The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2890-2 advisory.

  - Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to     bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl     calls. (CVE-2013-7446)

  - arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state     restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS     crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.
    (CVE-2015-7513)

  - The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly     use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls. (CVE-2015-7550)

  - Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows     local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2015-6937. (CVE-2015-7990)

  - fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local     users to obtain sensitive pre-truncation information from a file via a clone action. (CVE-2015-8374)

  - The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products,     does not validate protocol identifiers for certain protocol families, which allows local users to cause a     denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by     leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. (CVE-2015-8543)

  - The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through     4.3.3 do not verify an address length, which allows local users to obtain sensitive information from     kernel memory and bypass the KASLR protection mechanism via a crafted application. (CVE-2015-8569)

  - The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an     address length, which allows local users to obtain sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application. (CVE-2015-8575)

  - The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows     remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a     related issue to CVE-2003-1604. (CVE-2015-8787)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerabilities (USN-2890-2)

critical Nessus Plugin ID 88525

Version 2.15