The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3364-1 advisory.

  - The ethtool_get_wol function in net/core/ethtool.c in the Linux kernel through 4.7, as used in Android     before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not initialize a certain data structure, which     allows local users to obtain sensitive information via a crafted application, aka Android internal bug     28803952 and Qualcomm internal bug CR570754. (CVE-2014-9900)

  - The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7, as used in Android     before 2016-08-05 on Nexus 6 and 7 (2013) devices, uses weak permissions for /proc/iomem, which allows     local users to obtain sensitive information by reading this file, aka Android internal bug 28814213 and     Qualcomm internal bug CR786116. NOTE: the permissions may be intentional in most non-Android contexts.
    (CVE-2015-8944)

  - sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA     /dev/snd/timer driver resulting in local users being able to read information belonging to other users,     i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
    (CVE-2017-1000380)

  - The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel     through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of     service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device. (CVE-2017-7346)

  - The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the     allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows     local users to obtain sensitive address information via crafted bpf system calls. (CVE-2017-9150)

  - The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle     variable but does not give it an initial value. If one attempts to create a GB surface, with a previously     allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and     is then later returned to user space, allowing local users to obtain sensitive information from     uninitialized kernel memory via a crafted ioctl call. (CVE-2017-9605)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3364-1)

medium Nessus Plugin ID 101951

Version 3.10