Oracle Linux 7 : kernel (ELSA-2015-0987)

This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote Oracle Linux host is missing one or more security updates.

Description :

From Red Hat Security Advisory 2015:0987 :

Updated kernel packages that fix one security issue and several bugs
are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

* A buffer overflow flaw was found in the way the Linux kernel's Intel
AES-NI instructions optimized version of the RFC4106 GCM mode
decryption functionality handled fragmented packets. A remote attacker
could use this flaw to crash, or potentially escalate their privileges
on, a system over a connection with an active AEC-GCM mode IPSec
security association. (CVE-2015-3331, Important)

This update also fixes the following bugs :

* Previously, the kernel audit subsystem did not correctly track file
path names which could lead to empty, or '(null)' path names in the
PATH audit records. This update fixes the bug by correctly tracking
file path names and displaying the names in the audit PATH records.
(BZ#1197746)

* Due to a change in the internal representation of field types,
AUDIT_LOGINUID set to -1 (4294967295) by the audit API was
asymmetrically converted to an AUDIT_LOGINUID_SET field with a value
of 0, unrecognized by an older audit API. To fix this bug, the kernel
takes note about the way the rule has been formulated and reports the
rule in the originally given form. As a result, older versions of
audit provide a report as expected, in the AUDIT_LOGINUID field type
form, whereas the newer versions can migrate to the new
AUDIT_LOGINUID_SET filed type. (BZ#1197748)

* The GFS2 file system 'Splice Read' operation, which is used for the
sendfile() function, was not properly allocating a required
multi-block reservation structure in memory. Consequently, when the
GFS2 block allocator was called to assign blocks of data, it attempted
to dereference the structure, which resulted in a kernel panic. With
this update, 'Splice read' operation properly allocates the necessary
reservation structure in memory prior to calling the block allocator,
and sendfile() thus works properly for GFS2. (BZ#1201256)

* Moving an Open vSwitch (OVS) internal vport to a different net name
space and subsequently deleting that name space led to a kernel panic.
This bug has been fixed by removing the OVS internal vport at net name
space deletion. (BZ#1202357)

* Previously, the kernel audit subsystem was not correctly handling
file and directory moves, leading to audit records that did not match
the audit file watches. This fix correctly handles moves such that the
audit file watches work correctly. (BZ#1202358)

* Due to a regression, the crypto adapter could not be set online. A
patch has been provided that fixes the device registration process so
that the device can be used also before the registration process is
completed, thus fixing this bug. (BZ#1205300)

* Due to incorrect calculation for entropy during the entropy
addition, the amount of entropy in the /dev/random file could be
overestimated. The formula for the entropy addition has been changed,
thus fixing this bug. (BZ#1211288)

* Previously, the ansi_cprng and drbg utilities did not obey the call
convention and returned the positive value on success instead of the
correct value of zero. Consequently, Internet Protocol Security
(IPsec) terminated unexpectedly when ansi_cprng or drbg were used.
With this update, ansi_cprng and drbg have been changed to return zero
on success, and IPsec now functions correctly. (BZ#1211487)

* Due to a failure to clear the timestamp flag when reusing a tx
descriptor in the mlx4_en driver, programs that did not request a
hardware timestamp packet on their sent data received it anyway,
resulting in unexpected behavior in certain applications. With this
update, when reusing the tx descriptor in the mlx4_en driver in the
aforementioned situation, the hardware timestamp flag is cleared, and
applications now behave as expected. (BZ#1209240)

All kernel users are advised to upgrade to these updated packages,
which contain backported patches to correct these issues. The system
must be rebooted for this update to take effect.

See also :

https://oss.oracle.com/pipermail/el-errata/2015-May/005063.html

Solution :

Update the affected kernel packages.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.9
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Oracle Linux Local Security Checks

Nessus Plugin ID: 83402 ()

Bugtraq ID: 73060
74235

CVE ID: CVE-2015-3331

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now