The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does     not properly initialize a certain data structure, which allows local users to obtain sensitive information     from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The hi3660_stub_clk_probe function in     drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux     kernel before 4.16 allows local users to cause a denial     of service (NULL pointer dereference) by triggering a     failure of resource retrieval.(CVE-2018-10074i1/4%0

  - An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) backend driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client.(CVE-2014-4027i1/4%0

  - It was found that in the Linux kernel version 4.2-rc1     to 4.3-rc1, a use of uninitialized 'n_proto',     'ip_proto', and 'thoff' variables in
    __skb_flow_dissect() function can lead to a remote     denial-of-service via malformed MPLS     packet.(CVE-2017-13715i1/4%0

  - It was found that the packet_set_ring() function of the     Linux kernel's networking implementation did not     properly validate certain block-size data. A local     attacker with CAP_NET_RAW capability could use this     flaw to trigger a buffer overflow, resulting in the     crash of the system. Due to the nature of the flaw,     privilege escalation cannot be fully ruled     out.(CVE-2017-7308i1/4%0

  - A weakness was found in the Linux ASLR implementation.
    Any user able to running 32-bit applications in a x86     machine can disable ASLR by setting the RLIMIT_STACK     resource to unlimited.(CVE-2016-3672i1/4%0

  - sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the     MSM QDSP6 audio driver for the Linux kernel 3.x, as     used in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to cause a denial of service     (out-of-bounds write and memory corruption) or possibly     have unspecified other impact via a crafted application     that makes an ioctl call triggering incorrect use of a     parameters pointer.(CVE-2016-2065i1/4%0

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation.
    A local attacker could use this flaw to cause a denial     of service (out-of-bounds access or system crash) by     changing a certain size value.(CVE-2016-6480i1/4%0

  - The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel before     4.10.4 allows local users to cause a denial of service     (tty exhaustion) by leveraging reference count     mishandling.(CVE-2017-8925i1/4%0

  - The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     before 4.8.1 allows local users (who are physically     proximate for inserting a crafted USB device) to gain     privileges by leveraging a write-what-where condition     that occurs after a race condition and a NULL pointer     dereference.(CVE-2017-15102i1/4%0

  - The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel before 4.5.5     does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel stack memory by reading a Netlink     message.(CVE-2016-4486i1/4%0

  - A vulnerability was found in the Linux kernel's     lp_setup() function where it doesn't apply any bounds     checking when passing 'lp=none'. This can result into     overflow of the parport_nr array. An attacker with     control over kernel command line can overwrite kernel     code and data with fixed (0xff)     values.(CVE-2017-1000363i1/4%0

  - sound/core/hrtimer.c in the Linux kernel before 4.4.1     does not prevent recursive callback access, which     allows local users to cause a denial of service     (deadlock) via a crafted ioctl call.(CVE-2016-2549i1/4%0

  - The pn_recvmsg function in net/phonet/datagram.c in the     Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7265i1/4%0

  - A NULL pointer dereference flaw was found in the SCTP     implementation. A local user could use this flaw to     cause a denial of service on the system by triggering a     kernel panic when creating multiple sockets in parallel     while the system did not have the SCTP module     loaded.(CVE-2015-5283i1/4%0

  - It was found that in Linux kernel the mount table     expands by a power-of-two with each bind mount command.
    If a system is configured to allow non-privileged user     to do bind mounts, or allows to do so in a container or     unprivileged mount namespace, then non-privileged user     is able to cause a local DoS by overflowing the mount     table, which causes a deadlock for the whole     system.(CVE-2016-6213i1/4%0

  - The cifs_iovec_write function in fs/cifs/file.c in the     Linux kernel through 3.13.5 does not properly handle     uncached write operations that copy fewer than the     requested number of bytes, which allows local users to     obtain sensitive information from kernel memory, cause     a denial of service (memory corruption and system     crash), or possibly gain privileges via a writev system     call with a crafted pointer.(CVE-2014-0069i1/4%0

  - A flaw was found in the Linux kernel's implementation     of XFS file attributes. Two memory leaks were detected     in xfs_attr_shortform_list and xfs_attr3_leaf_list_int     when running a docker container backed by xfs/overlay2.
    A dedicated attacker could possible exhaust all memory     and create a denial of service     situation.(CVE-2016-9685i1/4%0

  - Multiple integer overflows in the MDSS driver for the     Linux kernel 3.x, as used in Qualcomm Innovation Center     (QuIC) Android contributions for MSM devices and other     products, allow attackers to cause a denial of service     or possibly have unspecified other impact via a large     size value, related to mdss_compat_utils.c, mdss_fb.c,     and mdss_rotator.c.(CVE-2016-5344i1/4%0

  - kernel/bpf/verifier.c in the Linux kernel through     4.14.8 ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior,     also considered an improper branch-pruning logic issue,     could possibly be used by local users for denial of     service.(CVE-2017-17862i1/4%0

  - A flaw was found in the Linux kernel's implementation     of the SCTP protocol. A remote attacker could trigger     an out-of-bounds read with an offset of up to 64kB     potentially causing the system to     crash.(CVE-2016-9555i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's futex     subsystem handled the requeuing of certain Priority     Inheritance (PI) futexes. A local, unprivileged user     could use this flaw to escalate their privileges on the     system.(CVE-2014-3153)

  - An out-of-bounds write flaw was found in the way the     Apple Magic Mouse/Trackpad multi-touch driver handled     Human Interface Device (HID) reports with an invalid     size. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3181)

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182)

  - Multiple out-of-bounds write flaws were found in the     way the Cherry Cymotion keyboard driver, KYE/Genius     device drivers, Logitech device drivers, Monterey     Genius KB29E keyboard driver, Petalynx Maxter remote     control driver, and Sunplus wireless desktop driver     handled HID reports with an invalid report descriptor     size. An attacker with physical access to the system     could use either of these flaws to write data past an     allocated memory buffer.(CVE-2014-3184)

  - A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed     completion commands sent via USB Request Blocks     buffers. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3185)

  - It was found that Linux kernel's ptrace subsystem did     not properly sanitize the address-space-control bits     when the program-status word (PSW) was being set. On     IBM S/390 systems, a local, unprivileged user could use     this flaw to set address-space-control bits to the     kernel space, and thus gain read and write access to     kernel memory.(CVE-2014-3534)

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601)

  - It was found that KVM's Write to Model Specific     Register (WRMSR) instruction emulation would write     non-canonical values passed in by the guest to certain     MSRs in the host's context. A privileged guest user     could use this flaw to crash the host.(CVE-2014-3610)

  - A race condition flaw was found in the way the Linux     kernel's KVM subsystem handled PIT (Programmable     Interval Timer) emulation. A guest user who has access     to the PIT I/O ports could use this flaw to crash the     host.(CVE-2014-3611)

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT)     instructions. On hosts with an Intel processor and     invept VM exit support, an unprivileged guest user     could use these instructions to crash the     guest.(CVE-2014-3645)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invvpid     (Invalidate Translations Based on VPID) instructions.
    On hosts with an Intel processor and invppid VM exit     support, an unprivileged guest user could use these     instructions to crash the guest.(CVE-2014-3646)

  - A flaw was found in the way the Linux kernel's KVM     subsystem handled non-canonical addresses when     emulating instructions that change the RIP (for     example, branches or calls). A guest user with access     to an I/O or MMIO region could use this flaw to crash     the guest.(CVE-2014-3647)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled malformed Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3673)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled duplicate Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3687)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled the association's output queue. A remote     attacker could send specially crafted packets that     would cause the system to use an excessive amount of     memory, leading to a denial of service.(CVE-2014-3688)

  - It was found that the Linux kernel's KVM implementation     did not ensure that the host CR4 control register value     remained unchanged across VM entries on the same     virtual CPU. A local, unprivileged user could use this     flaw to cause a denial of service on the     system.(CVE-2014-3690)

  - An out-of-bounds memory access flaw was found in the     Linux kernel's system call auditing implementation. On     a system with existing audit rules defined, a local,     unprivileged user could use this flaw to leak kernel     memory to user space or, potentially, crash the     system.(CVE-2014-3917)

  - A flaw was found in the way Linux kernel's Transparent     Huge Pages (THP) implementation handled non-huge page     migration. A local, unprivileged user could use this     flaw to crash the kernel by migrating transparent     hugepages.(CVE-2014-3940)

  - The capabilities implementation in the Linux kernel     before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows     local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by     setting the setgid bit on a file with group ownership     of root.(CVE-2014-4014)

  - An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) backend driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client.(CVE-2014-4027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0040 for details.

* A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service.
(CVE-2014-3688, Important)

* Two flaws were found in the way the Apple Magic Mouse/Trackpad multi- touch driver and the Minibox PicoLCD driver handled invalid HID reports. An attacker with physical access to the system could use these flaws to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3181, CVE-2014-3186, Moderate)

* A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate)

* A flaw was found in the way the Linux kernel's keys subsystem handled the termination condition in the associative array garbage collection functionality. A local, unprivileged user could use this flaw to crash the system. (CVE-2014-3631, Moderate)

* Multiple flaws were found in the way the Linux kernel's ALSA implementation handled user controls. A local, privileged user could use either of these flaws to crash the system. (CVE-2014-4654, CVE-2014-4655, CVE-2014-4656, Moderate)

* A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. (CVE-2014-5045, Moderate)

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low)

* A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low)

* An information leak flaw in the way the Linux kernel handled media device enumerate entities IOCTL requests could allow a local user able to access the /dev/media0 device file to leak kernel memory bytes.
(CVE-2014-1739, Low)

* An out-of-bounds read flaw in the Logitech Unifying receiver driver could allow an attacker with physical access to the system to crash the system or, potentially, escalate their privileges on the system.
(CVE-2014-3182, Low)

* Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled invalid HID reports. An attacker with physical access to the system could use either of these flaws to write data past an allocated memory buffer.
(CVE-2014-3184, Low)

* An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) back end driver of the iSCSI Target subsystem could allow a privileged user to leak the contents of kernel memory to an iSCSI initiator remote client. (CVE-2014-4027, Low)

* An information leak flaw in the Linux kernel's ALSA implementation could allow a local, privileged user to leak kernel memory to user space. (CVE-2014-4652, Low)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3104 advisory.

    - HID: magicmouse: sanity check report size in raw_event() callback (Jiri Kosina) [Orabug: 19849355]     {CVE-2014-3181}
    - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen) [Orabug: 20192542]     {CVE-2014-4652}
    - target/rd: Refactor rd_build_device_space + rd_release_device_space (Nicholas Bellinger) [Orabug:
    20192517] {CVE-2014-4027}
    - media-device: fix infoleak in ioctl media_enum_entities() (Salva Peiro) [Orabug: 20192501]     {CVE-2014-1739} {CVE-2014-1739}
    - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara) [Orabug: 20192449] {CVE-2014-6410}
    - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen) [Orabug: 20192418]     {CVE-2014-4656}
    - HID: picolcd: sanity check report size in raw_event() callback (Jiri Kosina) [Orabug: 20192205]     {CVE-2014-3186}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3103 advisory.

    - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen)  [Orabug: 20192540]     {CVE-2014-4652}
    - target/rd: Refactor rd_build_device_space + rd_release_device_space (Nicholas Bellinger)  [Orabug:
    20192516]  {CVE-2014-4027}
    - HID: logitech: perform bounds checking on device_id early enough (Jiri Kosina)  [Orabug: 20192477]     {CVE-2014-3182}
    - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara)  [Orabug: 20192448]  {CVE-2014-6410}
    - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen)  [Orabug: 20192416]     {CVE-2014-4656}
    - ALSA: control: Handle numid overflow (Lars-Peter Clausen)  [Orabug: 20192367]  {CVE-2014-4656}
    - HID: picolcd: sanity check report size in raw_event() callback (Jiri Kosina)  [Orabug: 20192208]     {CVE-2014-3186}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important)

* A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service.
(CVE-2014-3688, Important)

* Two flaws were found in the way the Apple Magic Mouse/Trackpad multi-touch driver and the Minibox PicoLCD driver handled invalid HID reports. An attacker with physical access to the system could use these flaws to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3181, CVE-2014-3186, Moderate)

* A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate)

* A flaw was found in the way the Linux kernel's keys subsystem handled the termination condition in the associative array garbage collection functionality. A local, unprivileged user could use this flaw to crash the system. (CVE-2014-3631, Moderate)

* Multiple flaws were found in the way the Linux kernel's ALSA implementation handled user controls. A local, privileged user could use either of these flaws to crash the system. (CVE-2014-4654, CVE-2014-4655, CVE-2014-4656, Moderate)

* A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. (CVE-2014-5045, Moderate)

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low)

* A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low)

* An information leak flaw in the way the Linux kernel handled media device enumerate entities IOCTL requests could allow a local user able to access the /dev/media0 device file to leak kernel memory bytes.
(CVE-2014-1739, Low)

* An out-of-bounds read flaw in the Logitech Unifying receiver driver could allow an attacker with physical access to the system to crash the system or, potentially, escalate their privileges on the system.
(CVE-2014-3182, Low)

* Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled invalid HID reports. An attacker with physical access to the system could use either of these flaws to write data past an allocated memory buffer.
(CVE-2014-3184, Low)

* An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) back end driver of the iSCSI Target subsystem could allow a privileged user to leak the contents of kernel memory to an iSCSI initiator remote client. (CVE-2014-4027, Low)

* An information leak flaw in the Linux kernel's ALSA implementation could allow a local, privileged user to leak kernel memory to user space. (CVE-2014-4652, Low)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1971 advisory.

    - [alsa] control: Make sure that id->index does not overflow (Jaroslav Kysela) [1117313 1117314]     {CVE-2014-4656}
    - [alsa] control: Handle numid overflow (Jaroslav Kysela) [1117313 1117314] {CVE-2014-4656}
    - [alsa] control: Protect user controls against concurrent access (Jaroslav Kysela) [1117338 1117339]     {CVE-2014-4652}
    - [alsa] control: Fix replacing user controls (Jaroslav Kysela) [1117323 1117324] {CVE-2014-4654     CVE-2014-4655}
    - [net] sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann) [1155750 1152755]     {CVE-2014-3688}
    - [net] sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [1155737 1152755] {CVE-2014-3687}
    - [net] sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [1147856     1152755] {CVE-2014-3673}
    - [lib] assoc_array: Fix termination condition in assoc array garbage collection (David Howells) [1155136     1139431] {CVE-2014-3631}
    - [fs] udf: Avoid infinite loop when processing indirect ICBs (Jacob Tanenbaum) [1142321 1142322]     {CVE-2014-6410}
    - [hid] picolcd: fix memory corruption via OOB write (Jacob Tanenbaum) [1141408 1141409] {CVE-2014-3186}
    - [usb] serial/whiteheat: fix memory corruption flaw (Jacob Tanenbaum) [1141403 1141404] {CVE-2014-3185}
    - [hid] fix off by one error in various _report_fixup routines (Jacob Tanenbaum) [1141393 1141394]     {CVE-2014-3184}
    - [hid] logitech-dj: fix OOB array access (Jacob Tanenbaum) [1141211 1141212] {CVE-2014-3182}
    - [hid] fix OOB write in magicmouse driver (Jacob Tanenbaum) [1141176 1141177] {CVE-2014-3181}
    - [fs] vfs: fix ref count leak in path_mountpoint() (Ian Kent) [1122481 1122376] {CVE-2014-5045}
    - [kernel] ptrace: get_dumpable() incorrect tests (Jacob Tanenbaum) [1111605 1111606] {CVE-2013-2929}
    - [media] media-device: fix an information leakage (Jacob Tanenbaum) [1109776 1109777] {CVE-2014-1739}
    - [target] rd: Refactor rd_build_device_space + rd_release_device_space (Denys Vlasenko) [1108754 1108755]     {CVE-2014-4027}
    - [virt] kvm: fix PIT timer race condition (Petr  Matousek) [1144879 1144880] {CVE-2014-3611}
    - [virt] kvm/vmx: handle invept and invvpid vm exits gracefully (Petr  Matousek) [1145449 1116936]     [1144828 1144829] {CVE-2014-3645 CVE-2014-3646}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2337-1 advisory.

    A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq).
    A guest OS user could exploit this flaw to cause a denial of service (host OS crash). (CVE-2014-0155)

    Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is     passed to a process of more privilege. A local user could exploit this flaw to bypass access restrictions     by having a privileged executable do something it was not intended to do. (CVE-2014-0181)

    An information leak was discovered in the Linux kernels aio_read_events_ring function. A local user could     exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-0206)

    A flaw was discovered in the Linux kernel's implementation of user namespaces with respect to inode     permissions. A local user could exploit this flaw by creating a user namespace to gain administrative     privileges. (CVE-2014-4014)

    An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux     kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by     leveraging access to a SCSI initiator. (CVE-2014-4027)

    Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range     notifications and hole punching. A local user could exploit this flaw to cause a denial of service.
    (CVE-2014-4171)

    Toralf Frster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local     user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

    An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture     (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information     from kernel memory. (CVE-2014-4652)

    A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control     implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service     (system crash). (CVE-2014-4653)

    A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound     Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service     (remove kernel controls). (CVE-2014-4654)

    A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled     a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and     limit bypass). (CVE-2014-4655)

    An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound     Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash).
    (CVE-2014-4656)

    An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain     SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a     crafted SCTP packet. (CVE-2014-4667)

    Vasily Averin discover a reference count flaw during attempts to umount in conjunction with a symlink. A     local user could exploit this flaw to cause a denial of service (memory consumption or use after free) or     possibly have other unspecified impact. (CVE-2014-5045)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq). A guest OS user could exploit this flaw to cause a denial of service (host OS crash).
(CVE-2014-0155)

Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is passed to a process of more privilege. A local user could exploit this flaw to bypass access restrictions by having a privileged executable do something it was not intended to do. (CVE-2014-0181)

An information leak was discovered in the Linux kernels aio_read_events_ring function. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-0206)

A flaw was discovered in the Linux kernel's implementation of user namespaces with respect to inode permissions. A local user could exploit this flaw by creating a user namespace to gain administrative privileges. (CVE-2014-4014)

An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range notifications and hole punching. A local user could exploit this flaw to cause a denial of service.
(CVE-2014-4171)

Toralf Forster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-4652)

A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4653)

A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service (remove kernel controls). (CVE-2014-4654)

A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and limit bypass). (CVE-2014-4655)

An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-4656)

An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a crafted SCTP packet. (CVE-2014-4667)

Vasily Averin discover a reference count flaw during attempts to umount in conjunction with a symlink. A local user could exploit this flaw to cause a denial of service (memory consumption or use after free) or possibly have other unspecified impact. (CVE-2014-5045).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An flaw was discovered in the Linux kernel's audit subsystem when auditing certain syscalls. A local attacker could exploit this flaw to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS). (CVE-2014-3917)

An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range notifications and hole punching. A local user could exploit this flaw to cause a denial of service.
(CVE-2014-4171)

Toralf Forster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-4652)

A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4653)

A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service (remove kernel controls). (CVE-2014-4654)

A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and limit bypass). (CVE-2014-4655)

An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-4656)

An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a crafted SCTP packet. (CVE-2014-4667)

Jason Gunthorpe reported a flaw with SCTP authentication in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (NULL pointer dereference and OOPS). (CVE-2014-5077).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions (CVE-2013-4514).

Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation (CVE-2014-0131).

The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator (CVE-2014-4027).

Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run (CVE-2014-4608).

Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (CVE-2014-4652).

sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (CVE-2014-4653).

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call (CVE-2014-4654).

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls (CVE-2014-4655).

Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function (CVE-2014-4656).

The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (CVE-2014-4667).

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls (CVE-2014-4699).

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket (CVE-2014-4943).

The updated packages provides a solution for these security issues.

Updated kernel-rt packages that fix multiple security issues are now available for Red Hat Enterprise MRG 2.5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

  * A flaw was found in the way the Linux kernel's futex     subsystem handled the requeuing of certain Priority     Inheritance (PI) futexes. A local, unprivileged user     could use this flaw to escalate their privileges on the     system. (CVE-2014-3153, Important)

  * It was found that the Linux kernel's ptrace subsystem     allowed a traced process' instruction pointer to be set     to a non-canonical memory address without forcing the     non-sysret code path when returning to user space. A     local, unprivileged user could use this flaw to crash     the system or, potentially, escalate their privileges     on the system. Note that this issue only affected     systems using an Intel CPU. (CVE-2014-4699, Important)

  * It was found that the permission checks performed by the     Linux kernel when a netlink message was received were     not sufficient. A local, unprivileged user could     potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged     process and altering the output of this process.
    (CVE-2014-0181, Moderate)

  * It was found that the aio_read_events_ring() function     of the Linux kernel's Asynchronous I/O (AIO) subsystem     did not properly sanitize the AIO ring head received     from user space. A local, unprivileged user could use     this flaw to disclose random parts of the (physical)     memory belonging to the kernel and/or other processes.
    (CVE-2014-0206, Moderate)

  * An out-of-bounds memory access flaw was found in the     Netlink Attribute extension of the Berkeley Packet     Filter (BPF) interpreter functionality in the Linux     kernel's networking implementation. A local,     unprivileged user could use this flaw to crash the     system or leak kernel memory to user space via a     specially crafted socket filter. (CVE-2014-3144,     CVE-2014-3145, Moderate)

  * An out-of-bounds memory access flaw was found in the     Linux kernel's system call auditing implementation. On     a system with existing audit rules defined, a local,     unprivileged user could use this flaw to leak kernel     memory to user space or, potentially, crash the system.
    (CVE-2014-3917, Moderate)

  * A flaw was found in the way Linux kernel's Transparent     Huge Pages (THP) implementation handled non-huge page     migration. A local, unprivileged user could use this     flaw to crash the kernel by migrating transparent     hugepages. (CVE-2014-3940, Moderate)

  * An integer underflow flaw was found in the way the Linux     kernel's Stream Control Transmission Protocol (SCTP)     implementation processed certain COOKIE_ECHO packets.
    By sending a specially crafted SCTP packet, a remote     attacker could use this flaw to prevent legitimate     connections to a particular SCTP server socket to be     made. (CVE-2014-4667, Moderate)

  * An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) back-end driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client. (CVE-2014-4027, Low)

Users are advised to upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.10.33-rt32.43 and correct these issues. The system must be rebooted for this update to take effect.

Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol (PPP) when used with the Layer Two Tunneling Protocol (L2TP).
A local user could exploit this flaw to gain administrative privileges. (CVE-2014-4943)

Michael S. Tsirkin discovered an information leak in the Linux kernel's segmentation of skbs when using the zerocopy feature of vhost-net. A local attacker could exploit this flaw to gain potentially sensitive information from kernel memory. (CVE-2014-0131)

Salva Peiro discovered an information leak in the Linux kernel's media- device driver. A local attacker could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-1739)

An flaw was discovered in the Linux kernel's audit subsystem when auditing certain syscalls. A local attacker could exploit this flaw to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS). (CVE-2014-3917)

A flaw was discovered in the Linux kernel's implementation of user namespaces with respect to inode permissions. A local user could exploit this flaw by creating a user namespace to gain administrative privileges. (CVE-2014-4014)

An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

Don Bailey discovered a flaw in the LZO decompress algorithm used by the Linux kernel. An attacker could exploit this flaw to cause a denial of service (memory corruption or OOPS). (CVE-2014-4608).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
218250	Linux Distros Unpatched Vulnerability : CVE-2014-4027	Nessus	Misc.	medium
124837	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1516)	Nessus	Huawei Local Security Checks	critical
124804	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1480)	Nessus	Huawei Local Security Checks	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
82691	OracleVM 3.3 : kernel-uek (OVMSA-2015-0040)	Nessus	OracleVM Local Security Checks	high
80014	Scientific Linux Security Update : kernel on SL7.x x86_64 (20141209)	Nessus	Scientific Linux Local Security Checks	high
80005	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3104)	Nessus	Oracle Linux Local Security Checks	high
80004	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2014-3103)	Nessus	Oracle Linux Local Security Checks	high
79876	CentOS 7 : kernel (CESA-2014:1971)	Nessus	CentOS Local Security Checks	high
79848	RHEL 7 : kernel (RHSA-2014:1971)	Nessus	Red Hat Local Security Checks	high
79845	Oracle Linux 7 : kernel (ELSA-2014-1971)	Nessus	Oracle Linux Local Security Checks	high
78651	SuSE 11.3 Security Update : Linux kernel (SAT Patch Number 9750)	Nessus	SuSE Local Security Checks	high
78650	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9746 / 9749 / 9751)	Nessus	SuSE Local Security Checks	high
78491	F5 Networks BIG-IP : Linux kernel vulnerability (SOL15685)	Nessus	F5 Networks Local Security Checks	medium
77492	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2337-1)	Nessus	Ubuntu Local Security Checks	medium
77491	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2336-1)	Nessus	Ubuntu Local Security Checks	medium
77490	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2334-1)	Nessus	Ubuntu Local Security Checks	high
77074	Mandriva Linux Security Advisory : kernel (MDVSA-2014:155)	Nessus	Mandriva Local Security Checks	medium
76696	RHEL 6 : kernel-rt (RHSA-2014:0913)	Nessus	Red Hat Local Security Checks	high
76564	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-2285-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-4027

medium

Tenable Plugins

medium

critical

high

critical

high

high

high

high

high

high

high

high

high

medium

medium

medium

high

medium

high

high