The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2965-1 advisory.

  - The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux     kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer     dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.
    (CVE-2016-2184)

  - The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2185)

  - The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2186)

  - The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-2188)

  - The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted USB device without two interrupt-in endpoint descriptors. (CVE-2016-3136)

  - drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and     cypress_open functions. (CVE-2016-3137)

  - The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically     proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB     device without both a control and a data endpoint descriptor. (CVE-2016-3138)

  - The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device descriptor. (CVE-2016-3140)

  - The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which     allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large     number of IP addresses. (CVE-2016-3156)

  - The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-     switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial     of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.
    (CVE-2016-3157)

  - The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not     properly randomize the legacy base address, which makes it easier for local users to defeat the intended     restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or     setgid program, by disabling stack-consumption resource limits. (CVE-2016-3672)

  - The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1     allows physically proximate attackers to cause a denial of service (system crash) via a USB device without     both a master and a slave interface. (CVE-2016-3689)

  - Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact     by inserting a USB device with an invalid USB descriptor. (CVE-2016-3951)

  - The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows     remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other     impact via a crafted length value in a USB/IP packet. (CVE-2016-3955)

  - The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does     not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial     of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.
    (CVE-2016-4557)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-2965-1)

critical Nessus Plugin ID 91082

Version 2.20

Version 2.19

Version 2.20 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 2.19 Oct 21, 2023, 3:09 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") CVSSv2 score source (set to "CVE-2016-3955") Detection Plugin metadata Plugin Feed: 202310210309