The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):The walk_hugetlb_range()     function in 'mm/pagewalk.c' file in the Linux kernel     from v4.0-rc1 through v4.15-rc1 mishandles holes in     hugetlb ranges. This allows local users to obtain     sensitive information from uninitialized kernel memory     via crafted use of the mincore() system     call.(CVE-2017-16994)In the Linux kernel before 4.7,     the amd_gpio_remove function in     drivers/pinctrl/pinctrl-amd.c calls the     pinctrl_unregister function, leading to a double     free.(CVE-2017-18174)In the Linux kernel through     4.20.11, af_alg_release() in crypto/af_alg.c neglects     to set a NULL value for a certain structure member,     which leads to a use-after-free in     sockfs_setattr.(CVE-2019-8912)A security flaw was found     in the Linux kernel that an attempt to move page mapped     by AIO ring buffer to the other node triggers NULL     pointer dereference at trace_writeback_dirty_page(),     because aio_fs_backing_dev_info.dev is     0.(CVE-2016-3070)The NFSv4 implementation in the Linux     kernel through 4.11.1 allows local users to cause a     denial of service (resource consumption) by leveraging     improper channel callback shutdown when unmounting an     NFSv4 filesystem, aka a 'module reference and kernel     daemon' leak.(CVE-2017-9059)When creating audit records     for parameters to executed children processes, an     attacker can convince the Linux kernel audit subsystem     can create corrupt records which may allow an attacker     to misrepresent or evade logging of executing     commands.(CVE-2016-6136)A use-after-free vulnerability     was found in a network namespaces code affecting the     Linux kernel since v4.0-rc1 through v4.15-rc5. The     function get_net_ns_by_id() does not check for the     net::count value after it has found a peer network in     netns_ids idr which could lead to double free and     memory corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out, although it is thought to be     unlikely.(CVE-2017-15129)A NULL pointer dereference     flaw was found in the rds_ib_laddr_check() function in     the Linux kernel's implementation of Reliable Datagram     Sockets (RDS). A local, unprivileged user could use     this flaw to crash the system.(CVE-2013-7339)A flaw was     found in the Linux kernel key management subsystem in     which a local attacker could crash the kernel or     corrupt the stack and additional memory (denial of     service) by supplying a specially crafted RSA key. This     flaw panics the machine during the verification of the     RSA key.(CVE-2016-8650)The uio_mmap_physical function     in drivers/uio/uio.c in the Linux kernel before 3.12     does not validate the size of a memory block, which     allows local users to cause a denial of service (memory     corruption) or possibly gain privileges via crafted     mmap operations, a different vulnerability than     CVE-2013-4511.(CVE-2013-6763)In the Linux kernel before     4.20.5, attackers can trigger a     drivers/char/ipmi/ipmi_msghandler.c use-after-free and     OOPS by arranging for certain simultaneous execution of     the code, as demonstrated by a 'service ipmievd     restart' loop.(CVE-2019-9003)An integer overflow flaw     was found in the way the Linux kernel randomized the     stack for processes on certain 64-bit architecture     systems, such as x86-64, causing the stack entropy to     be reduced by four.(CVE-2015-1593)The     compat_sys_recvmmsg function in net/compat.c in the     Linux kernel before 3.13.2, when CONFIG_X86_X32 is     enabled, allows local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter.(CVE-2014-0038)The kill_something_info     function in kernel/signal.c in the Linux kernel before     4.13, when an unspecified architecture and compiler is     used, might allow local users to cause a denial of     service via an INT_MIN     argument.(CVE-2018-10124)arch/s390/kernel/head64.S in     the Linux kernel before 3.13.5 on the s390 platform     does not properly handle attempted use of the linkage     stack, which allows local users to cause a denial of     service (system crash) by executing a crafted     instruction.(CVE-2014-2039)A flaw was found in the     Linux kernel in that the aoedisk_debugfs_show()     function in drivers/block/aoe/aoeblk.c allows local     users to obtain some kernel address information by     reading a debugfs file. This address is not useful to     commit a further attack.(CVE-2018-7754)ALSA sequencer     core initializes the event pool on demand by invoking     snd_seq_pool_init() when the first write happens and     the pool is empty. A user can reset the pool size     manually via ioctl concurrently, and this may lead to     UAF or out-of-bound access.(CVE-2018-7566)In the     function wmi_set_ie(), the length validation code does     not handle unsigned integer overflow properly. As a     result, a large value of the 'ie_len' argument can     cause a buffer overflow in all Android releases from     CAF (Android for MSM, Firefox OS for MSM, QRD Android)     using the Linux Kernel.(CVE-2018-5848)The Linux kernel     does not properly initialize memory in messages passed     between virtual guests and the host operating system in     the vhost/vhost.c:vhost_new_msg() function. This can     allow local privileged users to read some kernel memory     contents when reading from the /dev/vhost-net device     file.(CVE-2018-1118)Systems with microprocessors     utilizing speculative execution and speculative     execution of memory reads before the addresses of all     prior memory writes are known may allow unauthorized     disclosure of information to an attacker with local     user access via a side-channel analysis, aka     Speculative Store Bypass (SSB), Variant     4.(CVE-2018-3639)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The pn_recvmsg function in net/phonet/datagram.c in the     Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7265)

  - The mISDN_sock_recvmsg function in     drivers/isdn/mISDN/socket.c in the Linux kernel before     3.12.4 does not ensure that a certain length value is     consistent with the size of an associated data     structure, which allows local users to obtain sensitive     information from kernel memory via a (1) recvfrom, (2)     recvmmsg, or (3) recvmsg system call.(CVE-2013-7266)

  - The atalk_recvmsg function in net/appletalk/ddp.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7267)

  - The ipx_recvmsg function in net/ipx/af_ipx.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7268)

  - The nr_recvmsg function in net/netrom/af_netrom.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7269)

  - The packet_recvmsg function in net/packet/af_packet.c     in the Linux kernel before 3.12.4 updates a certain     length value before ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7270)

  - The x25_recvmsg function in net/x25/af_x25.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7271)

  - The dgram_recvmsg function in net/ieee802154/dgram.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel stack     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7281)

  - A NULL pointer dereference flaw was found in the     rds_ib_laddr_check() function in the Linux kernel's     implementation of Reliable Datagram Sockets (RDS). A     local, unprivileged user could use this flaw to crash     the system.(CVE-2013-7339)

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2013-7421)

  - A flaw was found in the Linux kernel's implementation     of Unix sockets. A server polling for client-socket     data could put the peer socket on a wait list the peer     socket could then close the connection, making the     reference on the wait list no longer valid. This could     lead to bypassing the permissions on a Unix socket and     packets being injected into the stream, and could also     panic the machine (denial of service).(CVE-2013-7446)

  - The compat_sys_recvmmsg function in net/compat.c in the     Linux kernel before 3.13.2, when CONFIG_X86_X32 is     enabled, allows local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter.(CVE-2014-0038)

  - Buffer overflow in the complete_emulated_mmio function     in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6     allows guest OS users to execute arbitrary code on the     host OS by leveraging a loop that triggers an invalid     memory copy affecting certain cancel_work_item     data.(CVE-2014-0049)

  - The cifs_iovec_write function in fs/cifs/file.c in the     Linux kernel through 3.13.5 does not properly handle     uncached write operations that copy fewer than the     requested number of bytes, which allows local users to     obtain sensitive information from kernel memory, cause     a denial of service (memory corruption and system     crash), or possibly gain privileges via a writev system     call with a crafted pointer.(CVE-2014-0069)

  - drivers/vhost/net.c in the Linux kernel before 3.13.10,     when mergeable buffers are disabled, does not properly     validate packet lengths, which allows guest OS users to     cause a denial of service (memory corruption and host     OS crash) or possibly gain privileges on the host OS     via crafted packets, related to the handle_rx and     get_rx_bufs functions.(CVE-2014-0077)

  - Race condition in the inet_frag_intern function in     net/ipv4/inet_fragment.c in the Linux kernel through     3.13.6 allows remote attackers to cause a denial of     service (use-after-free error) or possibly have     unspecified other impact via a large series of     fragmented ICMP Echo Request packets to a system with a     heavy CPU load.(CVE-2014-0100)

  - A flaw was found in the way the Linux kernel processed     an authenticated COOKIE_ECHO chunk during the     initialization of an SCTP connection. A remote attacker     could use this flaw to crash the system by initiating a     specially crafted SCTP handshake in order to trigger a     NULL pointer dereference on the system.(CVE-2014-0101)

  - The keyring_detect_cycle_iterator function in     security/keys/keyring.c in the Linux kernel through     3.13.6 does not properly determine whether keyrings are     identical, which allows local users to cause a denial     of service (OOPS) via crafted keyctl     commands.(CVE-2014-0102)

  - Use-after-free vulnerability in the skb_segment     function in net/core/skbuff.c in the Linux kernel     through 3.13.6 allows attackers to obtain sensitive     information from kernel memory by leveraging the     absence of a certain orphaning     operation.(CVE-2014-0131)

  - The ioapic_deliver function in virt/kvm/ioapic.c in the     Linux kernel through 3.14.1 does not properly validate     the kvm_irq_delivery_to_apic return value, which allows     guest OS users to cause a denial of service (host OS     crash) via a crafted entry in the redirection table of     an I/O APIC. NOTE: the affected code was moved to the     ioapic_service function before the vulnerability was     announced.(CVE-2014-0155)

  - It was found that the permission checks performed by     the Linux kernel when a netlink message was received     were not sufficient. A local, unprivileged user could     potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged     process and altering the output of this     process.(CVE-2014-0181)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.4 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A use-after-free flaw was found in the way the ping_init_sock() function of the Linux kernel handled the group_info reference counter.
A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-2851, Important)

* A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2013-7339, Moderate)

* It was found that a remote attacker could use a race condition flaw in the ath_tx_aggr_sleep() function to crash the system by creating large network traffic on the system's Atheros 9k wireless network adapter. (CVE-2014-2672, Moderate)

* A NULL pointer dereference flaw was found in the rds_iw_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2014-2678, Moderate)

* A race condition flaw was found in the way the Linux kernel's mac80211 subsystem implementation handled synchronization between TX and STA wake-up code paths. A remote attacker could use this flaw to crash the system. (CVE-2014-2706, Moderate)

This update also fixes the following bugs :

* The Completely Fair Scheduler (CFS) did not verify whether the CFS period timer is running while throttling tasks on the CFS run queue.
Therefore under certain circumstances, the CFS run queue became stuck because the CFS period timer was inactive and could not be restarted.
To fix this problem, the CFS now restarts the CFS period timer inside the throttling function if it is inactive. (BZ#1120666)

* A previous change to the SCSI code fixed a race condition that could occur when removing a SCSI device. However, that change caused performance degradation because it used a certain function from the block layer code that was returning different values compared with later versions of the kernel. This update alters the SCSI code to properly utilize the values returned by the block layer code.
(BZ#1117581)

* If a statically defined gateway became unreachable and its corresponding neighbor entry entered a FAILED state, the gateway stayed in the FAILED state even after it became reachable again. This prevented routing of the traffic through that gateway. This update allows probing such a gateway automatically and routing the traffic through the gateway again once it becomes reachable. (BZ#1115262)

* A miscalculation in the 'radix_tree' swap encoding corrupted swap area indexes bigger than 8 by truncating lower bits of swap entries.
Consequently, systems with more than 8 swap areas could trigger a bogus OOM scenario when swapping out to such a swap area. This update fixes this problem by reducing a return value of the SWP_TYPE_SHIFT() function and removing a broken function call from the read_swap_header() function. (BZ#1099727)

* The automatic route cache rebuilding feature could incorrectly compute the length of a route hash chain if the cache contained multiple entries with the same key but a different TOS, mark, or OIF bit. Consequently, the feature could reach the rebuild limit and disable the routing cache on the system. This problem is fixed by using a helper function that avoids counting such duplicate routes.
(BZ#1113823)

* When booting a guest in the Hyper-V environment and enough of Programmable Interval Timer (PIT) interrupts were lost or not injected into the guest on time, the kernel panicked and the guest failed to boot. This problem has been fixed by bypassing the relevant PIT check when the guest is running under the Hyper-V environment. (BZ#1112225)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A use-after-free flaw was found in the way the ping_init_sock() function of the Linux kernel handled the group_info reference counter.
A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-2851, Important)

* A NULL pointer dereference flaw was found in the way the futex_wait_requeue_pi() function of the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to crash the system.
(CVE-2012-6647, Moderate)

* A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2013-7339, Moderate)

* It was found that a remote attacker could use a race condition flaw in the ath_tx_aggr_sleep() function to crash the system by creating large network traffic on the system's Atheros 9k wireless network adapter. (CVE-2014-2672, Moderate)

* A NULL pointer dereference flaw was found in the rds_iw_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2014-2678, Moderate)

* A race condition flaw was found in the way the Linux kernel's mac80211 subsystem implementation handled synchronization between TX and STA wake-up code paths. A remote attacker could use this flaw to crash the system. (CVE-2014-2706, Moderate)

* An out-of-bounds memory access flaw was found in the Netlink Attribute extension of the Berkeley Packet Filter (BPF) interpreter functionality in the Linux kernel's networking implementation. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145, Moderate)

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0981 advisory.

  - Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1     allows local users to cause a denial of service (use-after-free and system crash) or possibly gain     privileges via a crafted application that leverages an improperly managed reference counter.
    (CVE-2014-2851)

  - The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact via a bind system call for an RDS socket on a system that lacks RDS transports. (CVE-2013-7339)

  - The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter     function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length     value is sufficiently large, which allows local users to cause a denial of service (integer underflow and     system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the vulnerability was announced. (CVE-2014-3144)

  - The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in     the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users     to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected     code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
    (CVE-2014-3145)

  - The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact via a bind system call for an RDS socket on a system that lacks RDS transports. (CVE-2014-2678)

  - The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that     calls have two different futex addresses, which allows local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have unspecified other impact via a crafted     FUTEX_WAIT_REQUEUE_PI command. (CVE-2012-6647)

  - Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux     kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large     amount of network traffic that triggers certain list deletions. (CVE-2014-2672)

  - Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to     cause a denial of service (system crash) via network traffic that improperly interacts with the     WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (CVE-2014-2706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel-rt packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

  * A denial of service flaw was found in the way the Linux     kernel's IPv6 implementation processed IPv6 router     advertisement (RA) packets. An attacker able to send a     large number of RA packets to a target system could     potentially use this flaw to crash the target system.
    (CVE-2014-2309, Important)

  * A flaw was found in the way the Linux kernel's netfilter     connection tracking implementation for Datagram     Congestion Control Protocol (DCCP) packets used the     skb_header_pointer() function. A remote attacker could     use this flaw to send a specially crafted DCCP packet     to crash the system or, potentially, escalate their     privileges on the system. (CVE-2014-2523, Important)

  * A flaw was found in the way the Linux kernel's CIFS     implementation handled uncached write operations with     specially crafted iovec structures. An unprivileged     local user with access to a CIFS share could use this     flaw to crash the system, leak kernel memory, or,     potentially, escalate their privileges on the system.
    (CVE-2014-0069, Moderate)

  * A flaw was found in the way the Linux kernel handled     pending Floating Pointer Unit (FPU) exceptions during     the switching of tasks. A local attacker could use this     flaw to terminate arbitrary processes on the system,     causing a denial of service, or, potentially, escalate     their privileges on the system. Note that this flaw only     affected systems using AMD CPUs on both 32-bit and     64-bit architectures. (CVE-2014-1438, Moderate)

  * It was found that certain protocol handlers in the Linux     kernel's networking implementation could set the     addr_len value without initializing the associated data     structure. A local, unprivileged user could use this     flaw to leak kernel stack memory to user space using the     recvmsg, recvfrom, and recvmmsg system calls.
    (CVE-2013-7263, CVE-2013-7265, Low)

  * An information leak flaw was found in the Linux kernel's     netfilter connection tracking IRC NAT helper     implementation that could allow a remote attacker to     disclose portions of kernel stack memory during IRC     DCC (Direct Client-to-Client) communication over NAT.
    (CVE-2014-1690, Low)

  * A denial of service flaw was discovered in the way the     Linux kernel's SELinux implementation handled files with     an empty SELinux security context. A local user who has     the CAP_MAC_ADMIN capability could use this flaw to     crash the system. (CVE-2014-1874, Low)

This update also fixes several bugs and adds multiple enhancements.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users are advised to upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.10.33-rt32.33, correct these issues, and fix the bugs and add the enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes. The system must be rebooted for this update to take effect.

The Linux kernel was updated to fix security issues and bugs :

Security issues fixed: CVE-2014-3153: The futex_requeue function in kernel/futex.c in the Linux kernel did not ensure that calls have two different futex addresses, which allowed local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

CVE-2014-0077: drivers/vhost/net.c in the Linux kernel, when mergeable buffers are disabled, did not properly validate packet lengths, which allowed guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.

CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package did not properly handle vhost_get_vq_desc errors, which allowed guest OS users to cause a denial of service (host OS crash) via unspecified vectors.

CVE-2014-2678: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

CVE-2013-7339: The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

CVE-2014-2851: Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.

CVE-2014-3122: The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel did not properly consider which pages must be locked, which allowed local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings.

Bugs fixed :

  - memcg: deprecate memory.force_empty knob (bnc#878274).

The Linux kernel was updated to fix security issues and bugs.

Security issues fixed: CVE-2014-3153: The futex_requeue function in kernel/futex.c in the Linux kernel did not ensure that calls have two different futex addresses, which allowed local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel did not check whether a certain length value is sufficiently large, which allowed local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the
__skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.

CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel used the reverse order in a certain subtraction, which allowed local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the
__skb_get_nlattr_nest function before the vulnerability was announced.

CVE-2014-0077: drivers/vhost/net.c in the Linux kernel, when mergeable buffers are disabled, did not properly validate packet lengths, which allowed guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.

CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package did not properly handle vhost_get_vq_desc errors, which allowed guest OS users to cause a denial of service (host OS crash) via unspecified vectors.

CVE-2014-2678: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

CVE-2013-7339: The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

CVE-2014-2851: Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.

  - ext4: Fix buffer double free in ext4_alloc_branch()     (bnc#880599 bnc#876981).

  - patches.fixes/firewire-01-net-fix-use-after-free.patch,     patches.fixes/firewire-02-ohci-fix-probe-failure-with-ag     ere-lsi-controllers.patch,     patches.fixes/firewire-03-dont-use-prepare_delayed_work.
    patch: Add missing bug reference (bnc#881697).

  - firewire: don't use PREPARE_DELAYED_WORK.

  - firewire: ohci: fix probe failure with Agere/LSI     controllers.

  - firewire: net: fix use after free.

  - USB: OHCI: fix problem with global suspend on ATI     controllers (bnc#868315).

  - mm: revert 'page-writeback.c: subtract min_free_kbytes     from dirtyable memory' (bnc#879792).

  - usb: musb: tusb6010: Use musb->tusb_revision instead of     tusb_get_revision call (bnc#872715).

  - usb: musb: tusb6010: Add tusb_revision to struct musb to     store the revision (bnc#872715).

  - ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets     (bnc#880613).

  - floppy: do not corrupt bio.bi_flags when reading block 0     (bnc#879258).

  - reiserfs: call truncate_setsize under tailpack mutex     (bnc#878115).

  - Update Xen config files: Set compatibility level back to     4.1 (bnc#851338).

  - Update config files. Guillaume GARDET reported a broken     build due to CONFIG_USB_SERIAL_GENERIC being modular

  - memcg: deprecate memory.force_empty knob (bnc#878274).

  - nfsd: when reusing an existing repcache entry, unhash it     first (bnc#877721).

  - Enable Socketcan again for i386 and x86_64 (bnc#858067)

  - xhci: extend quirk for Renesas cards (bnc#877713).

  - xhci: Fix resume issues on Renesas chips in Samsung     laptops (bnc#877713).

  - mm: try_to_unmap_cluster() should lock_page() before     mlocking (bnc#876102, CVE-2014-3122).

  - drm/i915, HD-audio: Don't continue probing when     nomodeset is given (bnc#882648).

  - x86/mm/numa: Fix 32-bit kernel NUMA boot (bnc#881727).

From Red Hat Security Advisory 2014:0740 :

Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

* A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2013-7339, Moderate)

Red Hat would like to thank Matthew Daley for reporting CVE-2014-1737 and CVE-2014-1738.

This update also fixes the following bugs :

* A bug in the futex system call could result in an overflow when passing a very large positive timeout. As a consequence, the FUTEX_WAIT operation did not work as intended and the system call was timing out immediately. A backported patch fixes this bug by limiting very large positive timeouts to the maximal supported value.
(BZ#1091832)

* A new Linux Security Module (LSM) functionality related to the setrlimit hooks should produce a warning message when used by a third party module that could not cope with it. However, due to a programming error, the kernel could print this warning message when a process was setting rlimits for a different process, or if rlimits were modified by another than the main thread even though there was no incompatible third party module. This update fixes the relevant code and ensures that the kernel handles this warning message correctly.
(BZ#1092869)

* Previously, the kernel was unable to detect KVM on system boot if the Hyper-V emulation was enabled. A patch has been applied to ensure that both KVM and Hyper-V hypervisors are now correctly detected during system boot. (BZ#1094152)

* A function in the RPC code responsible for verifying whether cached credentials match the current process did not perform the check correctly. The code checked only whether the groups in the current process credentials appear in the same order as in the cached credentials but did not ensure that no other groups are present in the cached credentials. As a consequence, when accessing files in NFS mounts, a process with the same UID and GID as the original process but with a non-matching group list could have been granted an unauthorized access to a file, or under certain circumstances, the process could have been wrongly prevented from accessing the file. The incorrect test condition has been fixed and the problem can no longer occur. (BZ#1095062)

* When being under heavy load, some Fibre Channel storage devices, such as Hitachi and HP Open-V series, can send a logout (LOGO) message to the host system. However, due to a bug in the lpfc driver, this could result in a loss of active paths to the storage and the paths could not be recovered without manual intervention. This update corrects the lpfc driver to ensure automatic recovery of the lost paths to the storage in this scenario. (BZ#1096061)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

- A flaw was found in the way the Linux kernel's floppy     driver handled user space provided data in certain error     code paths while processing FDRAWCMD IOCTL commands. A     local user with write access to /dev/fdX could use this     flaw to free (using the kfree() function) arbitrary     kernel memory. (CVE-2014-1737, Important)

  - It was found that the Linux kernel's floppy driver     leaked internal kernel memory addresses to user space     during the processing of the FDRAWCMD IOCTL command. A     local user with write access to /dev/fdX could use this     flaw to obtain information about the kernel heap     arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

  - A NULL pointer dereference flaw was found in the     rds_ib_laddr_check() function in the Linux kernel's     implementation of Reliable Datagram Sockets (RDS). A     local, unprivileged user could use this flaw to crash     the system. (CVE-2013-7339, Moderate)

This update also fixes the following bugs :

  - A bug in the futex system call could result in an     overflow when passing a very large positive timeout. As     a consequence, the FUTEX_WAIT operation did not work as     intended and the system call was timing out immediately.
    A backported patch fixes this bug by limiting very large     positive timeouts to the maximal supported value.

  - A new Linux Security Module (LSM) functionality related     to the setrlimit hooks should produce a warning message     when used by a third party module that could not cope     with it. However, due to a programming error, the kernel     could print this warning message when a process was     setting rlimits for a different process, or if rlimits     were modified by another than the main thread even     though there was no incompatible third party module.
    This update fixes the relevant code and ensures that the     kernel handles this warning message correctly.

  - Previously, the kernel was unable to detect KVM on     system boot if the Hyper-V emulation was enabled. A     patch has been applied to ensure that both KVM and     Hyper-V hypervisors are now correctly detected during     system boot.

  - A function in the RPC code responsible for verifying     whether cached credentials match the current process did     not perform the check correctly. The code checked only     whether the groups in the current process credentials     appear in the same order as in the cached credentials     but did not ensure that no other groups are present in     the cached credentials. As a consequence, when accessing     files in NFS mounts, a process with the same UID and GID     as the original process but with a non-matching group     list could have been granted an unauthorized access to a     file, or under certain circumstances, the process could     have been wrongly prevented from accessing the file. The     incorrect test condition has been fixed and the problem     can no longer occur.

  - When being under heavy load, some Fibre Channel storage     devices, such as Hitachi and HP Open-V series, can send     a logout (LOGO) message to the host system. However, due     to a bug in the lpfc driver, this could result in a loss     of active paths to the storage and the paths could not     be recovered without manual intervention. This update     corrects the lpfc driver to ensure automatic recovery of     the lost paths to the storage in this scenario.

The system must be rebooted for this update to take effect.

Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

* A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2013-7339, Moderate)

Red Hat would like to thank Matthew Daley for reporting CVE-2014-1737 and CVE-2014-1738.

This update also fixes the following bugs :

* A bug in the futex system call could result in an overflow when passing a very large positive timeout. As a consequence, the FUTEX_WAIT operation did not work as intended and the system call was timing out immediately. A backported patch fixes this bug by limiting very large positive timeouts to the maximal supported value.
(BZ#1091832)

* A new Linux Security Module (LSM) functionality related to the setrlimit hooks should produce a warning message when used by a third party module that could not cope with it. However, due to a programming error, the kernel could print this warning message when a process was setting rlimits for a different process, or if rlimits were modified by another than the main thread even though there was no incompatible third party module. This update fixes the relevant code and ensures that the kernel handles this warning message correctly.
(BZ#1092869)

* Previously, the kernel was unable to detect KVM on system boot if the Hyper-V emulation was enabled. A patch has been applied to ensure that both KVM and Hyper-V hypervisors are now correctly detected during system boot. (BZ#1094152)

* A function in the RPC code responsible for verifying whether cached credentials match the current process did not perform the check correctly. The code checked only whether the groups in the current process credentials appear in the same order as in the cached credentials but did not ensure that no other groups are present in the cached credentials. As a consequence, when accessing files in NFS mounts, a process with the same UID and GID as the original process but with a non-matching group list could have been granted an unauthorized access to a file, or under certain circumstances, the process could have been wrongly prevented from accessing the file. The incorrect test condition has been fixed and the problem can no longer occur. (BZ#1095062)

* When being under heavy load, some Fibre Channel storage devices, such as Hitachi and HP Open-V series, can send a logout (LOGO) message to the host system. However, due to a bug in the lpfc driver, this could result in a loss of active paths to the storage and the paths could not be recovered without manual intervention. This update corrects the lpfc driver to ensure automatic recovery of the lost paths to the storage in this scenario. (BZ#1096061)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-1738)

Matthew Daley reported a flaw in the handling of ioctl commands by the floppy disk driver in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges if the floppy disk module is loaded. (CVE-2014-1737)

A flaw was discovered in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel for systems that lack RDS transports. An unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2013-7339)

An error was discovered in the Reliable Datagram Sockets (RDS) protocol stack in the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash) or possibly have unspecified other impact. (CVE-2014-2678).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-0343     George Kargiotakis reported an issue in the temporary     address handling of the IPv6 privacy extensions. Users     on the same LAN can cause a denial of service or obtain     access to sensitive information by sending router     advertisement messages that cause temporary address     generation to be disabled.

  - CVE-2013-2147     Dan Carpenter reported issues in the cpqarray driver for     Compaq Smart2 Controllers and the cciss driver for HP     Smart Array controllers allowing users to gain access to     sensitive kernel memory.

  - CVE-2013-2889     Kees Cook discovered missing input sanitization in the     HID driver for Zeroplus game pads that could lead to a     local denial of service.

  - CVE-2013-2893     Kees Cook discovered that missing input sanitization in     the HID driver for various Logitech force feedback     devices could lead to a local denial of service.

  - CVE-2013-2929     Vasily Kulikov discovered that a flaw in the     get_dumpable() function of the ptrace subsytsem could     lead to information disclosure. Only systems with the     fs.suid_dumpable sysctl set to a non-default value of     '2' are vulnerable.

  - CVE-2013-4162     Hannes Frederic Sowa discovered that incorrect handling     of IPv6 sockets using the UDP_CORK option could result     in denial of service.

  - CVE-2013-4299     Fujitsu reported an issue in the device-mapper     subsystem. Local users could gain access to sensitive     kernel memory.

  - CVE-2013-4345     Stephan Mueller found in bug in the ANSI pseudo random     number generator which could lead to the use of less     entropy than expected.

  - CVE-2013-4512     Nico Golde and Fabian Yamaguchi reported an issue in the     user mode linux port. A buffer overflow condition exists     in the write method for the /proc/exitcode file. Local     users with sufficient privileges allowing them to write     to this file could gain further elevated privileges.

  - CVE-2013-4587     Andrew Honig of Google reported an issue in the KVM     virtualization subsystem. A local user could gain     elevated privileges by passing a large vcpu_id     parameter.

  - CVE-2013-6367     Andrew Honig of Google reported an issue in the KVM     virtualization subsystem. A divide-by-zero condition     could allow a guest user to cause a denial of service on     the host (crash).

  - CVE-2013-6380     Mahesh Rajashekhara reported an issue in the aacraid     driver for storage products from various vendors. Local     users with CAP_SYS_ADMIN privileges could gain further     elevated privileges.

  - CVE-2013-6381     Nico Golde and Fabian Yamaguchi reported an issue in the     Gigabit Ethernet device support for s390 systems. Local     users could cause a denial of service or gain elevated     privileges via the SIOC_QETH_ADP_SET_SNMP_CONTROL ioctl.

  - CVE-2013-6382     Nico Golde and Fabian Yamaguchi reported an issue in the     XFS filesystem. Local users with CAP_SYS_ADMIN     privileges could gain further elevated privileges.

  - CVE-2013-6383     Dan Carpenter reported an issue in the aacraid driver     for storage devices from various vendors. A local user     could gain elevated privileges due to a missing     privilege level check in the aac_compat_ioctl function.

  - CVE-2013-7263 CVE-2013-7264 CVE-2013-7265     mpb reported an information leak in the recvfrom,     recvmmsg and recvmsg system calls. A local user could     obtain access to sensitive kernel memory.

  - CVE-2013-7339     Sasha Levin reported an issue in the RDS network     protocol over Infiniband. A local user could cause a     denial of service condition.

  - CVE-2014-0101     Nokia Siemens Networks reported an issue in the SCTP     network protocol subsystem. Remote users could cause a     denial of service (NULL pointer dereference).

  - CVE-2014-1444     Salva Peiro reported an issue in the FarSync WAN driver.
    Local users with the CAP_NET_ADMIN capability could gain     access to sensitive kernel memory.

  - CVE-2014-1445     Salva Peiro reported an issue in the wanXL serial card     driver. Local users could gain access to sensitive     kernel memory.

  - CVE-2014-1446     Salva Peiro reported an issue in the YAM radio modem     driver. Local users with the CAP_NET_ADMIN capability     could gain access to sensitive kernel memory.

  - CVE-2014-1874     Matthew Thode reported an issue in the SELinux     subsystem. A local user with CAP_MAC_ADMIN privileges     could cause a denial of service by setting an empty     security context on a file.

  - CVE-2014-2039     Martin Schwidefsky reported an issue on s390 systems. A     local user could cause a denial of service (kernel oops)     by executing an application with a linkage stack     instruction.

  - CVE-2014-2523     Daniel Borkmann provided a fix for an issue in the     nf_conntrack_dccp module. Remote users could cause a     denial of service (system crash) or potentially gain     elevated privileges.

ID	Name	Product	Family	Severity
124991	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1538)	Nessus	Huawei Local Security Checks	critical
124801	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1477)	Nessus	Huawei Local Security Checks	medium
79043	RHEL 6 : kernel (RHSA-2014:1101)	Nessus	Red Hat Local Security Checks	high
76948	CentOS 6 : kernel (CESA-2014:0981)	Nessus	CentOS Local Security Checks	high
76908	RHEL 6 : kernel (RHSA-2014:0981)	Nessus	Red Hat Local Security Checks	high
76888	Oracle Linux 6 : kernel (ELSA-2014-0981)	Nessus	Oracle Linux Local Security Checks	high
76674	RHEL 6 : MRG (RHSA-2014:0439)	Nessus	Red Hat Local Security Checks	critical
76557	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9488 / 9491 / 9493)	Nessus	SuSE Local Security Checks	critical
76342	openSUSE Security Update : kernel (openSUSE-SU-2014:0856-1)	Nessus	SuSE Local Security Checks	high
76228	openSUSE Security Update : kernel (openSUSE-SU-2014:0840-1)	Nessus	SuSE Local Security Checks	high
74505	Oracle Linux 5 : kernel (ELSA-2014-0740-1)	Nessus	Oracle Linux Local Security Checks	high
74489	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20140610)	Nessus	Scientific Linux Local Security Checks	high
74482	Oracle Linux 5 : kernel (ELSA-2014-0740)	Nessus	Oracle Linux Local Security Checks	high
74471	CentOS 5 : kernel (CESA-2014:0740)	Nessus	CentOS Local Security Checks	high
74458	RHEL 5 : kernel (RHSA-2014:0740)	Nessus	Red Hat Local Security Checks	high
74183	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2220-1)	Nessus	Ubuntu Local Security Checks	high
74182	Ubuntu 10.04 LTS : linux vulnerabilities (USN-2219-1)	Nessus	Ubuntu Local Security Checks	high
73713	Debian DSA-2906-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2013-7339

medium

Tenable Plugins

critical

medium

high

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

critical