A buffer overflow flaw was found in the way the Linux kernel's XFS file system implementation handled links with overly long path names.
A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk. (CVE-2011-4077 , Moderate)

Flaws in ghash_update() and ghash_final() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-4081 , Moderate)

A flaw was found in the Linux kernel's Journaling Block Device (JBD).
A local, unprivileged user could use this flaw to crash the system by mounting a specially crafted ext3 or ext4 disk. (CVE-2011-4132 , Moderate)

It was found that the kvm_vm_ioctl_assign_device() function in the KVM (Kernel-based Virtual Machine) subsystem of a Linux kernel did not check if the user requesting device assignment was privileged or not.
A local, unprivileged user on the host could assign unused PCI devices, or even devices that were in use and whose resources were not properly claimed by the respective drivers, which could result in the host crashing. (CVE-2011-4347 , Moderate)

Two flaws were found in the way the Linux kernel's __sys_sendmsg() function, when invoked via the sendmmsg() system call, accessed user-space memory. A local, unprivileged user could use these flaws to cause a denial of service. (CVE-2011-4594 , Moderate)

A previous update introduced an integer overflow flaw in the Linux kernel. On PowerPC systems, a local, unprivileged user could use this flaw to cause a denial of service. (CVE-2011-4611 , Moderate)

A flaw was found in the way the KVM subsystem of a Linux kernel handled PIT (Programmable Interval Timer) IRQs (interrupt requests) when there was no virtual interrupt controller set up. A local, unprivileged user on the host could force this situation to occur, resulting in the host crashing. (CVE-2011-4622 , Moderate)

A flaw was found in the way the Linux kernel's XFS file system implementation handled on-disk Access Control Lists (ACLs). A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk.
(CVE-2012-0038 , Moderate)

A flaw was found in the way the Linux kernel's KVM hypervisor implementation emulated the syscall instruction for 32-bit guests. An unprivileged guest user could trigger this flaw to crash the guest.
(CVE-2012-0045 , Moderate)

A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207 , Moderate)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-4087)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330).

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0010 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A malicious CIFS (Common Internet File System) server could send a     specially-crafted response to a directory read request that would result in     a denial of service or privilege escalation on a system that has a CIFS     share mounted. (CVE-2011-3191, Important)

    * The way fragmented IPv6 UDP datagrams over the bridge with UDP     Fragmentation Offload (UFO) functionality on were handled could allow a     remote attacker to cause a denial of service. (CVE-2011-4326, Important)

    * GRO (Generic Receive Offload) fields could be left in an inconsistent     state. An attacker on the local network could use this flaw to cause a     denial of service. GRO is enabled by default in all network drivers that     support it. (CVE-2011-2723, Moderate)

    * IPv4 and IPv6 protocol sequence number and fragment ID generation could     allow a man-in-the-middle attacker to inject packets and possibly hijack     connections. Protocol sequence numbers and fragment IDs are now more     random. (CVE-2011-3188, Moderate)

    * A flaw in the FUSE (Filesystem in Userspace) implementation could allow     a local user in the fuse group who has access to mount a FUSE file system     to cause a denial of service. (CVE-2011-3353, Moderate)

    * A flaw in the b43 driver. If a system had an active wireless interface     that uses the b43 driver, an attacker able to send a specially-crafted     frame to that interface could cause a denial of service. (CVE-2011-3359,     Moderate)

    * A flaw in the way CIFS shares with DFS referrals at their root were     handled could allow an attacker on the local network, who is able to deploy     a malicious CIFS server, to create a CIFS network share that, when mounted,     would cause the client system to crash. (CVE-2011-3363, Moderate)

    * A flaw in the m_stop() implementation could allow a local, unprivileged     user to trigger a denial of service. (CVE-2011-3637, Moderate)

    * Flaws in ghash_update() and ghash_final() could allow a local,     unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)

    * A flaw in the key management facility could allow a local, unprivileged     user to cause a denial of service via the keyctl utility. (CVE-2011-4110,     Moderate)

    * A flaw in the Journaling Block Device (JBD) could allow a local attacker     to crash the system by mounting a specially-crafted ext3 or ext4 disk.
    (CVE-2011-4132, Moderate)

    * A flaw in the way memory containing security-related data was handled in     tpm_read() could allow a local, unprivileged user to read the results of a     previously run TPM command. (CVE-2011-1162, Low)

    * I/O statistics from the taskstats subsystem could be read without any     restrictions, which could allow a local, unprivileged user to gather     confidential information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

    * Flaws in tpacket_rcv() and packet_recvmsg() could allow a local,     unprivileged user to leak information to user-space. (CVE-2011-2898, Low)

    Red Hat would like to thank Darren Lavender for reporting CVE-2011-3191;
    Brent Meshier for reporting CVE-2011-2723; Dan Kaminsky for reporting     CVE-2011-3188; Yogesh Sharma for reporting CVE-2011-3363; Nick Bowler for     reporting CVE-2011-4081; Peter Huewe for reporting CVE-2011-1162; and     Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

    This update also fixes the following bugs:

    * Previously, a mismatch in the build-id of the kernel-rt and the one in     the related debuginfo package caused failures in SystemTap and perf.
    (BZ#768413)

    * IBM x3650m3 systems were not able to boot the MRG Realtime kernel because     they require a pmcraid driver that was not available. The pmcraid driver is     included in this update. (BZ#753992)

    Users should upgrade to these updated packages, which correct these issues.
    The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494)

Qianfeng Zhang discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-2942)

Yasuaki Ishimatsu discovered a flaw in the kernel's clock implementation. A local unprivileged attacker could exploit this causing a denial of service. (CVE-2011-3209)

Zheng Liu discovered a flaw in how the ext4 filesystem splits extents.
A local unprivileged attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-3638)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-4087)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

Nick Bowler discovered the kernel GHASH message digest algorithm incorrectly handled error conditions. A local attacker could exploit this to cause a kernel oops. (CVE-2011-4081)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0350 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A buffer overflow flaw was found in the way the Linux kernel's XFS file     system implementation handled links with overly long path names. A local,     unprivileged user could use this flaw to cause a denial of service or     escalate their privileges by mounting a specially-crafted disk.
    (CVE-2011-4077, Moderate)

    * Flaws in ghash_update() and ghash_final() could allow a local,     unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)

    * A flaw was found in the Linux kernel's Journaling Block Device (JBD). A     local, unprivileged user could use this flaw to crash the system by     mounting a specially-crafted ext3 or ext4 disk. (CVE-2011-4132, Moderate)

    * It was found that the kvm_vm_ioctl_assign_device() function in the KVM     (Kernel-based Virtual Machine) subsystem of a Linux kernel did not check if     the user requesting device assignment was privileged or not. A local,     unprivileged user on the host could assign unused PCI devices, or even     devices that were in use and whose resources were not properly claimed by     the respective drivers, which could result in the host crashing.
    (CVE-2011-4347, Moderate)

    * Two flaws were found in the way the Linux kernel's __sys_sendmsg()     function, when invoked via the sendmmsg() system call, accessed user-space     memory. A local, unprivileged user could use these flaws to cause a denial     of service. (CVE-2011-4594, Moderate)

    * The RHSA-2011:1530 kernel update introduced an integer overflow flaw in     the Linux kernel. On PowerPC systems, a local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2011-4611, Moderate)

    * A flaw was found in the way the KVM subsystem of a Linux kernel handled     PIT (Programmable Interval Timer) IRQs (interrupt requests) when there was     no virtual interrupt controller set up. A local, unprivileged user on the     host could force this situation to occur, resulting in the host crashing.
    (CVE-2011-4622, Moderate)

    * A flaw was found in the way the Linux kernel's XFS file system     implementation handled on-disk Access Control Lists (ACLs). A local,     unprivileged user could use this flaw to cause a denial of service or     escalate their privileges by mounting a specially-crafted disk.
    (CVE-2012-0038, Moderate)

    * A flaw was found in the way the Linux kernel's KVM hypervisor     implementation emulated the syscall instruction for 32-bit guests. An     unprivileged guest user could trigger this flaw to crash the guest.
    (CVE-2012-0045, Moderate)

    * A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query()     function. An attacker able to send certain IGMP (Internet Group Management     Protocol) packets to a target system could use this flaw to cause a denial     of service. (CVE-2012-0207, Moderate)

    Red Hat would like to thank Nick Bowler for reporting CVE-2011-4081; Sasha     Levin for reporting CVE-2011-4347; Tetsuo Handa for reporting     CVE-2011-4594; Maynard Johnson for reporting CVE-2011-4611; Wang Xi for     reporting CVE-2012-0038; Stephan Brwolf for reporting CVE-2012-0045; and     Simon McVittie for reporting CVE-2012-0207. Upstream acknowledges Mathieu     Desnoyers as the original reporter of CVE-2011-4594.

    This update also fixes several bugs. Documentation for these changes will     be available shortly from the Technical Notes document linked to in the     References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues, and fix the bugs noted in the Technical     Notes. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A buffer overflow flaw was found in the way the Linux     kernel's XFS file system implementation handled links     with overly long path names. A local, unprivileged user     could use this flaw to cause a denial of service or     escalate their privileges by mounting a specially     crafted disk. (CVE-2011-4077, Moderate)

  - Flaws in ghash_update() and ghash_final() could allow a     local, unprivileged user to cause a denial of service.
    (CVE-2011-4081, Moderate)

  - A flaw was found in the Linux kernel's Journaling Block     Device (JBD). A local, unprivileged user could use this     flaw to crash the system by mounting a specially crafted     ext3 or ext4 disk. (CVE-2011-4132, Moderate)

  - It was found that the kvm_vm_ioctl_assign_device()     function in the KVM (Kernel-based Virtual Machine)     subsystem of a Linux kernel did not check if the user     requesting device assignment was privileged or not. A     local, unprivileged user on the host could assign unused     PCI devices, or even devices that were in use and whose     resources were not properly claimed by the respective     drivers, which could result in the host crashing.
    (CVE-2011-4347, Moderate)

  - Two flaws were found in the way the Linux kernel's
    __sys_sendmsg() function, when invoked via the     sendmmsg() system call, accessed user-space memory. A     local, unprivileged user could use these flaws to cause     a denial of service. (CVE-2011-4594, Moderate)

  - A flaw was found in the way the KVM subsystem of a Linux     kernel handled PIT (Programmable Interval Timer) IRQs     (interrupt requests) when there was no virtual interrupt     controller set up. A local, unprivileged user on the     host could force this situation to occur, resulting in     the host crashing. (CVE-2011-4622, Moderate)

  - A flaw was found in the way the Linux kernel's XFS file     system implementation handled on-disk Access Control     Lists (ACLs). A local, unprivileged user could use this     flaw to cause a denial of service or escalate their     privileges by mounting a specially crafted disk.
    (CVE-2012-0038, Moderate)

  - A flaw was found in the way the Linux kernel's KVM     hypervisor implementation emulated the syscall     instruction for 32-bit guests. An unprivileged guest     user could trigger this flaw to crash the guest.
    (CVE-2012-0045, Moderate)

  - A divide-by-zero flaw was found in the Linux kernel's     igmp_heard_query() function. An attacker able to send     certain IGMP (Internet Group Management Protocol)     packets to a target system could use this flaw to cause     a denial of service. (CVE-2012-0207, Moderate)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0350 advisory.

    - [fs] xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink() (Carlos Maiolino) [749161     694702] {CVE-2011-4077}
    - [fs] xfs: Fix memory corruption in xfs_readlink (Carlos Maiolino) [749161 694702] {CVE-2011-4077}
    - [net] igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Jiri Pirko) [772870 772871]     {CVE-2012-0207}
    - [fs] xfs: validate acl count (Eric Sandeen) [773282 773283] {CVE-2012-0038}
    - [virt] kvm: x86: fix missing checks in syscall emulation (Marcelo Tosatti) [773390 773391]     {CVE-2012-0045}
    - [virt] kvm: x86: extend 'struct x86_emulate_ops' with 'get_cpuid' (Marcelo Tosatti) [773390 773391]     {CVE-2012-0045}
    - [kernel] crypto: ghash - Avoid null pointer dereference if no key is set (Jiri Benc) [749481 749482]     {CVE-2011-4081}
    - [fs] jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan) [753344 693981] {CVE-2011-4132}
    - [net] fix unsafe pointer access in sendmmsg (Jiri Benc) [761668 760798] {CVE-2011-4594}
    - [perf] powerpc: Handle events that raise an exception without overflowing (Steve Best) [767917 755737]     {CVE-2011-4611}
    - [virt] x86: Prevent starting PIT timers in the absence of irqchip support (Marcelo Tosatti) [769634     769550] {CVE-2011-4622}
    - [virt] KVM: Device assignment permission checks (Alex Williamson) [756092 756093] {CVE-2011-4347}
    - [virt] KVM: Remove ability to assign a device without iommu support (Alex Williamson) [756092 756093]     {CVE-2011-4347}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
69662	Amazon Linux AMI : kernel (ALAS-2012-55)	Nessus	Amazon Linux Local Security Checks	9/4/2013	7/31/2020	high
57344	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerability (USN-1313-1)	Nessus	Ubuntu Local Security Checks	12/20/2011	9/19/2019	medium
57305	USN-1304-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	12/14/2011	12/1/2016	high
57343	Ubuntu 11.04 : linux vulnerabilities (USN-1312-1)	Nessus	Ubuntu Local Security Checks	12/20/2011	9/19/2019	high
57304	Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1303-1)	Nessus	Ubuntu Local Security Checks	12/14/2011	1/2/2019	high
76635	RHEL 6 : kernel-rt (RHSA-2012:0010)	Nessus	Red Hat Local Security Checks	7/22/2014	3/24/2025	critical
57058	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1294-1)	Nessus	Ubuntu Local Security Checks	12/9/2011	9/19/2019	high
57303	USN-1302-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	12/14/2011	12/1/2016	high
57056	Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1292-1)	Nessus	Ubuntu Local Security Checks	12/9/2011	9/19/2019	high
58261	RHEL 6 : kernel (RHSA-2012:0350)	Nessus	Red Hat Local Security Checks	3/7/2012	11/4/2024	high
61277	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120306)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
68491	Oracle Linux 6 : kernel (ELSA-2012-0350)	Nessus	Oracle Linux Local Security Checks	7/12/2013	2/9/2026	high

Detections

Analytics

Plugins Search

high

medium

high

high

high

critical

high

high

high

high

high

high