Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to 3.0.101 and also includes various other bug and security fixes.

A new feature was added :

  - supported.conf: marked net/netfilter/xt_set as supported     (bnc#851066)(fate#313309)

The following security bugs have been fixed :

CVE-2013-4587: Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value. (bnc#853050)

CVE-2013-6368: The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address. (bnc#853052)

CVE-2013-6367: The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value. (bnc#853051)

CVE-2013-4592: Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots. (bnc#851101)

CVE-2013-6378: The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation. (bnc#852559)

CVE-2013-4514: Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions. (bnc#849029)

CVE-2013-4515: The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call. (bnc#849034)

CVE-2013-7027: The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame contains any data outside of the header, which might allow attackers to cause a denial of service (buffer over-read) via a crafted header.
(bnc#854634)

CVE-2013-4483: The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application. (bnc#848321)

CVE-2013-4511: Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c. (bnc#849021)

CVE-2013-6380: The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command. (bnc#852373)

CVE-2013-6463: Linux kernel built with the networking support(CONFIG_NET) is vulnerable to an information leakage flaw in the socket layer. It could occur while doing recvmsg(2), recvfrom(2) socket calls. It occurs due to improperly initialised msg_name & msg_namelen message header parameters. (bnc#854722)

CVE-2013-6383: The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call. (bnc#852558)

CVE-2013-4345: Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple requests for small amounts of data, leading to improper management of the state of the consumed data. (bnc#840226)

Also the following non-security bugs have been fixed :

  - kabi: protect bind_conflict callback in struct     inet_connection_sock_af_ops (bnc#823618).

  - printk: forcibly flush nmi ringbuffer if oops is in     progress (bnc#849675).

  - blktrace: Send BLK_TN_PROCESS events to all running     traces (bnc#838623).

  - x86/dumpstack: Fix printk_address for direct addresses     (bnc#845621).

  - futex: fix handling of read-only-mapped hugepages (VM     Functionality).

  - random: fix accounting race condition with lockless irq     entropy_count update (bnc#789359).

  - Provide realtime priority kthread and workqueue boot     options (bnc#836718).

  - sched: Fix several races in CFS_BANDWIDTH (bnc#848336).

  - sched: Fix cfs_bandwidth misuse of     hrtimer_expires_remaining (bnc#848336).

  - sched: Fix hrtimer_cancel()/rq->lock deadlock     (bnc#848336).

  - sched: Fix race on toggling cfs_bandwidth_used     (bnc#848336).

  - sched: Fix buglet in return_cfs_rq_runtime().

  - sched: Guarantee new group-entities always have weight     (bnc#848336).

  - sched: Use jump labels to reduce overhead when bandwidth     control is inactive (bnc#848336). watchdog: Get rid of     MODULE_ALIAS_MISCDEV statements (bnc#827767).

    tcp: bind() fix autoselection to share ports     (bnc#823618).

  - tcp: bind() use stronger condition for bind_conflict     (bnc#823618).

  - tcp: ipv6: bind() use stronger condition for     bind_conflict (bnc#823618).

  - macvlan: disable LRO on lower device instead of macvlan     (bnc#846984).

  - macvlan: introduce IFF_MACVLAN flag and helper function     (bnc#846984).

  - macvlan: introduce macvlan_dev_real_dev() helper     function (bnc#846984).

  - xen: netback: bump tx queue length (bnc#849404).

  - xen: xen_spin_kick fixed crash/lock release     (bnc#807434)(bnc#848652).

  - xen: fixed USB passthrough issue (bnc#852624).

  - netxen: fix off by one bug in netxen_release_tx_buffer()     (bnc#845729).

  - xfrm: invalidate dst on policy insertion/deletion     (bnc#842239). xfrm: prevent ipcomp scratch buffer race     condition (bnc#842239).

    crypto: Fix aes-xts parameter corruption (bnc#854546,     LTC#100718).

    crypto: gf128mul - fix call to memset() (obvious fix).

    autofs4: autofs4_wait() vs. autofs4_catatonic_mode()     race (bnc#851314).

  - autofs4: catatonic_mode vs. notify_daemon race     (bnc#851314).

  - autofs4: close the races around autofs4_notify_daemon()     (bnc#851314).

  - autofs4: deal with autofs4_write/autofs4_write races     (bnc#851314).

  - autofs4 - dont clear DCACHE_NEED_AUTOMOUNT on rootless     mount (bnc#851314).

  - autofs4 - fix deal with autofs4_write races     (bnc#851314). autofs4 - use simple_empty() for empty     directory check (bnc#851314).

    blkdev_max_block: make private to fs/buffer.c     (bnc#820338).

    Avoid softlockup in shrink_dcache_for_umount_subtree     (bnc#834473).

    dlm: set zero linger time on sctp socket (bnc#787843).

  - SUNRPC: Fix a data corruption issue when retransmitting     RPC calls (bnc#855037)

  - nfs: Change NFSv4 to not recover locks after they are     lost (bnc#828236). nfs: Adapt readdirplus to application     usage patterns (bnc#834708).

    xfs: Account log unmount transaction correctly     (bnc#849950).

  - xfs: improve ioend error handling (bnc#846036).

  - xfs: reduce ioend latency (bnc#846036).

  - xfs: use per-filesystem I/O completion workqueues     (bnc#846036). xfs: Hide additional entries in struct     xfs_mount (bnc#846036 bnc#848544).

    vfs: avoid 'attempt to access beyond end of device'     warnings (bnc#820338).

    vfs: fix O_DIRECT read past end of block device     (bnc#820338).

    cifs: Improve performance of browsing directories with     several files (bnc#810323).

    cifs: Ensure cifs directories do not show up as files     (bnc#826602).

    sd: avoid deadlocks when running under multipath     (bnc#818545).

  - sd: fix crash when UA received on DIF enabled device     (bnc#841445). sg: fix blk_get_queue usage (bnc#834808).

    block: factor out vector mergeable decision to a helper     function (bnc#769644).

    block: modify __bio_add_page check to accept pages that     do not start a new segment (bnc#769644).

    dm-multipath: abort all requests when failing a path     (bnc#798050).

  - scsi: Add 'eh_deadline' to limit SCSI EH runtime     (bnc#798050).

  - scsi: Allow error handling timeout to be specified     (bnc#798050).

  - scsi: Fixup compilation warning (bnc#798050).

  - scsi: Retry failfast commands after EH (bnc#798050).

  - scsi: Warn on invalid command completion (bnc#798050).

  - scsi: kABI fixes (bnc#798050).

  - scsi: remove check for 'resetting' (bnc#798050).

  - advansys: Remove 'last_reset' references (bnc#798050).

  - cleanup setting task state in scsi_error_handler()     (bnc#798050).

  - dc395: Move 'last_reset' into internal host structure     (bnc#798050).

  - dpt_i2o: Remove DPTI_STATE_IOCTL (bnc#798050).

  - dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset     (bnc#798050). tmscsim: Move 'last_reset' into host     structure (bnc#798050).

    scsi_dh: invoke callback if ->activate is not present     (bnc#708296).

  - scsi_dh: return individual errors in scsi_dh_activate()     (bnc#708296).

  - scsi_dh_alua: Decode EMC Clariion extended inquiry     (bnc#708296).

  - scsi_dh_alua: Decode HP EVA array identifier     (bnc#708296).

  - scsi_dh_alua: Evaluate state for all port groups     (bnc#708296).

  - scsi_dh_alua: Fix missing close brace in     alua_check_sense (bnc#843642).

  - scsi_dh_alua: Make stpg synchronous (bnc#708296).

  - scsi_dh_alua: Pass buffer as function argument     (bnc#708296).

  - scsi_dh_alua: Re-evaluate port group states after STPG     (bnc#708296).

  - scsi_dh_alua: Recheck state on transitioning     (bnc#708296).

  - scsi_dh_alua: Rework rtpg workqueue (bnc#708296).

  - scsi_dh_alua: Use separate alua_port_group structure     (bnc#708296).

  - scsi_dh_alua: Allow get_alua_data() to return NULL     (bnc#839407).

  - scsi_dh_alua: asynchronous RTPG (bnc#708296).

  - scsi_dh_alua: correctly terminate target port strings     (bnc#708296).

  - scsi_dh_alua: defer I/O while workqueue item is pending     (bnc#708296).

  - scsi_dh_alua: Do not attach to RAID or enclosure devices     (bnc#819979).

  - scsi_dh_alua: Do not attach to well-known LUNs     (bnc#821980).

  - scsi_dh_alua: fine-grained locking in alua_rtpg_work()     (bnc#708296).

  - scsi_dh_alua: invalid state information for 'optimized'     paths (bnc#843445).

  - scsi_dh_alua: move RTPG to workqueue (bnc#708296).

  - scsi_dh_alua: move 'expiry' into PG structure     (bnc#708296).

  - scsi_dh_alua: move some sense code handling into generic     code (bnc#813245).

  - scsi_dh_alua: multipath failover fails with error 15     (bnc#825696).

  - scsi_dh_alua: parse target device id (bnc#708296).

  - scsi_dh_alua: protect accesses to struct alua_port_group     (bnc#708296).

  - scsi_dh_alua: put sense buffer on stack (bnc#708296).

  - scsi_dh_alua: reattaching device handler fails with     'Error 15' (bnc#843429).

  - scsi_dh_alua: remove locking when checking state     (bnc#708296).

  - scsi_dh_alua: remove stale variable (bnc#708296).

  - scsi_dh_alua: retry RTPG on UNIT ATTENTION (bnc#708296).

  - scsi_dh_alua: retry command on 'mode parameter changed'     sense code (bnc#843645).

  - scsi_dh_alua: simplify alua_check_sense() (bnc#843642).

  - scsi_dh_alua: simplify state update (bnc#708296).

  - scsi_dh_alua: use delayed_work (bnc#708296).

  - scsi_dh_alua: use flag for RTPG extended header     (bnc#708296).

  - scsi_dh_alua: use local buffer for VPD inquiry     (bnc#708296). scsi_dh_alua: use spin_lock_irqsave for     port group (bnc#708296).

    lpfc: Do not free original IOCB whenever ABTS fails     (bnc#806988).

  - lpfc: Fix kernel warning on spinlock usage (bnc#806988).
    lpfc: Fixed system panic due to midlayer abort     (bnc#806988).

    qla2xxx: Add module parameter to override the default     request queue size (bnc#826756).

    qla2xxx: Module parameter 'ql2xasynclogin' (bnc#825896).

    bna: do not register ndo_set_rx_mode callback     (bnc#847261).

  - hv: handle more than just WS2008 in KVP negotiation     (bnc#850640). drm: do not add inferred modes for     monitors that do not support them (bnc#849809).

    pci/quirks: Modify reset method for Chelsio T4     (bnc#831168).

  - pci: fix truncation of resource size to 32 bits     (bnc#843419).

  - pci: pciehp: Retrieve link speed after link is trained     (bnc#820102).

  - pci: Separate pci_bus_read_dev_vendor_id from     pci_scan_device (bnc#820102).

  - pci: pciehp: replace unconditional sleep with config     space access check (bnc#820102).

  - pci: pciehp: make check_link_active more helpful     (bnc#820102).

  - pci: pciehp: Add pcie_wait_link_not_active()     (bnc#820102).

  - pci: pciehp: Add Disable/enable link functions     (bnc#820102). pci: pciehp: Disable/enable link during     slot power off/on (bnc#820102).

    mlx4: allocate just enough pages instead of always 4     pages (bnc#835186 bnc#835074).

  - mlx4: allow order-0 memory allocations in RX path     (bnc#835186 bnc#835074).

  - net/mlx4: use one page fragment per incoming frame     (bnc#835186 bnc#835074). qeth: request length checking     in snmp ioctl (bnc#849848, LTC#99511).

    cio: add message for timeouts on internal I/O     (bnc#837739,LTC#97047).

  - s390/cio: dont abort verification after missing irq     (bnc#837739,LTC#97047).

  - s390/cio: skip broken paths (bnc#837739,LTC#97047).

  - s390/cio: export vpm via sysfs (bnc#837739,LTC#97047).

  - s390/cio: handle unknown pgroup state     (bnc#837739,LTC#97047).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 6. This is the fifth regular update.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way the Linux kernel's IPv6 implementation handled certain UDP packets when the UDP Fragmentation Offload (UFO) feature was enabled. A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system.
(CVE-2013-4387, Important)

* A flaw was found in the way the Linux kernel handled the creation of temporary IPv6 addresses. If the IPv6 privacy extension was enabled (/proc/sys/net/ipv6/conf/eth0/use_tempaddr set to '2'), an attacker on the local network could disable IPv6 temporary address generation, leading to a potential information disclosure. (CVE-2013-0343, Moderate)

* A flaw was found in the way the Linux kernel handled HID (Human Interface Device) reports with an out-of-bounds Report ID. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system.
(CVE-2013-2888, Moderate)

* An off-by-one flaw was found in the way the ANSI CPRNG implementation in the Linux kernel processed non-block size aligned requests. This could lead to random numbers being generated with less bits of entropy than expected when ANSI CPRNG was used.
(CVE-2013-4345, Moderate)

* It was found that the fix for CVE-2012-2375 released via RHSA-2012:1580 accidentally removed a check for small-sized result buffers. A local, unprivileged user with access to an NFSv4 mount with ACL support could use this flaw to crash the system or, potentially, escalate their privileges on the system . (CVE-2013-4591, Moderate)

* A flaw was found in the way IOMMU memory mappings were handled when moving memory slots. A malicious user on a KVM host who has the ability to assign a device to a guest could use this flaw to crash the host. (CVE-2013-4592, Moderate)

* Heap-based buffer overflow flaws were found in the way the Zeroplus and Pantherlord/GreenAsia game controllers handled HID reports. An attacker with physical access to the system could use these flaws to crash the system or, potentially, escalate their privileges on the system. (CVE-2013-2889, CVE-2013-2892, Moderate)

* Two information leak flaws were found in the logical link control (LLC) implementation in the Linux kernel. A local, unprivileged user could use these flaws to leak kernel stack memory to user space.
(CVE-2012-6542, CVE-2013-3231, Low)

* A heap-based buffer overflow in the way the tg3 Ethernet driver parsed the vital product data (VPD) of devices could allow an attacker with physical access to a system to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1929, Low)

* Information leak flaws in the Linux kernel could allow a privileged, local user to leak kernel memory to user space. (CVE-2012-6545, CVE-2013-1928, CVE-2013-2164, CVE-2013-2234, Low)

* A format string flaw was found in the Linux kernel's block layer. A privileged, local user could potentially use this flaw to escalate their privileges to kernel level (ring0). (CVE-2013-2851, Low)

Red Hat would like to thank Stephan Mueller for reporting CVE-2013-4345, and Kees Cook for reporting CVE-2013-2851.

This update also fixes several hundred bugs and adds enhancements.
Refer to the Red Hat Enterprise Linux 6.5 Release Notes for information on the most significant of these changes, and the Technical Notes for further information, both linked to in the References.

All Red Hat Enterprise Linux 6 users are advised to install these updated packages, which correct these issues, and fix the bugs and add the enhancements noted in the Red Hat Enterprise Linux 6.5 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2929)

A flaw in the handling of memory regions of the kernel virtual machine (KVM) subsystem was discovered. A local user with the ability to assign a device could exploit this flaw to cause a denial of service (memory consumption). (CVE-2013-4592)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

Nico Golde and Fabian Yamaguchi reported a flaw in the driver for Adaptec AACRAID scsi raid devices in the Linux kernel. A local user could use this flaw to cause a denial of service or possibly other unspecified impact. (CVE-2013-6380).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2929)

Dave Jones and Vince Weaver reported a flaw in the Linux kernel's perf event subsystem that allows normal users to enable function tracing.
An unprivileged local user could exploit this flaw to obtain potentially sensitive information from the kernel. (CVE-2013-2930)

A flaw in the handling of memory regions of the kernel virtual machine (KVM) subsystem was discovered. A local user with the ability to assign a device could exploit this flaw to cause a denial of service (memory consumption). (CVE-2013-4592)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3002 advisory.

  - The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the     Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain     sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device,     related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32     command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.
    (CVE-2013-2147)

  - The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4     does not initialize a certain structure member, which allows local users to obtain sensitive information     from kernel memory via a read operation on the fanotify descriptor. (CVE-2013-2148)

  - Heap-based buffer overflow in the iscsi_add_notunderstood_response function in     drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through     3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly     execute arbitrary code via a long key that is not properly handled during construction of an error-     response packet. (CVE-2013-2850)

  - The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF,     CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a     denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-     lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c. (CVE-2013-2893)

  - drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a     crafted device. (CVE-2013-2895)

  - drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted device. (CVE-2013-2896)

  - Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem     in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate     attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via     a crafted device. (CVE-2013-2897)

  - drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive     information from kernel memory via a crafted device. (CVE-2013-2898)

  - drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) via a crafted device. (CVE-2013-2899)

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures     and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing the network. (CVE-2013-4350)

  - Memory leak in the unshare_userns function in kernel/user_namespace.c in the Linux kernel before 3.10.6     allows local users to cause a denial of service (memory consumption) via an invalid CLONE_NEWUSER unshare     call. (CVE-2013-4205)

  - Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before     3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS     share mount operation that triggers use of an unexpected DFS referral name length. (CVE-2013-4247)

  - The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly     determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a     crafted application. (CVE-2013-4270)

  - The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check     in an incorrect namespace, which allows local users to gain privileges via PID spoofing. (CVE-2013-4300)

  - The fib6_add function in net/ipv6/ip6_fib.c in the Linux kernel before 3.11.5 does not properly implement     error-code encoding, which allows local users to cause a denial of service (NULL pointer dereference and     system crash) by leveraging the CAP_NET_ADMIN capability for an IPv6 SIOCADDRT ioctl call. (CVE-2013-6431)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to 3.0.101 and also includes various other bug and security fixes.

A new feature was added :

  - supported.conf: marked net/netfilter/xt_set as supported     (bnc#851066)(fate#313309) The following security bugs     have been fixed :

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value. (bnc#853050).
    (CVE-2013-4587)

  - The KVM subsystem in the Linux kernel through 3.12.5     allows local users to gain privileges or cause a denial     of service (system crash) via a VAPIC synchronization     operation involving a page-end address. (bnc#853052).
    (CVE-2013-6368)

  - The apic_get_tmcct function in arch/x86/kvm/lapic.c in     the KVM subsystem in the Linux kernel through 3.12.5     allows guest OS users to cause a denial of service     (divide-by-zero error and host OS crash) via crafted     modifications of the TMICT value. (bnc#853051).
    (CVE-2013-6367)

  - Memory leak in the __kvm_set_memory_region function in     virt/kvm/kvm_main.c in the Linux kernel before 3.9     allows local users to cause a denial of service (memory     consumption) by leveraging certain device access to     trigger movement of memory slots. (bnc#851101).
    (CVE-2013-4592)

  - The lbs_debugfs_write function in     drivers/net/wireless/libertas/debugfs.c in the Linux     kernel through 3.12.1 allows local users to cause a     denial of service (OOPS) by leveraging root privileges     for a zero-length write operation. (bnc#852559).
    (CVE-2013-6378)

  - Multiple buffer overflows in     drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel     before 3.12 allow local users to cause a denial of     service or possibly have unspecified other impact by     leveraging the CAP_NET_ADMIN capability and providing a     long station-name string, related to the (1)     wvlan_uil_put_info and (2) wvlan_set_station_nickname     functions. (bnc#849029). (CVE-2013-4514)

  - The bcm_char_ioctl function in     drivers/staging/bcm/Bcmchar.c in the Linux kernel before     3.12 does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO     ioctl call. (bnc#849034). (CVE-2013-4515)

  - The ieee80211_radiotap_iterator_init function in     net/wireless/radiotap.c in the Linux kernel before     3.11.7 does not check whether a frame contains any data     outside of the header, which might allow attackers to     cause a denial of service (buffer over-read) via a     crafted header. (bnc#854634). (CVE-2013-7027)

  - The ipc_rcu_putref function in ipc/util.c in the Linux     kernel before 3.10 does not properly manage a reference     count, which allows local users to cause a denial of     service (memory consumption or system crash) via a     crafted application. (bnc#848321). (CVE-2013-4483)

  - Multiple integer overflows in Alchemy LCD frame-buffer     drivers in the Linux kernel before 3.12 allow local     users to create a read-write memory mapping for the     entirety of kernel memory, and consequently gain     privileges, via crafted mmap operations, related to the     (1) au1100fb_fb_mmap function in     drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap     function in drivers/video/au1200fb.c. (bnc#849021).
    (CVE-2013-4511)

  - The aac_send_raw_srb function in     drivers/scsi/aacraid/commctrl.c in the Linux kernel     through 3.12.1 does not properly validate a certain size     value, which allows local users to cause a denial of     service (invalid pointer dereference) or possibly have     unspecified other impact via an FSACTL_SEND_RAW_SRB     ioctl call that triggers a crafted SRB command.
    (bnc#852373). (CVE-2013-6380)

  - Linux kernel built with the networking     support(CONFIG_NET) is vulnerable to an information     leakage flaw in the socket layer. It could occur while     doing recvmsg(2), recvfrom(2) socket calls. It occurs     due to improperly initialised msg_name &amp; msg_namelen     message header parameters. (bnc#854722). (CVE-2013-6463)

  - The aac_compat_ioctl function in     drivers/scsi/aacraid/linit.c in the Linux kernel before     3.11.8 does not require the CAP_SYS_RAWIO capability,     which allows local users to bypass intended access     restrictions via a crafted ioctl call. (bnc#852558).
    (CVE-2013-6383)

  - Off-by-one error in the get_prng_bytes function in     crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to     defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper     management of the state of the consumed data.
    (bnc#840226). (CVE-2013-4345)

Also the following non-security bugs have been fixed :

  - kabi: protect bind_conflict callback in struct     inet_connection_sock_af_ops. (bnc#823618)

  - printk: forcibly flush nmi ringbuffer if oops is in     progress. (bnc#849675)

  - blktrace: Send BLK_TN_PROCESS events to all running     traces. (bnc#838623)

  - x86/dumpstack: Fix printk_address for direct addresses.
    (bnc#845621)

  - futex: fix handling of read-only-mapped hugepages (VM     Functionality).

  - random: fix accounting race condition with lockless irq     entropy_count update. (bnc#789359)

  - Provide realtime priority kthread and workqueue boot     options. (bnc#836718)

  - sched: Fix several races in CFS_BANDWIDTH. (bnc#848336)

  - sched: Fix cfs_bandwidth misuse of     hrtimer_expires_remaining. (bnc#848336)

  - sched: Fix hrtimer_cancel()/rq->lock deadlock.
    (bnc#848336)

  - sched: Fix race on toggling cfs_bandwidth_used.
    (bnc#848336)

  - sched: Fix buglet in return_cfs_rq_runtime().

  - sched: Guarantee new group-entities always have weight.
    (bnc#848336)

  - sched: Use jump labels to reduce overhead when bandwidth     control is inactive. (bnc#848336)

  - watchdog: Get rid of MODULE_ALIAS_MISCDEV statements.
    (bnc#827767)

  - tcp: bind() fix autoselection to share ports.
    (bnc#823618)

  - tcp: bind() use stronger condition for bind_conflict.
    (bnc#823618)

  - tcp: ipv6: bind() use stronger condition for     bind_conflict. (bnc#823618)

  - macvlan: disable LRO on lower device instead of macvlan.
    (bnc#846984)

  - macvlan: introduce IFF_MACVLAN flag and helper function.
    (bnc#846984)

  - macvlan: introduce macvlan_dev_real_dev() helper     function. (bnc#846984)

  - xen: netback: bump tx queue length. (bnc#849404)

  - xen: xen_spin_kick fixed crash/lock release     (bnc#807434)(bnc#848652).

  - xen: fixed USB passthrough issue. (bnc#852624)

  - netxen: fix off by one bug in     netxen_release_tx_buffer(). (bnc#845729)

  - xfrm: invalidate dst on policy insertion/deletion.
    (bnc#842239)

  - xfrm: prevent ipcomp scratch buffer race condition.
    (bnc#842239)

  - crypto: Fix aes-xts parameter corruption (bnc#854546,     LTC#100718).

  - crypto: gf128mul - fix call to memset() (obvious fix).

  - autofs4: autofs4_wait() vs. autofs4_catatonic_mode()     race. (bnc#851314)

  - autofs4: catatonic_mode vs. notify_daemon race.
    (bnc#851314)

  - autofs4: close the races around autofs4_notify_daemon().
    (bnc#851314)

  - autofs4: deal with autofs4_write/autofs4_write races.
    (bnc#851314)

  - autofs4 - dont clear DCACHE_NEED_AUTOMOUNT on rootless     mount. (bnc#851314)

  - autofs4 - fix deal with autofs4_write races.
    (bnc#851314)

  - autofs4 - use simple_empty() for empty directory check.
    (bnc#851314)

  - blkdev_max_block: make private to fs/buffer.c.
    (bnc#820338)

  - Avoid softlockup in shrink_dcache_for_umount_subtree.
    (bnc#834473)

  - dlm: set zero linger time on sctp socket. (bnc#787843)

  - SUNRPC: Fix a data corruption issue when retransmitting     RPC calls. (bnc#855037)

  - nfs: Change NFSv4 to not recover locks after they are     lost. (bnc#828236)

  - nfs: Adapt readdirplus to application usage patterns.
    (bnc#834708)

  - xfs: Account log unmount transaction correctly.
    (bnc#849950)

  - xfs: improve ioend error handling. (bnc#846036)

  - xfs: reduce ioend latency. (bnc#846036)

  - xfs: use per-filesystem I/O completion workqueues.
    (bnc#846036)

  - xfs: Hide additional entries in struct xfs_mount.
    (bnc#846036 / bnc#848544)

  - vfs: avoid 'attempt to access beyond end of device'     warnings. (bnc#820338)

  - vfs: fix O_DIRECT read past end of block device.
    (bnc#820338)

  - cifs: Improve performance of browsing directories with     several files. (bnc#810323)

  - cifs: Ensure cifs directories do not show up as files.
    (bnc#826602)

  - sd: avoid deadlocks when running under multipath.
    (bnc#818545)

  - sd: fix crash when UA received on DIF enabled device.
    (bnc#841445)

  - sg: fix blk_get_queue usage. (bnc#834808)

  - block: factor out vector mergeable decision to a helper     function. (bnc#769644)

  - block: modify __bio_add_page check to accept pages that     do not start a new segment. (bnc#769644)

  - dm-multipath: abort all requests when failing a path.
    (bnc#798050)

  - scsi: Add 'eh_deadline' to limit SCSI EH runtime.
    (bnc#798050)

  - scsi: Allow error handling timeout to be specified.
    (bnc#798050)

  - scsi: Fixup compilation warning. (bnc#798050)

  - scsi: Retry failfast commands after EH. (bnc#798050)

  - scsi: Warn on invalid command completion. (bnc#798050)

  - scsi: kABI fixes. (bnc#798050)

  - scsi: remove check for 'resetting'. (bnc#798050)

  - advansys: Remove 'last_reset' references. (bnc#798050)

  - cleanup setting task state in scsi_error_handler().
    (bnc#798050)

  - dc395: Move 'last_reset' into internal host structure.
    (bnc#798050)

  - dpt_i2o: Remove DPTI_STATE_IOCTL. (bnc#798050)

  - dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset.
    (bnc#798050)

  - tmscsim: Move 'last_reset' into host structure.
    (bnc#798050)

  - scsi_dh: invoke callback if ->activate is not present.
    (bnc#708296)

  - scsi_dh: return individual errors in scsi_dh_activate().
    (bnc#708296)

  - scsi_dh_alua: Decode EMC Clariion extended inquiry.
    (bnc#708296)

  - scsi_dh_alua: Decode HP EVA array identifier.
    (bnc#708296)

  - scsi_dh_alua: Evaluate state for all port groups.
    (bnc#708296)

  - scsi_dh_alua: Fix missing close brace in     alua_check_sense. (bnc#843642)

  - scsi_dh_alua: Make stpg synchronous. (bnc#708296)

  - scsi_dh_alua: Pass buffer as function argument.
    (bnc#708296)

  - scsi_dh_alua: Re-evaluate port group states after STPG.
    (bnc#708296)

  - scsi_dh_alua: Recheck state on transitioning.
    (bnc#708296)

  - scsi_dh_alua: Rework rtpg workqueue. (bnc#708296)

  - scsi_dh_alua: Use separate alua_port_group structure.
    (bnc#708296)

  - scsi_dh_alua: Allow get_alua_data() to return NULL.
    (bnc#839407)

  - scsi_dh_alua: asynchronous RTPG. (bnc#708296)

  - scsi_dh_alua: correctly terminate target port strings.
    (bnc#708296)

  - scsi_dh_alua: defer I/O while workqueue item is pending.
    (bnc#708296)

  - scsi_dh_alua: Do not attach to RAID or enclosure     devices. (bnc#819979)

  - scsi_dh_alua: Do not attach to well-known LUNs.
    (bnc#821980)

  - scsi_dh_alua: fine-grained locking in alua_rtpg_work().
    (bnc#708296)

  - scsi_dh_alua: invalid state information for 'optimized'     paths. (bnc#843445)

  - scsi_dh_alua: move RTPG to workqueue. (bnc#708296)

  - scsi_dh_alua: move 'expiry' into PG structure.
    (bnc#708296)

  - scsi_dh_alua: move some sense code handling into generic     code. (bnc#813245)

  - scsi_dh_alua: multipath failover fails with error 15.
    (bnc#825696)

  - scsi_dh_alua: parse target device id. (bnc#708296)

  - scsi_dh_alua: protect accesses to struct     alua_port_group. (bnc#708296)

  - scsi_dh_alua: put sense buffer on stack. (bnc#708296)

  - scsi_dh_alua: reattaching device handler fails with     'Error 15'. (bnc#843429)

  - scsi_dh_alua: remove locking when checking state.
    (bnc#708296)

  - scsi_dh_alua: remove stale variable. (bnc#708296)

  - scsi_dh_alua: retry RTPG on UNIT ATTENTION. (bnc#708296)

  - scsi_dh_alua: retry command on 'mode parameter changed'     sense code. (bnc#843645)

  - scsi_dh_alua: simplify alua_check_sense(). (bnc#843642)

  - scsi_dh_alua: simplify state update. (bnc#708296)

  - scsi_dh_alua: use delayed_work. (bnc#708296)

  - scsi_dh_alua: use flag for RTPG extended header.
    (bnc#708296)

  - scsi_dh_alua: use local buffer for VPD inquiry.
    (bnc#708296)

  - scsi_dh_alua: use spin_lock_irqsave for port group.
    (bnc#708296)

  - lpfc: Do not free original IOCB whenever ABTS fails.
    (bnc#806988)

  - lpfc: Fix kernel warning on spinlock usage. (bnc#806988)

  - lpfc: Fixed system panic due to midlayer abort.
    (bnc#806988)

  - qla2xxx: Add module parameter to override the default     request queue size. (bnc#826756)

  - qla2xxx: Module parameter 'ql2xasynclogin'. (bnc#825896)

  - bna: do not register ndo_set_rx_mode callback.
    (bnc#847261)

  - hv: handle more than just WS2008 in KVP negotiation.
    (bnc#850640)

  - drm: do not add inferred modes for monitors that do not     support them. (bnc#849809)

  - pci/quirks: Modify reset method for Chelsio T4.
    (bnc#831168)

  - pci: fix truncation of resource size to 32 bits.
    (bnc#843419)

  - pci: pciehp: Retrieve link speed after link is trained.
    (bnc#820102)

  - pci: Separate pci_bus_read_dev_vendor_id from     pci_scan_device. (bnc#820102)

  - pci: pciehp: replace unconditional sleep with config     space access check. (bnc#820102)

  - pci: pciehp: make check_link_active more helpful.
    (bnc#820102)

  - pci: pciehp: Add pcie_wait_link_not_active().
    (bnc#820102)

  - pci: pciehp: Add Disable/enable link functions.
    (bnc#820102)

  - pci: pciehp: Disable/enable link during slot power     off/on. (bnc#820102)

  - mlx4: allocate just enough pages instead of always 4     pages. (bnc#835186 / bnc#835074)

  - mlx4: allow order-0 memory allocations in RX path.
    (bnc#835186 / bnc#835074)

  - net/mlx4: use one page fragment per incoming frame.
    (bnc#835186 / bnc#835074)

  - qeth: request length checking in snmp ioctl (bnc#849848,     LTC#99511).

  - cio: add message for timeouts on internal I/O     (bnc#837739,LTC#97047).

  - s390/cio: dont abort verification after missing irq     (bnc#837739,LTC#97047).

  - s390/cio: skip broken paths (bnc#837739,LTC#97047).

  - s390/cio: export vpm via sysfs (bnc#837739,LTC#97047).

  - s390/cio: handle unknown pgroup state     (bnc#837739,LTC#97047).

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote authenticated user could exploit this flaw to obtain sensitive information or modify/corrupt data. (CVE-2013-4299)

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP Fragmentation Offload (UFO). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2013-4470)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

A flaw in the handling of memory regions of the kernel virtual machine (KVM) subsystem was discovered. A local user with the ability to assign a device could exploit this flaw to cause a denial of service (memory consumption). (CVE-2013-4592)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

Evan Huus reported a buffer overflow in the Linux kernel's radiotap header parsing. A remote attacker could cause a denial of service (buffer over- read) via a specially crafted header. (CVE-2013-7027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h (CVE-2013-2929).

The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application (CVE-2013-2930).

Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c (CVE-2013-4511).

Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation (CVE-2013-4512).

Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions (CVE-2013-4514).

The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call (CVE-2013-4515).

Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots (CVE-2013-4592).

The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation (CVE-2013-6378).

The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command (CVE-2013-6380).

Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size (CVE-2013-6381).

The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call (CVE-2013-6383).

The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different vulnerability than CVE-2013-4511 (CVE-2013-6763).

The updated packages provides a solution for these security issues.

This update fixes the following security issues :

  - A flaw was found in the way the Linux kernel's IPv6     implementation handled certain UDP packets when the UDP     Fragmentation Offload (UFO) feature was enabled. A     remote attacker could use this flaw to crash the system     or, potentially, escalate their privileges on the     system. (CVE-2013-4387, Important)

  - A flaw was found in the way the Linux kernel handled the     creation of temporary IPv6 addresses. If the IPv6     privacy extension was enabled     (/proc/sys/net/ipv6/conf/eth0/use_tempaddr set to '2'),     an attacker on the local network could disable IPv6     temporary address generation, leading to a potential     information disclosure. (CVE-2013-0343, Moderate)

  - A flaw was found in the way the Linux kernel handled HID     (Human Interface Device) reports with an out-of-bounds     Report ID. An attacker with physical access to the     system could use this flaw to crash the system or,     potentially, escalate their privileges on the system.
    (CVE-2013-2888, Moderate)

  - An off-by-one flaw was found in the way the ANSI CPRNG     implementation in the Linux kernel processed non-block     size aligned requests. This could lead to random numbers     being generated with less bits of entropy than expected     when ANSI CPRNG was used. (CVE-2013-4345, Moderate)

  - It was found that the fix for CVE-2012-2375 released via     SLSA-2012:1580 accidentally removed a check for     small-sized result buffers. A local, unprivileged user     with access to an NFSv4 mount with ACL support could use     this flaw to crash the system or, potentially, escalate     their privileges on the system . (CVE-2013-4591,     Moderate)

  - A flaw was found in the way IOMMU memory mappings were     handled when moving memory slots. A malicious user on a     KVM host who has the ability to assign a device to a     guest could use this flaw to crash the host.
    (CVE-2013-4592, Moderate)

  - Heap-based buffer overflow flaws were found in the way     the Zeroplus and Pantherlord/GreenAsia game controllers     handled HID reports. An attacker with physical access to     the system could use these flaws to crash the system or,     potentially, escalate their privileges on the system.
    (CVE-2013-2889, CVE-2013-2892, Moderate)

  - Two information leak flaws were found in the logical     link control (LLC) implementation in the Linux kernel. A     local, unprivileged user could use these flaws to leak     kernel stack memory to user space. (CVE-2012-6542,     CVE-2013-3231, Low)

  - A heap-based buffer overflow in the way the tg3 Ethernet     driver parsed the vital product data (VPD) of devices     could allow an attacker with physical access to a system     to cause a denial of service or, potentially, escalate     their privileges. (CVE-2013-1929, Low)

  - Information leak flaws in the Linux kernel could allow a     privileged, local user to leak kernel memory to user     space. (CVE-2012-6545, CVE-2013-1928, CVE-2013-2164,     CVE-2013-2234, Low)

  - A format string flaw was found in the Linux kernel's     block layer. A privileged, local user could potentially     use this flaw to escalate their privileges to kernel     level (ring0). (CVE-2013-2851, Low)

The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2584 advisory.

  - The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain     structures, which allows local users to obtain sensitive information from kernel memory via a crafted     application. (CVE-2012-6545)

  - The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a     certain length variable, which allows local users to obtain sensitive information from kernel stack memory     via a crafted recvmsg or recvfrom system call. (CVE-2013-3231)

  - The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly     handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a     denial of service (excessive retries and address-generation outage), and consequently obtain sensitive     information, via ICMPv6 Router Advertisement (RA) messages. (CVE-2013-0343)

  - Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper management of the state of the consumed data.
    (CVE-2013-4345)

  - The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified     architectures lacks a certain error check, which might allow local users to obtain sensitive information     from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
    (CVE-2013-1928)

  - Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
    (CVE-2013-2888)

  - drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device. (CVE-2013-2889)

  - drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device. (CVE-2013-2892)

  - net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP     Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which     allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have     unspecified other impact via network traffic that triggers a large response packet. (CVE-2013-4387)

  - Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9     allows local users to cause a denial of service (memory consumption) by leveraging certain device access     to trigger movement of memory slots. (CVE-2013-4592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2583 advisory.

  - The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly     handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a     denial of service (excessive retries and address-generation outage), and consequently obtain sensitive     information, via ICMPv6 Router Advertisement (RA) messages. (CVE-2013-0343)

  - Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper management of the state of the consumed data.
    (CVE-2013-4345)

  - Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
    (CVE-2013-2888)

  - drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device. (CVE-2013-2889)

  - drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device. (CVE-2013-2892)

  - net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP     Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which     allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have     unspecified other impact via network traffic that triggers a large response packet. (CVE-2013-4387)

  - Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9     allows local users to cause a denial of service (memory consumption) by leveraging certain device access     to trigger movement of memory slots. (CVE-2013-4592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1645 advisory.

  - The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return     value in certain circumstances, which allows local users to obtain sensitive information from kernel stack     memory via a crafted application that leverages an uninitialized pointer argument. (CVE-2012-6542)

  - Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the     Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system     crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital     Product Data (VPD) data structure. (CVE-2013-1929)

  - The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain     structures, which allows local users to obtain sensitive information from kernel memory via a crafted     application. (CVE-2012-6545)

  - The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a     certain length variable, which allows local users to obtain sensitive information from kernel stack memory     via a crafted recvmsg or recvfrom system call. (CVE-2013-3231)

  - The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows     local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning     CD-ROM drive. (CVE-2013-2164)

  - The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux     kernel before 3.10 do not initialize certain structure members, which allows local users to obtain     sensitive information from kernel heap memory by reading a broadcast message from the notify interface of     an IPSec key_socket. (CVE-2013-2234)

  - Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through     3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers     to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.
    (CVE-2013-2851)

  - The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly     handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a     denial of service (excessive retries and address-generation outage), and consequently obtain sensitive     information, via ICMPv6 Router Advertisement (RA) messages. (CVE-2013-0343)

  - Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper management of the state of the consumed data.
    (CVE-2013-4345)

  - The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified     architectures lacks a certain error check, which might allow local users to obtain sensitive information     from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
    (CVE-2013-1928)

  - Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
    (CVE-2013-2888)

  - drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device. (CVE-2013-2889)

  - drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device. (CVE-2013-2892)

  - net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP     Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which     allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have     unspecified other impact via network traffic that triggers a large response packet. (CVE-2013-4387)

  - Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before     3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly     have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a     pathname on an NFSv4 filesystem. (CVE-2013-4591)

  - Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9     allows local users to cause a denial of service (memory consumption) by leveraging certain device access     to trigger movement of memory slots. (CVE-2013-4592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
83609	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2014:0189-1)	Nessus	SuSE Local Security Checks	high
83608	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2014:0140-1)	Nessus	SuSE Local Security Checks	high
79170	CentOS 6 : kernel (CESA-2013:1645)	Nessus	CentOS Local Security Checks	medium
72577	Ubuntu 12.10 : linux vulnerabilities (USN-2114-1)	Nessus	Ubuntu Local Security Checks	medium
72575	Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2112-1)	Nessus	Ubuntu Local Security Checks	medium
72574	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-2111-1)	Nessus	Ubuntu Local Security Checks	medium
72472	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2014-3002)	Nessus	Oracle Linux Local Security Checks	high
72325	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 8823 / 8827)	Nessus	SuSE Local Security Checks	high
72324	SuSE 11.3 Security Update : Linux kernel (SAT Patch Number 8826)	Nessus	SuSE Local Security Checks	high
72163	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 8779 / 8791 / 8792)	Nessus	SuSE Local Security Checks	high
71793	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2066-1)	Nessus	Ubuntu Local Security Checks	medium
71511	Mandriva Linux Security Advisory : kernel (MDVSA-2013:291)	Nessus	Mandriva Local Security Checks	medium
71490	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
71133	Oracle Linux 5 / 6 : Unbreakable Enterprise Kernel (ELSA-2013-2584)	Nessus	Oracle Linux Local Security Checks	medium
71132	Oracle Linux 6 : Unbreakable Enterprise Kernel (ELSA-2013-2583)	Nessus	Oracle Linux Local Security Checks	medium
71108	Oracle Linux 6 : Oracle / Linux / 6 / kernel (ELSA-2013-1645)	Nessus	Oracle Linux Local Security Checks	medium
71013	RHEL 6 : kernel (RHSA-2013:1645)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2013-4592

medium

Tenable Plugins

critical

high

high

medium

medium

medium

medium

high

high

high

high

medium

medium

medium

medium

medium

medium

medium