OracleVM 3.3 : kernel-uek (OVMSA-2015-0034)

This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.


Synopsis :

The remote OracleVM host is missing one or more security updates.

Description :

The remote OracleVM system is missing necessary patches to address
critical security updates :

- kvm: fix excessive pages un-pinning in kvm_iommu_map
error path. (Quentin Casasnovas) [Orabug: 20687313]
(CVE-2014-3601) (CVE-2014-8369) (CVE-2014-3601)

- ttusb-dec: buffer overflow in ioctl (Dan Carpenter)
[Orabug: 20673376] (CVE-2014-8884)

- mm: Fix NULL pointer dereference in
madvise(MADV_WILLNEED) support (Kirill A. Shutemov)
[Orabug: 20673281] (CVE-2014-8173)

- netfilter: conntrack: disable generic tracking for known
protocols (Florian Westphal) [Orabug: 20673239]
(CVE-2014-8160)

- tracing/syscalls: Ignore numbers outside NR_syscalls'
range (Rabin Vincent) [Orabug: 20673163] (CVE-2014-7826)

- uek-rpm: ol7: update update-el to 7.1 (Guangyu Sun)
[Orabug: 20524579]

See also :

http://www.nessus.org/u?9dc7578d

Solution :

Update the affected kernel-uek / kernel-uek-firmware packages.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 5.3
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: OracleVM Local Security Checks

Nessus Plugin ID: 81904 ()

Bugtraq ID: 69489
70747
70749
70971
71097
72061
73133

CVE ID: CVE-2014-3601
CVE-2014-7826
CVE-2014-8160
CVE-2014-8173
CVE-2014-8369
CVE-2014-8884

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now