USN-3168-1でUbuntu 14.04 LTS用のLinuxカーネルの脆弱性が修正されました。この更新では、Ubuntu 12.04 LTSに対するUbuntu 14.04 LTSからのLinux Hardware Enablement（HWE）カーネルの対応する更新が提供されます。Dmitry Vyukov氏は、LinuxカーネルのKVM実装が、特定のエラーの場合にコードセグメント（CS）を適切に初期化しなかったことを発見しました。ローカルの攻撃者がこれを悪用して、秘密情報（カーネルメモリ）を漏えいさせる可能性があります。（CVE-2016-9756）Andrey Konovalov氏は、SO_SNDBUFFORCEおよびSO_RCVBUFFORCEオプションを処理するときにsetsockopt()システムコールに符号付き整数オーバーフローがあることを発見しました。CAP_NET_ADMIN機能を持つローカルの攻撃者が、これを悪用してサービス拒否（システムクラッシュまたはメモリ破損）を引き起こす可能性があります。（CVE-2016-9793）Baozeng Ding氏は、LinuxカーネルのALSA（Advanced Linux Sound Architecture）サブシステムでメモリ解放後使用（use-after-free）になる可能性のある競合状態を発見しました。ローカルの攻撃者がこれを悪用して、サービス拒否（システムクラッシュ）を引き起こす可能性があります。（CVE-2016-9794）Baozeng Ding氏は、Linuxカーネルのnetlink_dump()関数で二重開放があることを発見しました。ローカルの攻撃者がこれを悪用して、サービス拒否（システムクラッシュ）を引き起こす可能性があります。（CVE-2016-9806）注意：Tenable Network Securityは、前述の説明ブロックをUbuntuセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートの Ubuntu 14.04 LTS ホストには、USN-3169-2のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  -4.8.12より前のLinuxカーネル内のarch/x86/kvm/emulate.cは、特定のエラーケースでコードセグメント（CS）を適切に初期化していないため、ローカルユーザーが、細工されたアプリケーションを介してカーネルスタックメモリから機密情報を取得する可能性があります。（CVE-2016-9756）

  -4.8.14より前のLinux カーネルのsock_setsockopt function in net/core/sock.cがsk_sndbufとsk_rcvbufの負の値を不適切に処理するため、ローカルユーザーが（1）SO_SNDBUFFORCEまたは（2）SO_RCVBUFFORCEオプションを使用して、細工されたsetsockoptシステムコールのCAP_NET_ADMIN機能を悪用することによって、サービス拒否（メモリ破損やシステムクラッシュ）または他の詳細不明な影響を引き起こす可能性があります。
    (CVE-2016-9793)

  -4.7より前のLinuxカーネルのALSAサブシステムのsound/core/pcm_lib.cにあるsnd_pcm_period_elapsed関数での競合状態により、ローカルのユーザーが、細工されたSNDRV_PCM_TRIGGER_STARTコマンドを通じて、サービス拒否（メモリ解放後使用（Use After Free））を引き起こしたり、詳細不明なその他の影響を与えたりする可能性があります。（CVE-2016-9794）

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux カーネルに、権限昇格、サービス拒否、または情報漏洩を引き起こす可能性がある、いくつかの脆弱性が発見されました。CVE-2012-6704、CVE-2016-9793 : Eric Dumazet 氏が、CAP_NET_ADMIN 機能のあるローカルユーザーがソケットのバッファサイズを負に設定し、サービス拒否やその他のセキュリティへの影響を引き起こす可能性があることを発見しました。さらに、3.5 より前のカーネルバージョンでは、sysctl net.core.rmem_max が非常に大きな値に変更された場合、すべてのユーザーがこれを実行できました。CVE-2015-1350 / #770492 : Ben Harris 氏が、ローカルユーザーが表示される任意のファイルから set-capability 属性を削除することができ、そのためにサービス拒否が引き起こされる可能性があると報告しました。CVE-2015-8962 : Calvin Owens 氏が、SCSI ジェネリック (sg) ドライバーを介してアクセスされている SCSI デバイスを削除すると二重解放になり、サービス拒否 (クラッシュまたはメモリ破損) または権限昇格を引き起こす可能性があることを発見しました。これは、SCSI デバイスノードにアクセスする権限を持つローカルユーザーによって悪用される可能性があります。CVE-2015-8963 : Sasha Levin 氏が CPU のホットアンプラグの結果としてパフォーマンスイベント(perf) サブシステムによる use-after-free が発生し、サービス拒否 (クラッシュまたはメモリ破損) または権限昇格を引き起こす可能性があることを発見しました。これは、ローカルユーザーによって悪用される可能性があります。CVE-2015-8964 : ターミナルの行の規則が変更されたときにターミナル/シリアル (tty) サブシステムがターミナルバッファ状態を確実にリセットしないことが発見されました。これにより、ターミナルデバイスへのアクセス権を持つローカルユーザーが、これを使用してカーネルメモリから秘密情報を読み取る可能性があります。CVE-2016-7097 : Jan Kara 氏が、ファイルの POSIX ACL を変更してもファイルの set-group-ID フラグがクリアされないことを発見しました。これは変更するユーザーが group-owner のメンバーではない場合に実行する必要があります。場合によっては、これにより実行可能ファイルの user-owner が group-owner の権限を取得する可能性があります。CVE-2016-7910 : Vegard Nossum 氏が、/proc/diskstats or /proc/partitions の読み取りの処理中にメモリ割り当てエラーが発生し、use-after-free につながる可能性があることを発見しました。これによりサービス拒否 (クラッシュまたはメモリ破損) または権限昇格を引き起こす可能性があります。CVE-2016-7911 : Dmitry Vyukov 氏が、 ioprio_get() と ioprio_set() システム呼び出しの間の競合のために use-after-free が発生し, サービス拒否 (クラッシュ) または機密情報の漏洩を引き起こす可能性があることを報告しました。CVE-2016-7915 : Benjamin Tissoires 氏が、HID デバイスが HID コアで領域外メモリアクセスをトリガする可能性があることを発見しました。物理的に存在するユーザーがこれを悪用して、サービス拒否 (クラッシュ) または秘密情報の漏洩を発生させる可能性があります。CVE-2016-8399 : Qidan が、IPv4 ping ソケットの実装が送信されるパケットの長さを検証しなかったと報告しました。ping ソケットを使用する許可を持つユーザーが、領域外読み取りを発生させ、結果としてサービス拒否または情報漏洩が発生する可能性があります。ただし、Debian システムでは、デフォルトで ping ソケットを作成する権限を持つユーザーはいません。CVE-2016-8633 : Eyal Itkin 氏が、IP-over-Firewire ドライバー (firewire-net) がリンクレイヤーフラグメンテーションヘッダーのオフセットまたは長さを検証しないことを報告しました。これにより、Firewire で接続されたリモートシステムが、パケットバッファの後にメモリに書き込み、サービス拒否 (クラッシュ) またはリモートコードの実行につながる可能性があります。CVE-2016-8645 : Marco Grassi 氏が、TCP ソケットに接続されたソケットフィルタ (BPF プログラム) が TCP ヘッダーを切り捨てたり削除したりすると、サービス拒否 (クラッシュ) を引き起こす可能性があると報告しました。これは、ローカルユーザーによって悪用されました。CVE-2016-8655 : Philip Pettersson 氏が、パケットソケット (AF_PACKET ファミリー) の実装で、 送信リングバッファを有効にすることと、使用されるバッファのバージョンを変更することとの間に競合状態があったため、use-after-free が発生する可能性があることを発見しました。CAP_NET_ADMIN 機能を使用できるローカルユーザーは、これを利用して、権限昇格を引き起こす可能性があります。CVE-2016-9178 : Al Viro 氏が、ユーザーメモリからのデータの読み取りに失敗すると、x86 アーキテクチャ (amd64 または i386) で情報漏洩が発生する可能性があることを発見しました。CVE-2016-9555 : Andrey Konovalov 氏が、SCTP の実装で 'out of the blue' パケットチャンクの長さを十分早く検証していないと報告しました。リモートシステムは、これを使用して、SCTP を使用するシステムにサービス拒否 (クラッシュ) またはその他のセキュリティ上の影響を与える可能性があります。CVE-2016-9576、CVE-2016-10088 : Dmitry Vyukov 氏が、SCSI ジェネリックドライバで splice() を使用すると、カーネルメモリが破損することを報告しました。これは、SCSI デバイスノードにアクセスする権限を持つローカルユーザーがこれを悪用して権限を昇格させる可能性があります。CVE-2016-9756 : Dmitry Vyukov 氏が、x86アーキテクチャ (amd64 または i386) の KVM が、古いプロセッサでのソフトウェアエミュレーションを必要とする特定の命令の失敗を正しく処理しなかったと報告しました。これは、ゲストシステムによって悪用され、機密情報の漏洩やサービス拒否 (ログスパム) が引き起こされる可能性があります。CVE-2016-9794 : Baozeng Ding 氏が、ALSA (サウンド) サブシステムの競合状態を報告しました。このために use-after-free が発生する可能性があります。PCM サウンドデバイスにアクセスできるローカルユーザーが、これを悪用して、サービス拒否 (クラッシュまたはメモリ破損) またはその他のセキュリティへの影響を引き起こす可能性があります。Debian 7 'Wheezy' では、これらの問題はバージョン 3.2.84-1 で修正されています。このバージョンには、アップストリームバージョン 3.2.84 からのバグ修正も含まれており、 PREEMPT_RT 機能セットをバージョン 3.2.84-rt122 にアップグレードします。最後に、このバージョンでは、権限のないユーザーによる使用を無効にすることにより、パフォーマンスイベント (perf) サブシステムのセキュリティ問題を軽減するオプションが追加されました。これは、sysctl kernel.perf_event_paranoid=3 を設定することで実行できます。Debian 8 'Jessie' では、これらの問題はバージョン 3.16.39-1 で修正されています。これは次のポイントリリース (8.6) に含まれます。お使いの linux パッケージをアップグレードすることを推奨します。注 : Tenable Network Security は、前述の記述ブロックを DLA セキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

The 4.8.12 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in     certain error cases, which allows local users to obtain sensitive information from kernel stack memory via     a crafted application. (CVE-2016-9756)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Revert 'x86/mm: Expand the exception table logic to     allow new handling options' (Brian Maly) [Orabug:
    25790387] (CVE-2016-9644)

  - Revert 'fix minor infoleak in get_user_ex' (Brian Maly)     [Orabug: 25790387] (CVE-2016-9644)

  - x86/mm: Expand the exception table logic to allow new     handling options (Tony Luck) [Orabug: 25790387]     (CVE-2016-9644)

  - rebuild bumping release

  - net: ping: check minimum size on ICMP header length     (Kees Cook) [Orabug: 25766898] (CVE-2016-8399)     (CVE-2016-8399)

  - sg_write/bsg_write is not fit to be called under     KERNEL_DS (Al Viro) [Orabug: 25765436] (CVE-2016-10088)

  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter     chang) [Orabug: 25751984] (CVE-2017-7187)

  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander     Popov) [Orabug: 25696677] (CVE-2017-2636)

  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)     [Orabug: 25696677] (CVE-2017-2636)

  - If Slot Status indicates changes in both Data Link Layer     Status and Presence Detect, prioritize the Link status     change. (Jack Vogel) 

  - PCI: pciehp: Leave power indicator on when enabling     already-enabled slot (Ashok Raj) [Orabug: 25353783]

  - firewire: net: guard against rx buffer overflows (Stefan     Richter) [Orabug: 25451520] (CVE-2016-8633)

  - usbnet: cleanup after bind in probe (Oliver Neukum)     [Orabug: 25463898] (CVE-2016-3951)

  - cdc_ncm: do not call usbnet_link_change from     cdc_ncm_bind (Bj&oslash rn Mork) [Orabug: 25463898]     (CVE-2016-3951)

  - cdc_ncm: Add support for moving NDP to end of NCM frame     (Enrico Mioso) [Orabug: 25463898] (CVE-2016-3951)

  - x86/mm/32: Enable full randomization on i386 and X86_32     (Hector Marco-Gisbert) [Orabug: 25463918]     (CVE-2016-3672)

  - kvm: fix page struct leak in handle_vmon (Paolo Bonzini)     [Orabug: 25507133] (CVE-2017-2596)

  - crypto: mcryptd - Check mcryptd algorithm compatibility     (tim) [Orabug: 25507153] (CVE-2016-10147)

  - kvm: nVMX: Allow L1 to intercept software exceptions     (#BP and #OF) (Jim Mattson) [Orabug: 25507188]     (CVE-2016-9588)

  - KVM: x86: drop error recovery in em_jmp_far and     em_ret_far (Radim Kr&#x10D m&aacute &#x159 ) [Orabug:
    25507213] (CVE-2016-9756)

  - tcp: take care of truncations done by sk_filter (Eric     Dumazet) [Orabug: 25507226] (CVE-2016-8645)

  - rose: limit sk_filter trim to payload (Willem de Bruijn)     [Orabug: 25507226] (CVE-2016-8645)

  - tipc: check minimum bearer MTU (Michal Kube&#x10D ek)     [Orabug: 25507239] (CVE-2016-8632) (CVE-2016-8632)

  - fix minor infoleak in get_user_ex (Al Viro) [Orabug:
    25507269] (CVE-2016-9178)

  - scsi: arcmsr: Simplify user_len checking (Borislav     Petkov) [Orabug: 25507319] (CVE-2016-7425)

  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer     (Dan Carpenter) [Orabug: 25507319] (CVE-2016-7425)

  - tmpfs: clear S_ISGID when setting posix ACLs (Gu Zheng)     [Orabug: 25507341] (CVE-2016-7097) (CVE-2016-7097)

  - posix_acl: Clear SGID bit when setting file permissions     (Jan Kara) [Orabug: 25507341] (CVE-2016-7097)     (CVE-2016-7097)

  - ext2: convert to mbcache2 (Jan Kara) [Orabug: 25512366]     (CVE-2015-8952)

  - ext4: convert to mbcache2 (Jan Kara) [Orabug: 25512366]     (CVE-2015-8952)

  - mbcache2: reimplement mbcache (Jan Kara) [Orabug:
    25512366] (CVE-2015-8952)

  - USB: digi_acceleport: do sanity checking for the number     of ports (Oliver Neukum) [Orabug: 25512466]     (CVE-2016-3140)

  - net/llc: avoid BUG_ON in skb_orphan (Eric Dumazet)     [Orabug: 25682419] (CVE-2017-6345)

  - net/mlx4_core: Disallow creation of RAW QPs on a VF (Eli     Cohen) 

  - ipv4: keep skb->dst around in presence of IP options     (Eric Dumazet) [Orabug: 25698300] (CVE-2017-5970)

  - perf/core: Fix concurrent sys_perf_event_open vs.
    'move_group' race (Peter Zijlstra) [Orabug: 25698751]     (CVE-2017-6001)

  - ip6_gre: fix ip6gre_err invalid reads (Eric Dumazet)     [Orabug: 25699015] (CVE-2017-5897)

  - mpt3sas: Don't spam logs if logging level is 0 (Johannes     Thumshirn) 

  - xen-netfront: cast grant table reference first to type     int (Dongli Zhang)

  - xen-netfront: do not cast grant table reference to     signed short (Dongli Zhang)

USN-3168-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly initialize the Code Segment (CS) in certain error cases. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2016-9756)

Andrey Konovalov discovered that signed integer overflows existed in the setsockopt() system call when handling the SO_SNDBUFFORCE and SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability could use this to cause a denial of service (system crash or memory corruption). (CVE-2016-9793)

Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-9794)

Baozeng Ding discovered a double free in the netlink_dump() function in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-9806).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3169-2 advisory.

    USN-3169-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly initialize the     Code Segment (CS) in certain error cases. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2016-9756)

    Andrey Konovalov discovered that signed integer overflows existed in the setsockopt() system call when     handling the SO_SNDBUFFORCE and SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability     could use this to cause a denial of service (system crash or memory corruption). (CVE-2016-9793)

    Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound     Architecture (ALSA) subsystem of the Linux kernel. A local attacker could use this to cause a denial of     service (system crash). (CVE-2016-9794)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to 3.12.61 to receive various security and bugfixes. The following feature was implemented :

  - The ext2 filesystem got reenabled and supported to allow     support for 'XIP' (Execute In Place) (FATE#320805). The     following security bugs were fixed :

  - CVE-2017-5551: The tmpfs filesystem implementation in     the Linux kernel preserved the setgid bit during a     setxattr call, which allowed local users to gain group     privileges by leveraging the existence of a setgid     program with restrictions on execute permissions     (bsc#1021258).

  - CVE-2016-7097: The filesystem implementation in the     Linux kernel preserved the setgid bit during a setxattr     call, which allowed local users to gain group privileges     by leveraging the existence of a setgid program with     restrictions on execute permissions (bnc#995968).

  - CVE-2017-2583: A Linux kernel built with the     Kernel-based Virtual Machine (CONFIG_KVM) support was     vulnerable to an incorrect segment selector(SS) value     error. A user/process inside guest could have used this     flaw to crash the guest resulting in DoS or potentially     escalate their privileges inside guest. (bsc#1020602).

  - CVE-2017-2584: arch/x86/kvm/emulate.c in the Linux     kernel allowed local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt (bnc#1019851).

  - CVE-2016-10088: The sg implementation in the Linux     kernel did not properly restrict write operations in     situations where the KERNEL_DS option is set, which     allowed local users to read or write to arbitrary kernel     memory locations or cause a denial of service     (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c.
    NOTE: this vulnerability exists because of an incomplete     fix for CVE-2016-9576 (bnc#1017710).

  - CVE-2016-8645: The TCP stack in the Linux kernel     mishandled skb truncation, which allowed local users to     cause a denial of service (system crash) via a crafted     application that made sendto system calls, related to     net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c     (bnc#1009969).

  - CVE-2016-8399: An elevation of privilege vulnerability     in the kernel networking subsystem could enable a local     malicious application to execute arbitrary code within     the context of the kernel. This issue is rated as     Moderate because it first requires compromising a     privileged process and current compiler optimizations     restrict access to the vulnerable code. Product:
    Android. Versions: Kernel-3.10, Kernel-3.18. Android ID:
    A-31349935 (bnc#1014746).

  - CVE-2016-9806: Race condition in the netlink_dump     function in net/netlink/af_netlink.c in the Linux kernel     allowed local users to cause a denial of service (double     free) or possibly have unspecified other impact via a     crafted application that made sendmsg system calls,     leading to a free operation associated with a new dump     that started earlier than anticipated (bnc#1013540).

  - CVE-2016-9756: arch/x86/kvm/emulate.c in the Linux     kernel did not properly initialize Code Segment (CS) in     certain error cases, which allowed local users to obtain     sensitive information from kernel stack memory via a     crafted application (bnc#1013038).

  - CVE-2016-9793: The sock_setsockopt function in     net/core/sock.c in the Linux kernel mishandled negative     values of sk_sndbuf and sk_rcvbuf, which allowed local     users to cause a denial of service (memory corruption     and system crash) or possibly have unspecified other     impact by leveraging the CAP_NET_ADMIN capability for a     crafted setsockopt system call with the (1)     SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option     (bnc#1013531).

  - CVE-2016-7910: Use-after-free vulnerability in the     disk_seqf_stop function in block/genhd.c in the Linux     kernel allowed local users to gain privileges by     leveraging the execution of a certain stop operation     even if the corresponding start operation had failed     (bnc#1010716).

  - CVE-2015-8962: Double free vulnerability in the     sg_common_write function in drivers/scsi/sg.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (memory corruption and system     crash) by detaching a device during an SG_IO ioctl call     (bnc#1010501).

  - CVE-2016-7913: The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (use-after-free) via vectors involving     omission of the firmware name from a certain data     structure (bnc#1010478).

  - CVE-2016-7911: Race condition in the get_task_ioprio     function in block/ioprio.c in the Linux kernel allowed     local users to gain privileges or cause a denial of     service (use-after-free) via a crafted ioprio_get system     call (bnc#1010711).

  - CVE-2015-8964: The tty_set_termios_ldisc function in     drivers/tty/tty_ldisc.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory by reading a tty data structure (bnc#1010507).

  - CVE-2015-8963: Race condition in kernel/events/core.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (use-after-free) by     leveraging incorrect handling of an swevent data     structure during a CPU unplug operation (bnc#1010502).

  - CVE-2016-7914: The assoc_array_insert_into_terminal_node     function in lib/assoc_array.c in the Linux kernel did     not check whether a slot is a leaf, which allowed local     users to obtain sensitive information from kernel memory     or cause a denial of service (invalid pointer     dereference and out-of-bounds read) via an application     that uses associative-array data structures, as     demonstrated by the keyutils test suite (bnc#1010475).

  - CVE-2016-8633: drivers/firewire/net.c in the Linux     kernel allowed remote attackers to execute arbitrary     code via crafted fragmented packets (bnc#1008833).

  - CVE-2016-9083: drivers/vfio/pci/vfio_pci.c in the Linux     kernel allowed local users to bypass integer overflow     checks, and cause a denial of service (memory     corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a     VFIO_DEVICE_SET_IRQS ioctl call, aka a 'state machine     confusion bug (bnc#1007197).

  - CVE-2016-9084: drivers/vfio/pci/vfio_pci_intrs.c in the     Linux kernel misused the kzalloc function, which allowed     local users to cause a denial of service (integer     overflow) or have unspecified other impact by leveraging     access to a vfio PCI device file (bnc#1007197).

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel uses an     incorrect buffer size for certain timeout data, which     allowed local users to cause a denial of service (stack     memory corruption and panic) by reading the /proc/keys     file (bnc#1004517).

  - CVE-2015-8956: The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel allowed     local users to obtain sensitive information or cause a     denial of service (NULL pointer dereference) via vectors     involving a bind system call on a Bluetooth RFCOMM     socket (bnc#1003925).

  - CVE-2016-8658: Stack-based buffer overflow in the     brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a long SSID Information     Element in a command to a Netlink socket (bnc#1004462).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-6327: drivers/infiniband/ulp/srpt/ib_srpt.c in     the Linux kernel allowed local users to cause a denial     of service (NULL pointer dereference and system crash)     by using an ABORT_TASK command to abort a device write     operation (bnc#994748).

  - CVE-2016-6828: The tcp_check_send_head function in     include/net/tcp.h in the Linux kernel did not properly     maintain certain SACK state after a failed data copy,     which allowed local users to cause a denial of service     (tcp_xmit_retransmit_queue use-after-free and system     crash) via a crafted SACK option (bnc#994296).

  - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel     did not properly determine the rate of challenge ACK     segments, which made it easier for remote attackers to     hijack TCP sessions via a blind in-window attack     (bnc#989152).

  - CVE-2016-6130: Race condition in the sclp_ctl_ioctl_sccb     function in drivers/s390/char/sclp_ctl.c in the Linux     kernel allowed local users to obtain sensitive     information from kernel memory by changing a certain     length value, aka a 'double fetch' vulnerability     (bnc#987542).

  - CVE-2016-6480: Race condition in the ioctl_send_fib     function in drivers/scsi/aacraid/commctrl.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds access or system crash) by changing a     certain size value, aka a 'double fetch' vulnerability     (bnc#991608).

  - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging     in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary     (bnc#986362 bnc#986365).

  - CVE-2016-5828: The start_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms mishandled transactional state, which     allowed local users to cause a denial of service     (invalid process state or TM Bad Thing exception, and     system crash) or possibly have unspecified other impact     by starting and suspending a transaction before an exec     system call (bnc#986569).

  - CVE-2014-9904: The snd_compress_check_input function in     sound/core/compress_offload.c in the ALSA subsystem in     the Linux kernel did not properly check for an integer     overflow, which allowed local users to cause a denial of     service (insufficient memory allocation) or possibly     have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl call (bnc#986811).

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allow     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2012-6704, CVE-2016-9793

Eric Dumazet found that a local user with CAP_NET_ADMIN capability could set a socket's buffer size to be negative, leading to a denial of service or other security impact. Additionally, in kernel versions prior to 3.5, any user could do this if sysctl net.core.rmem_max was changed to a very large value.

CVE-2015-1350 / #770492

Ben Harris reported that local users could remove set-capability attributes from any file visible to them, allowing a denial of service.

CVE-2015-8962

Calvin Owens fouund that removing a SCSI device while it was being accessed through the SCSI generic (sg) driver led to a double- free, possibly causing a denial of service (crash or memory corruption) or privilege escalation. This could be exploited by local users with permision to access a SCSI device node.

CVE-2015-8963

Sasha Levin reported that hot-unplugging a CPU resulted in a use-after-free by the performance events (perf) subsystem, possibly causing a denial of service (crash or memory corruption) or privilege escalation. This could by exploited by any local user.

CVE-2015-8964

It was found that the terminal/serial (tty) subsystem did not reliably reset the terminal buffer state when the terminal line discipline was changed. This could allow a local user with access to a terminal device to read sensitive information from kernel memory.

CVE-2016-7097

Jan Kara found that changing the POSIX ACL of a file never cleared its set-group-ID flag, which should be done if the user changing it is not a member of the group-owner. In some cases, this would allow the user-owner of an executable to gain the privileges of the group-owner.

CVE-2016-7910

Vegard Nossum discovered that a memory allocation failure while handling a read of /proc/diskstats or /proc/partitions could lead to a use-after-free, possibly causing a denial of service (crash or memory corruption) or privilege escalation.

CVE-2016-7911

Dmitry Vyukov reported that a race between ioprio_get() and ioprio_set() system calls could result in a use-after-free, possibly causing a denial of service (crash) or leaking sensitive information.

CVE-2016-7915

Benjamin Tissoires found that HID devices could trigger an out-of- bounds memory access in the HID core. A physically present user could possibly use this for denial of service (crash) or to leak sensitive information.

CVE-2016-8399

Qidan He reported that the IPv4 ping socket implementation did not validate the length of packets to be sent. A user with permisson to use ping sockets could cause an out-of-bounds read, possibly resulting in a denial of service or information leak. However, on Debian systems no users have permission to create ping sockets by default.

CVE-2016-8633

Eyal Itkin reported that the IP-over-Firewire driver (firewire-net) did not validate the offset or length in link-layer fragmentation headers. This allowed a remote system connected by Firewire to write to memory after a packet buffer, leading to a denial of service (crash) or remote code execution.

CVE-2016-8645

Marco Grassi reported that if a socket filter (BPF program) attached to a TCP socket truncates or removes the TCP header, this could cause a denial of service (crash). This was exploitable by any local user.

CVE-2016-8655

Philip Pettersson found that the implementation of packet sockets (AF_PACKET family) had a race condition between enabling a transmit ring buffer and changing the version of buffers used, which could result in a use-after-free. A local user with the CAP_NET_ADMIN capability could exploit this for privilege escalation.

CVE-2016-9178

Al Viro found that a failure to read data from user memory might lead to a information leak on the x86 architecture (amd64 or i386).

CVE-2016-9555

Andrey Konovalov reported that the SCTP implementation does not validate 'out of the blue' packet chunk lengths early enough. A remote system able could use this to cause a denial of service (crash) or other security impact for systems using SCTP.

CVE-2016-9576, CVE-2016-10088

Dmitry Vyukov reported that using splice() with the SCSI generic driver led to kernel memory corruption. Local users with permision to access a SCSI device node could exploit this for privilege escalation.

CVE-2016-9756

Dmitry Vyukov reported that KVM for the x86 architecture (amd64 or i386) did not correctly handle the failure of certain instructions that require software emulation on older processors. This could be exploited by guest systems to leak sensitive information or for denial of service (log spam).

CVE-2016-9794

Baozeng Ding reported a race condition in the ALSA (sound) subsystem that could result in a use-after-free. Local users with access to a PCM sound device could exploit this for denial of service (crash or memory corruption) or other security impact.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2.84-1. This version also includes bug fixes from upstream version 3.2.84 and updates the PREEMPT_RT featureset to version 3.2.84-rt122.
Finally, this version adds the option to mitigate security issues in the performance events (perf) subsystem by disabling use by unprivileged users. This can be done by setting sysctl kernel.perf_event_paranoid=3.

For Debian 8 'Jessie', these problems have been fixed in version 3.16.39-1 which will be included in the next point release (8.6).

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
96438	Ubuntu 12.04 LTS：linux-lts-trustyの脆弱性（USN-3168-2）	Nessus	Ubuntu Local Security Checks	1/12/2017	1/12/2023	high
96440	Ubuntu 14.04 LTS : Linux カーネル (Xenial HWE) の脆弱性 (USN-3169-2)	Nessus	Ubuntu Local Security Checks	1/12/2017	8/27/2024	high
96188	Debian DLA-772-1 : linux セキュリティ更新	Nessus	Debian Local Security Checks	1/3/2017	1/11/2021	critical
95680	Fedora 23 : kernel (2016-9c17cb9648)	Nessus	Fedora Local Security Checks	12/12/2016	1/11/2021	high
220305	Linux Distros Unpatched Vulnerability : CVE-2016-9756	Nessus	Misc.	3/4/2025	9/5/2025	medium
99162	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0056)	Nessus	OracleVM Local Security Checks	4/3/2017	1/4/2021	critical
96438	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3168-2)	Nessus	Ubuntu Local Security Checks	1/12/2017	1/12/2023	high
96440	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3169-2)	Nessus	Ubuntu Local Security Checks	1/12/2017	8/27/2024	high
97205	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0471-1)	Nessus	SuSE Local Security Checks	2/16/2017	1/6/2021	high
96188	Debian DLA-772-1 : linux security update	Nessus	Debian Local Security Checks	1/3/2017	1/11/2021	critical

Detections

Analytics

Plugins Search

high

high

critical

high

medium

critical

high

high

high

critical