Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3510)

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Oracle Linux host is missing one or more security updates.

Description :

Description of changes:

kernel-uek
[4.1.12-32.1.2.el7uek]
- KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats)
[Orabug: 22563965] {CVE-2016-0728}

[4.1.12-32.1.1.el7uek]
- ocfs2: return non-zero st_blocks for inline data (John Haxby)
[Orabug: 22218243]
- xen/events/fifo: Consume unprocessed events when a CPU dies (Ross
Lagerwall) [Orabug: 22498877]
- Revert 'xen/fb: allow xenfb initialization for hvm guests' (Konrad
Rzeszutek Wilk)
- xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set.
(Konrad Rzeszutek Wilk)
- xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has
MSI(X) enabled. (Konrad Rzeszutek Wilk)
- xen/pciback: Do not install an IRQ handler for MSI interrupts. (Konrad
Rzeszutek Wilk)
- xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has
MSI or MSI-X enabled (Konrad Rzeszutek Wilk)
- xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI
or MSI-X enabled (Konrad Rzeszutek Wilk)
- xen/pciback: Save xen_pci_op commands before processing it (Konrad
Rzeszutek Wilk)
- xen-scsiback: safely copy requests (David Vrabel) - xen-blkback: read
from indirect descriptors only once (Roger Pau Monn&eacute )
- xen-blkback: only read request operation from shared ring once (Roger
Pau Monn&eacute )
- xen-netback: use RING_COPY_REQUEST() throughout (David Vrabel)
- xen-netback: don't use last request to determine minimum Tx credit
(David Vrabel)
- xen: Add RING_COPY_REQUEST() (David Vrabel)

See also :

https://oss.oracle.com/pipermail/el-errata/2016-January/005701.html
https://oss.oracle.com/pipermail/el-errata/2016-January/005702.html

Solution :

Update the affected unbreakable enterprise kernel packages.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Family: Oracle Linux Local Security Checks

Nessus Plugin ID: 88033 ()

Bugtraq ID:

CVE ID: CVE-2016-0728

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now