Detections
Analytics
MiracleLinux 3 : kernel-2.6.18-53.14AXS3 (AXSA:2008-519:09)
high Nessus Plugin ID 291446
Language:
Synopsis
The remote MiracleLinux host is missing one or more security updates.Description
The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2008-519:09 advisory.The kernel packages contain the Linux kernel, the core of any Linux operating system.
Bugs fixed:
CVE-2007-6417:
The shmem_getpage function (mm/shmem.c) in Linux kernel 2.6.11 through 2.6.23 does not properly clear allocated memory in some rare circumstances related to tmpfs, which might allow local users to read sensitive kernel data or cause a denial of service (crash).
CVE-2007-6716:
fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.
CVE-2008-2931:
The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.
CVE-2008-3272:
The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.
CVE-2008-3275:
The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service (overflow of the UBIFS orphan area) via a series of attempted file creations within deleted directories.
- fixes a bug in which the ipmi_si driverdid not load successfully and crash-dumping could not complete.
- adds support for ARC-1200 disks.
- when configuring bonding device (2 slave devices connected to a repeater hub) as active-backup, ipv6 DAD fails with the following message on the console:
bond0:duplicate address detected!
- repetition of kdumping via /proc/sysrq-trigger would trigger a lockup detected by NMI watchdog.
Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 291446
File Name: miracle_linux_AXSA-2008-519.nasl
Version: 1.1
Type: local
Published: 1/19/2026
Updated: 1/19/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2008-2931
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:miracle:linux:kernel-xen, p-cpe:/a:miracle:linux:kernel-pae-devel, p-cpe:/a:miracle:linux:kernel, p-cpe:/a:miracle:linux:kernel-xen-devel, p-cpe:/a:miracle:linux:kernel-pae, p-cpe:/a:miracle:linux:kernel-headers, p-cpe:/a:miracle:linux:kernel-devel, cpe:/o:miracle:linux:3
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/5/2008
Vulnerability Publication Date: 8/21/2007
Reference Information
CVE: CVE-2007-6417, CVE-2007-6716, CVE-2008-2931, CVE-2008-3272, CVE-2008-3275