The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the system.(CVE-2015-5157)

  - A denial of service vulnerability was found in the     WhiteHEAT USB Serial Driver (whiteheat_attach function     in drivers/usb/serial/whiteheat.c). In the driver, the     COMMAND_PORT variable was hard coded and set to 4 (5th     element). The driver assumed that the number of ports     would always be 5 and used port number 5 as the command     port. However, when using a USB device in which the     number of ports was set to a number less than 5 (for     example, 3), the driver triggered a kernel NULL-pointer     dereference. A non-privileged attacker could use this     flaw to panic the host.(CVE-2015-5257)

  - A NULL pointer dereference flaw was found in the SCTP     implementation. A local user could use this flaw to     cause a denial of service on the system by triggering a     kernel panic when creating multiple sockets in parallel     while the system did not have the SCTP module     loaded.(CVE-2015-5283)

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as     #AC (alignment check exception) is handled. A     privileged user inside a guest could use this flaw to     create denial of service conditions on the host     kernel.(CVE-2015-5307)

  - A flaw was found in the way the Linux kernel's     networking implementation handled UDP packets with     incorrect checksum values. A remote attacker could     potentially use this flaw to trigger an infinite loop     in the kernel, resulting in a denial of service on the     system, or cause a denial of service in applications     using the edge triggered epoll     functionality.(CVE-2015-5364)

  - A flaw was found in the way the Linux kernel's     networking implementation handled UDP packets with     incorrect checksum values. A remote attacker could     potentially use this flaw to trigger an infinite loop     in the kernel, resulting in a denial of service on the     system, or cause a denial of service in applications     using the edge triggered epoll     functionality.(CVE-2015-5366)

  - A cross-boundary flaw was discovered in the Linux     kernel software raid driver. The driver accessed a     disabled bitmap where only the first byte of the buffer     was initialized to zero. This meant that the rest of     the request (up to 4095 bytes) was left and copied into     user space. An attacker could use this flaw to read     private information from user space that would not     otherwise have been accessible.(CVE-2015-5697)

  - An integer-overflow vulnerability was found in the scsi     block-request handling code in function start_req(). A     local attacker could use specially crafted IOV requests     to overflow a counter used in bio_map_user_iov()'s page     calculation, and write past the end of the array that     contains kernel-page pointers.(CVE-2015-5707)

  - A flaw was found in the way the Linux kernel's vhost     driver treated userspace provided log file descriptor     when processing the VHOST_SET_LOG_FD ioctl command. The     file descriptor was never released and continued to     consume kernel memory. A privileged local user with     access to the /dev/vhost-net files could use this flaw     to create a denial-of-service attack.(CVE-2015-6252)

  - A flaw was found in the way the Linux kernel's perf     subsystem retrieved userlevel stack traces on PowerPC     systems. A local, unprivileged user could use this flaw     to cause a denial of service on the system by creating     a special stack layout that would force the     perf_callchain_user_64() function into an infinite     loop.(CVE-2015-6526)

  - A NULL-pointer dereference vulnerability was discovered     in the Linux kernel. The kernel's Reliable Datagram     Sockets (RDS) protocol implementation did not verify     that an underlying transport existed before creating a     connection to a remote server. A local system user     could exploit this flaw to crash the system by creating     sockets at specific times to trigger a NULL pointer     dereference.(CVE-2015-6937)

  - Multiple race conditions in the Advanced Union     Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch     patches for the Linux kernel 3.x and 4.x allow local     users to cause a denial of service (use-after-free and     BUG) or possibly gain privileges via a (1) madvise or     (2) msync system call, related to mm/madvise.c and     mm/msync.c.(CVE-2015-7312)

  - A divide-by-zero flaw was discovered in the Linux     kernel built with KVM virtualization     support(CONFIG_KVM). The flaw occurs in the KVM     module's Programmable Interval Timer(PIT) emulation,     when PIT counters for channel 1 or 2 are set to zero(0)     and a privileged user inside the guest attempts to read     these counters. A privileged guest user with access to     PIT I/O ports could exploit this issue to crash the     host kernel (denial of service).(CVE-2015-7513)

  - An out-of-bounds memory access flaw was found in the     Linux kernel's aiptek USB tablet driver (aiptek_probe()     function in drivers/input/tablet/aiptek.c). The driver     assumed that the interface always had at least one     endpoint. By using a specially crafted USB device with     no endpoints on one of its interfaces, an unprivileged     user with physical access to the system could trigger a     kernel NULL pointer dereference, causing the system to     panic.(CVE-2015-7515)

  - A NULL-pointer dereference flaw was found in the     kernel, which is caused by a race between revoking a     user-type key and reading from it. The issue could be     triggered by an unprivileged user with a local account,     causing the kernel to crash (denial of     service).(CVE-2015-7550)

  - A flaw was found in the way the Linux kernel visor     driver handles certain invalid USB device descriptors.
    The driver assumes that the device always has at least     one bulk OUT endpoint. By using a specially crafted USB     device (without a bulk OUT endpoint), an unprivileged     user with physical access could trigger a kernel     NULL-pointer dereference and cause a system panic     (denial of service).(CVE-2015-7566)

  - A race condition flaw was found in the way the Linux     kernel's IPC subsystem initialized certain fields in an     IPC object structure that were later used for     permission checking before inserting the object into a     globally visible list. A local, unprivileged user could     potentially use this flaw to elevate their privileges     on the system.(CVE-2015-7613)

  - A flaw was discovered in the Linux kernel where issuing     certain ioctl() -s commands to the '/dev/ppp' device     file could lead to a NULL pointer dereference. A     privileged user could use this flaw to cause a kernel     crash and denial of service.(CVE-2015-7799)

  - It was found that the Linux kernel's keys subsystem did     not correctly garbage collect uninstantiated keyrings.
    A local attacker could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-7872)

  - A denial of service flaw was discovered in the Linux     kernel, where a race condition caused a NULL pointer     dereference in the RDS socket-creation code. A local     attacker could use this flaw to create a situation in     which a NULL pointer crashed the kernel.(CVE-2015-7990)

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as     #DB (debug exception) is handled. A privileged user     inside a guest could use this flaw to create denial of     service conditions on the host kernel.(CVE-2015-8104)

  - It was found that the Linux kernel's IPv6 network stack     did not properly validate the value of the MTU variable     when it was set. A remote attacker could potentially     use this flaw to disrupt a target system's networking     (packet loss) by setting an invalid MTU value, for     example, via a NetworkManager daemon that is processing     router advertisement packets running on the target     system.(CVE-2015-8215)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In the ea_get function in fs/jfs/xattr.c in the Linux     kernel through 4.17.1, a memory corruption bug in JFS     can be triggered by calling setxattr twice with two     different extended attribute names on the same file.
    This vulnerability can be triggered by an unprivileged     user with the ability to create files and execute     programs. A kmalloc call is incorrect, leading to     slab-out-of-bounds in jfs_xattr.(CVE-2018-12233i1/4%0

  - The spectre_v2_select_mitigation function in     arch/x86/kernel/cpu/bugs.c in the Linux kernel before     4.18.1 does not always fill RSB upon a context switch,     which makes it easier for attackers to conduct     userspace-userspace spectreRSB     attacks.(CVE-2018-15572i1/4%0

  - Race condition in the queue_delete function in     sound/core/seq/seq_queue.c in the Linux kernel before     4.4.1 allows local users to cause a denial of service     (use-after-free and system crash) by making an ioctl     call at a certain time.(CVE-2016-2544i1/4%0

  - A flaw was found in the Linux kernel's implementation     of BPF in which systems can application can overflow a     32 bit refcount in both program and map refcount. This     refcount can wrap and end up a user after     free.(CVE-2016-4558i1/4%0

  - Interpretation conflict in     drivers/md/dm-snap-persistent.c in the Linux kernel     through 3.11.6 allows remote authenticated users to     obtain sensitive information or modify data via a     crafted mapping to a snapshot block     device.(CVE-2013-4299i1/4%0

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537i1/4%0

  - A vulnerability in the handling of Transactional Memory     on powerpc systems was found. An unprivileged local     user can crash the kernel by starting a transaction,     suspending it, and then calling any of the exec() class     system calls.(CVE-2016-5828i1/4%0

  - A cross-boundary flaw was discovered in the Linux     kernel software raid driver. The driver accessed a     disabled bitmap where only the first byte of the buffer     was initialized to zero. This meant that the rest of     the request (up to 4095 bytes) was left and copied into     user space. An attacker could use this flaw to read     private information from user space that would not     otherwise have been accessible.(CVE-2015-5697i1/4%0

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643i1/4%0

  - Race condition in the sclp_ctl_ioctl_sccb function in     drivers/s390/char/sclp_ctl.c in the Linux kernel before     4.6 allows local users to obtain sensitive information     from kernel memory by changing a certain length value,     aka a 'double fetch' vulnerability.(CVE-2016-6130i1/4%0

  - drivers/net/usb/asix_devices.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16647i1/4%0

  - A flaw was found in the Linux kernel which could cause     a kernel panic when restoring machine specific     registers on the PowerPC platform. Incorrect     transactional memory state registers could     inadvertently change the call path on return from     userspace and cause the kernel to enter an unknown     state and crash.(CVE-2015-8845i1/4%0

  - fs/namespace.c in the Linux kernel through 3.16.1 does     not properly restrict clearing MNT_NODEV, MNT_NOSUID,     and MNT_NOEXEC and changing MNT_ATIME_MASK during a     remount of a bind mount, which allows local users to     gain privileges, interfere with backups and auditing on     systems that had atime enabled, or cause a denial of     service (excessive filesystem updating) on systems that     had atime disabled via a 'mount -o remount' command     within a user namespace.(CVE-2014-5207i1/4%0

  - The NFS2/3 RPC client could send long arguments to the     NFS server. These encoded arguments are stored in an     array of memory pages, and accessed using pointer     variables. Arbitrarily long arguments could make these     pointers point outside the array and cause an     out-of-bounds memory access. A remote user or program     could use this flaw to crash the kernel, resulting in     denial of service.(CVE-2017-7645i1/4%0

  - The time subsystem in the Linux kernel, when     CONFIG_TIMER_STATS is enabled, allows local users to     discover real PID values (as distinguished from PID     values inside a PID namespace) by reading the     /proc/timer_list file, related to the print_timer     function in kernel/time/timer_list.c and the
    __timer_stats_timer_set_start_info function in     kernel/time/timer.c.(CVE-2017-5967i1/4%0

  - A vulnerability was found in the Linux kernel where the     keyctl_set_reqkey_keyring() function leaks the thread     keyring. This allows an unprivileged local user to     exhaust kernel memory and thus cause a     DoS.(CVE-2017-7472i1/4%0

  - A flaw was found that can be triggered in     keyring_search_iterator in keyring.c if type-i1/4zmatch     is NULL. A local user could use this flaw to crash the     system or, potentially, escalate their     privileges.(CVE-2017-2647i1/4%0

  - The make_response function in     drivers/block/xen-blkback/blkback.c in the Linux kernel     before 4.11.8 allows guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures, aka XSA-216.(CVE-2017-10911i1/4%0

  - Stack-based buffer overflow in the SET_WPS_IE IOCTL     implementation in wlan_hdd_hostapd.c in the WLAN (aka     Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used     in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to gain privileges via a crafted     application that uses a long WPS IE     element.(CVE-2015-0570i1/4%0

  - The net_ctl_permissions function in net/sysctl_net.c in     the Linux kernel before 3.11.5 does not properly     determine uid and gid values, which allows local users     to bypass intended /proc/sys/net restrictions via a     crafted application.(CVE-2013-4270i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0037 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0147 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3098 advisory.

  - The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not     enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of     service (system crash) or possibly have unspecified other impact via a crafted splice system call, as     demonstrated by use of a file descriptor associated with an ext4 filesystem. (CVE-2014-7822)

  - The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not     properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls,     which allows local users to cause a denial of service (system crash) or possibly gain privileges via a     crafted application, aka an I/O vector array overrun. (CVE-2015-1805)

  - The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not properly bound. (CVE-2015-6937)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2777-1 advisory.

  - The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support     a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of     service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
    (CVE-2015-5156)

  - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a     certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory     via a GET_BITMAP_FILE ioctl call. (CVE-2015-5697)

  - The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users     to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers     permanent file-descriptor allocation. (CVE-2015-6252)

  - The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not properly bound. (CVE-2015-6937)

  - Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch     patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free     and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c     and mm/msync.c. (CVE-2015-7312)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.48-52.27 to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-7613: A flaw was found in the Linux kernel IPC     code that could lead to arbitrary code execution. The     ipc_addid() function initialized a shared object that     has unset uid/gid values. Since the fields are not     initialized, the check can falsely succeed. (bsc#948536)

  - CVE-2015-5156: When a guests KVM network devices is in a     bridge configuration the kernel can create a situation     in which packets are fragmented in an unexpected     fashion. The GRO functionality can create a situation in     which multiple SKB's are chained together in a single     packets fraglist (by design). (bsc#940776)

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel before 4.1.6 on the x86_64 platform mishandles     IRET faults in processing NMIs that occurred during     userspace execution, which might allow local users to     gain privileges by triggering an NMI (bsc#938706).

  - CVE-2015-6252: A flaw was found in the way the Linux     kernel's vhost driver treated userspace provided log     file descriptor when processing the VHOST_SET_LOG_FD     ioctl command. The file descriptor was never released     and continued to consume kernel memory. A privileged     local user with access to the /dev/vhost-net files could     use this flaw to create a denial-of-service attack     (bsc#942367).

  - CVE-2015-5697: The get_bitmap_file function in     drivers/md/md.c in the Linux kernel before 4.1.6 does     not initialize a certain bitmap data structure, which     allows local users to obtain sensitive information from     kernel memory via a GET_BITMAP_FILE ioctl call.
    (bnc#939994)

  - CVE-2015-6937: A NULL pointer dereference flaw was found     in the Reliable Datagram Sockets (RDS) implementation     allowing a local user to cause system DoS. A     verification was missing that the underlying transport     exists when a connection was created. (bsc#945825)

  - CVE-2015-5283: A NULL pointer dereference flaw was found     in SCTP implementation allowing a local user to cause     system DoS. Creation of multiple sockets in parallel     when system doesn't have SCTP module loaded can lead to     kernel panic. (bsc#947155)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Benjamin Randazzo discovered an information leak in the md (multiple device) driver when the bitmap_info.file is disabled. A local privileged attacker could use this to obtain sensitive information from the kernel. (CVE-2015-5697)

Marc-Andre Lureau discovered that the vhost driver did not properly release the userspace provided log file descriptor. A privileged attacker could use this to cause a denial of service (resource exhaustion). (CVE-2015-6252).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2751-1 advisory.

  - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a     certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory     via a GET_BITMAP_FILE ioctl call. (CVE-2015-5697)

  - The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users     to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers     permanent file-descriptor allocation. (CVE-2015-6252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2748-1 advisory.

  - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a     certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory     via a GET_BITMAP_FILE ioctl call. (CVE-2015-5697)

  - The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users     to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers     permanent file-descriptor allocation. (CVE-2015-6252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the CVEs described below.

CVE-2015-0272

It was discovered that NetworkManager would set IPv6 MTUs based on the values received in IPv6 RAs (Router Advertisements), without sufficiently validating these values. A remote attacker could exploit this attack to disable IPv6 connectivity. This has been mitigated by adding validation in the kernel.

CVE-2015-5156

Jason Wang discovered that when a virtio_net device is connected to a bridge in the same VM, a series of TCP packets forwarded through the bridge may cause a heap buffer overflow. A remote attacker could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2015-5364

It was discovered that the Linux kernel does not properly handle invalid UDP checksums. A remote attacker could exploit this flaw to cause a denial of service using a flood of UDP packets with invalid checksums.

CVE-2015-5366

It was discovered that the Linux kernel does not properly handle invalid UDP checksums. A remote attacker can cause a denial of service against applications that use epoll by injecting a single packet with an invalid checksum.

CVE-2015-5697

A flaw was discovered in the md driver in the Linux kernel leading to an information leak.

CVE-2015-5707

An integer overflow in the SCSI generic driver in the Linux kernel was discovered. A local user with write permission on a SCSI generic device could potentially exploit this flaw for privilege escalation.

CVE-2015-6937

It was found that the Reliable Datagram Sockets (RDS) protocol implementation did not verify that an underlying transport exists when creating a connection. Depending on how a local RDS application initialised its sockets, a remote attacker might be able to cause a denial of service (crash) by sending a crafted packet.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 2.6.32-48squeeze14.

For the oldstable distribution (wheezy), these problems have been fixed in version 3.2.68-1+deb7u4 or earlier.

For the stable distribution (jessie), these problems have been fixed in version 3.16.7-ckt11-1+deb8u4 or earlier.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Benjamin Randazzo discovered an information leak in the md (multiple device) driver when the bitmap_info.file is disabled. A local privileged attacker could use this to obtain sensitive information from the kernel.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.1.5 update contains a number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.1.5 update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest upstream stable release, Linux v4.1.4. Fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - md: use kzalloc when bitmap is disabled (Benjamin     Randazzo) [Orabug: 21563041] (CVE-2015-5697)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak.

  - CVE-2015-1333     Colin Ian King discovered a flaw in the add_key function     of the Linux kernel's keyring subsystem. A local user     can exploit this flaw to cause a denial of service due     to memory exhaustion.

  - CVE-2015-3212     Ji Jianwen of Red Hat Engineering discovered a flaw in     the handling of the SCTPs automatic handling of dynamic     multi-homed connections. A local attacker could use this     flaw to cause a crash or potentially for privilege     escalation.

  - CVE-2015-4692     A NULL pointer dereference flaw was found in the     kvm_apic_has_events function in the KVM subsystem. A     unprivileged local user could exploit this flaw to crash     the system kernel resulting in denial of service.

  - CVE-2015-4700     Daniel Borkmann discovered a flaw in the Linux kernel     implementation of the Berkeley Packet Filter which can     be used by a local user to crash the system.

  - CVE-2015-5364     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     could exploit this flaw to cause a denial of service     using a flood of UDP packets with invalid checksums.

  - CVE-2015-5366     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     can cause a denial of service against applications that     use epoll by injecting a single packet with an invalid     checksum.

  - CVE-2015-5697     A flaw was discovered in the md driver in the Linux     kernel leading to an information leak.

  - CVE-2015-5706     An user triggerable use-after-free vulnerability in path     lookup in the Linux kernel could potentially lead to     privilege escalation.

  - CVE-2015-5707     An integer overflow in the SCSI generic driver in the     Linux kernel was discovered. A local user with write     permission on a SCSI generic device could potentially     exploit this flaw for privilege escalation.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3068 advisory.

  - include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5     uses an insufficiently large data type for certain extension data, which allows local users to cause a     denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension     loading, as demonstrated by configuring a PPTP tunnel in a NAT environment. (CVE-2014-9715)

  - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a     certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory     via a GET_BITMAP_FILE ioctl call. (CVE-2015-5697)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3067 advisory.

  - include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5     uses an insufficiently large data type for certain extension data, which allows local users to cause a     denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension     loading, as demonstrated by configuring a PPTP tunnel in a NAT environment. (CVE-2014-9715)

  - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a     certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory     via a GET_BITMAP_FILE ioctl call. (CVE-2015-5697)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-3066 advisory.

  - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a     certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory     via a GET_BITMAP_FILE ioctl call. (CVE-2015-5697)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
124812	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1488)	Nessus	Huawei Local Security Checks	medium
124802	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1478)	Nessus	Huawei Local Security Checks	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
90019	OracleVM 3.2 : kernel-uek (OVMSA-2016-0037)	Nessus	OracleVM Local Security Checks	critical
86882	OracleVM 3.3 : kernel-uek (OVMSA-2015-0147)	Nessus	OracleVM Local Security Checks	high
86881	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3098)	Nessus	Oracle Linux Local Security Checks	high
86468	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2777-1)	Nessus	Ubuntu Local Security Checks	medium
86378	SUSE SLED12 / SLES12 Security Update : kernel-source (SUSE-SU-2015:1727-1)	Nessus	SuSE Local Security Checks	high
86207	Ubuntu 15.04 : linux vulnerabilities (USN-2752-1)	Nessus	Ubuntu Local Security Checks	low
86206	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2751-1)	Nessus	Ubuntu Local Security Checks	medium
86204	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2749-1)	Nessus	Ubuntu Local Security Checks	low
86190	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2748-1)	Nessus	Ubuntu Local Security Checks	medium
86049	Debian DLA-310-1 : linux-2.6 security update	Nessus	Debian Local Security Checks	high
85799	Ubuntu 12.04 LTS : linux vulnerability (USN-2731-1)	Nessus	Ubuntu Local Security Checks	low
85556	Fedora 22 : kernel-4.1.5-200.fc22 (2015-13396)	Nessus	Fedora Local Security Checks	low
85555	Fedora 21 : kernel-4.1.5-100.fc21 (2015-13391)	Nessus	Fedora Local Security Checks	low
85364	Fedora 21 : kernel-4.1.4-100.fc21 (2015-12917)	Nessus	Fedora Local Security Checks	low
85363	Fedora 22 : kernel-4.1.4-200.fc22 (2015-12908)	Nessus	Fedora Local Security Checks	low
85340	OracleVM 3.3 : kernel-uek (OVMSA-2015-0113)	Nessus	OracleVM Local Security Checks	low
85281	Debian DSA-3329-1 : linux - security update	Nessus	Debian Local Security Checks	high
85263	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3068)	Nessus	Oracle Linux Local Security Checks	medium
85262	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3067)	Nessus	Oracle Linux Local Security Checks	medium
85261	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3066)	Nessus	Oracle Linux Local Security Checks	low

Detections

Analytics

CVE-2015-5697

medium

Tenable Plugins

medium

high

critical

critical

high

high

medium

high

low

medium

low

medium

high

low

low

low

low

low

low

high

medium

medium

low