The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed :

  - The __request_module function in kernel/kmod.c in the     Linux kernel before 3.4 did not set a certain killable     attribute, which allowed local users to cause a denial     of service (memory consumption) via a crafted     application. (bnc#779488). (CVE-2012-4398)

  - drivers/hid/hid-zpff.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_ZEROPLUS is enabled, allowed physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device.
    (bnc#835839). (CVE-2013-2889)

  - The Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_LOGITECH_FF,     CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled,     allowed physically proximate attackers to cause a denial     of service (heap-based out-of-bounds write) via a     crafted device, related to (1) drivers/hid/hid-lgff.c,     (2) drivers/hid/hid-lg3ff.c, and (3)     drivers/hid/hid-lg4ff.c. (bnc#835839). (CVE-2013-2893)

  - Multiple array index errors in     drivers/hid/hid-multitouch.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_MULTITOUCH is enabled, allowed     physically proximate attackers to cause a denial of     service (heap memory corruption, or NULL pointer     dereference and OOPS) via a crafted device.
    (bnc#835839). (CVE-2013-2897)

  - drivers/hid/hid-picolcd_core.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_PICOLCD is enabled, allowed physically     proximate attackers to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted device.
    (bnc#835839). (CVE-2013-2899)

  - The Linux kernel before 3.12.4 updates certain length     values before ensuring that associated data structures     have been initialized, which allowed local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call, related to net/ipv4/ping.c, net/ipv4/raw.c,     net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.
    (bnc#853040, bnc#857643). (CVE-2013-7263)

  - Multiple stack-based buffer overflows in the     magicmouse_raw_event function in     drivers/hid/hid-magicmouse.c in the Magic Mouse HID     driver in the Linux kernel through 3.16.3 allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that provides a large amount     of (1) EHCI or (2) XHCI data associated with an event.
    (bnc#896382). (CVE-2014-3181)

  - The report_fixup functions in the HID subsystem in the     Linux kernel before 3.16.2 allowed physically proximate     attackers to cause a denial of service (out-of-bounds     write) via a crafted device that provides a small report     descriptor, related to (1) drivers/hid/hid-cherry.c, (2)     drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4)     drivers/hid/hid-monterey.c, (5)     drivers/hid/hid-petalynx.c, and (6)     drivers/hid/hid-sunplus.c. (bnc#896390). (CVE-2014-3184)

  - Multiple buffer overflows in the     command_port_read_callback function in     drivers/usb/serial/whiteheat.c in the Whiteheat USB     Serial Driver in the Linux kernel before 3.16.2 allowed     physically proximate attackers to execute arbitrary code     or cause a denial of service (memory corruption and     system crash) via a crafted device that provides a large     amount of (1) EHCI or (2) XHCI data associated with a     bulk response. (bnc#896391). (CVE-2014-3185)

  - Buffer overflow in the picolcd_raw_event function in     devices/hid/hid-picolcd_core.c in the PicoLCD HID device     driver in the Linux kernel through 3.16.3, as used in     Android on Nexus 7 devices, allowed physically proximate     attackers to cause a denial of service (system crash) or     possibly execute arbitrary code via a crafted device     that sends a large report. (bnc#896392). (CVE-2014-3186)

  - The kvm_iommu_map_pages function in virt/kvm/iommu.c in     the Linux kernel through 3.16.1 miscalculated the number     of pages during the handling of a mapping failure, which     allowed guest OS users to (1) cause a denial of service     (host OS memory corruption) or possibly have unspecified     other impact by triggering a large gfn value or (2)     cause a denial of service (host OS memory consumption)     by triggering a small gfn value that leads to     permanently pinned pages. (bnc#892782). (CVE-2014-3601)

  - The WRMSR processing functionality in the KVM subsystem     in the Linux kernel through 3.17.2 did not properly     handle the writing of a non-canonical address to a     model-specific register, which allowed guest OS users to     cause a denial of service (host OS crash) by leveraging     guest OS privileges, related to the wrmsr_interception     function in arch/x86/kvm/svm.c and the handle_wrmsr     function in arch/x86/kvm/vmx.c. (bnc#899192).
    (CVE-2014-3610)

  - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux     kernel through 3.17.2 did not have an exit handler for     the INVVPID instruction, which allowed guest OS users to     cause a denial of service (guest OS crash) via a crafted     application. (bnc#899192). (CVE-2014-3646)

  - arch/x86/kvm/emulate.c in the KVM subsystem in the Linux     kernel through 3.17.2 did not properly perform RIP     changes, which allowed guest OS users to cause a denial     of service (guest OS crash) via a crafted application.
    (bnc#899192). (CVE-2014-3647)

  - The SCTP implementation in the Linux kernel through     3.17.2 allowed remote attackers to cause a denial of     service (system crash) via a malformed ASCONF chunk,     related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c. (bnc#902346, bnc#902349).
    (CVE-2014-3673)

  - arch/x86/kernel/entry_32.S in the Linux kernel through     3.15.1 on 32-bit x86 platforms, when syscall auditing is     enabled and the sep CPU feature flag is set, allowed     local users to cause a denial of service (OOPS and     system crash) via an invalid syscall number, as     demonstrated by number 1000. (bnc#883724).
    (CVE-2014-4508)

  - * DISPUTED * Multiple integer overflows in the     lzo1x_decompress_safe function in     lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor     in the Linux kernel before 3.15.2 allowed     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Literal Run. NOTE: the     author of the LZO algorithms says: The Linux kernel is     not affected; media hype. (bnc#883948). (CVE-2014-4608)

  - kernel/trace/trace_syscalls.c in the Linux kernel     through 3.17.2 did not properly handle private syscall     numbers during use of the ftrace subsystem, which     allowed local users to gain privileges or cause a denial     of service (invalid pointer dereference) via a crafted     application. (bnc#904013). (CVE-2014-7826)

  - An SCTP server doing ASCONF would panic on malformed     INIT ping-of-death. (bnc#905100). (CVE-2014-7841)

  - The ieee80211_fragment function in net/mac80211/tx.c in     the Linux kernel before 3.13.5 did not properly maintain     a certain tail pointer, which allowed remote attackers     to obtain sensitive cleartext information by reading     packets. (bnc#904700). (CVE-2014-8709)

  - A local user with write access could have used this flaw     to crash the kernel or elevate privileges (bnc#905522).
    The following non-security bugs have been fixed:.
    (CVE-2014-8884)

  - Build the KOTD against the SP3 Update project

  - HID: fix kabi breakage.

  - NFS: Provide stub nfs_fscache_wait_on_invalidate() for     when CONFIG_NFS_FSCACHE=n.

  - NFS: fix inverted test for delegation in     nfs4_reclaim_open_state. (bnc#903331)

  - NFS: remove incorrect Lock reclaim failed! warning.
    (bnc#903331)

  - NFSv4: nfs4_open_done first must check that GETATTR     decoded a file type. (bnc#899574)

  - PCI: pciehp: Clear Data Link Layer State Changed during     init. (bnc#898295)

  - PCI: pciehp: Enable link state change notifications.
    (bnc#898295)

  - PCI: pciehp: Handle push button event asynchronously.
    (bnc#898295)

  - PCI: pciehp: Make check_link_active() non-static.
    (bnc#898295)

  - PCI: pciehp: Use link change notifications for hot-plug     and removal. (bnc#898295)

  - PCI: pciehp: Use per-slot workqueues to avoid deadlock.
    (bnc#898295)

  - PCI: pciehp: Use symbolic constants, not hard-coded     bitmask. (bnc#898295)

  - PM / hibernate: Iterate over set bits instead of PFNs in     swsusp_free(). (bnc#860441)

  - be2net: Fix invocation of be_close() after be_clear().
    (bnc#895468)

  - block: Fix bogus partition statistics reports.
    (bnc#885077 / bnc#891211)

  - block: Fix computation of merged request priority.

  - btrfs: Fix wrong device size when we are resizing the     device.

  - btrfs: Return right extent when fiemap gives unaligned     offset and len.

  - btrfs: abtract out range locking in clone ioctl().

  - btrfs: always choose work from prio_head first.

  - btrfs: balance delayed inode updates.

  - btrfs: cache extent states in defrag code path.

  - btrfs: check file extent type before anything else.
    (bnc#897694)

  - btrfs: clone, do not create invalid hole extent map.

  - btrfs: correctly determine if blocks are shared in     btrfs_compare_trees.

  - btrfs: do not bug_on if we try to cow a free space cache     inode.

  - btrfs: ensure btrfs_prev_leaf does not miss 1 item.

  - btrfs: ensure readers see new data after a clone     operation.

  - btrfs: fill_holes: Fix slot number passed to     hole_mergeable() call.

  - btrfs: filter invalid arg for btrfs resize.

  - btrfs: fix EINVAL checks in btrfs_clone.

  - btrfs: fix EIO on reading file after ioctl clone works     on it.

  - btrfs: fix a crash of clone with inline extents split.

  - btrfs: fix crash of compressed writes. (bnc#898375)

  - btrfs: fix crash when starting transaction.

  - btrfs: fix deadlock with nested trans handles.

  - btrfs: fix hang on error (such as ENOSPC) when writing     extent pages.

  - btrfs: fix leaf corruption after __btrfs_drop_extents.

  - btrfs: fix race between balance recovery and root     deletion.

  - btrfs: fix wrong extent mapping for DirectIO.

  - btrfs: handle a missing extent for the first file     extent.

  - btrfs: limit delalloc pages outside of     find_delalloc_range. (bnc#898375)

  - btrfs: read lock extent buffer while walking backrefs.

  - btrfs: remove unused wait queue in struct extent_buffer.

  - btrfs: replace EINVAL with ERANGE for resize when     ULLONG_MAX.

  - btrfs: replace error code from btrfs_drop_extents.

  - btrfs: unlock extent and pages on error in     cow_file_range.

  - btrfs: unlock inodes in correct order in clone ioctl.

  - btrfs_ioctl_clone: Move clone code into its own     function.

  - cifs: delay super block destruction until all     cifsFileInfo objects are gone. (bnc#903653)

  - drm/i915: Flush the PTEs after updating them before     suspend. (bnc#901638)

  - drm/i915: Undo gtt scratch pte unmapping again.
    (bnc#901638)

  - ext3: return 32/64-bit dir name hash according to usage     type. (bnc#898554)

  - ext4: return 32/64-bit dir name hash according to usage     type. (bnc#898554)

  - fix: use after free of xfs workqueues. (bnc#894895)

  - fs: add new FMODE flags: FMODE_32bithash and     FMODE_64bithash. (bnc#898554)

  - futex: Ensure get_futex_key_refs() always implies a     barrier (bnc#851603 (futex scalability series)).

  - futex: Fix a race condition between REQUEUE_PI and task     death (bnc#851603 (futex scalability series)).

  - ipv6: add support of peer address. (bnc#896415)

  - ipv6: fix a refcnt leak with peer addr. (bnc#896415)

  - megaraid_sas: Disable fastpath writes for non-RAID0.
    (bnc#897502)

  - mm: change __remove_pages() to call     release_mem_region_adjustable(). (bnc#891790)

  - netxen: Fix link event handling. (bnc#873228)

  - netxen: fix link notification order. (bnc#873228)

  - nfsd: rename int access to int may_flags in nfsd_open().
    (bnc#898554)

  - nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes).
    (bnc#898554)

  - ocfs2: fix NULL pointer dereference in     ocfs2_duplicate_clusters_by_page. (bnc#899843)

  - powerpc: Add smp_mb() to arch_spin_is_locked()     (bsc#893758).

  - powerpc: Add smp_mb()s to arch_spin_unlock_wait()     (bsc#893758).

  - powerpc: Add support for the optimised lockref     implementation (bsc#893758).

  - powerpc: Implement arch_spin_is_locked() using     arch_spin_value_unlocked() (bsc#893758).

  - refresh patches.xen/xen-blkback-multi-page-ring     (bnc#897708)).

  - remove filesize checks for sync I/O journal commit.
    (bnc#800255)

  - resource: add __adjust_resource() for internal use.
    (bnc#891790)

  - resource: add release_mem_region_adjustable().
    (bnc#891790)

  - revert PM / Hibernate: Iterate over set bits instead of     PFNs in swsusp_free(). (bnc#860441)

  - rpm/mkspec: Generate specfiles according to Factory     requirements.

  - rpm/mkspec: Generate a per-architecture per-package
    _constraints file

  - sched: Fix unreleased llc_shared_mask bit during CPU     hotplug. (bnc#891368)

  - scsi_dh_alua: disable ALUA handling for non-disk     devices. (bnc#876633)

  - usb: Do not re-read descriptors for wired devices in     usb_authorize_device(). (bnc#904358)

  - usbback: Do not access request fields in shared ring     more than once.

  - usbhid: add another mouse that needs QUIRK_ALWAYS_POLL.
    (bnc#888607)

  - vfs,proc: guarantee unique inodes in /proc. (bnc#868049)

  - x86, cpu hotplug: Fix stack frame warning     incheck_irq_vectors_for_cpu_disable(). (bnc#887418)

  - x86, ioremap: Speed up check for RAM pages (Boot time     optimisations (bnc#895387)).

  - x86: Add check for number of available vectors before     CPU down. (bnc#887418)

  - x86: optimize resource lookups for ioremap (Boot time     optimisations (bnc#895387)).

  - x86: use optimized ioresource lookup in ioremap function     (Boot time optimisations (bnc#895387)).

  - xfs: Do not free EFIs before the EFDs are committed     (bsc#755743).

  - xfs: Do not reference the EFI after it is freed     (bsc#755743).

  - xfs: fix cil push sequence after log recovery     (bsc#755743).

  - zcrypt: support for extended number of ap domains     (bnc#894058, LTC#117041).

  - zcrypt: toleration of new crypto adapter hardware     (bnc#894058, LTC#117041).

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1724 advisory.

    - [virt] kvm: fix PIT timer race condition (Petr  Matousek) [1144879 1144880] {CVE-2014-3611}
    - [virt] kvm/vmx: handle invept and invvpid vm exits gracefully (Petr  Matousek) [1145449 1116936]     [1144828 1144829] {CVE-2014-3645 CVE-2014-3646}
    - [net] sctp: inherit auth_capable on INIT collisions (Daniel Borkmann) [1124337 1123763] {CVE-2014-5077}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1843 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A race condition flaw was found in the way the Linux kernel's KVM     subsystem handled PIT (Programmable Interval Timer) emulation. A guest user     who has access to the PIT I/O ports could use this flaw to crash the host.
    (CVE-2014-3611, Important)

    * A memory corruption flaw was found in the way the USB ConnectTech     WhiteHEAT serial driver processed completion commands sent via USB Request     Blocks buffers. An attacker with physical access to the system could use     this flaw to crash the system or, potentially, escalate their privileges on     the system. (CVE-2014-3185, Moderate)

    * It was found that the Linux kernel's KVM subsystem did not handle the VM     exits gracefully for the invept (Invalidate Translations Derived from EPT)     and invvpid (Invalidate Translations Based on VPID) instructions. On hosts     with an Intel processor and invept/invppid VM exit support, an unprivileged     guest user could use these instructions to crash the guest. (CVE-2014-3645,     CVE-2014-3646, Moderate)

    Red Hat would like to thank Lars Bull of Google for reporting     CVE-2014-3611, and the Advanced Threat Research team at Intel Security for     reporting CVE-2014-3645 and CVE-2014-3646.

    This update also fixes the following bugs:

    * This update fixes several race conditions between PCI error recovery     callbacks and potential calls of the ifup and ifdown commands in the tg3     driver. When triggered, these race conditions could cause a kernel crash.
    (BZ#1142570)

    * Previously, GFS2 failed to unmount a sub-mounted GFS2 file system if its     parent was also a GFS2 file system. This problem has been fixed by adding     the appropriate d_op->d_hash() routine call for the last component of the     mount point path in the path name lookup mechanism code (namei).
    (BZ#1145193)

    * Due to previous changes in the virtio-net driver, a Red Hat Enterprise     Linux 6.6 guest was unable to boot with the mgr_rxbuf=off option     specified. This was caused by providing the page_to_skb() function with an     incorrect packet length in the driver's Rx path. This problem has been     fixed and the guest in the described scenario can now boot successfully.
    (BZ#1148693)

    * When using one of the newer IPSec Authentication Header (AH) algorithms     with Openswan, a kernel panic could occur. This happened because the     maximum truncated ICV length was too small. To fix this problem, the     MAX_AH_AUTH_LEN parameter has been set to 64. (BZ#1149083)

    * A bug in the IPMI driver caused the kernel to panic when an IPMI     interface was removed using the hotmod script. The IPMI driver has been     fixed to properly clean the relevant data when removing an IPMI interface.
    (BZ#1149578)

    * Due to a bug in the IPMI driver, the kernel could panic when adding an     IPMI interface that was previously removed using the hotmod script.
    This update fixes this bug by ensuring that the relevant shadow structure     is initialized at the right time. (BZ#1149580)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c (CVE-2014-3610).

Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation (CVE-2014-3611).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3645).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3646).

arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3647).

The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c (CVE-2014-3673).

The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter (CVE-2014-3687).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU (CVE-2014-3690).

kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application (CVE-2014-7825).

kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application (CVE-2014-7826).

The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call (CVE-2014-7970).

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601 (CVE-2014-8369).

The updated packages provides a solution for these security issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's futex     subsystem handled the requeuing of certain Priority     Inheritance (PI) futexes. A local, unprivileged user     could use this flaw to escalate their privileges on the     system.(CVE-2014-3153)

  - An out-of-bounds write flaw was found in the way the     Apple Magic Mouse/Trackpad multi-touch driver handled     Human Interface Device (HID) reports with an invalid     size. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3181)

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182)

  - Multiple out-of-bounds write flaws were found in the     way the Cherry Cymotion keyboard driver, KYE/Genius     device drivers, Logitech device drivers, Monterey     Genius KB29E keyboard driver, Petalynx Maxter remote     control driver, and Sunplus wireless desktop driver     handled HID reports with an invalid report descriptor     size. An attacker with physical access to the system     could use either of these flaws to write data past an     allocated memory buffer.(CVE-2014-3184)

  - A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed     completion commands sent via USB Request Blocks     buffers. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3185)

  - It was found that Linux kernel's ptrace subsystem did     not properly sanitize the address-space-control bits     when the program-status word (PSW) was being set. On     IBM S/390 systems, a local, unprivileged user could use     this flaw to set address-space-control bits to the     kernel space, and thus gain read and write access to     kernel memory.(CVE-2014-3534)

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601)

  - It was found that KVM's Write to Model Specific     Register (WRMSR) instruction emulation would write     non-canonical values passed in by the guest to certain     MSRs in the host's context. A privileged guest user     could use this flaw to crash the host.(CVE-2014-3610)

  - A race condition flaw was found in the way the Linux     kernel's KVM subsystem handled PIT (Programmable     Interval Timer) emulation. A guest user who has access     to the PIT I/O ports could use this flaw to crash the     host.(CVE-2014-3611)

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT)     instructions. On hosts with an Intel processor and     invept VM exit support, an unprivileged guest user     could use these instructions to crash the     guest.(CVE-2014-3645)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invvpid     (Invalidate Translations Based on VPID) instructions.
    On hosts with an Intel processor and invppid VM exit     support, an unprivileged guest user could use these     instructions to crash the guest.(CVE-2014-3646)

  - A flaw was found in the way the Linux kernel's KVM     subsystem handled non-canonical addresses when     emulating instructions that change the RIP (for     example, branches or calls). A guest user with access     to an I/O or MMIO region could use this flaw to crash     the guest.(CVE-2014-3647)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled malformed Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3673)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled duplicate Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3687)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled the association's output queue. A remote     attacker could send specially crafted packets that     would cause the system to use an excessive amount of     memory, leading to a denial of service.(CVE-2014-3688)

  - It was found that the Linux kernel's KVM implementation     did not ensure that the host CR4 control register value     remained unchanged across VM entries on the same     virtual CPU. A local, unprivileged user could use this     flaw to cause a denial of service on the     system.(CVE-2014-3690)

  - An out-of-bounds memory access flaw was found in the     Linux kernel's system call auditing implementation. On     a system with existing audit rules defined, a local,     unprivileged user could use this flaw to leak kernel     memory to user space or, potentially, crash the     system.(CVE-2014-3917)

  - A flaw was found in the way Linux kernel's Transparent     Huge Pages (THP) implementation handled non-huge page     migration. A local, unprivileged user could use this     flaw to crash the kernel by migrating transparent     hugepages.(CVE-2014-3940)

  - The capabilities implementation in the Linux kernel     before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows     local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by     setting the setgid bit on a file with group ownership     of root.(CVE-2014-4014)

  - An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) backend driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client.(CVE-2014-4027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
80250	SuSE 11.3 Security Update : Linux kernel (SAT Patch Number 10103)	Nessus	SuSE Local Security Checks	12/26/2014	1/19/2021	high
78721	Oracle Linux 7 : kernel (ELSA-2014-1724)	Nessus	Oracle Linux Local Security Checks	10/29/2014	2/9/2026	medium
79206	RHEL 6 : kernel (RHSA-2014:1843)	Nessus	Red Hat Local Security Checks	11/12/2014	11/4/2024	medium
79610	Mandriva Linux Security Advisory : kernel (MDVSA-2014:230)	Nessus	Mandriva Local Security Checks	11/28/2014	1/6/2021	high
124804	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1480)	Nessus	Huawei Local Security Checks	5/13/2019	7/4/2024	high

Detections

Analytics

Plugins Search

high

medium

medium

high

high