The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3798-1 advisory.

  - The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.
    (CVE-2015-8539)

  - The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6     allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving     omission of the firmware name from a certain data structure. (CVE-2016-7913)

  - A elevation of privilege vulnerability in the Upstream kernel scsi driver. Product: Android. Versions:
    Android kernel. Android ID: A-35644812. (CVE-2017-0794)

  - The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already     exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have unspecified other impact via a crafted system call.
    (CVE-2017-15299)

  - In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of     service (NULL pointer dereference and BUG) because a required mutex is not used. (CVE-2017-18216)

  - In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in     the sound system, this can lead to a deadlock and denial of service condition. (CVE-2018-1000004)

  - The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation     to /dev/snd/seq by a local user. (CVE-2018-7566)

  - In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing     bounds check. This could lead to local escalation of privilege with System execution privileges needed.
    User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID:
    A-73083945. (CVE-2018-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3798-1)

high Nessus Plugin ID 118329

Version 1.10

Version 1.9

Version 1.10 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.9 Oct 21, 2023, 5:06 AM CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv3 score source (set to "CVE-2018-9518") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210506