The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2517-1 advisory.

  - arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1     allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local     users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area     system call and later reads a 16-bit value. (CVE-2014-8133)

  - net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack     entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,     which allows remote attackers to bypass intended access restrictions via packets with disallowed port     numbers. (CVE-2014-8160)

  - The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the     semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang)     via a crafted application. (CVE-2014-8559)

  - The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in     certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other     category, aka a negative groups issue, related to kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c. (CVE-2014-8989)

  - The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not     ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which     makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that     reads a TLS base address. (CVE-2014-9419)

  - The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the     number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite     loop, and system crash or hang) via a crafted iso9660 image. (CVE-2014-9420)

  - The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N.
    implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of     an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash)     via fragmented packets. (CVE-2014-9428)

  - Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2     allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified     other impact via keyctl commands that trigger access to a key structure member during garbage collection     of a key. (CVE-2014-9529)

  - The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not     validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to     obtain sensitive information from kernel memory via a crafted iso9660 image. (CVE-2014-9584)

  - The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose     memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection     mechanism by guessing a location at the end of a PMD. (CVE-2014-9585)

  - Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs     subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer     overflow and system crash) or possibly gain privileges via a crafted filename. (CVE-2014-9683)

  - The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths,     which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted     filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c. (CVE-2014-9728)

  - The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain     data-structure size consistency, which allows local users to cause a denial of service (system crash) via     a crafted UDF filesystem image. (CVE-2014-9729)

  - The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component     lengths that are unused, which allows local users to cause a denial of service (system crash) via a     crafted UDF filesystem image. (CVE-2014-9730)

  - The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is     available for storing a symlink target's name along with a trailing \0 character, which allows local users     to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and     fs/udf/unicode.c. (CVE-2014-9731)

  - The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS     lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of     service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER     instruction. (CVE-2015-0239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2517-1)

medium Nessus Plugin ID 81570

Version 1.21

Version 1.20

Version 1.21 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 1.20 Oct 21, 2023, 3:09 AM CVSSv2 severity (based on CVE-2014-9529, severity decreased from "High" to "Medium") CVE (set "CVE" coverage to "CVE-2014-8133,CVE-2014-8160,CVE-2014-8559,CVE-2014-8989,CVE-2014-9419,CVE-2014-9420,CVE-2014-9428,CVE-2014-9529,CVE-2014-9584,CVE-2014-9585,CVE-2014-9683,CVE-2014-9728,CVE-2014-9729,CVE-2014-9730,CVE-2014-9731,CVE-2015-0239") CVSS metrics ("CVSSv2 score" changed from 7.8 to 6.9. "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C" to "CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2014-9529") CVSSv3 score source (set to "CVE-2014-8559") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210309