The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not     check whether a batch message's length field is large enough, which allows local users to obtain sensitive     information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by     leveraging the CAP_NET_ADMIN capability. (CVE-2016-7917)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - powercap: restrict energy meter to root access (Kanth     Ghatraju) [Orabug: 32137965] (CVE-2020-8694)     (CVE-2020-8695)

  - Revert 'x86/efi: Initialize and display UEFI secure boot     state a bit later during init' (Eric Snowberg) [Orabug:
    31887248]

  - xfs: fix xfs_inode use after free (Wengang Wang)     [Orabug: 31932452]

  - SUNRPC: ECONNREFUSED should cause a rebind. (NeilBrown)     [Orabug: 32070175]

  - netfilter: nfnetlink: correctly validate length of batch     messages (Phil Turnbull) [Orabug: 30658635]     (CVE-2016-7917)

  - xc2028: Fix use-after-free bug properly (Takashi Iwai)     [Orabug: 30658659] (CVE-2016-7913)

  - [media] xc2028: avoid use after free (Mauro Carvalho     Chehab) [Orabug: 30658659] (CVE-2016-7913)

  - uek-rpm: Create initramfs at postinstall stage also.
    (Somasundaram Krishnasamy) [Orabug: 30821411]

  - hdlc_ppp: add range checks in ppp_cp_parse_cr (Dan     Carpenter) [Orabug: 31989190] (CVE-2020-25643)

  - tracing: Reverse the order of trace_types_lock and     event_mutex (Alan Maguire) [Orabug: 32002706]

  - ocfs2/dlm: move lock to the tail of grant queue while     doing in-place convert (xuejiufei) [Orabug: 32071234]

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5912 advisory.

    - kexec: validate pe files against the system_blacklist_keyring (Eric Snowberg)  [Orabug: 31961119]     {CVE-2020-26541}
    - usb: cdc-acm: make sure a refcount is taken early enough (Oliver Neukum)  [Orabug: 31351088]     {CVE-2019-19530}
    - netfilter: ctnetlink: add a range check for l3/l4 protonum (Will McVicker)  [Orabug: 31872865]     {CVE-2020-25211}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - drivers/soc/qcom/qdsp6v2/voice_svc.c in the QDSP6v2     Voice Service driver for the Linux kernel 3.x, as used     in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via a write request, as demonstrated by a     voice_svc_send_req buffer overflow.(CVE-2016-5343i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4655i1/4%0

  - Race condition in the handle_to_path function in     fs/fhandle.c in the Linux kernel through 3.19.1 allows     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function.(CVE-2015-1420i1/4%0

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631i1/4%0

  - A flaw was found in the ext4 subsystem. This     vulnerability is a use after free vulnerability was     found in __ext4_journal_stop(). Attackers could abuse     this to allow any code which attempts to deal with the     journal failure to be mishandled or not fail at all.
    This could lead to data corruption or     crashes.(CVE-2015-8961i1/4%0

  - Buffer overflow in the oz_cdev_write function in     drivers/staging/ozwpan/ozcdev.c in the Linux kernel     before 3.12 allows local users to cause a denial of     service or possibly have unspecified other impact via a     crafted write operation.(CVE-2013-4513i1/4%0

  - The nfnetlink_rcv_batch() function in     'net/netfilter/nfnetlink.c' in the Linux kernel before     4.5 does not check whether a batch message's length     field is large enough, which allows local users to     obtain sensitive information from kernel memory or     cause a denial of service (infinite loop or     out-of-bounds read) by leveraging the CAP_NET_ADMIN     capability.(CVE-2016-7917i1/4%0

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value.(CVE-2013-4587i1/4%0

  - A leak of information was possible when issuing a     netlink command of the stack memory area leading up to     this function call. An attacker could use this to     determine stack information for use in a later     exploit.(CVE-2016-5243i1/4%0

  - An issue was discovered in the Linux kernel in the F2FS     filesystem code. A NULL pointer dereference in     fscrypt_do_page_crypto() in the fs/crypto/crypto.c     function can occur when operating on a file on a     corrupted f2fs image.(CVE-2018-14616i1/4%0

  - An out-of-bounds flaw was found in the kernel, where     the sco_sock_bind() function (bluetooth/sco) did not     check the length of its sockaddr parameter. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8575i1/4%0

  - A denial of service vulnerability was found in the     WhiteHEAT USB Serial Driver (whiteheat_attach function     in drivers/usb/serial/whiteheat.c). In the driver, the     COMMAND_PORT variable was hard coded and set to 4 (5th     element). The driver assumed that the number of ports     would always be 5 and used port number 5 as the command     port. However, when using a USB device in which the     number of ports was set to a number less than 5 (for     example, 3), the driver triggered a kernel NULL-pointer     dereference. A non-privileged attacker could use this     flaw to panic the host.(CVE-2015-5257i1/4%0

  - The LLC subsystem in the Linux kernel does not ensure     that a certain destructor exists in required     circumstances, which allows local users to cause a     denial of service (BUG_ON) or possibly have unspecified     other impact via crafted system calls.(CVE-2017-6345i1/4%0

  - A vulnerability was found in Linux kernel. There is an     information leak in file sound/core/timer.c of the     latest mainline Linux kernel. The stack object aEURoer1aEUR     has a total size of 32 bytes. Its field aEURoeeventaEUR and     aEURoevalaEUR both contain 4 bytes padding. These 8 bytes     padding bytes are sent to user without being     initialized.(CVE-2016-4578i1/4%0

  - An information leak flaw was found in the way the Linux     kernel changed certain segment registers and     thread-local storage (TLS) during a context switch. A     local, unprivileged user could use this flaw to leak     the user space TLS base address of an arbitrary     process.(CVE-2014-9419i1/4%0

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1     MiB to make successful exploitation of this issue more     difficult.(CVE-2017-1000364i1/4%0

  - A flaw was found in the Linux kernel's handling of     clearing SELinux attributes on /proc/pid/attr files. An     empty (null) write to this file can crash the system by     causing the system to attempt to access unmapped kernel     memory.(CVE-2017-2618i1/4%0

  - A use-after-free vulnerability was found in ALSA pcm     layer, which allows local users to cause a denial of     service, memory corruption, or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9794i1/4%0

  - A flaw was found in the way the Linux kernel's floppy     driver handled user space provided data in certain     error code paths while processing FDRAWCMD IOCTL     commands. A local user with write access to /dev/fdX     could use this flaw to free (using the kfree()     function) arbitrary kernel memory. (CVE-2014-1737,     Important)t was found that the Linux kernel's floppy     driver leaked internal kernel memory addresses to user     space during the processing of the FDRAWCMD IOCTL     command. A local user with write access to /dev/fdX     could use this flaw to obtain information about the     kernel heap arrangement. (CVE-2014-1738, Low)Note: A     local user with write access to /dev/fdX could use     these two flaws (CVE-2014-1737 in combination with     CVE-2014-1738) to escalate their privileges on the     system.(CVE-2014-1737i1/4%0

  - An out-of-bounds memory access flaw was found in the     Linux kernel's aiptek USB tablet driver (aiptek_probe()     function in drivers/input/tablet/aiptek.c). The driver     assumed that the interface always had at least one     endpoint. By using a specially crafted USB device with     no endpoints on one of its interfaces, an unprivileged     user with physical access to the system could trigger a     kernel NULL pointer dereference, causing the system to     panic.(CVE-2015-7515i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3312-2 advisory.

    USN-3312-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    It was discovered that the netfilter netlink implementation in the Linux kernel did not properly validate     batch messages. A local attacker with the CAP_NET_ADMIN capability could use this to expose sensitive     information or cause a denial of service. (CVE-2016-7917)

    Qian Zhang discovered a heap-based buffer overflow in the tipc_msg_build() function in the Linux kernel. A     local attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code     with administrative privileges. (CVE-2016-8632)

    It was discovered that the keyring implementation in the Linux kernel in some situations did not prevent     special internal keyrings from being joined by userspace keyrings. A privileged local attacker could use     this to bypass module verification. (CVE-2016-9604)

    It was discovered that a buffer overflow existed in the trace subsystem in the Linux kernel. A privileged     local attacker could use this to execute arbitrary code. (CVE-2017-0605)

    Dmitry Vyukov discovered that KVM implementation in the Linux kernel improperly emulated the VMXON     instruction. A local attacker in a guest OS could use this to cause a denial of service (memory     consumption) in the host OS. (CVE-2017-2596)

    Daniel Jiang discovered that a race condition existed in the ipv4 ping socket implementation in the Linux     kernel. A local privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2017-2671)

    Di Shen discovered that a race condition existed in the perf subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service or possibly gain administrative privileges.
    (CVE-2017-6001)

    Eric Biggers discovered a memory leak in the keyring implementation in the Linux kernel. A local attacker     could use this to cause a denial of service (memory consumption). (CVE-2017-7472)

    Sabrina Dubroca discovered that the asynchronous cryptographic hash (ahash) implementation in the Linux     kernel did not properly handle a full request queue. A local attacker could use this to cause a denial of     service (infinite recursion). (CVE-2017-7618)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly handle certain long RPC replies. A remote attacker could use this to cause a     denial of service (system crash). (CVE-2017-7645)

    Tommi Rantala and Brad Spengler discovered that the memory manager in the Linux kernel did not properly     enforce the CONFIG_STRICT_DEVMEM protection mechanism. A local attacker with access to /dev/mem could use     this to expose sensitive information or possibly execute arbitrary code. (CVE-2017-7889)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly check for the end of buffer. A remote attacker could use this to craft requests     that cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-7895)

    It was discovered that a use-after-free vulnerability existed in the device driver for XCeive     xc2028/xc3028 tuners in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2016-7913)

    Vlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO PCI driver for the Linux kernel.
    A local attacker with access to a vfio PCI device file could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3312-1 advisory.

    It was discovered that the netfilter netlink implementation in the Linux kernel did not properly validate     batch messages. A local attacker with the CAP_NET_ADMIN capability could use this to expose sensitive     information or cause a denial of service. (CVE-2016-7917)

    Qian Zhang discovered a heap-based buffer overflow in the tipc_msg_build() function in the Linux kernel. A     local attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code     with administrative privileges. (CVE-2016-8632)

    It was discovered that the keyring implementation in the Linux kernel in some situations did not prevent     special internal keyrings from being joined by userspace keyrings. A privileged local attacker could use     this to bypass module verification. (CVE-2016-9604)

    It was discovered that a buffer overflow existed in the trace subsystem in the Linux kernel. A privileged     local attacker could use this to execute arbitrary code. (CVE-2017-0605)

    Dmitry Vyukov discovered that KVM implementation in the Linux kernel improperly emulated the VMXON     instruction. A local attacker in a guest OS could use this to cause a denial of service (memory     consumption) in the host OS. (CVE-2017-2596)

    Daniel Jiang discovered that a race condition existed in the ipv4 ping socket implementation in the Linux     kernel. A local privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2017-2671)

    Di Shen discovered that a race condition existed in the perf subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service or possibly gain administrative privileges.
    (CVE-2017-6001)

    Eric Biggers discovered a memory leak in the keyring implementation in the Linux kernel. A local attacker     could use this to cause a denial of service (memory consumption). (CVE-2017-7472)

    Sabrina Dubroca discovered that the asynchronous cryptographic hash (ahash) implementation in the Linux     kernel did not properly handle a full request queue. A local attacker could use this to cause a denial of     service (infinite recursion). (CVE-2017-7618)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly handle certain long RPC replies. A remote attacker could use this to cause a     denial of service (system crash). (CVE-2017-7645)

    Tommi Rantala and Brad Spengler discovered that the memory manager in the Linux kernel did not properly     enforce the CONFIG_STRICT_DEVMEM protection mechanism. A local attacker with access to /dev/mem could use     this to expose sensitive information or possibly execute arbitrary code. (CVE-2017-7889)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly check for the end of buffer. A remote attacker could use this to craft requests     that cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-7895)

    It was discovered that a use-after-free vulnerability existed in the device driver for XCeive     xc2028/xc3028 tuners in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2016-7913)

    Vlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO PCI driver for the Linux kernel.
    A local attacker with access to a vfio PCI device file could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE Leap 42.1 kernel to 4.1.38 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2016-7117: Use-after-free vulnerability in the
    __sys_recvmmsg function in net/socket.c in the Linux     kernel allowed remote attackers to execute arbitrary     code via vectors involving a recvmmsg system call that     is mishandled during error processing (bnc#1003077).

  - CVE-2017-5551: tmpfs: Fixed a bug that could have     allowed users to set setgid bits on files they don't     down (bsc#1021258).

  - CVE-2016-10147: crypto/mcryptd.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) by using an AF_ALG     socket with an incompatible algorithm, as demonstrated     by mcryptd(md5) (bnc#1020381).

  - CVE-2016-10088: The sg implementation in the Linux     kernel did not properly restrict write operations in     situations where the KERNEL_DS option is set, which     allowed local users to read or write to arbitrary kernel     memory locations or cause a denial of service     (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c.
    NOTE: this vulnerability exists because of an incomplete     fix for CVE-2016-9576 (bnc#1017710).

  - CVE-2016-7917: The nfnetlink_rcv_batch function in     net/netfilter/nfnetlink.c in the Linux kernel did not     check whether a batch message's length field is large     enough, which allowed local users to obtain sensitive     information from kernel memory or cause a denial of     service (infinite loop or out-of-bounds read) by     leveraging the CAP_NET_ADMIN capability (bnc#1010444).

  - CVE-2016-8645: The TCP stack in the Linux kernel     mishandled skb truncation, which allowed local users to     cause a denial of service (system crash) via a crafted     application that made sendto system calls, related to     net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c     (bnc#1009969).

  - CVE-2016-9806: Race condition in the netlink_dump     function in net/netlink/af_netlink.c in the Linux kernel     allowed local users to cause a denial of service (double     free) or possibly have unspecified other impact via a     crafted application that made sendmsg system calls,     leading to a free operation associated with a new dump     that started earlier than anticipated (bnc#1013540     1017589).

  - CVE-2016-9793: The sock_setsockopt function in     net/core/sock.c in the Linux kernel mishandled negative     values of sk_sndbuf and sk_rcvbuf, which allowed local     users to cause a denial of service (memory corruption     and system crash) or possibly have unspecified other     impact by leveraging the CAP_NET_ADMIN capability for a     crafted setsockopt system call with the (1)     SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option (bnc#1013531     1013542).

The following non-security bugs were fixed :

  - PCI: generic: Fix pci_remap_iospace() failure path     (bsc#1019658).

  - bcache: partition support: add 16 minors per bcacheN     device (bsc#1019784).

  - bnx2x: Correct ringparam estimate when DOWN     (bsc#1020214).

  - clk: xgene: Do not call __pa on ioremaped address     (bsc#1019660).

  - kABI workaround for 4.1.37 mount changes     (stable-4.1.37).

  - kABI: reintroduce sk_filter (bsc#1009969).

  - kabi/severities: Ignore inode_change_ok change It's     renamed in 4.1.37 to setattr_prepare()

  - mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]     (bsc#1011820).

  - net: introduce __sock_queue_rcv_skb() function     (bsc#1009969).

  - netback: correct array index (bsc#983348).

  - netfront: do not truncate grant references.

  - netfront: use correct linear area after linearizing an     skb (bsc#1007886).

  - reiserfs: fix race in prealloc discard (bsc#987576).

  - rose: limit sk_filter trim to payload (bsc#1009969).

  - scsi: bfa: Increase requested firmware version to     3.2.5.1 (bsc#1013273).

  - xenbus: correctly signal errors from     xenstored_local_init() (luckily none so far).

  - xenbus: do not invoke ->is_ready() for most device     states (bsc#987333).

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.38 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x     provides an incomplete set of requirements for setattr     operations that underspecifies removing extended     privilege attributes, which allowed local users to cause     a denial of service (capability stripping) via a failed     invocation of a system call, as demonstrated by using     chown to remove a capability from the ping or Wireshark     dumpcap program (bnc#914939).

  - CVE-2015-8964: The tty_set_termios_ldisc function in     drivers/tty/tty_ldisc.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory by reading a tty data structure (bnc#1010507).

  - CVE-2016-7039: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for large     crafted packets, as demonstrated by packets that contain     only VLAN headers, a related issue to CVE-2016-8666     (bnc#1001486).

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel through 4.8.2,     when the GNU Compiler Collection (gcc) stack protector     is enabled, uses an incorrect buffer size for certain     timeout data, which allowed local users to cause a     denial of service (stack memory corruption and panic) by     reading the /proc/keys file (bnc#1004517).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-7913: The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (use-after-free) via vectors involving     omission of the firmware name from a certain data     structure (bnc#1010478).

  - CVE-2016-7917: The nfnetlink_rcv_batch function in     net/netfilter/nfnetlink.c in the Linux kernel did not     check whether a batch message's length field is large     enough, which allowed local users to obtain sensitive     information from kernel memory or cause a denial of     service (infinite loop or out-of-bounds read) by     leveraging the CAP_NET_ADMIN capability (bnc#1010444).

  - CVE-2016-8645: The TCP stack in the Linux kernel     mishandled skb truncation, which allowed local users to     cause a denial of service (system crash) via a crafted     application that made sendto system calls, related to     net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c     (bnc#1009969).

  - CVE-2016-8666: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for     packets with tunnel stacking, as demonstrated by     interleaved IPv4 headers and GRE headers, a related     issue to CVE-2016-7039 (bnc#1003964).

  - CVE-2016-9083: drivers/vfio/pci/vfio_pci.c in the Linux     kernel allowed local users to bypass integer overflow     checks, and cause a denial of service (memory     corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a     VFIO_DEVICE_SET_IRQS ioctl call, aka a 'state machine     confusion bug (bnc#1007197).

  - CVE-2016-9084: drivers/vfio/pci/vfio_pci_intrs.c in the     Linux kernel misuses the kzalloc function, which allowed     local users to cause a denial of service (integer     overflow) or have unspecified other impact by leveraging     access to a vfio PCI device file (bnc#1007197).

  - CVE-2016-9793: A bug in SO_{SND|RCV}BUFFORCE     setsockopt() implementation was fixed, which allowed     CAP_NET_ADMIN users to cause memory corruption.
    (bsc#1013531).

  - CVE-2016-9919: The icmp6_send function in     net/ipv6/icmp.c in the Linux kernel omits a certain     check of the dst data structure, which allowed remote     attackers to cause a denial of service (panic) via a     fragmented IPv6 packet (bnc#1014701).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
247916	Linux Distros Unpatched Vulnerability : CVE-2016-7917	Nessus	Misc.	medium
142943	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0051)	Nessus	OracleVM Local Security Checks	high
142483	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5912)	Nessus	Oracle Linux Local Security Checks	high
125301	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1508)	Nessus	Huawei Local Security Checks	critical
100665	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3312-2)	Nessus	Ubuntu Local Security Checks	critical
100664	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3312-1)	Nessus	Ubuntu Local Security Checks	critical
97138	openSUSE Security Update : the Linux Kernel (openSUSE-2017-246)	Nessus	SuSE Local Security Checks	critical
96603	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:0181-1)	Nessus	SuSE Local Security Checks	high
95701	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1426)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-7917

medium

Tenable Plugins

medium

high

high

critical

critical

critical

critical

high

critical