The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's perf     subsystem retrieved userlevel stack traces on PowerPC     systems. A local, unprivileged user could use this flaw     to cause a denial of service on the system by creating     a special stack layout that would force the     perf_callchain_user_64() function into an infinite     loop.(CVE-2015-6526i1/4%0

  - A vulnerability was found in the Linux kernel. Payloads     of NM entries are not supposed to contain NUL. When     such entry is processed, only the part prior to the     first NUL goes into the concatenation (i.e. the     directory entry name being encoded by a bunch of NM     entries). The process stops when the amount collected     so far + the claimed amount in the current NM entry     exceed 254. However, the value returned as the total     length is the sum of *claimed* sizes, not the actual     amount collected. And that's what will be passed to     readdir() callback as the name length - 8Kb
    __copy_to_user() from a buffer allocated by
    __get_free_page().(CVE-2016-4913i1/4%0

  - The perf_trace_event_perm function in     kernel/trace/trace_event_perf.c in the Linux kernel     before 3.12.2 does not properly restrict access to the     perf subsystem, which allows local users to enable     function tracing via a crafted     application.(CVE-2013-2930i1/4%0

  - The mincore() implementation in mm/mincore.c in the     Linux kernel through 4.19.13 allowed local attackers to     observe page cache access patterns of other processes     on the same system, potentially allowing sniffing of     secret information. (Fixing this affects the output of     the fincore program.) Limited remote exploitation may     be possible, as demonstrated by latency differences in     accessing public files from an Apache HTTP     Server.(CVE-2019-5489i1/4%0

  - It was found that the espfix functionality could be     bypassed by installing a 16-bit RW data segment into     GDT instead of LDT (which espfix checks), and using     that segment on the stack. A local, unprivileged user     could potentially use this flaw to leak kernel stack     addresses.(CVE-2014-8133i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An out-of-bounds access is possible     in write_extent_buffer() when mounting and operating a     crafted btrfs image due to a lack of verification at     mount time within the btrfs_read_block_groups() in     fs/btrfs/extent-tree.c function. This could lead to a     system crash and a denial of service.(CVE-2018-14610i1/4%0

  - kernel/bpf/verifier.c in the Linux kernel through     4.14.8 mishandles states_equal comparisons between the     pointer data type and the UNKNOWN_VALUE data type,     which allows local users to obtain potentially     sensitive address information, aka a 'pointer     leak.'(CVE-2017-17864i1/4%0

  - drivers/hid/hid-lenovo-tpkbd.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows     physically proximate attackers to cause a denial of     service (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2894i1/4%0

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757i1/4%0

  - It was found that the original fix for CVE-2016-6786     was incomplete. There exist a race between two     concurrent sys_perf_event_open() calls when both try     and move the same pre-existing software group into a     hardware context.(CVE-2017-6001i1/4%0

  - In the Linux kernel before 4.20.12,     net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP     NAT module has insufficient ASN.1 length checks (aka an     array index error), making out-of-bounds read and write     operations possible, leading to an OOPS or local     privilege escalation. This affects snmp_version and     snmp_helper.(CVE-2019-9162i1/4%0

  - An information leak flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled access of the user control's     state. A local, privileged user could use this flaw to     leak kernel memory to user space.(CVE-2014-4652i1/4%0

  - A flaw was found that the vfs_rename() function did not     detect hard links on overlayfs. A local, unprivileged     user could use the rename syscall on overlayfs on top     of xfs to crash the system.(CVE-2016-6198i1/4%0

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way. This     could allow a local user to gain group privileges via     certain setgid applications.(CVE-2016-7097i1/4%0

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2014-9644i1/4%0

  - An arbitrary memory r/w access issue was found in the     Linux kernel compiled with the eBPF bpf(2) system call     (CONFIG_BPF_SYSCALL) support. The issue could occur due     to calculation errors in the eBPF verifier module,     triggered by user supplied malicious BPF program. An     unprivileged user could use this flaw to escalate their     privileges on a system. Setting parameter     'kernel.unprivileged_bpf_disabled=1' prevents such     privilege escalation by restricting access to bpf(2)     call.(CVE-2017-16995i1/4%0

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel     oops).(CVE-2017-15274i1/4%0

  - A flaw was found in the Linux kernel's keyring handling     code: the key_reject_and_link() function could be     forced to free an arbitrary memory block. An attacker     could use this flaw to trigger a use-after-free     condition on the system, potentially allowing for     privilege escalation.(CVE-2016-4470i1/4%0

  - A flaw was found in the way certain interfaces of the     Linux kernel's Infiniband subsystem used write() as     bi-directional ioctl() replacement, which could lead to     insufficient memory security checks when being invoked     using the splice() system call. A local unprivileged     user on a system with either Infiniband hardware     present or RDMA Userspace Connection Manager Access     module explicitly loaded, could use this flaw to     escalate their privileges on the     system.(CVE-2016-4565i1/4%0

  - It was found that the Linux kernel's IPv6 network stack     did not properly validate the value of the MTU variable     when it was set. A remote attacker could potentially     use this flaw to disrupt a target system's networking     (packet loss) by setting an invalid MTU value, for     example, via a NetworkManager daemon that is processing     router advertisement packets running on the target     system.(CVE-2015-8215i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - net/ceph/auth_none.c in the Linux kernel through 3.10     allows remote attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via an auth_reply message     that triggers an attempted build_request     operation.(CVE-2013-1059)

  - The dispatch_discard_io function in     drivers/block/xen-blkback/blkback.c in the Xen blkback     implementation in the Linux kernel before 3.10.5 allows     guest OS users to cause a denial of service (data loss)     via filesystem write operations on a read-only disk     that supports the (1) BLKIF_OP_DISCARD (aka discard or     TRIM) or (2) SCSI UNMAP feature.(CVE-2013-2140)

  - The mmc_ioctl_cdrom_read_data function in     drivers/cdrom/cdrom.c in the Linux kernel through 3.10     allows local users to obtain sensitive information from     kernel memory via a read operation on a malfunctioning     CD-ROM drive.(CVE-2013-2164)

  - Multiple array index errors in drivers/hid/hid-core.c     in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate     attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted     device that provides an invalid Report     ID.(CVE-2013-2888)

  - drivers/hid/hid-zpff.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_ZEROPLUS is enabled, allows physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2889)

  - drivers/hid/hid-pl.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_PANTHERLORD is enabled, allows physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2892)

  - A flaw was found in the way the get_dumpable() function     return value was interpreted in the ptrace subsystem of     the Linux kernel. When 'fs.suid_dumpable' was set to 2,     a local, unprivileged local user could use this flaw to     bypass intended ptrace restrictions and obtain     potentially sensitive information.(CVE-2013-2929)

  - The perf_trace_event_perm function in     kernel/trace/trace_event_perf.c in the Linux kernel     before 3.12.2 does not properly restrict access to the     perf subsystem, which allows local users to enable     function tracing via a crafted     application.(CVE-2013-2930)

  - The fib6_add_rt2node function in net/ipv6/ip6_fib.c in     the IPv6 stack in the Linux kernel through 3.10.1 does     not properly handle Router Advertisement (RA) messages     in certain circumstances involving three routes that     initially qualified for membership in an ECMP route set     until a change occurred for one of the first two     routes, which allows remote attackers to cause a denial     of service (system crash) via a crafted sequence of     messages.(CVE-2013-4125)

  - Use-after-free vulnerability in the     vhost_net_set_backend function in drivers/vhost/net.c     in the Linux kernel through 3.10.3 allows local users     to cause a denial of service (OOPS and system crash)     via vectors involving powering on a virtual     machine.(CVE-2013-4127)

  - The udp_v6_push_pending_frames function in     net/ipv6/udp.c in the IPv6 implementation in the Linux     kernel through 3.10.3 makes an incorrect function call     for pending data, which allows local users to cause a     denial of service (BUG and system crash) via a crafted     application that uses the UDP_CORK option in a     setsockopt system call.(CVE-2013-4162)

  - The ip6_append_data_mtu function in     net/ipv6/ip6_output.c in the IPv6 implementation in the     Linux kernel through 3.10.3 does not properly maintain     information about whether the IPV6_MTU setsockopt     option had been specified, which allows local users to     cause a denial of service (BUG and system crash) via a     crafted application that uses the UDP_CORK option in a     setsockopt system call.(CVE-2013-4163)

  - Memory leak in the unshare_userns function in     kernel/user_namespace.c in the Linux kernel before     3.10.6 allows local users to cause a denial of service     (memory consumption) via an invalid CLONE_NEWUSER     unshare call.(CVE-2013-4205)

  - Off-by-one error in the build_unc_path_to_root function     in fs/cifs/connect.c in the Linux kernel before 3.9.6     allows remote attackers to cause a denial of service     (memory corruption and system crash) via a DFS share     mount operation that triggers use of an unexpected DFS     referral name length.(CVE-2013-4247)

  - The net_ctl_permissions function in net/sysctl_net.c in     the Linux kernel before 3.11.5 does not properly     determine uid and gid values, which allows local users     to bypass intended /proc/sys/net restrictions via a     crafted application.(CVE-2013-4270)

  - Interpretation conflict in     drivers/md/dm-snap-persistent.c in the Linux kernel     through 3.11.6 allows remote authenticated users to     obtain sensitive information or modify data via a     crafted mapping to a snapshot block     device.(CVE-2013-4299)

  - The scm_check_creds function in net/core/scm.c in the     Linux kernel before 3.11 performs a capability check in     an incorrect namespace, which allows local users to     gain privileges via PID spoofing.(CVE-2013-4300)

  - It was found that the Linux kernel did not properly     account file descriptors passed over the unix socket     against the process limit. A local user could use this     flaw to exhaust all available memory on the     system.(CVE-2013-4312)

  - Use-after-free vulnerability in drivers/net/tun.c in     the Linux kernel through 3.11.1 allows local users to     gain privileges by leveraging the CAP_NET_ADMIN     capability and providing an invalid tuntap interface     name in a TUNSETIFF ioctl call.(CVE-2013-4343)

  - Off-by-one error in the get_prng_bytes function in     crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to     defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper     management of the state of the consumed     data.(CVE-2013-4345)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3070 advisory.

  - The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2     does not properly restrict access to the perf subsystem, which allows local users to enable function     tracing via a crafted application. (CVE-2013-2930)

  - The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel     through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device     is listening, which allows remote attackers to discover the original MAC address after spoofing by sending     a series of packets to MAC addresses with certain bit manipulations. (CVE-2013-4579)

  - The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers     to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect     packet data is transmitted during use of the NAT mangle feature. (CVE-2014-1690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel-rt packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise MRG 2.4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled sending of certain UDP packets over sockets that used the UDP_CORK option when the UDP Fragmentation Offload (UFO) feature was enabled on the output device. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges on the system. (CVE-2013-4470, Important)

* A flaw was found in the way the perf_trace_event_perm() function in the Linux kernel checked permissions for the function tracer functionality. An unprivileged local user could use this flaw to enable function tracing and cause a denial of service on the system.
(CVE-2013-2930, Moderate)

* A flaw was found in the way the net_ctl_permissions() function in the Linux kernel checked access permissions. A local, unprivileged user could potentially use this flaw to access certain files in /proc/sys/net regardless of the underlying file system permissions.
(CVE-2013-4270, Moderate)

* A flaw was found in the way the Linux kernel's Adaptec RAID controller (aacraid) checked permissions of compat IOCTLs. A local attacker could use this flaw to bypass intended security restrictions.
(CVE-2013-6383, Moderate)

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low)

* An invalid pointer dereference flaw was found in the Marvell 8xxx Libertas WLAN (libertas) driver in the Linux kernel. A local user able to write to a file that is provided by the libertas driver and located on the debug file system (debugfs) could use this flaw to crash the system. Note: The debugfs file system must be mounted locally to exploit this issue. It is not mounted by default. (CVE-2013-6378, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's IPv6 source address-based routing implementation. A local attacker who has the CAP_NET_ADMIN capability could use this flaw to crash the system.
(CVE-2013-6431, Low)

Red Hat would like to thank Hannes Frederic Sowa for reporting CVE-2013-4470. The CVE-2013-4270 issue was discovered by Miroslav Vadkerti of Red Hat.

This update also fixes multiple bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.8.13-rt27, correct these issues, and fix the bugs noted in the Red Hat Enterprise MRG 2 Technical Notes. The system must be rebooted for this update to take effect.

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2929)

Dave Jones and Vince Weaver reported a flaw in the Linux kernel's perf event subsystem that allows normal users to enable function tracing.
An unprivileged local user could exploit this flaw to obtain potentially sensitive information from the kernel. (CVE-2013-2930)

A flaw in the handling of memory regions of the kernel virtual machine (KVM) subsystem was discovered. A local user with the ability to assign a device could exploit this flaw to cause a denial of service (memory consumption). (CVE-2013-4592)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2929)

Dave Jones and Vince Weaver reported a flaw in the Linux kernel's per event subsystem that allows normal users to enable function tracing.
An unprivileged local user could exploit this flaw to obtain potentially sensitive information from the kernel. (CVE-2013-2930)

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. (CVE-2013-4345)

Jason Wang discovered a bug in the network flow dissector in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (infinite loop). (CVE-2013-4348)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a buffer overflow in the Ozmo Devices USB over WiFi devices. A local user could exploit this flaw to cause a denial of service or possibly unspecified impact.
(CVE-2013-4513)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for the SystemBase Multi-2/PCI serial card. An unprivileged user could obtain sensitive information from kernel memory.
(CVE-2013-4516)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

Nico Golde and Fabian Yamaguchi reported a flaw in the driver for Adaptec AACRAID scsi raid devices in the Linux kernel. A local user could use this flaw to cause a denial of service or possibly other unspecified impact. (CVE-2013-6380)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

A race condition flaw was discovered in the Linux kernel's ipc shared memory implementation. A local user could exploit this flaw to cause a denial of service (system crash) or possibly have unspecied other impacts. (CVE-2013-7026).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dave Jones and Vince Weaver reported a flaw in the Linux kernel's per event subsystem that allows normal users to enable function tracing.
An unprivileged local user could exploit this flaw to obtain potentially sensitive information from the kernel. (CVE-2013-2930)

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. (CVE-2013-4345)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a buffer overflow in the Ozmo Devices USB over WiFi devices. A local user could exploit this flaw to cause a denial of service or possibly unspecified impact.
(CVE-2013-4513)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

Evan Huus reported a buffer overflow in the Linux kernel's radiotap header parsing. A remote attacker could cause a denial of service (buffer over- read) via a specially crafted header. (CVE-2013-7027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h (CVE-2013-2929).

The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application (CVE-2013-2930).

Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c (CVE-2013-4511).

Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation (CVE-2013-4512).

Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions (CVE-2013-4514).

The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call (CVE-2013-4515).

Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots (CVE-2013-4592).

The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation (CVE-2013-6378).

The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command (CVE-2013-6380).

Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size (CVE-2013-6381).

The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call (CVE-2013-6383).

The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different vulnerability than CVE-2013-4511 (CVE-2013-6763).

The updated packages provides a solution for these security issues.

ID	Name	Product	Family	Severity
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	high
124985	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1532)	Nessus	Huawei Local Security Checks	high
124797	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1473)	Nessus	Huawei Local Security Checks	medium
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
83609	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2014:0189-1)	Nessus	SuSE Local Security Checks	high
77355	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2014-3070)	Nessus	Oracle Linux Local Security Checks	high
76672	RHEL 6 : MRG (RHSA-2014:0100)	Nessus	Red Hat Local Security Checks	medium
72575	Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2112-1)	Nessus	Ubuntu Local Security Checks	medium
72325	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 8823 / 8827)	Nessus	SuSE Local Security Checks	high
72324	SuSE 11.3 Security Update : Linux kernel (SAT Patch Number 8826)	Nessus	SuSE Local Security Checks	high
71799	Ubuntu 13.10 : linux vulnerabilities (USN-2075-1)	Nessus	Ubuntu Local Security Checks	high
71797	Ubuntu 12.10 : linux vulnerabilities (USN-2071-1)	Nessus	Ubuntu Local Security Checks	medium
71796	Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2070-1)	Nessus	Ubuntu Local Security Checks	high
71794	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-2068-1)	Nessus	Ubuntu Local Security Checks	medium
71511	Mandriva Linux Security Advisory : kernel (MDVSA-2013:291)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-2930

critical

Tenable Plugins

high

high

medium

critical

high

high

medium

medium

high

high

high

medium

high

medium

medium