The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2854-1 advisory.

  - Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial     of service (host OS crash) or gain privileges by writing to memory shared between the frontend and     backend, aka a double fetch vulnerability. (CVE-2015-8550)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL     pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X     capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka Linux pciback missing     sanity checks. (CVE-2015-8551)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to generate a continuous stream of WARN messages and     cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or     MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka Linux pciback missing sanity     checks. (CVE-2015-8552)

  - kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local     users to gain privileges by establishing a user namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states there     is no kernel bug here. (CVE-2015-8709)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2854-1)

high Nessus Plugin ID 87537

Version 2.16