Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.

USN-3127-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

It was discovered that the compression handling code in the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel did not properly check for an integer overflow. A local attacker could use this to cause a denial of service (system crash). (CVE-2014-9904)

Kirill A. Shutemov discovered that memory manager in the Linux kernel did not properly handle anonymous pages. A local attacker could use this to cause a denial of service or possibly gain administrative privileges. (CVE-2015-3288)

Vitaly Kuznetsov discovered that the Linux kernel did not properly suppress hugetlbfs support in X86 paravirtualized guests. An attacker in the guest OS could cause a denial of service (guest system crash).
(CVE-2016-3961)

Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a buffer overflow when displaying timeout events via the /proc/keys interface. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-7042).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3127-1 advisory.

  - The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux     kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a     denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl call. (CVE-2014-9904)

  - mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain     privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to     page zero. (CVE-2015-3288)

  - Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which     allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a     hugetlbfs mapped area. (CVE-2016-3961)

  - The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU     Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout     data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading     the /proc/keys file. (CVE-2016-7042)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when handling IPT_SO_SET_REPLACE events.
A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-3134)

Vitaly Kuznetsov discovered that the Linux kernel did not properly suppress hugetlbfs support in X86 paravirtualized guests. An attacker in the guest OS could cause a denial of service (guest system crash).
(CVE-2016-3961)

It was discovered that the keyring implementation in the Linux kernel did not ensure a data structure was initialized before referencing it after an error condition occurred. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-4470)

Kangjie Lu discovered an information leak in the netlink implementation of the Linux kernel. A local attacker could use this to obtain sensitive information from kernel memory. (CVE-2016-5243).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2015-7515, CVE-2016-2184, CVE-2016-2185,     CVE-2016-2186, CVE-2016-2187, CVE-2016-3136,     CVE-2016-3137, CVE-2016-3138, CVE-2016-3140     Ralf Spenneberg of OpenSource Security reported that     various USB drivers do not sufficiently validate USB     descriptors. This allowed a physically present user with     a specially designed USB device to cause a denial of     service (crash).

  - CVE-2016-0821     Solar Designer noted that the list 'poisoning' feature,     intended to mitigate the effects of bugs in list     manipulation in the kernel, used poison values within     the range of virtual addresses that can be allocated by     user processes.

  - CVE-2016-1237     David Sinquin discovered that nfsd does not check     permissions when setting ACLs, allowing users to grant     themselves permissions to a file by setting the ACL.

  - CVE-2016-1583     Jann Horn of Google Project Zero reported that the     eCryptfs filesystem could be used together with the proc     filesystem to cause a kernel stack overflow. If the     ecryptfs-utils package is installed, local users could     exploit this, via the mount.ecryptfs_private program,     for denial of service (crash) or possibly for privilege     escalation.

  - CVE-2016-2117     Justin Yackoski of Cryptonite discovered that the     Atheros L2 ethernet driver incorrectly enables     scatter/gather I/O. A remote attacker could take     advantage of this flaw to obtain potentially sensitive     information from kernel memory.

  - CVE-2016-2143     Marcin Koscielnicki discovered that the fork     implementation in the Linux kernel on s390 platforms     mishandles the case of four page-table levels, which     allows local users to cause a denial of service (system     crash).

  - CVE-2016-3070     Jan Stancek of Red Hat discovered a local denial of     service vulnerability in AIO handling.

  - CVE-2016-3134     The Google Project Zero team found that the netfilter     subsystem does not sufficiently validate filter table     entries. A user with the CAP_NET_ADMIN capability could     use this for denial of service (crash) or possibly for     privilege escalation. Debian disables unprivileged user     namespaces by default, if locally enabled with the     kernel.unprivileged_userns_clone sysctl, this allows     privilege escalation.

  - CVE-2016-3156     Solar Designer discovered that the IPv4 implementation     in the Linux kernel did not perform the destruction of     inet device objects properly. An attacker in a guest OS     could use this to cause a denial of service (networking     outage) in the host OS.

  - CVE-2016-3157 / XSA-171     Andy Lutomirski discovered that the x86_64 (amd64) task     switching implementation did not correctly update the     I/O permission level when running as a Xen paravirtual     (PV) guest. In some configurations this would allow     local users to cause a denial of service (crash) or to     escalate their privileges within the guest.

  - CVE-2016-3672     Hector Marco and Ismael Ripoll noted that it was     possible to disable Address Space Layout Randomisation     (ASLR) for x86_32 (i386) programs by removing the stack     resource limit. This made it easier for local users to     exploit security flaws in programs that have the setuid     or setgid flag set.

  - CVE-2016-3951     It was discovered that the cdc_ncm driver would free     memory prematurely if certain errors occurred during its     initialisation. This allowed a physically present user     with a specially designed USB device to cause a denial     of service (crash) or possibly to escalate their     privileges.

  - CVE-2016-3955     Ignat Korchagin reported that the usbip subsystem did     not check the length of data received for a USB buffer.
    This allowed denial of service (crash) or privilege     escalation on a system configured as a usbip client, by     the usbip server or by an attacker able to impersonate     it over the network. A system configured as a usbip     server might be similarly vulnerable to physically     present users.

  - CVE-2016-3961 / XSA-174     Vitaly Kuznetsov of Red Hat discovered that Linux     allowed the use of hugetlbfs on x86 (i386 and amd64)     systems even when running as a Xen paravirtualised (PV)     guest, although Xen does not support huge pages. This     allowed users with access to /dev/hugepages to cause a     denial of service (crash) in the guest.

  - CVE-2016-4470     David Howells of Red Hat discovered that a local user     can trigger a flaw in the Linux kernel's handling of key     lookups in the keychain subsystem, leading to a denial     of service (crash) or possibly to privilege escalation.

  - CVE-2016-4482, CVE-2016-4485, CVE-2016-4486,     CVE-2016-4569, CVE-2016-4578, CVE-2016-4580,     CVE-2016-5243, CVE-2016-5244

    Kangjie Lu reported that the USB devio, llc, rtnetlink,     ALSA timer, x25, tipc, and rds facilities leaked     information from the kernel stack.

  - CVE-2016-4565     Jann Horn of Google Project Zero reported that various     components in the InfiniBand stack implemented unusual     semantics for the write() operation. On a system with     InfiniBand drivers loaded, local users could use this     for denial of service or privilege escalation.

  - CVE-2016-4581     Tycho Andersen discovered that in some situations the     Linux kernel did not handle propagated mounts correctly.
    A local user can take advantage of this flaw to cause a     denial of service (system crash).

  - CVE-2016-4805     Baozeng Ding discovered a use-after-free in the generic     PPP layer in the Linux kernel. A local user can take     advantage of this flaw to cause a denial of service     (system crash), or potentially escalate their     privileges.

  - CVE-2016-4913     Al Viro found that the ISO9660 filesystem implementation     did not correctly count the length of certain invalid     name entries. Reading a directory containing such name     entries would leak information from kernel memory. Users     permitted to mount disks or disk images could use this     to obtain sensitive information.

  - CVE-2016-4997 / CVE-2016-4998     Jesse Hertz and Tim Newsham discovered that missing     input sanitising in Netfilter socket handling may result     in denial of service. Debian disables unprivileged user     namespaces by default, if locally enabled with the     kernel.unprivileged_userns_clone sysctl, this also     allows privilege escalation.

This update fixes the CVEs described below.

CVE-2016-0821

Solar Designer noted that the list 'poisoning' feature, intended to mitigate the effects of bugs in list manipulation in the kernel, used poison values within the range of virtual addresses that can be allocated by user processes.

CVE-2016-1583

Jann Horn of Google Project Zero reported that the eCryptfs filesystem could be used together with the proc filesystem to cause a kernel stack overflow. If the ecryptfs-utils package was installed, local users could exploit this, via the mount.ecryptfs_private program, for denial of service (crash) or possibly for privilege escalation.

CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140

Ralf Spenneberg of OpenSource Security reported that various USB drivers do not sufficiently validate USB descriptors. This allowed a physically present user with a specially designed USB device to cause a denial of service (crash). Not all the drivers have yet been fixed.

CVE-2016-3134

The Google Project Zero team found that the netfilter subsystem does not sufficiently validate filter table entries. A user with the CAP_NET_ADMIN capability could use this for denial of service (crash) or possibly for privilege escalation.

CVE-2016-3157 / XSA-171

Andy Lutomirski discovered that the x86_64 (amd64) task switching implementation did not correctly update the I/O permission level when running as a Xen paravirtual (PV) guest. In some configurations this would allow local users to cause a denial of service (crash) or to escalate their privileges within the guest.

CVE-2016-3672

Hector Marco and Ismael Ripoll noted that it was still possible to disable Address Space Layout Randomisation (ASLR) for x86_32 (i386) programs by removing the stack resource limit. This made it easier for local users to exploit security flaws in programs that have the setuid or setgid flag set.

CVE-2016-3951

It was discovered that the cdc_ncm driver would free memory prematurely if certain errors occurred during its initialisation. This allowed a physically present user with a specially designed USB device to cause a denial of service (crash) or possibly to escalate their privileges.

CVE-2016-3955

Ignat Korchagin reported that the usbip subsystem did not check the length of data received for a USB buffer. This allowed denial of service (crash) or privilege escalation on a system configured as a usbip client, by the usbip server or by an attacker able to impersonate it over the network. A system configured as a usbip server might be similarly vulnerable to physically present users.

CVE-2016-3961 / XSA-174

Vitaly Kuznetsov of Red Hat discovered that Linux allowed use of hugetlbfs on x86 (i386 and amd64) systems even when running as a Xen paravirtualised (PV) guest, although Xen does not support huge pages.
This allowed users with access to /dev/hugepages to cause a denial of service (crash) in the guest.

CVE-2016-4482, CVE-2016-4485, CVE-2016-4486, CVE-2016-4569, CVE-2016-4578, CVE-2016-4580, CVE-2016-5243, CVE-2016-5244

Kangjie Lu reported that the USB devio, llc, rtnetlink, ALSA timer, x25, tipc, and rds facilities leaked information from the kernel stack.

CVE-2016-4565

Jann Horn of Google Project Zero reported that various components in the InfiniBand stack implemented unusual semantics for the write() operation. On a system with InfiniBand drivers loaded, local users could use this for denial of service or privilege escalation.

CVE-2016-4913

Al Viro found that the ISO9660 filesystem implementation did not correctly count the length of certain invalid name entries. Reading a directory containing such name entries would leak information from kernel memory. Users permitted to mount disks or disk images could use this to obtain sensitive information.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2.81-1.

This update also fixes bug #627782, which caused data corruption in some applications running on an aufs filesystem, and includes many other bug fixes from upstream stable updates 3.2.79, 3.2.80 and 3.2.81.

For Debian 8 'Jessie', these problems will be fixed soon.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3007-1 advisory.

  - Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

  - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows     local users to gain privileges or cause a denial of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)

  - The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2     incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data. (CVE-2016-2117)

  - The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted     endpoints value in a USB device descriptor. (CVE-2016-2187)

  - Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which     allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a     hugetlbfs mapped area. (CVE-2016-3961)

  - The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a     certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by     reading a message. (CVE-2016-4485)

  - The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory by reading a Netlink message. (CVE-2016-4486)

  - The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users     to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted     application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2)     a 1 Tb system, related to the map reference count. (CVE-2016-4558)

  - The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system     call, which allows local users to cause a denial of service (kernel memory write operation) or possibly     have unspecified other impact via a uAPI interface. (CVE-2016-4565)

  - fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a     certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls. (CVE-2016-4581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3006-1 advisory.

  - Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

  - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows     local users to gain privileges or cause a denial of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)

  - The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2     incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data. (CVE-2016-2117)

  - The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted     endpoints value in a USB device descriptor. (CVE-2016-2187)

  - Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which     allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a     hugetlbfs mapped area. (CVE-2016-3961)

  - The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a     certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by     reading a message. (CVE-2016-4485)

  - The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory by reading a Netlink message. (CVE-2016-4486)

  - The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users     to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted     application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2)     a 1 Tb system, related to the map reference count. (CVE-2016-4558)

  - The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system     call, which allows local users to cause a denial of service (kernel memory write operation) or possibly     have unspecified other impact via a uAPI interface. (CVE-2016-4565)

  - fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a     certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls. (CVE-2016-4581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3005-1 advisory.

  - Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

  - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows     local users to gain privileges or cause a denial of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)

  - The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2     incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data. (CVE-2016-2117)

  - The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted     endpoints value in a USB device descriptor. (CVE-2016-2187)

  - Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which     allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a     hugetlbfs mapped area. (CVE-2016-3961)

  - The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a     certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by     reading a message. (CVE-2016-4485)

  - The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory by reading a Netlink message. (CVE-2016-4486)

  - The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users     to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted     application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2)     a 1 Tb system, related to the map reference count. (CVE-2016-4558)

  - The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system     call, which allows local users to cause a denial of service (kernel memory write operation) or possibly     have unspecified other impact via a uAPI interface. (CVE-2016-4565)

  - fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a     certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls. (CVE-2016-4581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-2117)

Jann Horn discovered that eCryptfs improperly attempted to use the mmap() handler of a lower filesystem that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-1583)

Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB over wifi device drivers in the Linux kernel. A remote attacker could use this to cause a denial of service (system crash) or obtain potentially sensitive information from kernel memory. (CVE-2015-4004)

Ralf Spenneberg discovered that the Linux kernel's GTCO digitizer USB device driver did not properly validate endpoint descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2187)

Hector Marco and Ismael Ripoll discovered that the Linux kernel would improperly disable Address Space Layout Randomization (ASLR) for x86 processes running in 32 bit mode if stack-consumption resource limits were disabled. A local attacker could use this to make it easier to exploit an existing vulnerability in a setuid/setgid program.
(CVE-2016-3672)

Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3951)

It was discovered that an out-of-bounds write could occur when handling incoming packets in the USB/IP implementation in the Linux kernel. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-3955)

Vitaly Kuznetsov discovered that the Linux kernel did not properly suppress hugetlbfs support in X86 paravirtualized guests. An attacker in the guest OS could cause a denial of service (guest system crash).
(CVE-2016-3961)

Kangjie Lu discovered an information leak in the ANSI/IEEE 802.2 LLC type 2 Support implementations in the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-4485)

Kangjie Lu discovered an information leak in the routing netlink socket interface (rtnetlink) implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-4486)

Jann Horn discovered that the InfiniBand interfaces within the Linux kernel could be coerced into overwriting kernel memory. A local unprivileged attacker could use this to possibly gain administrative privileges on systems where InifiniBand related kernel modules are loaded. (CVE-2016-4565)

It was discovered that in some situations the Linux kernel did not handle propagated mounts correctly. A local unprivileged attacker could use this to cause a denial of service (system crash).
(CVE-2016-4581).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3002-1 advisory.

  - The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash) via a crafted packet. (CVE-2015-4004)

  - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows     local users to gain privileges or cause a denial of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)

  - The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2     incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data. (CVE-2016-2117)

  - The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted     endpoints value in a USB device descriptor. (CVE-2016-2187)

  - The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not     properly randomize the legacy base address, which makes it easier for local users to defeat the intended     restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or     setgid program, by disabling stack-consumption resource limits. (CVE-2016-3672)

  - Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact     by inserting a USB device with an invalid USB descriptor. (CVE-2016-3951)

  - The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows     remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other     impact via a crafted length value in a USB/IP packet. (CVE-2016-3955)

  - Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which     allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a     hugetlbfs mapped area. (CVE-2016-3961)

  - The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a     certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by     reading a message. (CVE-2016-4485)

  - The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory by reading a Netlink message. (CVE-2016-4486)

  - The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system     call, which allows local users to cause a denial of service (kernel memory write operation) or possibly     have unspecified other impact via a uAPI interface. (CVE-2016-4565)

  - fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a     certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls. (CVE-2016-4581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3001-1 advisory.

  - The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash) via a crafted packet. (CVE-2015-4004)

  - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows     local users to gain privileges or cause a denial of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)

  - The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2     incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data. (CVE-2016-2117)

  - The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted     endpoints value in a USB device descriptor. (CVE-2016-2187)

  - The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not     properly randomize the legacy base address, which makes it easier for local users to defeat the intended     restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or     setgid program, by disabling stack-consumption resource limits. (CVE-2016-3672)

  - Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact     by inserting a USB device with an invalid USB descriptor. (CVE-2016-3951)

  - The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows     remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other     impact via a crafted length value in a USB/IP packet. (CVE-2016-3955)

  - Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which     allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a     hugetlbfs mapped area. (CVE-2016-3961)

  - The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a     certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by     reading a message. (CVE-2016-4485)

  - The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory by reading a Netlink message. (CVE-2016-4486)

  - The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system     call, which allows local users to cause a denial of service (kernel memory write operation) or possibly     have unspecified other impact via a uAPI interface. (CVE-2016-4565)

  - fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a     certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls. (CVE-2016-4581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux kernel did not properly suppress hugetlbfs support in x86 PV guests, which could allow local PV guest users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area. (CVE-2016-3961 / XSA-174)

A flaw was found in the way the Linux kernel's ASN.1 DER decoder processed certain certificate files with tags of indefinite length. A local, unprivileged user could use a specially crafted X.509 certificate DER file to crash the system or, potentially, escalate their privileges on the system. (CVE-2016-0758)

Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

The following flaws were also fixed in this version :

CVE-2016-4557 : Use after free vulnerability via double fdput

CVE-2016-4581 : Slave being first propagated copy causes oops in propagate_mnt

CVE-2016-4486 : Information leak in rtnetlink

CVE-2016-4485 : Information leak in llc module

CVE-2016-4558 : bpf: refcnt overflow

CVE-2016-4565 : infiniband: Unprivileged process can overwrite kernel memory using rdma_ucm.ko

CVE-2016-0758 : tags with indefinite length can corrupt pointers in asn1_find_indefinite_length()

CVE-2015-8839 : ext4 filesystem page fault race condition with fallocate call.

The 4.4.8 update contains a number of important fixes across the tree
---- The 4.4.7 update contains a number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.4.8 update contains an number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.5.2 stable update contains a number of important fixes across the tree. This build should also boot on some of the i686 systems that would not boot before.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
94732	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3127-2)	Nessus	Ubuntu Local Security Checks	high
94731	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3127-1)	Nessus	Ubuntu Local Security Checks	high
92860	Ubuntu 12.04 LTS : linux vulnerabilities (USN-3049-1)	Nessus	Ubuntu Local Security Checks	high
91886	Debian DSA-3607-1 : linux - security update	Nessus	Debian Local Security Checks	critical
91687	Debian DLA-516-1 : linux security update	Nessus	Debian Local Security Checks	critical
91569	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3007-1)	Nessus	Ubuntu Local Security Checks	high
91568	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3006-1)	Nessus	Ubuntu Local Security Checks	high
91567	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3005-1)	Nessus	Ubuntu Local Security Checks	high
91566	Ubuntu 15.10 : linux-raspi2 vulnerabilities (USN-3004-1)	Nessus	Ubuntu Local Security Checks	critical
91565	Ubuntu 15.10 : linux vulnerabilities (USN-3003-1)	Nessus	Ubuntu Local Security Checks	critical
91564	Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerabilities (USN-3002-1)	Nessus	Ubuntu Local Security Checks	critical
91563	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-3001-1)	Nessus	Ubuntu Local Security Checks	critical
91241	Amazon Linux AMI : kernel (ALAS-2016-703)	Nessus	Amazon Linux Local Security Checks	high
90952	Fedora 22 : kernel-4.4.8-200.fc22 (2016-373c063e79)	Nessus	Fedora Local Security Checks	critical
90769	Fedora 23 : kernel-4.4.8-300.fc23 (2016-8a1f49149e)	Nessus	Fedora Local Security Checks	critical
90693	Fedora 24 : binutils-2.26-18.fc24 / kernel-4.5.2-301.fc24 (2016-7f37d42add)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-3961

medium

Tenable Plugins

high

high

high

critical

critical

high

high

high

critical

critical

critical

critical

high

critical

critical

critical