The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2337-1 advisory.

  - The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly     validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of     service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected     code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

  - The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing     socket operations based on the opener of a socket, which allows local users to bypass intended access     restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr     of a setuid program. (CVE-2014-0181)

  - Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1     allows local users to obtain sensitive information from kernel memory via a large head value.
    (CVE-2014-0206)

  - The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership     of root. (CVE-2014-4014)

  - The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does     not properly initialize a certain data structure, which allows local users to obtain sensitive information     from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

  - mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range     notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by     using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity     by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.
    (CVE-2014-4171)

  - arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall     auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service     (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (CVE-2014-4508)

  - Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in     sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local     users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
    (CVE-2014-4652)

  - sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure     possession of a read/write lock, which allows local users to cause a denial of service (use-after-free)     and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
    (CVE-2014-4653)

  - The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux     kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows     local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by     leveraging /dev/snd/controlCX access for an ioctl call. (CVE-2014-4654)

  - The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux     kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to     cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for     a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. (CVE-2014-4655)

  - Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel     before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access,     related to (1) index values in the snd_ctl_add function and (2) numid values in the     snd_ctl_remove_numid_conflict function. (CVE-2014-4656)

  - The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not     properly manage a certain backlog value, which allows remote attackers to cause a denial of service     (socket outage) via a crafted SCTP packet. (CVE-2014-4667)

  - The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a     certain reference count during attempts to use the umount system call in conjunction with a symlink, which     allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have     unspecified other impact via the umount program. (CVE-2014-5045)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2337-1)

high Nessus Plugin ID 77492

Version 1.23