An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed, unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned routers will themselves be the ones dropping their own traffic.

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities:

  - It was found that AIO interface didn't use the proper     rw_verify_area() helper function with extended     functionality, for example, mandatory locking on the     file. Also rw_verify_area() makes extended checks, for     example, that the size of the access doesn't cause     overflow of the provided offset limits. This integer     overflow in fs/aio.c in the Linux kernel before 3.4.1     allows local users to cause a denial of service or     possibly have unspecified other impact via a large AIO     iovec. (CVE-2012-6701)

  - Integer overflow in the aio_setup_single_vector function     in fs/aio.c in the Linux kernel 4.0 allows local users     to cause a denial of service or possibly have     unspecified other impact via a large AIO iovec. NOTE:
    this vulnerability exists because of a CVE-2012-6701     regression. (CVE-2015-8830)

  - It was discovered that a remote attacker could leverage     the generation of IPv6 atomic fragments to trigger the     use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is     not needed) and could subsequently perform any type of a     fragmentation-based attack against legacy IPv6 nodes     that do not implement RFC6946. (CVE-2016-10142)

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation. A     local attacker could use this flaw to cause a denial of     service (out-of-bounds access or system crash) by     changing a certain size value. (CVE-2016-6480)

  - It was found that when the gcc stack protector was     enabled, reading the /proc/keys file could cause a panic     in the Linux kernel due to stack corruption. This     happened because an incorrect buffer size was used to     hold a 64-bit timeout value rendered as weeks.
    (CVE-2016-7042)

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but doesn't     clear the setgid bit in a similar way. This could allow     a local user to gain group privileges via certain setgid     applications. (CVE-2016-7097)

  - A flaw was found in the Linux networking subsystem where     a local attacker with CAP_NET_ADMIN capabilities could     cause an out-of-bounds memory access by creating a     smaller-than-expected ICMP header and sending to its     destination via sendto(). (CVE-2016-8399)

  - A flaw was found in the Linux kernel key management     subsystem in which a local attacker could crash the     kernel or corrupt the stack and additional memory     (denial of service) by supplying a specially crafted RSA     key. This flaw panics the machine during the     verification of the RSA key. (CVE-2016-8650)

  - Use-after-free vulnerability in the snd_pcm_info()     function in the ALSA subsystem in the Linux kernel     allows attackers to induce a kernel memory corruption     and possibly crash or lock up a system. Due to the     nature of the flaw, a privilege escalation cannot be     fully ruled out, although we believe it is unlikely.
    (CVE-2017-0861)

  - A race condition issue was found in the way the raw     packet socket implementation in the Linux kernel     networking subsystem handled synchronization. A local     user able to open a raw packet socket (requires the     CAP_NET_RAW capability) could use this to waste     resources in the kernel's ring buffer or possibly cause     an out-of-bounds read on the heap leading to a system     crash. (CVE-2017-1000111)

  - A use-after-free flaw was found in the Netlink     functionality of the Linux kernel networking subsystem.
    Due to the insufficient cleanup in the mq_notify     function, a local attacker could potentially use this     flaw to escalate their privileges on the system.
    (CVE-2017-11176)

  - It was found that in the Linux kernel through v4.14-rc5,     bio_map_user_iov() and bio_unmap_user() in 'block/bio.c'     do unbalanced pages refcounting if IO vector has small     consecutive buffers belonging to the same page.
    bio_add_pc_page() merges them into one, but the page     reference is never dropped, causing a memory leak and     possible system lockup due to out-of-memory condition.
    (CVE-2017-12190)

  - A divide-by-zero vulnerability was found in the
    __tcp_select_window function in the Linux kernel. This     can result in a kernel panic causing a local denial of     service. (CVE-2017-14106)

  - A non-privileged user is able to mount a fuse filesystem     on RHEL 6 or 7 and crash a system if an application     punches a hole in a file that does not end aligned to a     page boundary. (CVE-2017-15121)

  - A use-after-free vulnerability was found when issuing an     ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption or     possibly privilege escalation. (CVE-2017-15265)

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with CAP_SYS_ADMIN     capability) can directly perform the ioctl operations     for dm device creation and removal and this would     typically be outside the direct control of the     unprivileged attacker. (CVE-2017-18203)

  - A race condition leading to a NULL pointer dereference     was found in the Linux kernel's Link Layer Control     implementation. A local attacker with access to ping     sockets could use this flaw to crash the system.
    (CVE-2017-2671)

  - It was found that the original fix for CVE-2016-6786 was     incomplete. There exist a race between two concurrent     sys_perf_event_open() calls when both try and move the     same pre-existing software group into a hardware     context. (CVE-2017-6001)

  - A flaw was found in the Linux kernel's handling of     packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality could allow     a remote attacker to force the kernel to enter a     condition in which it could loop indefinitely.
    (CVE-2017-6214)

  - Kernel memory corruption due to a buffer overflow was     found in brcmf_cfg80211_mgmt_tx() function in Linux     kernels from v3.9-rc1 to v4.13-rc1. The vulnerability     can be triggered by sending a crafted NL80211_CMD_FRAME     packet via netlink. This flaw is unlikely to be     triggered remotely as certain userspace code is needed     for this. An unprivileged local user could use this flaw     to induce kernel memory corruption on the system,     leading to a crash. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     it is unlikely. (CVE-2017-7541)

  - An integer overflow vulnerability in     ip6_find_1stfragopt() function was found. A local     attacker that has privileges (of CAP_NET_RAW) to open     raw socket can cause an infinite loop inside the     ip6_find_1stfragopt() function. (CVE-2017-7542)

  - Incorrect error handling in the set_mempolicy() and     mbind() compat syscalls in 'mm/mempolicy.c' in the Linux     kernel allows local users to obtain sensitive     information from uninitialized stack data by triggering     failure of a certain bitmap operation. (CVE-2017-7616)

  - The mm subsystem in the Linux kernel through 4.10.10     does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read     or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access     restrictions) via an application that opens the /dev/mem     file, related to arch/x86/mm/init.c and     drivers/char/mem.c. (CVE-2017-7889)

  - The IPv6 fragmentation implementation in the Linux     kernel does not consider that the nexthdr field may be     associated with an invalid option, which allows local     users to cause a denial of service (out-of-bounds read     and BUG) or possibly have unspecified other impact via     crafted socket and send system calls. Due to the nature     of the flaw, privilege escalation cannot be fully ruled     out, although we believe it is unlikely. (CVE-2017-9074)

  - In the Linux kernel versions 4.12, 3.10, 2.6, and     possibly earlier, a race condition vulnerability exists     in the sound system allowing for a potential deadlock     and memory corruption due to use-after-free condition     and thus denial of service. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely. (CVE-2018-1000004)

  - A null pointer dereference in dccp_write_xmit() function     in net/dccp/output.c in the Linux kernel allows a local     user to cause a denial of service by a number of certain     crafted system calls. (CVE-2018-1130)

  - Modern Intel microprocessors implement hardware-level     micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is     split into STA (STore Address) and STD (STore Data) sub-     operations. These sub-operations allow the processor to     hand-off address generation logic into these sub-     operations for optimized writes. Both of these sub-     operations write to a shared distributed processor     structure called the 'processor store buffer'. As a     result, an unprivileged attacker could use this flaw to     read private data resident within the CPU's processor     store buffer. (CVE-2018-12126)

  - Microprocessors use a load port subcomponent to     perform load operations from memory or IO. During a load     operation, the load port receives data from the memory     or IO subsystem and then provides the data to the CPU     registers and operations in the CPUs pipelines. Stale     load operations results are stored in the 'load port'     table until overwritten by newer operations. Certain     load-port operations triggered by an attacker can be     used to reveal data about previous stale requests     leaking data back to the attacker via a timing side-     channel. (CVE-2018-12127)

  - A flaw was found in the implementation of the fill     buffer, a mechanism used by modern CPUs when a cache-     miss is made on L1 CPU cache. If an attacker can     generate a load operation that would create a page     fault, the execution will continue speculatively with     incorrect data from the fill buffer while the data is     fetched from higher level caches. This response time can     be measured to infer data in the fill buffer.
    (CVE-2018-12130)

  - A vulnerability was found in the     fs/inode.c:inode_init_owner() function logic of the     LInux kernel that allows local users to create files     with an unintended group ownership and with group     execution and SGID permission bits set, in a scenario     where a directory is SGID and belongs to a certain group     and is writable by a user who is not a member of this     group. This can lead to excessive permissions granted in     case when they should not. (CVE-2018-13405)

  - A Floating Point Unit (FPU) state information leakage     flaw was found in the way the Linux kernel saved and     restored the FPU state during task switch. Linux kernels     that follow the Lazy FPU Restore scheme are vulnerable     to the FPU state information leakage issue. An     unprivileged local attacker could use this flaw to read     FPU state bits by conducting targeted cache side-channel     attacks, similar to the Meltdown vulnerability disclosed     earlier this year. (CVE-2018-3665)

  - An error in the _sctp_make_chunk() function     (net/sctp/sm_make_chunk.c) when handling SCTP, packet     length can be exploited by a malicious local user to     cause a kernel crash and a DoS. (CVE-2018-5803)

  - ALSA sequencer core initializes the event pool on demand     by invoking snd_seq_pool_init() when the first write     happens and the pool is empty. A user can reset the pool     size manually via ioctl concurrently, and this may lead     to UAF or out-of-bound access. (CVE-2018-7566)

  - Uncacheable memory on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. (CVE-2019-11091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the version of Pulse Policy Secure running on the remote host is affected by multiple vulnerabilities. Refer to the vendor advisory for additional information.

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is affected by multiple vulnerabilities. Refer to the vendor advisory for additional information.

An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed, unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned routers will themselves be the ones dropping their own traffic. (CVE-2016-10142)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability in the ICMP Packet Too Big (PTB) message functionality that occurs when handling IPv6 atomic fragments that trigger fragmentation in traffic.
An unauthenticated, remote attacker can exploit this issue, via a specially crafted series of packets, to cause the device to stop responding, the exhaustion of resources, or other impact that results in a denial of service condition.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J.
    Bruce Fields) [Orabug: 25986995] (CVE-2017-7895)

  - ocfs2/o2net: o2net_listen_data_ready should do nothing     if socket state is not TCP_LISTEN (Tariq Saeed) [Orabug:
    25510857]

  - IB/CORE: sync the resouce access in fmr_pool (Wengang     Wang) [Orabug: 23750748]

  - ipv6: Skip XFRM lookup if dst_entry in socket cache is     valid (Jakub Sitnicki) [Orabug: 25534688]

  - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles) [Orabug:
    25549845]

  - ksplice: add sysctls for determining Ksplice features.
    (Jamie Iles) 

  - signal: protect SIGNAL_UNKILLABLE from unintentional     clearing. (Jamie Iles) [Orabug: 25549845]

  - KVM: x86: fix emulation of 'MOV SS, null selector'     (Paolo Bonzini) [Orabug: 25719676] (CVE-2017-2583)     (CVE-2017-2583)

  - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Marcelo     Ricardo Leitner) [Orabug: 25719811] (CVE-2017-5986)

  - tcp: avoid infinite loop in tcp_splice_read (Eric     Dumazet) [Orabug: 25720815] (CVE-2017-6214)

  - USB: visor: fix null-deref at probe (Johan Hovold)     [Orabug: 25796604] (CVE-2016-2782)

  - ipc/shm: Fix shmat mmap nil-page protection (Davidlohr     Bueso) [Orabug: 25797014] (CVE-2017-5669)

  - vhost: actually track log eventfd file     (Marc-Andr&eacute  Lureau) [Orabug: 25797056]     (CVE-2015-6252)

  - xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size     harder (Andy Whitcroft) [Orabug: 25814664]     (CVE-2017-7184)

  - xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL     replay_window (Andy Whitcroft) [Orabug: 25814664]     (CVE-2017-7184)

  - KEYS: Remove key_type::match in favour of overriding     default by match_preparse (David Howells) [Orabug:
    25823965] (CVE-2017-2647) (CVE-2017-2647)

  - USB: whiteheat: fix potential null-deref at probe (Johan     Hovold) [Orabug: 25825107] (CVE-2015-5257)

  - RDS: fix race condition when sending a message on     unbound socket (Quentin Casasnovas) [Orabug: 25871048]     (CVE-2015-6937) (CVE-2015-6937)

  - udf: Check path length when reading symlink (Jan Kara)     [Orabug: 25871104] (CVE-2015-9731)

  - udf: Treat symlink component of type 2 as / (Jan Kara)     [Orabug: 25871104] (CVE-2015-9731)

  - udp: properly support MSG_PEEK with truncated buffers     (Eric Dumazet) [Orabug: 25874741] (CVE-2016-10229)

  - block: fix use-after-free in seq file (Vegard Nossum)     [Orabug: 25877531] (CVE-2016-7910)

  - RHEL: complement upstream workaround for CVE-2016-10142.
    (Quentin Casasnovas) [Orabug: 25765786] (CVE-2016-10142)     (CVE-2016-10142)

  - net: ping: check minimum size on ICMP header length     (Kees Cook) [Orabug: 25766914] (CVE-2016-8399)

  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen     Paul Pfeifer) [Orabug: 25765786] (CVE-2016-10142)

  - sg_write/bsg_write is not fit to be called under     KERNEL_DS (Al Viro) [Orabug: 25765448] (CVE-2016-10088)

  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter     chang) [Orabug: 25752011] (CVE-2017-7187)

  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander     Popov) [Orabug: 25696689] (CVE-2017-2636)

  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)     [Orabug: 25696689] (CVE-2017-2636)

  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc     (Fabian Frederick) [Orabug: 25696689] (CVE-2017-2636)

  - list: introduce list_first_entry_or_null (Jiri Pirko)     [Orabug: 25696689] (CVE-2017-2636)

  - firewire: net: guard against rx buffer overflows (Stefan     Richter) [Orabug: 25451538] (CVE-2016-8633)

  - x86/mm/32: Enable full randomization on i386 and X86_32     (Hector Marco-Gisbert) [Orabug: 25463929]     (CVE-2016-3672)

  - x86 get_unmapped_area: Access mmap_legacy_base through     mm_struct member (Radu Caragea) [Orabug: 25463929]     (CVE-2016-3672)

  - sg_start_req: make sure that there's not too many     elements in iovec (Al Viro) [Orabug: 25490377]     (CVE-2015-5707)

  - tcp: take care of truncations done by sk_filter (Eric     Dumazet) [Orabug: 25507232] (CVE-2016-8645)

  - rose: limit sk_filter trim to payload (Willem de Bruijn)     [Orabug: 25507232] (CVE-2016-8645)

  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer     (Dan Carpenter) [Orabug: 25507330] (CVE-2016-7425)

  - x86: bpf_jit: fix compilation of large bpf programs     (Alexei Starovoitov) [Orabug: 25507375] (CVE-2015-4700)

  - net: fix a kernel infoleak in x25 module (Kangjie Lu)     [Orabug: 25512417] (CVE-2016-4580)

  - USB: digi_acceleport: do sanity checking for the number     of ports (Oliver Neukum) [Orabug: 25512472]     (CVE-2016-3140)

  - net/llc: avoid BUG_ON in skb_orphan (Eric Dumazet)     [Orabug: 25682437] (CVE-2017-6345)

  - dccp: fix freeing skb too early for IPV6_RECVPKTINFO     (Andrey Konovalov) [Orabug: 25598277] (CVE-2017-6074)

  - vfs: read file_handle only once in handle_to_path (Sasha     Levin) [Orabug: 25388709] (CVE-2015-1420)

  - crypto: algif_hash - Only export and import on sockets     with data (Herbert Xu) [Orabug: 25417807]

  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)     [Orabug: 25462763] (CVE-2016-4482)

  - net: fix infoleak in llc (Kangjie Lu) [Orabug: 25462811]     (CVE-2016-4485)

  - af_unix: Guard against other == sk in unix_dgram_sendmsg     (Rainer Weikusat) [Orabug: 25464000] (CVE-2013-7446)

  - unix: avoid use-after-free in ep_remove_wait_queue     (Rainer Weikusat) [Orabug: 25464000] (CVE-2013-7446)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J.
    Bruce Fields) [Orabug: 25986990] (CVE-2017-7895)

  - fnic: Update fnic driver version to 1.6.0.24 (John     Sobecki) [Orabug: 24448585]

  - xen-netfront: Rework the fix for Rx stall during OOM and     network stress (Dongli Zhang) [Orabug: 25450703]

  - xen-netfront: Fix Rx stall during network stress and OOM     (Dongli Zhang) [Orabug: 25450703]

  - ipv6: Skip XFRM lookup if dst_entry in socket cache is     valid (Jakub Sitnicki)

  - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles) [Orabug:
    25549809]

  - ksplice: add sysctls for determining Ksplice features.
    (Jamie Iles) 

  - signal: protect SIGNAL_UNKILLABLE from unintentional     clearing. (Jamie Iles) [Orabug: 25549809]

  - VSOCK: Fix lockdep issue. (Dongli Zhang) [Orabug:
    25559937]

  - VSOCK: sock_put wasn't safe to call in interrupt context     (Dongli Zhang) [Orabug: 25559937]

  - IB/CORE: sync the resouce access in fmr_pool (Wengang     Wang) [Orabug: 25677469]

  - KVM: x86: fix emulation of 'MOV SS, null selector'     (Paolo Bonzini) [Orabug: 25719675] (CVE-2017-2583)     (CVE-2017-2583)

  - ext4: validate s_first_meta_bg at mount time (Eryu Guan)     [Orabug: 25719738] (CVE-2016-10208)

  - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Marcelo     Ricardo Leitner) [Orabug: 25719810] (CVE-2017-5986)

  - tcp: avoid infinite loop in tcp_splice_read (Eric     Dumazet) [Orabug: 25720813] (CVE-2017-6214)

  - lpfc cannot establish connection with targets that send     PRLI under P2P mode (Joe Jin) [Orabug: 25759083]

  - USB: visor: fix null-deref at probe (Johan Hovold)     [Orabug: 25796594] (CVE-2016-2782)

  - ipc/shm: Fix shmat mmap nil-page protection (Davidlohr     Bueso) [Orabug: 25797012] (CVE-2017-5669)

  - vhost: actually track log eventfd file     (Marc-Andr&eacute  Lureau) [Orabug: 25797052]     (CVE-2015-6252)

  - xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size     harder (Andy Whitcroft) [Orabug: 25814663]     (CVE-2017-7184)

  - xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL     replay_window (Andy Whitcroft) [Orabug: 25814663]     (CVE-2017-7184)

  - KEYS: Remove key_type::match in favour of overriding     default by match_preparse (Aniket Alshi) [Orabug:
    25823962] (CVE-2017-2647) (CVE-2017-2647)

  - USB: whiteheat: fix potential null-deref at probe (Johan     Hovold) [Orabug: 25825105] (CVE-2015-5257)     (CVE-2015-5257)

  - udf: Check path length when reading symlink (Jan Kara)     [Orabug: 25871102] (CVE-2015-9731)

  - udp: properly support MSG_PEEK with truncated buffers     (Eric Dumazet) [Orabug: 25876655] (CVE-2016-10229)

  - block: fix use-after-free in seq file (Vegard Nossum)     [Orabug: 25877530] (CVE-2016-7910)

  - Revert 'fix minor infoleak in get_user_ex' (Brian Maly)     [Orabug: 25790392] (CVE-2016-9644)

  - net: ping: check minimum size on ICMP header length     (Kees Cook) [Orabug: 25766911] (CVE-2016-8399)

  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen     Paul Pfeifer) [Orabug: 25765776] (CVE-2016-10142)

  - sg_write/bsg_write is not fit to be called under     KERNEL_DS (Al Viro) [Orabug: 25765445] (CVE-2016-10088)

  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter     chang) [Orabug: 25751996] (CVE-2017-7187)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3567 advisory.

  - The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not properly bound. (CVE-2015-6937)

  - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5     improperly emulates a MOV SS, NULL selector instruction, which allows guest OS users to cause a denial     of service (guest OS crash) or gain guest OS privileges via a crafted application. (CVE-2017-2583)

  - The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers     to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the     URG flag. (CVE-2017-6214)

  - The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not     validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root     privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN     capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-     image-* package 4.8.0.41.52. (CVE-2017-7184)

  - Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11     allows local users to cause a denial of service (assertion failure and panic) via a multithreaded     application that peels off an association in a certain buffer-full state. (CVE-2017-5986)

  - The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the     end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have     unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
    (CVE-2017-7895)

  - The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users     to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers     permanent file-descriptor allocation. (CVE-2015-6252)

  - The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain     match field, related to the keyring_search_iterator function in keyring.c. (CVE-2017-2647)

  - drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact     via a crafted USB device. NOTE: this ID was incorrectly used for an Apache Cordova issue that has the     correct ID of CVE-2015-8320. (CVE-2015-5257)

  - The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly     have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint. (CVE-2016-2782)

  - The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address     calculated by a certain rounding operation, which allows local users to map page zero, and consequently     bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat     system calls in a privileged context. (CVE-2017-5669)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3566 advisory.

  - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5     improperly emulates a MOV SS, NULL selector instruction, which allows guest OS users to cause a denial     of service (guest OS crash) or gain guest OS privileges via a crafted application. (CVE-2017-2583)

  - The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers     to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the     URG flag. (CVE-2017-6214)

  - The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not     validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root     privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN     capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-     image-* package 4.8.0.41.52. (CVE-2017-7184)

  - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly     validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-     of-bounds read and system crash) via a crafted ext4 image. (CVE-2016-10208)

  - Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11     allows local users to cause a denial of service (assertion failure and panic) via a multithreaded     application that peels off an association in a certain buffer-full state. (CVE-2017-5986)

  - The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the     end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have     unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
    (CVE-2017-7895)

  - The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users     to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers     permanent file-descriptor allocation. (CVE-2015-6252)

  - The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain     match field, related to the keyring_search_iterator function in keyring.c. (CVE-2017-2647)

  - drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact     via a crafted USB device. NOTE: this ID was incorrectly used for an Apache Cordova issue that has the     correct ID of CVE-2015-8320. (CVE-2015-5257)

  - The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly     have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint. (CVE-2016-2782)

  - The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address     calculated by a certain rounding operation, which allows local users to map page zero, and consequently     bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat     system calls in a privileged context. (CVE-2017-5669)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was discovered that a remote attacker could leverage     the generation of IPv6 atomic fragments to trigger the     use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is     not needed) and could subsequently perform any type of a     fragmentation- based attack against legacy IPv6 nodes     that do not implement RFC6946. (CVE-2016-10142,     Moderate)

  - A flaw was discovered in the way the Linux kernel dealt     with paging structures. When the kernel invalidated a     paging structure that was not in use locally, it could,     in principle, race against another CPU that is switching     to a process that uses the paging structure in question.
    A local user could use a thread running with a stale     cached virtual->physical translation to potentially     escalate their privileges if the translation in question     were writable and the physical page got reused for     something critical (for example, a page table).
    (CVE-2016-2069, Moderate)

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation. A     local attacker could use this flaw to cause a denial of     service (out-of-bounds access or system crash) by     changing a certain size value. (CVE-2016-6480, Moderate)

  - It was found that when the gcc stack protector was     enabled, reading the /proc/keys file could cause a panic     in the Linux kernel due to stack corruption. This     happened because an incorrect buffer size was used to     hold a 64-bit timeout value rendered as weeks.
    (CVE-2016-7042, Moderate)

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but doesn't     clear the setgid bit in a similar way. This could allow     a local user to gain group privileges via certain setgid     applications. (CVE-2016-7097, Moderate)

  - A flaw was found in the Linux networking subsystem where     a local attacker with CAP_NET_ADMIN capabilities could     cause an out-of-bounds memory access by creating a     smaller-than-expected ICMP header and sending to its     destination via sendto(). (CVE-2016-8399, Moderate)

  - It was found that the blk_rq_map_user_iov() function in     the Linux kernel's block device implementation did not     properly restrict the type of iterator, which could     allow a local attacker to read or write to arbitrary     kernel memory locations or cause a denial of service     (use-after-free) by leveraging write access to a /dev/sg     device. (CVE-2016-9576, CVE-2016-10088, Moderate)

  - A flaw was found in the USB-MIDI Linux kernel driver: a     double-free error could be triggered for the 'umidi'     object. An attacker with physical access to the system     could use this flaw to escalate their privileges.
    (CVE-2016-2384, Low)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - RHEL: complement upstream workaround for CVE-2016-10142.
    (Quentin Casasnovas) [Orabug: 25765786] (CVE-2016-10142)     (CVE-2016-10142)

  - net: ping: check minimum size on ICMP header length     (Kees Cook) [Orabug: 25766914] (CVE-2016-8399)

  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen     Paul Pfeifer) [Orabug: 25765786] (CVE-2016-10142)

  - sg_write/bsg_write is not fit to be called under     KERNEL_DS (Al Viro) [Orabug: 25765448] (CVE-2016-10088)

  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter     chang) [Orabug: 25752011] (CVE-2017-7187)

  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander     Popov) [Orabug: 25696689] (CVE-2017-2636)

  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)     [Orabug: 25696689] (CVE-2017-2636)

  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc     (Fabian Frederick) [Orabug: 25696689] (CVE-2017-2636)

  - list: introduce list_first_entry_or_null (Jiri Pirko)     [Orabug: 25696689] (CVE-2017-2636)

  - firewire: net: guard against rx buffer overflows (Stefan     Richter) [Orabug: 25451538] (CVE-2016-8633)

  - x86/mm/32: Enable full randomization on i386 and X86_32     (Hector Marco-Gisbert) [Orabug: 25463929]     (CVE-2016-3672)

  - x86 get_unmapped_area: Access mmap_legacy_base through     mm_struct member (Radu Caragea) [Orabug: 25463929]     (CVE-2016-3672)

  - sg_start_req: make sure that there's not too many     elements in iovec (Al Viro) [Orabug: 25490377]     (CVE-2015-5707)

  - tcp: take care of truncations done by sk_filter (Eric     Dumazet) [Orabug: 25507232] (CVE-2016-8645)

  - rose: limit sk_filter trim to payload (Willem de Bruijn)     [Orabug: 25507232] (CVE-2016-8645)

  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer     (Dan Carpenter) [Orabug: 25507330] (CVE-2016-7425)

  - x86: bpf_jit: fix compilation of large bpf programs     (Alexei Starovoitov) [Orabug: 25507375] (CVE-2015-4700)

  - net: fix a kernel infoleak in x25 module (Kangjie Lu)     [Orabug: 25512417] (CVE-2016-4580)

  - USB: digi_acceleport: do sanity checking for the number     of ports (Oliver Neukum) [Orabug: 25512472]     (CVE-2016-3140)

  - net/llc: avoid BUG_ON in skb_orphan (Eric Dumazet)     [Orabug: 25682437] (CVE-2017-6345)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3535 advisory.

  - The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows     local users to cause a denial of service (system crash) by creating a packet filter and then loading     crafted BPF instructions that trigger late convergence by the JIT compiler. (CVE-2015-4700)

  - The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in     situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary     kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-9576. (CVE-2016-10088)

  - An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious     application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate     because it first requires compromising a privileged process and current compiler optimizations restrict     access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID:
    A-31349935. (CVE-2016-8399)

  - An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages.
    (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications     of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the     generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of     fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing     fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed,     unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to     DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is     communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain     extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between     Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU     smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as     required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received     ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with     extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS     scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they     implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the     aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an     attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message     with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned     routers will themselves be the ones dropping their own traffic. (CVE-2016-10142)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause     a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large     command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write     function. (CVE-2017-7187)

  - Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain     privileges or cause a denial of service (double free) by setting the HDLC line discipline. (CVE-2017-2636)

  - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2     does not restrict a certain length field, which allows local users to gain privileges or cause a denial of     service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. (CVE-2016-7425)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations,     allows remote attackers to execute arbitrary code via crafted fragmented packets. (CVE-2016-8633)

  - The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not     properly randomize the legacy base address, which makes it easier for local users to defeat the intended     restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or     setgid program, by disabling stack-consumption resource limits. (CVE-2016-3672)

  - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. (CVE-2016-8645)

  - The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device descriptor. (CVE-2016-3140)

  - The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in     required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have     unspecified other impact via crafted system calls. (CVE-2017-6345)

  - Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x     before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a     large iov_count value in a write request. (CVE-2015-5707)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3534 advisory.

  - The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows     local users to cause a denial of service (system crash) by creating a packet filter and then loading     crafted BPF instructions that trigger late convergence by the JIT compiler. (CVE-2015-4700)

  - The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in     situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary     kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-9576. (CVE-2016-10088)

  - An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious     application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate     because it first requires compromising a privileged process and current compiler optimizations restrict     access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID:
    A-31349935. (CVE-2016-8399)

  - An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages.
    (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications     of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the     generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of     fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing     fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed,     unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to     DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is     communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain     extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between     Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU     smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as     required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received     ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with     extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS     scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they     implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the     aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an     attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message     with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned     routers will themselves be the ones dropping their own traffic. (CVE-2016-10142)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause     a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large     command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write     function. (CVE-2017-7187)

  - Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain     privileges or cause a denial of service (double free) by setting the HDLC line discipline. (CVE-2017-2636)

  - arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows     guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by     an L2 guest. (CVE-2016-9588)

  - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2     does not restrict a certain length field, which allows local users to gain privileges or cause a denial of     service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. (CVE-2016-7425)

  - The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through     4.3.3 do not verify an address length, which allows local users to obtain sensitive information from     kernel memory and bypass the KASLR protection mechanism via a crafted application. (CVE-2015-8569)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations,     allows remote attackers to execute arbitrary code via crafted fragmented packets. (CVE-2016-8633)

  - The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not     properly randomize the legacy base address, which makes it easier for local users to defeat the intended     restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or     setgid program, by disabling stack-consumption resource limits. (CVE-2016-3672)

  - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. (CVE-2016-8645)

  - The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not     initialize a certain integer variable, which allows local users to obtain sensitive information from     kernel stack memory by triggering failure of a get_user_ex call. (CVE-2016-9178)

  - The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device descriptor. (CVE-2016-3140)

  - The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in     required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have     unspecified other impact via crafted system calls. (CVE-2017-6345)

  - The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows     attackers to cause a denial of service (system crash) via (1) an application that makes crafted system     calls or possibly (2) IPv4 traffic with invalid IP options. (CVE-2017-5970)

  - Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x     before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a     large iov_count value in a write request. (CVE-2015-5707)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's handling of     packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality can allow     a remote attacker to force the kernel to enter a     condition in which it can loop indefinitely.

  - It was discovered that a remote attacker could leverage     the generation of IPv6 atomic fragments to trigger the     use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is     not needed) and could subsequently perform any type of     a fragmentation-based attack against legacy IPv6 nodes     that do not implement RFC6946.

  - It was found that the blk_rq_map_user_iov() function in     the Linux kernel's block device implementation did not     properly restrict the type of iterator, which could     allow a local attacker to read or write to arbitrary     kernel memory locations or cause a denial of service     (use-after-free) by leveraging write access to a     /dev/sg device.

  - A flaw was found in the Linux kernel's implementation     of the SCTP protocol. A remote attacker could trigger     an out-of-bounds read with an offset of up to 64kB     potentially causing the system to crash.

  - A flaw was found in the Linux networking subsystem     where a local attacker with CAP_NET_ADMIN capabilities     could cause an out-of-bounds memory access by creating     a smaller-than-expected ICMP header and sending to its     destination via sendto().

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way. This     could allow a local user to gain group privileges via     certain setgid applications.

  - It was found that when the gcc stack protector was     enabled, reading the /proc/keys file could cause a     panic in the Linux kernel due to stack corruption. This     happened because an incorrect buffer size was used to     hold a 64-bit timeout value rendered as weeks.

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation.
    A local attacker could use this flaw to cause a denial     of service (out-of-bounds access or system crash) by     changing a certain size value.

  - When creating audit records for parameters to executed     children processes, an attacker can convince the Linux     kernel audit subsystem can create corrupt records which     may allow an attacker to misrepresent or evade logging     of executing commands.

  - A flaw was discovered in the way the Linux kernel dealt     with paging structures. When the kernel invalidated a     paging structure that was not in use locally, it could,     in principle, race against another CPU that is     switching to a process that uses the paging structure     in question. A local user could use a thread running     with a stale cached virtual->physical translation to     potentially escalate their privileges if the     translation in question were writable and the physical     page got reused for something critical (for example, a     page table).

  - A flaw was found in the USB-MIDI Linux kernel driver: a     double-free error could be triggered for the 'umidi'     object. An attacker with physical access to the system     could use this flaw to escalate their privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0817 advisory.

  - Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges     by triggering access to a paging structure by a different CPU. (CVE-2016-2069)

  - Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel     before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have     unspecified other impact via vectors involving an invalid USB descriptor. (CVE-2016-2384)

  - Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel     through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by     changing a certain size value, aka a double fetch vulnerability. (CVE-2016-6480)

  - The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU     Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout     data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading     the /proc/keys file. (CVE-2016-7042)

  - The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly     restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory     locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
    (CVE-2016-9576)

  - The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in     situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary     kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-9576. (CVE-2016-10088)

  - The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr     call, which allows local users to gain group privileges by leveraging the existence of a setgid program     with restrictions on execute permissions. (CVE-2016-7097)

  - An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious     application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate     because it first requires compromising a privileged process and current compiler optimizations restrict     access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID:
    A-31349935. (CVE-2016-8399)

  - An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages.
    (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications     of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the     generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of     fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing     fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed,     unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to     DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is     communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain     extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between     Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU     smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as     required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received     ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with     extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS     scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they     implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the     aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an     attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message     with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned     routers will themselves be the ones dropping their own traffic. (CVE-2016-10142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was discovered that a remote attacker could leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and could subsequently perform any type of a fragmentation-based attack against legacy IPv6 nodes that do not implement RFC6946. (CVE-2016-10142, Moderate)

* A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table).
(CVE-2016-2069, Moderate)

* A race condition flaw was found in the ioctl_send_fib() function in the Linux kernel's aacraid implementation. A local attacker could use this flaw to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value. (CVE-2016-6480, Moderate)

* It was found that when the gcc stack protector was enabled, reading the /proc/keys file could cause a panic in the Linux kernel due to stack corruption. This happened because an incorrect buffer size was used to hold a 64-bit timeout value rendered as weeks. (CVE-2016-7042, Moderate)

* It was found that when file permissions were modified via chmod and the user modifying them was not in the owning group or capable of CAP_FSETID, the setgid bit would be cleared. Setting a POSIX ACL via setxattr sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way. This could allow a local user to gain group privileges via certain setgid applications.
(CVE-2016-7097, Moderate)

* A flaw was found in the Linux networking subsystem where a local attacker with CAP_NET_ADMIN capabilities could cause an out-of-bounds memory access by creating a smaller-than-expected ICMP header and sending to its destination via sendto(). (CVE-2016-8399, Moderate)

* It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
(CVE-2016-9576, CVE-2016-10088, Moderate)

* A flaw was found in the USB-MIDI Linux kernel driver: a double-free error could be triggered for the 'umidi' object. An attacker with physical access to the system could use this flaw to escalate their privileges. (CVE-2016-2384, Low)

The CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat) and the CVE-2016-7097 issue was discovered by Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was discovered that a remote attacker could leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and could subsequently perform any type of a fragmentation-based attack against legacy IPv6 nodes that do not implement RFC6946. (CVE-2016-10142, Moderate)

* A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table).
(CVE-2016-2069, Moderate)

* A race condition flaw was found in the ioctl_send_fib() function in the Linux kernel's aacraid implementation. A local attacker could use this flaw to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value. (CVE-2016-6480, Moderate)

* It was found that when the gcc stack protector was enabled, reading the / proc/keys file could cause a panic in the Linux kernel due to stack corruption. This happened because an incorrect buffer size was used to hold a 64-bit timeout value rendered as weeks. (CVE-2016-7042, Moderate)

* It was found that when file permissions were modified via chmod and the user modifying them was not in the owning group or capable of CAP_FSETID, the setgid bit would be cleared. Setting a POSIX ACL via setxattr sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way. This could allow a local user to gain group privileges via certain setgid applications.
(CVE-2016-7097, Moderate)

* A flaw was found in the Linux networking subsystem where a local attacker with CAP_NET_ADMIN capabilities could cause an out-of-bounds memory access by creating a smaller-than-expected ICMP header and sending to its destination via sendto(). (CVE-2016-8399, Moderate)

* It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
(CVE-2016-9576, CVE-2016-10088, Moderate)

* A flaw was found in the USB-MIDI Linux kernel driver: a double-free error could be triggered for the 'umidi' object. An attacker with physical access to the system could use this flaw to escalate their privileges. (CVE-2016-2384, Low)

The CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat) and the CVE-2016-7097 issue was discovered by Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

ID	Name	Product	Family	Severity
127425	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0152)	Nessus	NewStart CGSL Local Security Checks	high
109920	Pulse Policy Secure Multiple Vulnerabilities (SA43730)	Nessus	Misc.	medium
109919	Pulse Connect Secure Multiple Vulnerabilities (SA43730)	Nessus	Misc.	medium
101493	F5 Networks BIG-IP : IPv6 fragmentation vulnerability (K57211290)	Nessus	F5 Networks Local Security Checks	high
101266	Juniper Junos ICMPv6 PTB Atomic Fragment DoS (JSA10780)	Nessus	Junos Local Security Checks	high
100238	OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0106)	Nessus	OracleVM Local Security Checks	critical
100237	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0105)	Nessus	OracleVM Local Security Checks	critical
100235	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2017-3567)	Nessus	Oracle Linux Local Security Checks	critical
100234	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3566)	Nessus	Oracle Linux Local Security Checks	critical
99218	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20170321)	Nessus	Scientific Linux Local Security Checks	high
99164	OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0058)	Nessus	OracleVM Local Security Checks	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
99161	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2017-3535)	Nessus	Oracle Linux Local Security Checks	high
99160	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3534)	Nessus	Oracle Linux Local Security Checks	high
99106	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-025)	Nessus	Virtuozzo Local Security Checks	critical
99074	Oracle Linux 6 : kernel (ELSA-2017-0817)	Nessus	Oracle Linux Local Security Checks	high
97962	CentOS 6 : kernel (CESA-2017:0817)	Nessus	CentOS Local Security Checks	high
97886	RHEL 6 : kernel (RHSA-2017:0817)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2016-10142

high

Tenable Plugins

high

medium

medium

high

high

critical

critical

critical

critical

high

high

critical

high

high

critical

high

high

high