The remote Oracle Linux host is missing a security update for the kernel package(s).

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1276:01 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any     Linux operating system.  The kernel handles the basic functions     of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2016-6828     The tcp_check_send_head function in include/net/tcp.h in the Linux     kernel before 4.7.5 does not properly maintain certain SACK state     after a failed data copy, which allows local users to cause a denial     of service (tcp_xmit_retransmit_queue use-after-free and system crash)     via a crafted SACK option.
    CVE-2016-7117     Use-after-free vulnerability in the __sys_recvmmsg function in     net/socket.c in the Linux kernel before 4.5.2 allows remote attackers     to execute arbitrary code via vectors involving a recvmmsg system call     that is mishandled during error processing.
    CVE-2016-9555     The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux     kernel before 4.8.8 lacks chunk-length checking for the first chunk,     which allows remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified other impact     via crafted SCTP data.
    Fixed bugs:
    * Previously, the performance of Internet Protocol over InfiniBand (IPoIB) was suboptimal due to a     conflict of IPoIB with the Generic Receive Offload (GRO) infrastructure. With this update, the data cached     by the IPoIB driver has been moved from a control block into the IPoIB hard header, thus avoiding the GRO     problem and the corruption of IPoIB address information. As a result, the performance of IPoIB has been     improved.
    * Previously, when a virtual machine (VM) with PCI-Passthrough interfaces was recreated, a race condition     between the eventfd daemon and the virqfd daemon occurred. Consequently, the operating system rebooted.
    This update fixes the race condition. As a result, the operating system no longer reboots in the described     situation.
    * Previously, a packet loss occurred when the team driver in round-robin mode was sending a large number     of packets. This update fixes counting of the packets in the round-robin runner of the team driver, and     the packet loss no longer occurs in the described situation.
    * Previously, the virtual network devices contained in the deleted namespace could be deleted in any     order. If the loopback device was not deleted as the last item, other netns devices, such as vxlan     devices, could end up with dangling references to the loopback device. Consequently, deleting a network     namespace (netns) occasionally ended by a kernel oops. With this update, the underlying source code has     been fixed to ensure the correct order when deleting the virtual network devices on netns deletion. As a     result, the kernel oops no longer occurs under the described circumstances.
    * Previously, a Kabylake system with a Sunrise Point Platform Controller Hub (PCH) with a PCI device ID of     0xA149 showed the following warning messages during the boot:
    Unknown Intel PCH (0xa149) detected. Warning: Intel Kabylake processor with unknown PCH - this hardware     has not undergone testing by Red Hat and might not be certified. Please consult     https://hardware.redhat.comfor certified hardware.
    * Previously, the operating system occasionally became unresponsive after a long run. This was caused by a     race condition between the try_to_wake_up() function and a woken up task in the core scheduler. With this     update, the race condition has been fixed, and the operating system no longer locks up in the described     scenario.
    These updated kernel packages include several security issues and numerous bug fixes, some of which you     can see below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3161-2 advisory.

    USN-3161-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2015-8964)

    It was discovered that the Video For Linux Two (v4l2) implementation in the Linux kernel did not properly     handle multiple planes when processing a VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)

    CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without     restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of     service (system crash). (CVE-2016-6213)

    It was discovered that the KVM implementation for x86/x86_64 in the Linux kernel could dereference a null     pointer. An attacker in a guest virtual machine could use this to cause a denial of service (system crash)     in the KVM host. (CVE-2016-8630)

    Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation in the Linux kernel contained a     buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute     arbitrary code with administrative privileges. (CVE-2016-8633)

    Marco Grassi discovered that the TCP implementation in the Linux kernel mishandles socket buffer (skb)     truncation. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-8645)

    Andrey Konovalov discovered that the SCTP implementation in the Linux kernel improperly handled validation     of incoming data. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2016-9555)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's handling of     packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality can allow     a remote attacker to force the kernel to enter a     condition in which it can loop indefinitely.

  - It was discovered that a remote attacker could leverage     the generation of IPv6 atomic fragments to trigger the     use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is     not needed) and could subsequently perform any type of     a fragmentation-based attack against legacy IPv6 nodes     that do not implement RFC6946.

  - It was found that the blk_rq_map_user_iov() function in     the Linux kernel's block device implementation did not     properly restrict the type of iterator, which could     allow a local attacker to read or write to arbitrary     kernel memory locations or cause a denial of service     (use-after-free) by leveraging write access to a     /dev/sg device.

  - A flaw was found in the Linux kernel's implementation     of the SCTP protocol. A remote attacker could trigger     an out-of-bounds read with an offset of up to 64kB     potentially causing the system to crash.

  - A flaw was found in the Linux networking subsystem     where a local attacker with CAP_NET_ADMIN capabilities     could cause an out-of-bounds memory access by creating     a smaller-than-expected ICMP header and sending to its     destination via sendto().

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way. This     could allow a local user to gain group privileges via     certain setgid applications.

  - It was found that when the gcc stack protector was     enabled, reading the /proc/keys file could cause a     panic in the Linux kernel due to stack corruption. This     happened because an incorrect buffer size was used to     hold a 64-bit timeout value rendered as weeks.

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation.
    A local attacker could use this flaw to cause a denial     of service (out-of-bounds access or system crash) by     changing a certain size value.

  - When creating audit records for parameters to executed     children processes, an attacker can convince the Linux     kernel audit subsystem can create corrupt records which     may allow an attacker to misrepresent or evade logging     of executing commands.

  - A flaw was discovered in the way the Linux kernel dealt     with paging structures. When the kernel invalidated a     paging structure that was not in use locally, it could,     in principle, race against another CPU that is     switching to a process that uses the paging structure     in question. A local user could use a thread running     with a stale cached virtual->physical translation to     potentially escalate their privileges if the     translation in question were writable and the physical     page got reused for something critical (for example, a     page table).

  - A flaw was found in the USB-MIDI Linux kernel driver: a     double-free error could be triggered for the 'umidi'     object. An attacker with physical access to the system     could use this flaw to escalate their privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE Leap 42.1 kernel was updated to 4.1.36 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2016-8655: A race condition in the af_packet     packet_set_ring function could be used by local     attackers to crash the kernel or gain privileges     (bsc#1012754).

  - CVE-2016-9794: A use-after-free in ALSA pcm could lead     to crashes or allowed local users to potentially gain     privileges (bsc#1013533).

  - CVE-2015-8962: Double free vulnerability in the     sg_common_write function in drivers/scsi/sg.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (memory corruption and system     crash) by detaching a device during an SG_IO ioctl call     (bnc#1010501).

  - CVE-2016-9178: The __get_user_asm_ex macro in     arch/x86/include/asm/uaccess.h in the Linux kernel did     not initialize a certain integer variable, which allowed     local users to obtain sensitive information from kernel     stack memory by triggering failure of a get_user_ex call     (bnc#1008650).

  - CVE-2016-7913: The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (use-after-free) via vectors involving     omission of the firmware name from a certain data     structure (bnc#1010478).

  - CVE-2016-9555: The sctp_sf_ootb function in     net/sctp/sm_statefuns.c in the Linux kernel lacks     chunk-length checking for the first chunk, which allowed     remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified     other impact via crafted SCTP data (bnc#1011685).

  - CVE-2015-8963: Race condition in kernel/events/core.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (use-after-free) by     leveraging incorrect handling of an swevent data     structure during a CPU unplug operation (bnc#1010502).

  - CVE-2015-8964: The tty_set_termios_ldisc function in     drivers/tty/tty_ldisc.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory by reading a tty data structure (bnc#1010507).

  - CVE-2016-8646: The hash_accept function in     crypto/algif_hash.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) by attempting     to trigger use of in-kernel hash algorithms for a socket     that has received zero bytes of data (bnc#1010150).

  - CVE-2016-8633: drivers/firewire/net.c in the Linux     kernel in certain unusual hardware configurations,     allowed remote attackers to execute arbitrary code via     crafted fragmented packets (bnc#1008833).

  - CVE-2016-8630: The x86_decode_insn function in     arch/x86/kvm/emulate.c in the Linux kernel, when KVM is     enabled, allowed local users to cause a denial of     service (host OS crash) via a certain use of a ModR/M     byte in an undefined instruction (bnc#1009222).

  - CVE-2016-9083: drivers/vfio/pci/vfio_pci.c in the Linux     kernel allowed local users to bypass integer overflow     checks, and cause a denial of service (memory     corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a     VFIO_DEVICE_SET_IRQS ioctl call, aka a 'state machine     confusion bug (bnc#1007197).

  - CVE-2016-9084: drivers/vfio/pci/vfio_pci_intrs.c in the     Linux kernel misuses the kzalloc function, which allowed     local users to cause a denial of service (integer     overflow) or have unspecified other impact by leveraging     access to a vfio PCI device file (bnc#1007197).

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel through 4.8.2,     when the GNU Compiler Collection (gcc) stack protector     is enabled, uses an incorrect buffer size for certain     timeout data, which allowed local users to cause a     denial of service (stack memory corruption and panic) by     reading the /proc/keys file (bnc#1004517).

  - CVE-2016-7097: The filesystem implementation in the     Linux kernel preserves the setgid bit during a setxattr     call, which allowed local users to gain group privileges     by leveraging the existence of a setgid program with     restrictions on execute permissions (bnc#995968).

  - CVE-2015-8956: The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel allowed     local users to obtain sensitive information or cause a     denial of service (NULL pointer dereference) via vectors     involving a bind system call on a Bluetooth RFCOMM     socket (bnc#1003925).

The following non-security bugs were fixed :

  - ata: ahci_xgene: dereferencing uninitialized pointer in     probe (bsc#1006580).

  - blacklist.conf: add some commits (bsc#1006580)

  - bna: Add synchronization for tx ring (bsc#993739).

  - bonding: set carrier off for devices created through     netlink (bsc#999577).

  - btrfs: deal with duplicates during extent_map insertion     in btrfs_get_extent (bsc#1001171).

  - btrfs: deal with existing encompassing extent map in     btrfs_get_extent() (bsc#1001171).

  - btrfs: fix extent tree corruption due to relocation     (bsc#990384).

  - btrfs: fix races on root_log_ctx lists (bsc#1007653).

  - ext4: fix data exposure after a crash (bsc#1012876).

  - ext4: fix reference counting bug on block allocation     error (bsc#1012876).

  - gre: Disable segmentation offloads w/ CSUM and we are     encapsulated via FOU (bsc#1001486).

  - gro: Allow tunnel stacking in the case of FOU/GUE     (bsc#1001486).

  - ipv6: send NEWLINK on RA managed/otherconf changes     (bsc#934067).

  - ipv6: send only one NEWLINK when RA causes changes     (bsc#934067).

  - isofs: Do not return EACCES for unknown filesystems     (bsc#1012876).

  - jbd2: fix checkpoint list cleanup (bsc#1012876).

  - jbd2: Fix unreclaimed pages after truncate in     data=journal mode (bsc#1010909).

  - locking/static_key: Fix concurrent static_key_slow_inc()     (bsc#1006580).

  - mmc: Fix kabi breakage of mmc-block in 4.1.36     (stable-4.1.36).

  - posix_acl: Added fix for f2fs.

  - Revert 'kbuild: add -fno-PIE' (stable-4.1.36).

  - Revert 'x86/mm: Expand the exception table logic to     allow new handling options' (stable-4.1.36).

  - tunnels: Remove encapsulation offloads on decap     (bsc#1001486).

  - usbhid: add ATEN CS962 to list of quirky devices     (bsc#1007615).

  - vmxnet3: Wake queue from reset work (bsc#999907).

The openSUSE 13.1 kernel was updated to receive various critical security fixes.

The following security bugs were fixed :

  - CVE-2016-8655: A race condition in the af_packet     packet_set_ring function could be used by local     attackers to crash the kernel or gain privileges     (bsc#1012754).

  - CVE-2016-8632: The tipc_msg_build function in     net/tipc/msg.c in the Linux kernel did not validate the     relationship between the minimum fragment length and the     maximum packet size, which allowed local users to gain     privileges or cause a denial of service (heap-based     buffer overflow) by leveraging the CAP_NET_ADMIN     capability (bnc#1008831).

  - CVE-2016-9555: The sctp_sf_ootb function in     net/sctp/sm_statefuns.c in the Linux kernel lacks     chunk-length checking for the first chunk, which allowed     remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified     other impact via crafted SCTP data (bnc#1011685).

This update for the Linux Kernel 3.12.55-52_45 fixes several issues.
The following security bugs were fixed :

  - CVE-2016-8655: A race condition in the af_packet     packet_set_ring function could be used by local     attackers to crash the kernel or gain privileges     (bsc#1012759).

  - CVE-2016-9555: The sctp_sf_ootb function in     net/sctp/sm_statefuns.c in the Linux kernel lacks     chunk-length checking for the first chunk, which allowed     remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified     other impact via crafted SCTP data (bsc#1012183).

  - CVE-2016-7117: Use-after-free vulnerability in the
    __sys_recvmmsg function in net/socket.c in the Linux     kernel allowed remote attackers to execute arbitrary     code via vectors involving a recvmmsg system call that     is mishandled during error processing (bsc#1003253).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various critical security fixes. The following security bugs were fixed :

  - CVE-2016-8655: A race condition in the af_packet     packet_set_ring function could be used by local     attackers to crash the kernel or gain privileges     (bsc#1012754).

  - CVE-2016-8632: The tipc_msg_build function in     net/tipc/msg.c in the Linux kernel did not validate the     relationship between the minimum fragment length and the     maximum packet size, which allowed local users to gain     privileges or cause a denial of service (heap-based     buffer overflow) by leveraging the CAP_NET_ADMIN     capability (bnc#1008831).

  - CVE-2016-9555: The sctp_sf_ootb function in     net/sctp/sm_statefuns.c in the Linux kernel lacks     chunk-length checking for the first chunk, which allowed     remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified     other impact via crafted SCTP data (bnc#1011685).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.55-52_42 fixes several issues.
The following security bugs were fixed :

  - CVE-2016-8655: A race condition in the af_packet     packet_set_ring function could be used by local     attackers to crash the kernel or gain privileges     (bsc#1012759).

  - CVE-2016-9555: The sctp_sf_ootb function in     net/sctp/sm_statefuns.c in the Linux kernel lacks     chunk-length checking for the first chunk, which allowed     remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified     other impact via crafted SCTP data (bsc#1012183).

  - CVE-2016-7117: Use-after-free vulnerability in the
    __sys_recvmmsg function in net/socket.c in the Linux     kernel allowed remote attackers to execute arbitrary     code via vectors involving a recvmmsg system call that     is mishandled during error processing (bsc#1003253).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.60-52_54 fixes several issues.
The following security bugs were fixed :

  - CVE-2016-8655: A race condition in the af_packet     packet_set_ring function could be used by local     attackers to crash the kernel or gain privileges     (bsc#1012759).

  - CVE-2016-9555: The sctp_sf_ootb function in     net/sctp/sm_statefuns.c in the Linux kernel lacks     chunk-length checking for the first chunk, which allowed     remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified     other impact via crafted SCTP data (bsc#1012183).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
102511	Oracle Linux 7 : kernel (ELSA-2017-1842-1) (Stack Clash)	Nessus	Oracle Linux Local Security Checks	8/16/2017	11/26/2025	critical
289595	MiracleLinux 7 : kernel-3.10.0-514.6.1.el7 (AXSA:2017-1276:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/19/2026	critical
95996	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3161-2)	Nessus	Ubuntu Local Security Checks	12/21/2016	8/27/2024	critical
99106	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-025)	Nessus	Virtuozzo Local Security Checks	3/31/2017	12/26/2025	critical
95702	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1428)	Nessus	SuSE Local Security Checks	12/12/2016	1/14/2026	critical
95708	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1436)	Nessus	SuSE Local Security Checks	12/12/2016	1/14/2026	critical
95799	SUSE SLES12 Security Update : kernel (SUSE-SU-2016:3109-1)	Nessus	SuSE Local Security Checks	12/14/2016	1/14/2026	critical
95606	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:3039-1)	Nessus	SuSE Local Security Checks	12/7/2016	1/15/2026	critical
95802	SUSE SLES12 Security Update : kernel (SUSE-SU-2016:3112-1)	Nessus	SuSE Local Security Checks	12/14/2016	1/14/2026	critical
95989	SUSE SLES12 Security Update : kernel (SUSE-SU-2016:3197-1)	Nessus	SuSE Local Security Checks	12/21/2016	1/7/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical