The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2931-1 advisory.

  - The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of     service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to     net/unix/af_unix.c and net/unix/garbage.c. (CVE-2013-4312)

  - net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between     a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted     sctp_accept call. (CVE-2015-8767)

  - Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges     by triggering access to a paging structure by a different CPU. (CVE-2016-2069)

  - Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel     before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have     unspecified other impact via vectors involving an invalid USB descriptor. (CVE-2016-2384)

  - The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before     4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to     cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call. (CVE-2016-2543)

  - Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1     allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call     at a certain time. (CVE-2016-2544)

  - The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly     maintain a certain linked list, which allows local users to cause a denial of service (race condition and     system crash) via a crafted ioctl call. (CVE-2016-2545)

  - sound/core/timer.c in the Linux kernel before 4.4.1 uses an incorrect type of mutex, which allows local     users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl     call. (CVE-2016-2546)

  - sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider     slave timer instances, which allows local users to cause a denial of service (race condition, use-after-     free, and system crash) via a crafted ioctl call. (CVE-2016-2547)

  - sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop     action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call,     related to the (1) snd_timer_close and (2) _snd_timer_stop functions. (CVE-2016-2548)

  - sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which     allows local users to cause a denial of service (deadlock) via a crafted ioctl call. (CVE-2016-2549)

  - The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which     allows local users to gain privileges or cause a denial of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call. (CVE-2016-3134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2931-1)

high Nessus Plugin ID 89936

Version 2.22

Version 2.21

Version 2.21

Version 2.20

Version 2.22 Jan 10, 2024, 8:45 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202401100845
Version 2.21 Oct 23, 2023, 4:39 PM CVSSv2 score source (set to "CVE-2016-3134") Detection Plugin metadata Plugin Feed: 202310231639
Version 2.21 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 2.20 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901