The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for     packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue     to CVE-2016-7039. (CVE-2016-8666)

Note that Nessus relies on the presence of the package as reported by the vendor.

The openSUSE Leap 42.1 kernel was updated to 4.1.34, fixing bugs and security issues.

The following security bugs were fixed :

  - CVE-2016-5195: A local privilege escalation using     MAP_PRIVATE was fixed, which is reportedly exploited in     the wild (bsc#1004418).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-7039: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for large     crafted packets, as demonstrated by packets that contain     only VLAN headers, a related issue to CVE-2016-8666     (bnc#1001486).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

The following non-security bugs were fixed :

  - 9p: use file_dentry() (bsc#1005101).

  - af_unix: Do not set err in unix_stream_read_generic     unless there was an error (bsc#1005101).

  - alsa: hda - Fix superfluous HDMI jack repoll     (bsc#1005101).

  - alsa: hda - Turn off loopback mixing as default     (bsc#1001462).

  - apparmor: add missing id bounds check on dfa     verification (bsc#1000304).

  - apparmor: check that xindex is in trans_table bounds     (bsc#1000304).

  - apparmor: do not check for vmalloc_addr if kvzalloc()     failed (bsc#1000304).

  - apparmor: do not expose kernel stack (bsc#1000304).

  - apparmor: ensure the target profile name is always     audited (bsc#1000304).

  - apparmor: exec should not be returning ENOENT when it     denies (bsc#1000304).

  - apparmor: fix audit full profile hname on successful     load (bsc#1000304).

  - apparmor: fix change_hat not finding hat after policy     replacement (bsc#1000287).

  - apparmor: fix disconnected bind mnts reconnection     (bsc#1000304).

  - apparmor: fix log failures for all profiles in a set     (bsc#1000304).

  - apparmor: fix module parameters can be changed after     policy is locked (bsc#1000304).

  - apparmor: fix oops in profile_unpack() when policy_db is     not present (bsc#1000304).

  - apparmor: fix put() parent ref after updating the active     ref (bsc#1000304).

  - apparmor: fix refcount bug in profile replacement     (bsc#1000304).

  - apparmor: fix refcount race when finding a child profile     (bsc#1000304).

  - apparmor: fix replacement bug that adds new child to old     parent (bsc#1000304).

  - apparmor: fix uninitialized lsm_audit member     (bsc#1000304).

  - apparmor: fix update the mtime of the profile file on     replacement (bsc#1000304).

  - apparmor: internal paths should be treated as     disconnected (bsc#1000304).

  - apparmor: use list_next_entry instead of list_entry_next     (bsc#1000304).

  - arm: orion5x: Fix legacy get_irqnr_and_base     (bsc#1005101).

  - batman-adv: Fix memory leak on tt add with invalid vlan     (bsc#1005101).

  - batman-adv: replace WARN with rate limited output on     non-existing VLAN (bsc#1005101).

  - blacklist.conf: add some commits (bsc#1005101)

  - blacklist.conf: add unaplicable IB/uverbs commit     (bsc#1005101)

  - blacklist.conf: Blacklist unsupported architectures

  - blkfront: fix an error path memory leak (luckily none so     far).

  - blktap2: eliminate deadlock potential from shutdown path     (bsc#909994).

  - blktap2: eliminate race from deferred work queue     handling (bsc#911687).

  - btrfs: ensure that file descriptor used with subvol     ioctls is a dir (bsc#999600).

  - cdc-acm: added sanity checking for probe() (bsc#993891).

  - cgroup: add seq_file forward declaration for struct     cftype (bsc#1005101).

  - do 'fold checks into iterate_and_advance()' right     (bsc#972460).

  - drm/i915: Wait up to 3ms for the pcu to ack the cdclk     change request on SKL (bsc#1005101).

  - drm/rockchip: unset pgoff when mmap'ing gems     (bsc#1005101).

  - fold checks into iterate_and_advance() (bsc#972460).

  - fs/cifs: cifs_get_root shouldn't use path with tree name     (bsc#963655, bsc#979681, bsc#1000907).

  - fs/cifs: Compare prepaths when comparing superblocks     (bsc#799133).

  - fs/cifs: Fix memory leaks in cifs_do_mount()     (bsc#799133).

  - fs/cifs: Fix regression which breaks DFS mounting     (bsc#799133).

  - fs/cifs: Move check for prefix path to within     cifs_get_root() (bsc#799133).

  - hid: multitouch: force retrieving of Win8 signature blob     (bsc#1005101).

  - input: ALPS - add touchstick support for SS5 hardware     (bsc#987703).

  - input: ALPS - allow touchsticks to report pressure     (bsc#987703).

  - input: ALPS - handle 0-pressure 1F events (bsc#987703).

  - input: ALPS - set DualPoint flag for 74 03 28 devices     (bsc#987703).

  - ipip: Properly mark ipip GRO packets as encapsulated     (bsc#1001486).

  - ipv6: suppress sparse warnings in IP6_ECN_set_ce()     (bsc#1005101).

  - kabi: hide name change of napi_gro_cb::udp_mark     (bsc#1001486).

  - kaweth: fix firmware download (bsc#993890).

  - kaweth: fix oops upon failed memory allocation     (bsc#993890).

  - kvm: x86: only channel 0 of the i8254 is linked to the     HPET (bsc#1005101).

  - memcg: fix thresholds for 32b architectures     (bsc#1005101).

  - msi-x: fix an error path (luckily none so far).

  - netback: fix flipping mode (bsc#996664).

  - netback: fix flipping mode (bsc#996664).

  - netem: fix a use after free (bsc#1005101).

  - net: fix warnings in 'make htmldocs' by moving macro     definition out of field declaration (bsc#1005101).

  - netfront: linearize SKBs requiring too many slots     (bsc#991247).

  - netlink: not trim skb for mmaped socket when dump     (bsc#1005101).

  - net_sched: fix pfifo_head_drop behavior vs backlog     (bsc#1005101).

  - net_sched: keep backlog updated with qlen (bsc#1005101).

  - nfs: use file_dentry() (bsc#1005101).

  - ovl: fix open in stacked overlay (bsc#1005101).

  - pci: Prevent out of bounds access in numa_node override     (bsc#1005101).

  - perf/core: Do not leak event in the syscall error path     (bsc#1005101).

  - perf: Fix PERF_EVENT_IOC_PERIOD deadlock (bsc#1005101).

  - Revive iov_iter_fault_in_multipages_readable() for     4.1.34.

  - sch_drr: update backlog as well (bsc#1005101).

  - sch_hfsc: always keep backlog updated (bsc#1005101).

  - sch_prio: update backlog as well (bsc#1005101).

  - sch_qfq: keep backlog updated with qlen (bsc#1005101).

  - sch_red: update backlog as well (bsc#1005101).

  - sch_sfb: keep backlog updated with qlen (bsc#1005101).

  - sch_tbf: update backlog as well (bsc#1005101).

  - tpm: fix: return rc when devm_add_action() fails     (bsc#1005101).

  - tunnels: Do not apply GRO to multiple layers of     encapsulation (bsc#1001486).

  - Update blacklisting documentation to contain     path-blacklisting

  - usb: fix typo in wMaxPacketSize validation (bsc#991665).

  - usb: hub: Fix auto-remount of safely removed or ejected     USB-3 devices (bsc#922634).

  - x86/LDT: Print the real LDT base address (bsc#1005101).

  - x86/PCI: Mark Broadwell-EP Home Agent 1 as having     non-compliant BARs (bsc#1005101).

  - xenbus: do not bail early from     xenbus_dev_request_and_reply() (luckily none so far).

  - xenbus: inspect the correct type in     xenbus_dev_request_and_reply().

  - xen: Fix refcnt regression in xen netback introduced by     changes made for bug#881008 (bnc#978094)

  - xen: Linux 4.1.28.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2110 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write     (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to     gain write access to otherwise read-only memory mappings and thus increase their privileges on the system.
    (CVE-2016-5195, Important)

    * Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area     Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack     overflow issue. It could occur while receiving large packets via GRO path; As an unlimited recursion could     unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel. (CVE-2016-7039,     Important)

    Red Hat would like to thank Phil Oester for reporting CVE-2016-5195.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
219758	Linux Distros Unpatched Vulnerability : CVE-2016-8666	Nessus	Misc.	3/4/2025	8/22/2025	high
94219	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1212) (Dirty COW)	Nessus	SuSE Local Security Checks	10/24/2016	3/8/2022	high
94316	RHEL 7 : kernel-rt (RHSA-2016:2110)	Nessus	Red Hat Local Security Checks	10/27/2016	3/10/2025	high

Detections

Analytics

Plugins Search

high

high

high