The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2447-1 advisory.

  - The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of     service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c. (CVE-2014-3673)

  - The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux     kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF     chunks that trigger an incorrect uncork within the side-effect interpreter. (CVE-2014-3687)

  - The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of     service (memory consumption) by triggering a large number of chunks in an association's output queue, as     demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c. (CVE-2014-3688)

  - kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall     numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-     bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. (CVE-2014-7825)

  - kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall     numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial     of service (invalid pointer dereference) via a crafted application. (CVE-2014-7826)

  - The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly     interact with certain locations of a chroot directory, which allows local users to cause a denial of     service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
    (CVE-2014-7970)

  - Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17     allows local users to cause a denial of service (file unavailability) via a combination of a write action     and an F_SETFL fcntl operation for the O_DIRECT flag. (CVE-2014-8086)

  - The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper     paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the     ASLR protection mechanism via a crafted application that reads a 16-bit value. (CVE-2014-8134)

  - The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the     number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of     service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS     privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. (CVE-2014-8369)

  - The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not     properly handle faults associated with the Stack Segment (SS) segment register, which allows local users     to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the     linux-clock-tests test suite. (CVE-2014-9090)

  - arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated     with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an     IRET instruction that leads to access to a GS Base address from the wrong space. (CVE-2014-9322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2447-1)

high Nessus Plugin ID 80033

Version 1.20

Version 1.19

Version 1.20 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.19 Oct 21, 2023, 5:06 AM CVE (set "CVE" coverage to "CVE-2014-3673,CVE-2014-3687,CVE-2014-3688,CVE-2014-7825,CVE-2014-7826,CVE-2014-7970,CVE-2014-8086,CVE-2014-8134,CVE-2014-8369,CVE-2014-9090,CVE-2014-9322") CVSS metrics ("CVSSv2 score" changed from 7.8 to 7.2. "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C" to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2014-9322") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210506