The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2888-1 advisory.

    It was discovered that a use-after-free vulnerability existed in the AF_UNIX implementation in the Linux     kernel. A local attacker could use crafted epoll_ctl calls to cause a denial of service (system crash) or     expose sensitive information. (CVE-2013-7446)

    It was discovered that the KVM implementation in the Linux kernel did not properly restore the values of     the Programmable Interrupt Timer (PIT). A user-assisted attacker in a KVM guest could cause a denial of     service in the host (system crash). (CVE-2015-7513)

    It was discovered that the Linux kernel keyring subsystem contained a race between read and revoke     operations. A local attacker could use this to cause a denial of service (system crash). (CVE-2015-7550)

    Sasha Levin discovered that the Reliable Datagram Sockets (RDS) implementation in the Linux kernel had a     race condition when checking whether a socket was bound or not. A local attacker could use this to cause a     denial of service (system crash). (CVE-2015-7990)

    It was discovered that the Btrfs implementation in the Linux kernel incorrectly handled compressed inline     extants on truncation. A local attacker could use this to expose sensitive information. (CVE-2015-8374)

     discovered that the Linux kernel networking implementation did not validate protocol identifiers     for certain protocol families, A local attacker could use this to cause a denial of service (system crash)     or possibly gain administrative privileges. (CVE-2015-8543)

    Dmitry Vyukov discovered that the pptp implementation in the Linux kernel did not verify an address length     when setting up a socket. A local attacker could use this to craft an application that exposed sensitive     information from kernel memory. (CVE-2015-8569)

    David Miller discovered that the Bluetooth implementation in the Linux kernel did not properly validate     the socket address length for Synchronous Connection-Oriented (SCO) sockets. A local attacker could use     this to expose sensitive information. (CVE-2015-8575)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2888-1)

high Nessus Plugin ID 88521

Version 2.17

Version 2.16

Version 2.16

Version 2.15

Version 2.17 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 2.16 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 2.16 Oct 21, 2023, 9:06 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2015-8543") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210906
Version 2.15 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901