Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The ipx_recvmsg function in net/ipx/af_ipx.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7268i1/4%0

  - The move_pages system call in mm/migrate.c in the Linux     kernel doesn't check the effective uid of the target     process. This enables a local attacker to learn the     memory layout of a setuid executable allowing     mitigation of ASLR.(CVE-2017-14140i1/4%0

  - Multiple array index errors in drivers/hid/hid-core.c     in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate     attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted     device that provides an invalid Report     ID.(CVE-2013-2888i1/4%0

  - It was found that if a Non-Maskable Interrupt (NMI)     occurred immediately after a SYSCALL call or before a     SYSRET call with the user RSP pointing to the NMI IST     stack, the kernel could skip that NMI.(CVE-2015-3291i1/4%0

  - The sound/core/seq_device.c in the Linux kernel, before     4.13.4, allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16528i1/4%0

  - net/ceph/auth_x.c in Ceph, as used in the Linux kernel     before 3.16.3, does not properly consider the     possibility of kmalloc failure, which allows remote     attackers to cause a denial of service (system crash)     or possibly have unspecified other impact via a long     unencrypted auth ticket.(CVE-2014-6417i1/4%0

  - A NULL pointer dereference flaw was found in the Linux     kernel: the NFSv4.2 migration code improperly     initialized the kernel structure. A local,     authenticated user could use this flaw to cause a panic     of the NFS client (denial of service).(CVE-2015-8746i1/4%0

  - A stack-based buffer overflow flaw was found in the     TechnoTrend/Hauppauge DEC USB device driver. A local     user with write access to the corresponding device     could use this flaw to crash the kernel or,     potentially, elevate their privileges on the     system.(CVE-2014-8884i1/4%0

  - A flaw was found in the linux kernel's implementation     of the airspy USB device driver in which a leak was     found when a subdev or SDR are plugged into the host.An     attacker can create an targeted USB device which can     emulate 64 of these devices. Then by emulating an     additional device which continuously connects and     disconnects, each connection attempt will leak memory     which can not be recovered.(CVE-2016-5400i1/4%0

  - The sound/usb/mixer.c in the Linux kernel, before     4.13.8, allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16527i1/4%0

  - The Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_LOGITECH_FF,     CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled,     allows physically proximate attackers to cause a denial     of service (heap-based out-of-bounds write) via a     crafted device, related to (1) drivers/hid/hid-lgff.c,     (2) drivers/hid/hid-lg3ff.c, and (3)     drivers/hid/hid-lg4ff.c.(CVE-2013-2893i1/4%0

  - It was found that reporting emulation failures to user     space could lead to either a local (CVE-2014-7842) or a     L2-i1/4zL1 (CVE-2010-5313) denial of service. In the case     of a local denial of service, an attacker must have     access to the MMIO area or be able to access an I/O     port. Please note that on certain systems, HPET is     mapped to userspace as part of vdso (vvar) and thus an     unprivileged user may generate MMIO transactions (and     enter the emulator) this way.(CVE-2014-7842i1/4%0

  - A flaw was discovered in the way the Linux kernel's TTY     subsystem handled the tty shutdown phase. A local,     unprivileged user could use this flaw to cause denial     of service on the system by holding a reference to the     ldisc lock during tty shutdown, causing a     deadlock.(CVE-2015-4170i1/4%0

  - The __ip6_append_data function in net/ipv6/ip6_output.c     in the Linux kernel through 4.11.3 is too late in     checking whether an overwrite of an skb data structure     may occur, which allows local users to cause a denial     of service (system crash) via crafted system     calls.(CVE-2017-9242i1/4%0

  - The Linux kernel built with the KVM visualization     support (CONFIG_KVM), with nested visualization(nVMX)     feature enabled (nested=1), was vulnerable to a stack     buffer overflow issue. The vulnerability could occur     while traversing guest page table entries to resolve     guest virtual address(gva). An L1 guest could use this     flaw to crash the host kernel resulting in denial of     service (DoS) or potentially execute arbitrary code on     the host to gain privileges on the     system.(CVE-2017-12188i1/4%0

  - The recalculate_apic_map function in     arch/x86/kvm/lapic.c in the KVM subsystem in the Linux     kernel through 3.12.5 allows guest OS users to cause a     denial of service (host OS crash) via a crafted ICR     write operation in x2apic mode.(CVE-2013-6376i1/4%0

  - The wanxl_ioctl function in drivers/net/wan/wanxl.c in     the Linux kernel before 3.11.7 does not properly     initialize a certain data structure, which allows local     users to obtain sensitive information from kernel     memory via an ioctl call.(CVE-2014-1445i1/4%0

  - The restore_fpu_checking function in     arch/x86/include/asm/fpu-internal.h in the Linux kernel     before 3.12.8 on the AMD K7 and K8 platforms does not     clear pending exceptions before proceeding to an EMMS     instruction, which allows local users to cause a denial     of service (task kill) or possibly gain privileges via     a crafted application.(CVE-2014-1438i1/4%0

  - A race condition was found in the way the Linux     kernel's memory subsystem handled the copy-on-write     (COW) breakage of private read-only memory mappings. An     unprivileged, local user could use this flaw to gain     write access to otherwise read-only memory mappings and     thus increase their privileges on the     system.(CVE-2016-5195i1/4%0

  - Algorithms not compatible with mcryptd could be spawned     by mcryptd with a direct crypto_alloc_tfm invocation     using a 'mcryptd(alg)' name construct. This causes     mcryptd to crash the kernel if an arbitrary 'alg' is     incompatible and not intended to be used with     mcryptd.(CVE-2016-10147i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-4 advisory.

  - nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions     by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c. (CVE-2016-1237)

  - The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a     certain structure member, which allows remote attackers to obtain sensitive information from kernel stack     memory by reading an RDS message. (CVE-2016-5244)

  - Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in     the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a     crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect     and disconnect operations. (CVE-2016-5400)

  - net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK     segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
    (CVE-2016-5696)

  - Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the     Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a     denial of service (memory corruption and system crash) by changing a certain header, aka a double fetch     vulnerability. (CVE-2016-5728)

  - The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc     platforms mishandles transactional state, which allows local users to cause a denial of service (invalid     process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by     starting and suspending a transaction before an exec system call. (CVE-2016-5828)

  - Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in     the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified     other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. (CVE-2016-5829)

  - fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not     properly verify the upper dentry before proceeding with unlink and rename system-call processing, which     allows local users to cause a denial of service (system crash) via a rename system call that specifies a     self-hardlink. (CVE-2016-6197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-3 advisory.

  - nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions     by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c. (CVE-2016-1237)

  - The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a     certain structure member, which allows remote attackers to obtain sensitive information from kernel stack     memory by reading an RDS message. (CVE-2016-5244)

  - Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in     the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a     crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect     and disconnect operations. (CVE-2016-5400)

  - net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK     segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
    (CVE-2016-5696)

  - Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the     Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a     denial of service (memory corruption and system crash) by changing a certain header, aka a double fetch     vulnerability. (CVE-2016-5728)

  - The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc     platforms mishandles transactional state, which allows local users to cause a denial of service (invalid     process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by     starting and suspending a transaction before an exec system call. (CVE-2016-5828)

  - Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in     the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified     other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. (CVE-2016-5829)

  - fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not     properly verify the upper dentry before proceeding with unlink and rename system-call processing, which     allows local users to cause a denial of service (system crash) via a rename system call that specifies a     self-hardlink. (CVE-2016-6197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-2 advisory.

  - nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions     by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c. (CVE-2016-1237)

  - The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a     certain structure member, which allows remote attackers to obtain sensitive information from kernel stack     memory by reading an RDS message. (CVE-2016-5244)

  - Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in     the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a     crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect     and disconnect operations. (CVE-2016-5400)

  - net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK     segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
    (CVE-2016-5696)

  - Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the     Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a     denial of service (memory corruption and system crash) by changing a certain header, aka a double fetch     vulnerability. (CVE-2016-5728)

  - The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc     platforms mishandles transactional state, which allows local users to cause a denial of service (invalid     process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by     starting and suspending a transaction before an exec system call. (CVE-2016-5828)

  - Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in     the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified     other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. (CVE-2016-5829)

  - fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not     properly verify the upper dentry before proceeding with unlink and rename system-call processing, which     allows local users to cause a denial of service (system crash) via a rename system call that specifies a     self-hardlink. (CVE-2016-6197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-1 advisory.

  - nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions     by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c. (CVE-2016-1237)

  - The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a     certain structure member, which allows remote attackers to obtain sensitive information from kernel stack     memory by reading an RDS message. (CVE-2016-5244)

  - Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in     the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a     crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect     and disconnect operations. (CVE-2016-5400)

  - net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK     segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
    (CVE-2016-5696)

  - Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the     Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a     denial of service (memory corruption and system crash) by changing a certain header, aka a double fetch     vulnerability. (CVE-2016-5728)

  - The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc     platforms mishandles transactional state, which allows local users to cause a denial of service (invalid     process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by     starting and suspending a transaction before an exec system call. (CVE-2016-5828)

  - Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in     the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified     other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. (CVE-2016-5829)

  - fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not     properly verify the upper dentry before proceeding with unlink and rename system-call processing, which     allows local users to cause a denial of service (system crash) via a rename system call that specifies a     self-hardlink. (CVE-2016-6197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to latest upstream stable release, Linux v4.6.5.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124982	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1529)	Nessus	Huawei Local Security Checks	high
93243	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3070-4)	Nessus	Ubuntu Local Security Checks	high
93242	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3070-3)	Nessus	Ubuntu Local Security Checks	high
93241	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3070-2)	Nessus	Ubuntu Local Security Checks	high
93217	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3070-1)	Nessus	Ubuntu Local Security Checks	high
92804	Fedora 23 : kernel (2016-754e4768d8)	Nessus	Fedora Local Security Checks	medium
92799	Fedora 24 : kernel (2016-30e3636e79)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-5400

medium

Tenable Plugins

high

high

high

high

high

medium

medium