Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3013)

High Nessus Plugin ID 81871

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

Description of changes:

kernel-uek [3.8.13-55.1.8.el7uek]
- kvm: fix excessive pages un-pinning in kvm_iommu_map error path. (Quentin Casasnovas) [Orabug: 20687313] {CVE-2014-3601} {CVE-2014-8369} {CVE-2014-3601}

[3.8.13-55.1.7.el7uek]
- ttusb-dec: buffer overflow in ioctl (Dan Carpenter) [Orabug: 20673376] {CVE-2014-8884}
- mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support (Kirill A. Shutemov) [Orabug: 20673281] {CVE-2014-8173}
- netfilter: conntrack: disable generic tracking for known protocols (Florian Westphal) [Orabug: 20673239] {CVE-2014-8160}
- tracing/syscalls: Ignore numbers outside NR_syscalls' range (Rabin Vincent) [Orabug: 20673163] {CVE-2014-7826}

Solution

Update the affected unbreakable enterprise kernel packages.

See Also

https://oss.oracle.com/pipermail/el-errata/2015-March/004892.html

https://oss.oracle.com/pipermail/el-errata/2015-March/004893.html

Plugin Details

Severity: High

ID: 81871

File Name: oraclelinux_ELSA-2015-3013.nasl

Version: 1.10

Type: local

Agent: unix

Published: 2015/03/17

Updated: 2019/04/01

Dependencies: 122878, 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-55.1.8.el6uek, p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-55.1.8.el7uek, p-cpe:/a:oracle:linux:kernel-uek, p-cpe:/a:oracle:linux:kernel-uek-debug, p-cpe:/a:oracle:linux:kernel-uek-debug-devel, p-cpe:/a:oracle:linux:kernel-uek-devel, p-cpe:/a:oracle:linux:kernel-uek-doc, p-cpe:/a:oracle:linux:kernel-uek-firmware, cpe:/o:oracle:linux:6, cpe:/o:oracle:linux:7

Required KB Items: Host/local_checks_enabled, Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2015/03/13

Vulnerability Publication Date: 2014/08/31

Reference Information

CVE: CVE-2014-3601, CVE-2014-7826, CVE-2014-8160, CVE-2014-8173, CVE-2014-8369, CVE-2014-8884

BID: 69489, 70747, 70749, 70971, 71097, 72061