipc kernel module is now externally supported     (FATE#305033).

  - Hyper-V KVP IP injection was implemented (FATE#314441).
    A seperate hyper-v package will be published to support     this feature.

  - Intel Lynx Point PCH chipset support was added.
    (FATE#313409)

  - Enable various md/raid10 and DASD enhancements.
    (FATE#311379) These make it possible for RAID10 to cope     with DASD devices being slow for various reasons - the     affected device will be temporarily removed from the     array.

    Also added support for reshaping of RAID10 arrays.

    mdadm changes will be published to support this feature.

The following security issues have been fixed :

  - A race condition on hot adding memory could be used by     local attackers to crash the system during hot adding     new memory. (CVE-2012-5517)

  - A flaw has been found in the way Linux kernels KVM     subsystem handled vcpu->arch.cr4 X86_CR4_OSXSAVE bit set     upon guest enter. On hosts without the XSAVE feature and     using qemu userspace an unprivileged local user could     have used this flaw to crash the system. (CVE-2012-4461)

  - The KVM implementation in the Linux kernel allowed host     OS users to cause a denial of service (NULL pointer     dereference and host OS crash) by making a     KVM_CREATE_IRQCHIP ioctl call after a virtual CPU     already exists. (CVE-2012-1601)

  - Attempting an rds connection from the IP address of an     IPoIB interface to itself causes a kernel panic due to a     BUG_ON() being triggered. Making the test less strict     allows rds-ping to work without crashing the machine. A     local unprivileged user could use this flaw to crash the     sytem. (CVE-2012-2372)

  - Dimitry Monakhov, one of the ext4 developers, has     discovered a race involving asynchronous I/O and     fallocate which can lead to the exposure of stale data
    --- that is, an extent which should have had the     'uninitialized' bit set indicating that its blocks have     not yet been written and thus contain data from a     deleted file will get exposed to anyone with read access     to the file. (CVE-2012-4508)

  - The rds_recvmsg function in net/rds/recv.c in the Linux     kernel did not initialize a certain structure member,     which allows local users to obtain potentially sensitive     information from kernel stack memory via a (1) recvfrom     or (2) recvmsg system call on an RDS socket.
    (CVE-2012-3430)

  - The sfc (aka Solarflare Solarstorm) driver in the Linux     kernel allowed remote attackers to cause a denial of     service (DMA descriptor consumption and     network-controller outage) via crafted TCP packets that     trigger a small MSS value. (CVE-2012-3412)

The following non-security issues have been fixed :

BTRFS :

  - btrfs: fix double mntput() in mount_subvol().

  - btrfs: use common work instead of delayed work

  - btrfs: limit fallocate extent reservation to 256MB

  - btrfs: fix a double free on pending snapshots in error     handling

  - btrfs: Do not trust the superblock label and simply     printk('%s') it

  - patches.suse/btrfs-update-message-levels.patch: Refresh.

  - patches.suse/btrfs-enospc-debugging-messages.patch:
    Minor updates.

  - patches.suse/btrfs-update-message-levels.patch: Minor     updates.

  - btrfs: continue after abort during snapshot drop.
    (bnc#752067)

  - btrfs: Return EINVAL when length to trim is less than     FSB.

  - btrfs: fix unnecessary while loop when search the free     space, cache.

  - btrfs: Use btrfs_update_inode_fallback when creating a     snapshot.

  - btrfs: do not bug when we fail to commit the     transaction.

  - btrfs: fill the global reserve when unpinning space.

  - btrfs: do not allow degraded mount if too many devices     are missing.

  -     patches.suse/btrfs-8112-resume-balance-on-rw-re-mounts-p     roperly.patch: fix mismerge.

  - btrfs: do not allocate chunks as agressively.

  - btrfs: btrfs_drop_extent_cache should never fail.

  - btrfs: fix full backref problem when inserting shared     block reference.

  - btrfs: wait on async pages when shrinking delalloc.

  - btrfs: remove bytes argument from do_chunk_alloc.

  - btrfs: cleanup of error processing in     btree_get_extent().

  - btrfs: remove unnecessary code in btree_get_extent().

  - btrfs: kill obsolete arguments in     btrfs_wait_ordered_extents.

  - btrfs: do not do anything in our ->freeze_fs and
    ->unfreeze_fs.

  - btrfs: do not async metadata csumming in certain     situations.

  - btrfs: do not hold the file extent leaf locked when     adding extent item.

  - btrfs: cache extent state when writing out dirty     metadata pages.

  - btrfs: do not lookup csums for prealloc extents.

  - btrfs: be smarter about dropping things from the tree     log.

  - btrfs: confirmation of value is added before     trace_btrfs_get_extent() is called.

  - btrfs: make filesystem read-only when submitting barrier     fails.

  - btrfs: cleanup pages properly when ENOMEM in     compression.

  - btrfs: do not bug on enomem in readpage.

  - btrfs: do not warn_on when we cannot alloc a page for an     extent buffer.

  - btrfs: enospc debugging messages. S/390 :

  - smsgiucv: reestablish IUCV path after resume     (bnc#786976,LTC#86245).

  - dasd: move wake_up call (bnc#786976,LTC#86252).

  - kernel: fix get_user_pages_fast() page table walk     (bnc#786976,LTC#86307).

  - qeth: Fix IPA_CMD_QIPASSIST return code handling     (bnc#785851,LTC#86101).

  - mm: Fix XFS oops due to dirty pages without buffers on     s390. (bnc#762259)

  - zfcp: only access zfcp_scsi_dev for valid scsi_device     (bnc#781484,LTC#85285).

  - dasd: check count address during online setting     (bnc#781484,LTC#85346).

  - hugetlbfs: fix deadlock in unmap_hugepage_range()     (bnc#781484,LTC#85449).

  - kernel: make user-access pagetable walk code huge page     aware (bnc#781484,LTC#85455).

  - hugetlbfs: add missing TLB invalidation     (bnc#781484,LTC#85463).

  - zfcp: fix adapter (re)open recovery while link to SAN is     down (bnc#789010,LTC#86283).

  - qeth: set new mac even if old mac is gone     (bnc#789010,LTC#86643).

  - qdio: fix kernel panic for zfcp 31-bit     (bnc#789010,LTC#86623).

  - crypto: msgType50 (RSA-CRT) Fix (bnc#789010,LTC#86378).
    DRM :

  - drm/915: Update references, fixed a missing patch chunk.
    (bnc#725355)

  - drm/dp: Document DP spec versions for various DPCD     registers. (bnc#780461)

  - drm/dp: Make sink count DP 1.2 aware. (bnc#780461)

  - DRM/i915: Restore sdvo_flags after dtd->mode->dtd     Roundrtrip. (bnc#775577)

  - DRM/i915: Do not clone SDVO LVDS with analog.
    (bnc#766410)

  - DRM/radeon: For single CRTC GPUs move handling of     CRTC_CRT_ON to crtc_dpms(). (bnc#725152)

  - DRM/Radeon: Fix TV DAC Load Detection for single CRTC     chips. (bnc#725152)

  - DRM/Radeon: Clean up code in TV DAC load detection.
    (bnc#725152)

  - DRM/Radeon: On DVI-I use Load Detection when EDID is     bogus. (bnc#725152)

  - DRM/Radeon: Fix primary DAC Load Detection for RV100     chips. (bnc#725152)

  - DRM/Radeon: Fix Load Detection on legacy primary DAC.
    (bnc#725152)

  - drm/i915: enable plain RC6 on Sandy Bridge by default     (bnc#725355). Hyper-V :

  - Hyper-V KVP IP injection (fate#31441) :

  - drivers: net: Remove casts to same type.

  - drivers: hv: remove IRQF_SAMPLE_RANDOM which is now a     no-op.

  - hyperv: Move wait completion msg code into     rndis_filter_halt_device().

  - hyperv: Add comments for the extended buffer after RNDIS     message.

  - Drivers: hv: Cleanup the guest ID computation.

  - Drivers: hv: vmbus: Use the standard format string to     format GUIDs.

  - Drivers: hv: Add KVP definitions for IP address     injection.

  - Drivers: hv: kvp: Cleanup error handling in KVP.

  - Drivers: hv: kvp: Support the new IP injection messages.

  - Tools: hv: Prepare to expand kvp_get_ip_address()     functionality.

  - Tools: hv: Further refactor kvp_get_ip_address().

  - Tools: hv: Gather address family information.

  - Tools: hv: Gather subnet information.

  - Tools: hv: Represent the ipv6 mask using CIDR notation.

  - Tools: hv: Gather ipv[4,6] gateway information.

  - hv: fail the probing immediately when we are not in     hyperv platform.

  - hv: vmbus_drv: detect hyperv through x86_hyper.

  - Tools: hv: Get rid of some unused variables.

  - Tools: hv: Correctly type string variables.

  - Tools: hv: Add an example script to retrieve DNS     entries.

  - Tools: hv: Gather DNS information.

  - Drivers: hv: kvp: Copy the address family information.

  - Tools: hv: Add an example script to retrieve dhcp state.

  - Tools: hv: Gather DHCP information.

  - Tools: hv: Add an example script to configure an     interface.

  - Tools: hv: Implement the KVP verb - KVP_OP_SET_IP_INFO.

  - Tools: hv: Rename the function kvp_get_ip_address().

  - Tools: hv: Implement the KVP verb - KVP_OP_GET_IP_INFO.

  - tools/hv: Fix file handle leak.

  - tools/hv: Fix exit() error code.

  - tools/hv: Check for read/write errors.

  - tools/hv: Parse /etc/os-release.

  - hyperv: Fix the max_xfer_size in RNDIS initialization.

  - hyperv: Fix the missing return value in     rndis_filter_set_packet_filter().

  - hyperv: Fix page buffer handling in     rndis_filter_send_request().

  - hyperv: Remove extra allocated space for recv_pkt_list     elements.

  - hyperv: Report actual status in receive completion     packet.

  - hyperv: Add buffer for extended info after the RNDIS     response message. Other :

  - net: prevent NULL dereference in check_peer_redir().
    (bnc#776044 / bnc#784576)

  -     patches.fixes/mm-hotplug-correctly-add-zone-to-other-nod     es-list.patch: Refresh.

  - igb: fix recent VLAN changes that would leave VLANs     disabled after reset. (bnc#787168)

  - md: Change goto target to avoid pointless bug messages     in normal error cases. (bnc#787848)

  - intel_idle: IVB support (fate#313719).

  - x86 cpufreq: Do not complain on missing cpufreq tables     on ProLiants. (bnc#787202)

  - hpilo: remove pci_disable_device. (bnc#752544)

  - ixgbe: Address fact that RSC was not setting GSO size     for incoming frames. (bnc#776144)

  - hv: Cleanup error handling in vmbus_open().

  - [SCSI] storvsc: Account for in-transit packets in the     RESET path.

  - sg: remove sg_mutex. (bnc#785496)

  - perf: Do no try to schedule task events if there are     none. (bnc#781574)

  - perf: Do not set task_ctx pointer in cpuctx if there are     no events in the context. (bnc#781574)

  - mm: swap: Implement generic handlers for swap-related     address ops fix. (bnc#778334)

  - hpwdt: Only BYTE reads/writes to WD Timer port 0x72.

  - xenbus: fix overflow check in xenbus_dev_write().

  - xen/x86: do not corrupt %eip when returning from a     signal handler.

  - Update Xen patches to 3.0.46.

  - Update Xen patches to 3.0.51.

  - mm: Check if PTE is already allocated during page fault.

  - rpm/kernel-binary.spec.in: Revert f266e647f to allow     building with icecream again, as     patches.rpmify/kbuild-fix-gcc-x-syntax.patch is a real     fix now.

  - ipmi: decrease the IPMI message transaction time in     interrupt mode. (bnc#763654)

  - ipmi: simplify locking. (bnc#763654)

  - ipmi: use a tasklet for handling received messages.
    (bnc#763654)

  - cxgb3: Set vlan_feature on net_device (bnc#776127,     LTC#84260).

  - qlge: Add offload features to vlan interfaces     (bnc#776081,LTC#84322).

  - mlx4_en: Added missing iounmap upon releasing a device     (bnc#774964,LTC#82768).

  - mlx4: allow device removal by fixing dma unmap size     (bnc#774964,LTC#82768).

  - qeth: fix deadlock between recovery and bonding driver     (bnc#785100,LTC#85905).

  - SCSI st: add st_nowait_eof param to module. (bnc#775394)

  -     patches.fixes/sched-fix-migration-thread-accounting-woes     .patch: Update references. (bnc#773699, bnc#769251)

  - memcg: oom: fix totalpages calculation for     swappiness==0. (bnc#783965)

  - fs: cachefiles: add support for large files in     filesystem caching (FATE#312793, bnc#782369).

  - mm/mempolicy.c: use enum value MPOL_REBIND_ONCE in     mpol_rebind_policy().

  - mm, mempolicy: fix mbind() to do synchronous migration.

  - revert 'mm: mempolicy: Let vma_merge and vma_split     handle vma->vm_policy linkages'.

  - mempolicy: fix a race in shared_policy_replace().

  - mempolicy: fix refcount leak in     mpol_set_shared_policy().

  - mempolicy: fix a memory corruption by refcount imbalance     in alloc_pages_vma().

  - mempolicy: remove mempolicy sharing. Memory policy     enhancements for robustness against fuzz attacks and     force mbind to use synchronous migration.

  - Update scsi_dh_alua to mainline version (bnc#708296,     bnc#784334) :

  - scsi_dh_alua: Enable STPG for unavailable ports

  - scsi_dh_alua: Re-enable STPG for unavailable ports

  - scsi_dh_alua: backoff alua rtpg retry linearly vs.
    geometrically

  - scsi_dh_alua: implement implied transition timeout

  - scsi_dh_alua: retry alua rtpg extended header for     illegal request response

  - Revert removal of ACPI procfs entries. (bnc#777283)

  - x86: Clear HPET configuration registers on startup.
    (bnc#748896)

  - mlx4: Fixed build warning, update references     (bnc#774500,LTC#83966).

  - xen/frontends: handle backend CLOSED without CLOSING.

  - xen/pciback: properly clean up after calling     pcistub_device_find().

  - xen/netfront: add netconsole support (bnc#763858     fate#313830).

  - netfilter: nf_conntrack_ipv6: fix tracking of ICMPv6     error messages containing fragments. (bnc#779750)

  - ipv6, xfrm: use conntrack-reassembled packet for policy     lookup. (bnc#780216)

  - inetpeer: add namespace support for inetpeer.
    (bnc#779969)

  - inetpeer: add parameter net for inet_getpeer_v4,v6.
    (bnc#779969)

  - inetpeer: make unused_peers list per-netns. (bnc#779969)

  - kABI: use net_generic to protect struct netns_ipv{4,6}.
    (bnc#779969)

  - patches.rpmify/kbuild-fix-gcc-x-syntax.patch: kbuild:
    Fix gcc -x syntax. (bnc#773831)

  - patches.suse/supported-flag: Re-enabled warning on     unsupported module loading.

  - nbd: clear waiting_queue on shutdown. (bnc#778630)

  - nohz: fix idle ticks in cpu summary line of /proc/stat     (follow up fix for bnc#767469, bnc#705551).

  - fix TAINT_NO_SUPPORT handling on module load.

  - NFS: Fix Oopses in nfs_lookup_revalidate and     nfs4_lookup_revalidate. (bnc#780008)

  - svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping     (bnc@779462).

  - net: do not disable sg for packets requiring no     checksum. (bnc#774859)

  - sfc: prevent extreme TSO parameters from stalling TX     queues. (bnc#774523 / CVE-2012-3412)

  - X86 MCE: Fix correct ring/severity identification in V86     case. (bnc#773267)

  - scsi_dh_rdac: Add a new netapp vendor/product string.
    (bnc#772483)

  - scsi_dh_rdac : Consolidate rdac strings together.
    (bnc#772483)

  - scsi_dh_rdac : minor return fix for rdac. (bnc#772483)

  - dh_rdac: Associate HBA and storage in rdac_controller to     support partitions in storage. (bnc#772454)

  - scsi_dh_rdac: Fix error path. (bnc#772454)

  - scsi_dh_rdac: Fix for unbalanced reference count.
    (bnc#772454)

  - sd: Ensure we correctly disable devices with unknown     protection type. (bnc#780876)

  - netfilter: ipset: timeout can be modified for already     added elements. (bnc#790457)

  - netfilter: ipset: fix adding ranges to hash types.
    (bnc#790498)

  - workqueue: exit rescuer_thread() as TASK_RUNNING.
    (bnc#789993)

  - xhci: Add Lynx Point LP to list of Intel switchable     hosts. (bnc#791853)

  - tg3: Introduce separate functions to allocate/free RX/TX     rings. (bnc#785554)

  - net-next: Add netif_get_num_default_rss_queues.
    (bnc#785554)

  - tg3: set maximal number of default RSS queues.
    (bnc#785554)

  - tg3: Allow number of rx and tx rings to be set     independently. (bnc#785554)

  - tg3: Separate coalescing setup for rx and tx.
    (bnc#785554)

  - tg3: Refactor tg3_open(). (bnc#785554)

  - tg3: Refactor tg3_close(). (bnc#785554)

  - tg3: Add support for ethtool -L|-l to get/set the number     of rings. (bnc#785554)

  - tg3: Disable multiple TX rings by default due to     hardware flaw. (bnc#785554)

  - x86, microcode, AMD: Add support for family 16h     processors (bnc#791498,fate#314145).

  - scsi_remove_target: fix softlockup regression on hot     remove. (bnc#789836)

  - autofs4: allow autofs to work outside the initial PID     namespace. (bnc#779294)

  - autofs4: translate pids to the right namespace for the     daemon. (bnc#779294)

  - vfs: dont chain pipe/anon/socket on superblock s_inodes     list. (bnc#789703)

  - reiserfs: fix problems with chowning setuid file w/     xattrs. (bnc#790920)

  - reiserfs: fix double-lock while chowning setuid file w/     xattrs. (bnc#790920)

  - ALSA: hda - Fix SSYNC register value for non-Intel     controllers (fate#313409,bnc#760833).

  - ALSA: hda: option to enable arbitrary buffer/period     sizes (fate#313409,bnc#760833).

  - ALSA: hda - Fix buffer-alignment regression with Nvidia     HDMI (fate#313409,bnc#760833).

  - ALSA: hda - explicitly set buffer-align flag for Nvidia     controllers (fate#313409,bnc#760833).

  - ALSA: hda - Add Lynx Point HD Audio Controller DeviceIDs     (fate#313409,bnc#760833).

  - ALSA: hda_intel: Add Device IDs for Intel Lynx Point-LP     PCH (fate#313409,bnc#760833).

  - USB: OHCI: workaround for hardware bug: retired TDs not     added to the Done Queue. (bnc#762158)

  - watchdog: iTCO_wdt: clean-up PCI device IDs     (fate#313409, bnc#760833).

  - watchdog: iTCO_wdt: add Intel Lynx Point DeviceIDs     (fate#313409, bnc#760833).

  - ahci: AHCI-mode SATA patch for Intel Lynx Point     DeviceIDs (fate#313409, bnc#760833).

  - ata_piix: IDE-mode SATA patch for Intel Lynx Point     DeviceIDs (fate#313409, bnc#760833).

  - i2c-i801: Add device IDs for Intel Lynx Point     (fate#313409, bnc#760833).

  - jbd: Fix lock ordering bug in journal_unmap_buffer().
    (bnc#790935)

  - usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP     Hardware. (bnc#788277)

  - usb: host: xhci: Fix NULL pointer dereferencing with     71c731a for non-x86 systems. (bnc#788277)

  - Do not remove fillup from the buildsystem. (bnc#781327)

  - ibmvfc: Fix double completion on abort timeout.
    (bnc#788452)

  - ibmvfc: Ignore fabric RSCNs when link is dead.
    (bnc#788452)

  - fs: only send IPI to invalidate LRU BH when needed.
    (bnc#763628 / bnc#744692)

  - smp: add func to IPI cpus based on parameter func.
    (bnc#763628 / bnc#744692)

  - smp: introduce a generic on_each_cpu_mask() function.
    (bnc#763628 / bnc#744692)

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An unprivileged user could exploit this flaw to read kernel stack memory. (CVE-2012-0957)

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE feature. On hosts, using qemu userspace, without the XSAVE feature an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem that can expose stale data. An unprivileged user could exploit this flaw to cause an information leak. (CVE-2012-4508)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents.
(CVE-2012-4530)

Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois congestion control algorithm. A local attacker could use this to cause a denial of service. (CVE-2012-4565)

A flaw was discovered in the Linux kernel's handling of new hot-plugged memory. An unprivileged local user could exploit this flaw to cause a denial of service by crashing the system. (CVE-2012-5517)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE CPU feature. On hosts without the XSAVE CPU feature, using qemu userspace, an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents.
(CVE-2012-4530)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE feature. On hosts, using qemu userspace, without the XSAVE feature an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents.
(CVE-2012-4530)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE feature. On hosts, using qemu userspace, without the XSAVE feature an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents.
(CVE-2012-4530).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The linux 3.6.7 stable update contains a number of important bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes CVE-2012-4461 and adds support for two rebranded BCM20702A0 bluetooth adapters. Also adds 1/2 of the fix for bug 859485. Latest upstream stable release v3.6.7. As usual, fixes across the tree. In addition to the listed bugs, this also fixes :

  - correct module signatures on PAE and -debug/PAEdebug     kernel flavours

    - external module builds with module signing

    - vanilla kernel builds

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2012-4461: kvm: invalid opcode oops on SET_SREGS with OSXSAVE bit set

Update to upstream stable release 3.6.7

Assorted other fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2013-0223.

ID	Name	Product	Family	Severity
79497	OracleVM 3.2 : kernel-uek (OVMSA-2013-0008)	Nessus	OracleVM Local Security Checks	medium
78877	F5 Networks BIG-IP : Linux kernel vulnerability (SOL15797)	Nessus	F5 Networks Local Security Checks	low
69725	Amazon Linux AMI : kernel (ALAS-2013-166)	Nessus	Amazon Linux Local Security Checks	medium
68847	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2013-2507)	Nessus	Oracle Linux Local Security Checks	high
68845	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2013-2503)	Nessus	Oracle Linux Local Security Checks	medium
68724	Oracle Linux 6 : kernel (ELSA-2013-0223)	Nessus	Oracle Linux Local Security Checks	medium
66705	RHEL 6 : kernel (RHSA-2013:0882)	Nessus	Red Hat Local Security Checks	medium
66431	Debian DSA-2668-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	medium
64492	CentOS 6 : kernel (CESA-2013:0223)	Nessus	CentOS Local Security Checks	medium
64489	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20130205)	Nessus	Scientific Linux Local Security Checks	medium
64479	RHEL 6 : kernel (RHSA-2013:0223)	Nessus	Red Hat Local Security Checks	medium
64436	Ubuntu 12.04 LTS : linux-lts-quantal - Linux kernel hardware enablement from Quantal regression (USN-1704-2)	Nessus	Ubuntu Local Security Checks	medium
64434	Ubuntu 12.10 : linux regression (USN-1699-2)	Nessus	Ubuntu Local Security Checks	medium
64432	Ubuntu 12.04 LTS : linux regression (USN-1696-2)	Nessus	Ubuntu Local Security Checks	medium
64180	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 7123 / 7127)	Nessus	SuSE Local Security Checks	high
63669	Ubuntu 12.04 LTS : linux-lts-quantal - Linux kernel hardware enablement from Quantal vulnerabilities (USN-1704-1)	Nessus	Ubuntu Local Security Checks	medium
63615	Ubuntu 12.10 : linux vulnerabilities (USN-1699-1)	Nessus	Ubuntu Local Security Checks	medium
63613	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1696-1)	Nessus	Ubuntu Local Security Checks	medium
63540	Ubuntu 11.10 : linux vulnerabilities (USN-1689-1)	Nessus	Ubuntu Local Security Checks	low
63539	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1688-1)	Nessus	Ubuntu Local Security Checks	low
63090	Fedora 16 : kernel-3.6.7-4.fc16 (2012-18691)	Nessus	Fedora Local Security Checks	low
63055	Fedora 18 : kernel-3.6.7-5.fc18 (2012-18740)	Nessus	Fedora Local Security Checks	low
63013	Fedora 17 : kernel-3.6.7-4.fc17 (2012-18684)	Nessus	Fedora Local Security Checks	low
801534	CentOS RHSA-2013-0223 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-4461

medium

Tenable Plugins

medium

low

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

low

low

low

low

low

high