Scientific Linux Security Update : kernel on SL7.x x86_64

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

Security Fix(es) :

- An use-after-free flaw was found in the Linux kernel
which enables a race condition in the L2TPv3 IP
Encapsulation feature. A local user could use this flaw
to escalate their privileges or crash the system.
(CVE-2016-10200, Important)

- A flaw was found that can be triggered in
keyring_search_iterator in keyring.c if type->match is
NULL. A local user could use this flaw to crash the
system or, potentially, escalate their privileges.
(CVE-2017-2647, Important)

- It was found that the NFSv4 server in the Linux kernel
did not properly validate layout type when processing
NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A
remote attacker could use this flaw to soft- lockup the
system and thus cause denial of service. (CVE-2017-8797,
Important)

This update also fixes multiple Moderate and Low impact security
issues :

- CVE-2015-8839, CVE-2015-8970, CVE-2016-9576,
CVE-2016-7042, CVE-2016-7097, CVE-2016-8645,
CVE-2016-9576, CVE-2016-9588, CVE-2016-9806,
CVE-2016-10088, CVE-2016-10147, CVE-2017-2596,
CVE-2017-2671, CVE-2017-5970, CVE-2017-6001,
CVE-2017-6951, CVE-2017-7187, CVE-2017-7616,
CVE-2017-7889, CVE-2017-8890, CVE-2017-9074,
CVE-2017-8890, CVE-2017-9075, CVE-2017-8890,
CVE-2017-9076, CVE-2017-8890, CVE-2017-9077,
CVE-2017-9242, CVE-2014-7970, CVE-2014-7975,
CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

See also :

http://www.nessus.org/u?7f04737b

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)