The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed     completion commands sent via USB Request Blocks     buffers. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3185i1/4%0

  - Use-after-free vulnerability in the msm_set_crop     function in drivers/media/video/msm/msm_camera.c in the     MSM-Camera driver for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, allows attackers to     gain privileges or cause a denial of service (memory     corruption) via an application that makes a crafted     ioctl call.(CVE-2015-0568i1/4%0

  - The vivid_fb_ioctl function in     drivers/media/platform/vivid/vivid-osd.c in the Linux     kernel through 4.3.3 does not initialize a certain     structure member, which allows local users to obtain     sensitive information from kernel memory via a crafted     application.(CVE-2015-7884i1/4%0

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel can allow     a local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535i1/4%0

  - The ACPI parsing functionality in the Linux kernel does     not flush the node and node_ext caches which causes a     kernel stack dump. This allows local users to obtain     sensitive information from kernel memory and use this     information to bypass the KASLR protection mechanism by     creating and applying crafted ACPI     table.(CVE-2017-13694i1/4%0

  - The is_ashmem_file function in     drivers/staging/android/ashmem.c in a certain Qualcomm     Innovation Center (QuIC) Android patch for the Linux     kernel 3.x mishandles pointer validation within the     KGSL Linux Graphics Module, which allows attackers to     bypass intended access restrictions by using the     /ashmem string as the dentry name.(CVE-2016-5340i1/4%0

  - It was found that the Linux kernel did not properly     account file descriptors passed over the unix socket     against the process limit. A local user could use this     flaw to exhaust all available memory on the     system.(CVE-2013-4312i1/4%0

  - Kernel memory corruption due to a buffer overflow was     found in brcmf_cfg80211_mgmt_tx() function in Linux     kernels from v3.9-rc1 to v4.13-rc1. The vulnerability     can be triggered by sending a crafted NL80211_CMD_FRAME     packet via netlink. This flaw is unlikely to be     triggered remotely as certain userspace code is needed     for this. An unprivileged local user could use this     flaw to induce kernel memory corruption on the system,     leading to a crash. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although it is unlikely.(CVE-2017-7541i1/4%0

  - A flaw in the netback module allowed frontends to     control mapping of requests to request queues. An     attacker can change this mapping by requesting invalid     mapping requests allowing the (usually privileged)     backend to access out-of-bounds memory access for     reading and writing.(CVE-2018-15471i1/4%0

  - A buffer overflow vulnerability due to a lack of input     filtering of incoming fragmented datagrams was found in     the IP-over-1394 driver firewire-net in a fragment     handling code in the Linux kernel. The vulnerability     exists since firewire supported IPv4, i.e. since     version 2.6.31 (year 2009) till version v4.9-rc4. A     maliciously formed fragment with a respectively large     datagram offset would cause a memcpy() past the     datagram buffer, which would cause a system panic or     possible arbitrary code execution.The flaw requires     firewire-net module to be loaded and is remotely     exploitable from connected firewire devices, but not     over a local network.(CVE-2016-8633i1/4%0

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.(CVE-2016-10741i1/4%0

  - A vulnerability was found in the Linux kernel. The     pointer to the netlink socket attribute is not checked,     which could cause a null pointer dereference when     parsing the nested attributes in function     tipc_nl_publ_dump(). This allows local users to cause a     DoS.(CVE-2016-4951i1/4%0

  - It was reported that with Linux kernel, earlier than     version v4.10-rc8, an application may trigger a BUG_ON     in sctp_wait_for_sndbuf if the socket tx buffer is     full, a thread is waiting on it to queue more data, and     meanwhile another thread peels off the association     being used by the first thread.(CVE-2017-5986i1/4%0

  - The kvm_vm_ioctl_check_extension function in     arch/powerpc/kvm/powerpc.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) via a     KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl call to     /dev/kvm.(CVE-2017-15306i1/4%0

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830i1/4%0

  - A flaw was found in the way the Linux kernel's SCTP     implementation validated INIT chunks when performing     Address Configuration Change (ASCONF). A remote     attacker could use this flaw to crash the system by     sending a specially crafted SCTP packet to trigger a     NULL pointer dereference on the     system.(CVE-2014-7841i1/4%0

  - A race condition issue leading to a use-after-free flaw     was found in the way the raw packet sockets are     implemented in the Linux kernel networking subsystem     handling synchronization. A local user able to open a     raw packet socket (requires the CAP_NET_RAW capability)     can use this issue to crash the     system.(CVE-2017-1000111)

  - A flaw was found in the way the Linux kernel performed     forking inside of a transaction. A local, unprivileged     user on a PowerPC system that supports transactional     memory could use this flaw to crash the     system.(CVE-2014-2673i1/4%0

  - The hashbin_delete function in net/irda/irqueue.c in     the Linux kernel improperly manages lock dropping,     which allows local users to cause a denial of service     (deadlock) via crafted operations on IrDA     devices.(CVE-2017-6348i1/4%0

  - An out-of-bounds flaw was found in the kernel, where     the length of the sockaddr parameter was not checked in     the pptp_bind() and pptp_connect() functions. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local system user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8569i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0100 for details.

The openSUSE Leap 42.1 kernel was updated to 4.1.31 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bnc#970948).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-3156: The IPv4 implementation in the Linux     kernel mishandled destruction of device objects, which     allowed guest OS users to cause a denial of service     (host OS networking outage) by arranging for a large     number of IP addresses (bnc#971360).

  - CVE-2016-4485: The llc_cmsg_rcv function in     net/llc/af_llc.c in the Linux kernel did not initialize     a certain data structure, which allowed attackers to     obtain sensitive information from kernel stack memory by     reading a message (bnc#978821).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-4557: The replace_map_fd_with_map_ptr function     in kernel/bpf/verifier.c in the Linux kernel did not     properly maintain an fd data structure, which allowed     local users to gain privileges or cause a denial of     service (use-after-free) via crafted BPF instructions     that reference an incorrect file descriptor     (bnc#979018).

  - CVE-2016-4580: The x25_negotiate_facilities function in     net/x25/x25_facilities.c in the Linux kernel did not     properly initialize a certain data structure, which     allowed attackers to obtain sensitive information from     kernel stack memory via an X.25 Call Request     (bnc#981267).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-4951: The tipc_nl_publ_dump function in     net/tipc/socket.c in the Linux kernel did not verify     socket existence, which allowed local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     dumpit operation (bnc#981058).

  - CVE-2015-8787: The nf_nat_redirect_ipv4 function in     net/netfilter/nf_nat_redirect.c in the Linux kernel     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact by sending certain IPv4     packets to an incompletely configured interface, a     related issue to CVE-2003-1604 (bnc#963931).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bnc#979213).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-6828: A use after free in     tcp_xmit_retransmit_queue() was fixed that could be used     by local attackers to crash the kernel (bsc#994296).

  - CVE-2016-6480: Race condition in the ioctl_send_fib     function in drivers/scsi/aacraid/commctrl.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds access or system crash) by changing a     certain size value, aka a 'double fetch' vulnerability     (bnc#991608).

  - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging     in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary     (bnc#986362 986365 990058).

  - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel     did not properly determine the rate of challenge ACK     segments, which made it easier for man-in-the-middle     attackers to hijack TCP sessions via a blind in-window     attack (bnc#989152).

  - CVE-2016-1237: nfsd in the Linux kernel allowed local     users to bypass intended file-permission restrictions by     setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c,     and nfs4acl.c (bnc#986570).

The following non-security bugs were fixed :

  - AF_VSOCK: Shrink the area influenced by prepare_to_wait     (bsc#994520).

  - KVM: arm/arm64: Handle forward time correction     gracefully (bnc#974266).

  - Linux 4.1.29. Refreshed patch:
    patches.xen/xen3-fixup-xen Deleted patches:
    patches.fixes/0001-Revert-ecryptfs-forbid-opening-files-     without-mmap-ha.patch     patches.fixes/0001-ecryptfs-don-t-allow-mmap-when-the-lo     wer-file-system.patch     patches.rpmify/Revert-mm-swap.c-flush-lru-pvecs-on-compo     und-page-ar     patches.rpmify/Revert-powerpc-Update-TM-user-feature-bit     s-in-scan_f

  - Revert 'mm/swap.c: flush lru pvecs on compound page     arrival' (boo#989084).

  - Revert 'powerpc: Update TM user feature bits in     scan_features()'. Fix the build error of 4.1.28 on ppc.

  - Revive i8042_check_power_owner() for 4.1.31 kabi fix.

  - USB: OHCI: Do not mark EDs as ED_OPER if scheduling     fails (bnc#987886).

  - USB: validate wMaxPacketValue entries in endpoint     descriptors (bnc#991665).

  - Update     patches.fixes/0002-nfsd-check-permissions-when-setting-A     CLs.patch (bsc#986570 CVE-2016-1237).

  - Update     patches.fixes/0001-posix_acl-Add-set_posix_acl.patch     (bsc#986570 CVE-2016-1237).

  - netfilter: x_tables: fix 4.1 stable backport     (bsc#989176).

  - nfsd: check permissions when setting ACLs (bsc#986570).

  - posix_acl: Add set_posix_acl (bsc#986570).

  - ppp: defer netns reference release for ppp channel     (bsc#980371).

  - series.conf: Move a kABI patch to its own section

  - supported.conf: enable i2c-designware driver     (bsc#991110)

  - tcp: enable per-socket rate limiting of all 'challenge     acks' (bsc#989152).

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3596 advisory.

  - The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to     cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the     first segment of an iov. (CVE-2015-8785)

  - The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly     maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of     service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a     USB hub device. (CVE-2015-8816)

  - Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges     by triggering access to a paging structure by a different CPU. (CVE-2016-2069)

  - The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which     allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large     number of IP addresses. (CVE-2016-3156)

  - fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a     certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls. (CVE-2016-4581)

  - Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows     local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions. (CVE-2016-4805)

  - The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM     (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive     information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
    (CVE-2016-4913)

  - The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket     existence, which allows local users to cause a denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a dumpit operation. (CVE-2016-4951)

  - The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows     remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a     related issue to CVE-2003-1604. (CVE-2015-8787)

  - Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows     local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-     free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.
    (CVE-2016-0723)

  - fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows     local users to cause a denial of service (memory consumption) by creating many pipes with non-default     sizes. (CVE-2016-2847)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 4.5.6 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.4.11 update contains a number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux Kernel contains a NULL pointer dereference flaw in the tipc_nl_publ_dump() function in net/tipc/socket.c that is triggered when parsing nested attributes. This may allow a local attacker to crash the system.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3020-1 advisory.

  - The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. (CVE-2016-4482)

  - The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via crafted use of the ALSA timer interface. (CVE-2016-4569)

  - sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which     allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA     timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
    (CVE-2016-4578)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM     (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive     information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
    (CVE-2016-4913)

  - The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket     existence, which allows local users to cause a denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a dumpit operation. (CVE-2016-4951)

  - The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter     subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of     service (memory corruption) by leveraging in-container root access to provide a crafted offset value that     triggers an unintended decrement. (CVE-2016-4997)

  - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6     allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary. (CVE-2016-4998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3017-3 advisory.

  - The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. (CVE-2016-4482)

  - The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via crafted use of the ALSA timer interface. (CVE-2016-4569)

  - sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which     allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA     timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
    (CVE-2016-4578)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM     (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive     information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
    (CVE-2016-4913)

  - The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket     existence, which allows local users to cause a denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a dumpit operation. (CVE-2016-4951)

  - The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter     subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of     service (memory corruption) by leveraging in-container root access to provide a crafted offset value that     triggers an unintended decrement. (CVE-2016-4997)

  - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6     allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary. (CVE-2016-4998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denial of service (system crash) or execute arbitrary code with administrative privileges. (CVE-2016-4997)

Kangjie Lu discovered an information leak in the core USB implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory.
(CVE-2016-4482)

Kangjie Lu discovered an information leak in the timer handling implementation in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory.
(CVE-2016-4569, CVE-2016-4578)

Kangjie Lu discovered an information leak in the X.25 Call Request handling in the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory.
(CVE-2016-4580)

It was discovered that an information leak exists in the Rock Ridge implementation in the Linux kernel. A local attacker who is able to mount a malicious iso9660 file system image could exploit this flaw to obtain potentially sensitive information from kernel memory.
(CVE-2016-4913)

Baozeng Ding discovered that the Transparent Inter-process Communication (TIPC) implementation in the Linux kernel did not verify socket existence before use in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-4951)

Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling IPT_SO_SET_REPLACE events. A local unprivileged attacker could use this to cause a denial of service (system crash) or obtain potentially sensitive information from kernel memory. (CVE-2016-4998).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3016-4 advisory.

  - The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. (CVE-2016-4482)

  - The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via crafted use of the ALSA timer interface. (CVE-2016-4569)

  - sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which     allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA     timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
    (CVE-2016-4578)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM     (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive     information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
    (CVE-2016-4913)

  - The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket     existence, which allows local users to cause a denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a dumpit operation. (CVE-2016-4951)

  - The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter     subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of     service (memory corruption) by leveraging in-container root access to provide a crafted offset value that     triggers an unintended decrement. (CVE-2016-4997)

  - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6     allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary. (CVE-2016-4998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3016-3 advisory.

  - The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. (CVE-2016-4482)

  - The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via crafted use of the ALSA timer interface. (CVE-2016-4569)

  - sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which     allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA     timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
    (CVE-2016-4578)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM     (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive     information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
    (CVE-2016-4913)

  - The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket     existence, which allows local users to cause a denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a dumpit operation. (CVE-2016-4951)

  - The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter     subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of     service (memory corruption) by leveraging in-container root access to provide a crafted offset value that     triggers an unintended decrement. (CVE-2016-4997)

  - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6     allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary. (CVE-2016-4998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3016-2 advisory.

  - The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. (CVE-2016-4482)

  - The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via crafted use of the ALSA timer interface. (CVE-2016-4569)

  - sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which     allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA     timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
    (CVE-2016-4578)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM     (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive     information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
    (CVE-2016-4913)

  - The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket     existence, which allows local users to cause a denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a dumpit operation. (CVE-2016-4951)

  - The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter     subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of     service (memory corruption) by leveraging in-container root access to provide a crafted offset value that     triggers an unintended decrement. (CVE-2016-4997)

  - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6     allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary. (CVE-2016-4998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3016-1 advisory.

  - The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call. (CVE-2016-4482)

  - The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not     initialize a certain data structure, which allows local users to obtain sensitive information from kernel     stack memory via crafted use of the ALSA timer interface. (CVE-2016-4569)

  - sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which     allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA     timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
    (CVE-2016-4578)

  - The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does     not properly initialize a certain data structure, which allows attackers to obtain sensitive information     from kernel stack memory via an X.25 Call Request. (CVE-2016-4580)

  - The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM     (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive     information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
    (CVE-2016-4913)

  - The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket     existence, which allows local users to cause a denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a dumpit operation. (CVE-2016-4951)

  - The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter     subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of     service (memory corruption) by leveraging in-container root access to provide a crafted offset value that     triggers an unintended decrement. (CVE-2016-4997)

  - The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6     allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary. (CVE-2016-4998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS.
(CVE-2016-4997)

An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments. (CVE-2016-4998)

A vulnerability was found in the Linux kernel. The pointer to the netlink socket attribute is not checked, which could cause a NULL pointer dereference when parsing the nested attributes in function tipc_nl_publ_dump().

This allows local users to cause a DoS. (CVE-2016-4951)

A double free vulnerability was found in netlink_dump, which could cause a denial of service or possibly other unspecified impact.
(CVE-2016-9806)

(Updated on 2016-07-14: CVE-2016-4998 and CVE-2016-4951 were fixed in this version, but was not previously listed in this errata.)

(Updated on 2017-01-19: CVE-2016-9806 was fixed in this release but was previously not part of this errata.)

The openSUSE Leap 42.1 kernel was updated to 4.1.26 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2016-1583: Prevent the usage of mmap when the lower     file system does not allow it. This could have lead to     local privilege escalation when ecryptfs-utils was     installed and /sbin/mount.ecryptfs_private was setuid     (bsc#983143).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relies on the write system     call, which allows local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface.
    (bsc#979548)

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions. (bsc#980371).

  - CVE-2016-4951: The tipc_nl_publ_dump function in     net/tipc/socket.c in the Linux kernel did not verify     socket existence, which allowed local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     dumpit operation. (bsc#981058).

  - CVE-2016-5244: An information leak vulnerability in     function rds_inc_info_copy of file net/rds/recv.c was     fixed that might have leaked kernel stack data.
    (bsc#983213).

  - CVE-2016-4580: The x25_negotiate_facilities function in     net/x25/x25_facilities.c in the Linux kernel did not     properly initialize a certain data structure, which     allowed attackers to obtain sensitive information from     kernel stack memory via an X.25 Call Request.
    (bsc#981267).

  - CVE-2016-0758: Tags with indefinite length could have     corrupted pointers in asn1_find_indefinite_length     (bsc#979867).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-3672: The arch_pick_mmap_layout function in     arch/x86/mm/mmap.c in the Linux kernel did not properly     randomize the legacy base address, which made it easier     for local users to defeat the intended restrictions on     the ADDR_NO_RANDOMIZE flag, and bypass the ASLR     protection mechanism for a setuid or setgid program, by     disabling stack-consumption resource limits     (bnc#974308).

  - CVE-2016-4482: A kernel information leak in the usbfs     devio connectinfo was fixed, which could expose kernel     stack memory to userspace. (bnc#978401).

  - CVE-2016-4485: A kernel information leak in llc was     fixed (bsc#978821).

  - CVE-2016-4486: A kernel information leak in rtnetlink     was fixed, where 4 uninitialized bytes could leak to     userspace (bsc#978822).

  - CVE-2016-4557: A use-after-free via double-fdput in     replace_map_fd_with_map_ptr() was fixed, which could     allow privilege escalation (bsc#979018).

  - CVE-2016-4565: When the 'rdma_ucm' infiniband module is     loaded, local attackers could escalate their privileges     (bsc#979548).

  - CVE-2016-4569: A kernel information leak in the ALSA     timer via events via snd_timer_user_tinterrupt that     could leak information to userspace was fixed     (bsc#979213).

  - CVE-2016-4578: A kernel information leak in the ALSA     timer via events that could leak information to     userspace was fixed (bsc#979879).

  - CVE-2016-4581: If the first propogated mount copy was     being a slave it could oops the kernel (bsc#979913)

The following non-security bugs were fixed :

  - ALSA: hda - Add dock support for ThinkPad X260     (boo#979278).

  - ALSA: hda - Apply fix for white noise on Asus N550JV,     too (boo#979278).

  - ALSA: hda - Asus N750JV external subwoofer fixup     (boo#979278).

  - ALSA: hda - Fix broken reconfig (boo#979278).

  - ALSA: hda - Fix headphone mic input on a few Dell ALC293     machines (boo#979278).

  - ALSA: hda - Fix subwoofer pin on ASUS N751 and N551     (boo#979278).

  - ALSA: hda - Fix white noise on Asus N750JV headphone     (boo#979278).

  - ALSA: hda - Fix white noise on Asus UX501VW headset     (boo#979278).

  - ALSA: hda/realtek - Add ALC3234 headset mode for     Optiplex 9020m (boo#979278).

  - ALSA: hda/realtek - New codecs support for     ALC234/ALC274/ALC294 (boo#979278).

  - ALSA: hda/realtek - New codec support of ALC225     (boo#979278).

  - ALSA: hda/realtek - Support headset mode for ALC225     (boo#979278).

  - ALSA: pcxhr: Fix missing mutex unlock (boo#979278).

  - ALSA: usb-audio: Quirk for yet another Phoenix Audio     devices (v2) (boo#979278).

  - bluetooth: fix power_on vs close race (bsc#966849).

  - bluetooth: vhci: fix open_timeout vs. hdev race     (bsc#971799,bsc#966849).

  - bluetooth: vhci: Fix race at creating hci device     (bsc#971799,bsc#966849).

  - bluetooth: vhci: purge unhandled skbs     (bsc#971799,bsc#966849).

  - btrfs: do not use src fd for printk (bsc#980348).

  - btrfs: fix crash/invalid memory access on fsync when     using overlayfs (bsc#977198)

  - drm: qxl: Workaround for buggy user-space (bsc#981344).

  - enic: set netdev->vlan_features (bsc#966245).

  - fs: add file_dentry() (bsc#977198).

  - IB/IPoIB: Do not set skb truesize since using one     linearskb (bsc#980657).

  - input: i8042 - lower log level for 'no controller'     message (bsc#945345).

  - kabi: Add kabi/severities entries to ignore sound/hda/*,     x509_*, efivar_validate, file_open_root and dax_fault

  - kabi: Add some fixups (module, pci_dev, drm, fuse and     thermal)

  - kabi: file_dentry changes (bsc#977198).

  - kABI fixes for 4.1.22

  - mm/page_alloc.c: calculate 'available' memory in a     separate function (bsc#982239).

  - net: disable fragment reassembly if high_thresh is zero     (bsc#970506).

  - of: iommu: Silence misleading warning.

  - pstore_register() error handling was wrong -- it tried     to release lock before it's acquired, causing spinlock /     preemption imbalance. - usb: quirk to stop runtime PM     for Intel 7260 (bnc#984460).

  - Revert 'usb: hub: do not clear BOS field during reset     device' (boo#979728).

  - usb: core: hub: hub_port_init lock controller instead of     bus (bnc#978073).

  - usb: preserve kABI in address0 locking (bnc#978073).

  - usb: usbip: fix potential out-of-bounds write     (bnc#975945).

  - USB: xhci: Add broken streams quirk for Frescologic     device id 1009 (bnc#982712).

  - virtio_balloon: do not change memory amount visible via     /proc/meminfo (bsc#982238).

  - virtio_balloon: export 'available' memory to balloon     statistics (bsc#982239).

ID	Name	Product	Family	Severity
124970	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1517)	Nessus	Huawei Local Security Checks	high
93679	OracleVM 3.4 : Unbreakable / etc (OVMSA-2016-0100)	Nessus	OracleVM Local Security Checks	critical
93445	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1076)	Nessus	SuSE Local Security Checks	critical
93148	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3596)	Nessus	Oracle Linux Local Security Checks	critical
92178	Fedora 24 : kernel (2016-d9147693a3)	Nessus	Fedora Local Security Checks	high
92153	Fedora 23 : kernel (2016-c1faf6005c)	Nessus	Fedora Local Security Checks	high
92067	Fedora 22 : kernel (2016-2363b37a98)	Nessus	Fedora Local Security Checks	high
802008	Multiple Kernel Versions Null Pointer Dereference Local DoS	Log Correlation Engine	Operating System Detection	medium
91883	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-3020-1)	Nessus	Ubuntu Local Security Checks	high
91879	Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerabilities (USN-3017-3)	Nessus	Ubuntu Local Security Checks	high
91878	Ubuntu 15.10 : linux-raspi2 vulnerabilities (USN-3017-2)	Nessus	Ubuntu Local Security Checks	high
91877	Ubuntu 15.10 : linux vulnerabilities (USN-3017-1)	Nessus	Ubuntu Local Security Checks	high
91876	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3016-4)	Nessus	Ubuntu Local Security Checks	high
91875	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3016-3)	Nessus	Ubuntu Local Security Checks	high
91874	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3016-2)	Nessus	Ubuntu Local Security Checks	high
91873	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3016-1)	Nessus	Ubuntu Local Security Checks	high
91858	Amazon Linux AMI : kernel (ALAS-2016-718)	Nessus	Amazon Linux Local Security Checks	high
91736	openSUSE Security Update : the Linux Kernel (openSUSE-2016-753)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-4951

high

Tenable Plugins

high

critical

critical

critical

high

high

high

medium

high

high

high

high

high

high

high

high

high

critical