The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2888-1 advisory.

  - Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to     bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl     calls. (CVE-2013-7446)

  - arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state     restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS     crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.
    (CVE-2015-7513)

  - The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly     use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls. (CVE-2015-7550)

  - Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows     local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2015-6937. (CVE-2015-7990)

  - fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local     users to obtain sensitive pre-truncation information from a file via a clone action. (CVE-2015-8374)

  - The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products,     does not validate protocol identifiers for certain protocol families, which allows local users to cause a     denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by     leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. (CVE-2015-8543)

  - The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through     4.3.3 do not verify an address length, which allows local users to obtain sensitive information from     kernel memory and bypass the KASLR protection mechanism via a crafted application. (CVE-2015-8569)

  - The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an     address length, which allows local users to obtain sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application. (CVE-2015-8575)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2888-1)

high Nessus Plugin ID 88521

Version 2.17

Version 2.16

Version 2.16

Version 2.15

Version 2.17 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 2.16 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 2.16 Oct 21, 2023, 9:06 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2015-8543") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210906
Version 2.15 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901