The remote OracleVM system is missing necessary patches to address critical security updates :

  - crypto: aesni

  - fix memory usage in GCM decryption (Stephan Mueller)     [Orabug: 21077385] (CVE-2015-3331)

  - xen/pciback: Don't disable PCI_COMMAND on PCI device     reset. (Konrad Rzeszutek Wilk) [Orabug: 20807438]     (CVE-2015-2150)

  - xen-blkfront: fix accounting of reqs when migrating     (Roger Pau Monne) [Orabug: 20860817]

  - Doc/cpu-hotplug: Specify race-free way to register CPU     hotplug callbacks (Srivatsa S. Bhat) [Orabug: 20917697]

  - net/iucv/iucv.c: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - net/core/flow.c: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - mm, vmstat: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697] 

  - profile: Fix CPU hotplug callback registration (Srivatsa     S. Bhat) 

  - trace, ring-buffer: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - hwmon, via-cputemp: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) 

  - hwmon, coretemp: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - octeon, watchdog: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - oprofile, nmi-timer: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - intel-idle: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - drivers/base/topology.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - acpi-cpufreq: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - scsi, fcoe: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697] 

  - scsi, bnx2fc: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - scsi, bnx2i: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - arm64, debug-monitors: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - arm64, hw_breakpoint.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, kvm: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, oprofile, nmi: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, pci, amd-bus: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, hpet: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, intel, cacheinfo: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, amd, ibs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, therm_throt.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, mce: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, intel, uncore: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, vsyscall: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, cpuid: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, msr: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - powerpc, sysfs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) 

  - sparc, sysfs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - s390, smp: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - s390, cacheinfo: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) 

  - arm, hw-breakpoint: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, err-inject: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, topology: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, palinfo: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - CPU hotplug, perf: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - CPU hotplug: Provide lockless versions of callback     registration functions (Srivatsa S. Bhat) [Orabug:
    20917697]

  - isofs: Fix unchecked printing of ER records (Jan Kara)     [Orabug: 20930551] (CVE-2014-9584)

  - KEYS: close race between key lookup and freeing (Sasha     Levin) [Orabug: 20930548] (CVE-2014-9529)     (CVE-2014-9529)

  - mm: memcg: do not allow task about to OOM kill to bypass     the limit (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not declare OOM from __GFP_NOFAIL     allocations (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - fs: buffer: move allocation failure loop into the     allocator (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: handle non-error OOM situations more     gracefully (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not trap chargers with full callstack on     OOM (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: rework and document OOM waiting and wakeup     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: enable memcg OOM killer only for user faults     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - x86: finish user fault error path with fatal signal     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - arch: mm: pass userspace fault flag to generic fault     handler (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - selinux: Permit bounded transitions under NO_NEW_PRIVS     or NOSUID. (Stephen Smalley) [Orabug: 20930501]     (CVE-2014-3215)

  - IB/core: Prevent integer overflow in ib_umem_get address     arithmetic (Shachar Raindel) [Orabug: 20799875]     (CVE-2014-8159) (CVE-2014-8159)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2615-1 advisory.

    Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes     (xattrs). A local attacker could exploit this flaw to bypass ACLs and potentially escalate privileges.
    (CVE-2014-9710)

    A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code     path. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     escalate privileges on Intel base machines with AEC-GCM mode IPSec security association. (CVE-2015-3331)

    A flaw was discovered in the Linux kernel's IPv4 networking when using TCP fast open to initiate a     connection. An unprivileged local user could exploit this flaw to cause a denial of service (system     crash). (CVE-2015-3332)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix two security issues and three bugs are now available for Red Hat Enterprise Linux 6.5 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-1805, Important)

* A buffer overflow flaw was found in the way the Linux kernel's Intel AES-NI instructions optimized version of the RFC4106 GCM mode decryption functionality handled fragmented packets. A remote attacker could use this flaw to crash, or potentially escalate their privileges on, a system over a connection with an active AES-GCM mode IPSec security association. (CVE-2015-3331, Important)

The security impact of the CVE-2015-1805 issue was discovered by Red Hat.

This update also fixes the following bugs :

* Parallel extending direct I/O writes to a file could previously race to update the size of the file. If executed in an incorrect order, the file size could move backwards and push a previously completed write beyond the end of the file, which resulted in losing the write. With this update, file size updates always execute in appropriate order, thus fixing this bug. (BZ#1218498)

* When the load rose and run queues were busy due to the effects of the enqueue_entity() function, tasks with large sched_entity.vruntime values could previously be prevented from using the CPU time. A patch eliminating the entity_key() function in the sched_fair.c latency value has been backported from upstream, and all tasks are now provided with fair CPU runtime. (BZ# 1219121)

* Previously, running the clock_gettime() function quickly in a loop could result in a jump back in time. Consequently, programs could behave unexpectedly when they assumed that clock_getime() returned an equal or greater time in subsequent calls. With this update, if the time delta between calls is negative, the clock is no longer updated.
As a result, a subsequent call to clock_gettime() is guaranteed to return a time greater than or equal to a previous call. (BZ#1219500)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-178:05 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any     Linux operating system. The kernel handles the basic functions     of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2014-9419     CVE-2014-9420     CVE-2014-9585     CVE-2015-1805     CVE-2015-3331

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0981 advisory.

  - Kernel: crypto: buffer overruns in RFC4106 implementation using AESNI (CVE-2015-3331)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A buffer overflow flaw was found in the way the Linux kernel's Intel AES-NI instructions optimized version of the RFC4106 GCM mode decryption functionality handled fragmented packets. A remote attacker could use this flaw to crash, or potentially escalate their privileges on, a system over a connection with an active AEC-GCM mode IPSec security association. (CVE-2015-3331)

It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system. (CVE-2015-3636)

Vincent Tondellier discovered an integer overflow in the Linux kernel's netfilter connection tracking accounting of loaded extensions. An attacker on the local area network (LAN) could potential exploit this flaw to cause a denial of service (system crash of targeted system). (CVE-2014-9715)

Jan Beulich discovered the Xen virtual machine subsystem of the Linux kernel did not properly restrict access to PCI command registers. A local guest user could exploit this flaw to cause a denial of service (host crash). (CVE-2015-2150)

A privilege escalation was discovered in the fork syscal vi the int80 entry on 64 bit kernels with 32 bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges on the system. (CVE-2015-2830)

A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code path. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate privileges on Intel base machines with AEC-GCM mode IPSec security association. (CVE-2015-3331).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that the Linux kernel's implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already     processed when retrying after a failed atomic access     operation, potentially resulting in memory corruption     due to an I/O vector array overrun. A local,     unprivileged user could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-1805)

  - net/llc/sysctl_net_llc.c in the Linux kernel before     3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry.(CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042)

  - Xen 3.3.x through 4.5.x and the Linux kernel through     3.19.1 do not properly restrict access to PCI command     registers, which might allow local guest OS users to     cause a denial of service (non-maskable interrupt and     host crash) by disabling the (1) memory or (2) I/O     decoding for a PCI Express device and then accessing     the device, which triggers an Unsupported Request (UR)     response.(CVE-2015-2150)

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666)

  - The xsave/xrstor implementation in     arch/x86/include/asm/xsave.h in the Linux kernel before     3.19.2 creates certain .altinstr_replacement pointers     and consequently does not provide any protection     against instruction faulting, which allows local users     to cause a denial of service (panic) by triggering a     fault, as demonstrated by an unaligned memory operand     or a non-canonical address memory     operand.(CVE-2015-2672)

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830)

  - It was found that the Linux kernel's TCP/IP protocol     suite implementation for IPv6 allowed the Hop Limit     value to be set to a smaller value than the default     one. An attacker on a local network could use this flaw     to prevent systems on that network from sending or     receiving network packets.(CVE-2015-2922)

  - A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in     which the source was inside and the destination was     outside of a bind mount. A privileged user inside a     container could use this flaw to escape the bind mount     and, potentially, escalate their privileges on the     system.(CVE-2015-2925)

  - A race condition flaw was found in the way the Linux     kernel's SCTP implementation handled Address     Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could     use this flaw to crash the system via a race condition     triggered by setting certain ASCONF options on a     socket.(CVE-2015-3212)

  - mm/memory.c in the Linux kernel before 4.1.4 mishandles     anonymous pages, which allows local users to gain     privileges or cause a denial of service (page tainting)     via a crafted application that triggers writing to page     zero.(CVE-2015-3288)

  - A flaw was found in the way the Linux kernel's nested     NMI handler and espfix64 functionalities interacted     during NMI processing. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system.(CVE-2015-3290)

  - It was found that if a Non-Maskable Interrupt (NMI)     occurred immediately after a SYSCALL call or before a     SYSRET call with the user RSP pointing to the NMI IST     stack, the kernel could skip that NMI.(CVE-2015-3291)

  - A buffer overflow flaw was found in the way the Linux     kernel's Intel AES-NI instructions optimized version of     the RFC4106 GCM mode decryption functionality handled     fragmented packets. A remote attacker could use this     flaw to crash, or potentially escalate their privileges     on, a system over a connection with an active AES-GCM     mode IPSec security association.(CVE-2015-3331)

  - A race condition flaw was found between the chown and     execve system calls. When changing the owner of a     setuid user binary to root, the race condition could     momentarily make the binary setuid root. A local,     unprivileged user could potentially use this flaw to     escalate their privileges on the system.(CVE-2015-3339)

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636)

  - An inode data validation error was found in Linux     kernels built with UDF file system (CONFIG_UDF_FS)     support. An attacker able to mount a     corrupted/malicious UDF file system image could cause     the kernel to crash.(CVE-2015-4167)

  - A flaw was discovered in the way the Linux kernel's TTY     subsystem handled the tty shutdown phase. A local,     unprivileged user could use this flaw to cause denial     of service on the system by holding a reference to the     ldisc lock during tty shutdown, causing a     deadlock.(CVE-2015-4170)

  - A flaw was discovered in the kernel's collect_mounts     function. If the kernel's audit subsystem called     collect_mounts to audit an unmounted path, it could     panic the system. With this flaw, an unprivileged user     could call umount(MNT_DETACH) to launch a     denial-of-service attack.(CVE-2015-4177)

  - A DoS flaw was found for a Linux kernel built for the     x86 architecture which had the KVM virtualization     support(CONFIG_KVM) enabled. The kernel would be     vulnerable to a NULL pointer dereference flaw in Linux     kernel's kvm_apic_has_events() function while doing an     ioctl. An unprivileged user able to access the     '/dev/kvm' device could use this flaw to crash the     system kernel.(CVE-2015-4692)

  - A flaw was found in the kernel's implementation of the     Berkeley Packet Filter (BPF). A local attacker could     craft BPF code to crash the system by creating a     situation in which the JIT compiler would fail to     correctly optimize the JIT image on the last pass. This     would lead to the CPU executing instructions that were     not part of the JIT code.(CVE-2015-4700)

  - A buffer overflow flaw was found in the way the Linux     kernel's virtio-net subsystem handled certain fraglists     when the GRO (Generic Receive Offload) functionality     was enabled in a bridged network configuration. An     attacker on the local network could potentially use     this flaw to crash the system, or, although unlikely,     elevate their privileges on the system.(CVE-2015-5156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

* It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-1805, Important)

* A buffer overflow flaw was found in the way the Linux kernel's Intel AES-NI instructions optimized version of the RFC4106 GCM mode decryption functionality handled fragmented packets. A remote attacker could use this flaw to crash, or potentially escalate their privileges on, a system over a connection with an active AES-GCM mode IPSec security association. (CVE-2015-3331, Important)

* An information leak flaw was found in the way the Linux kernel changed certain segment registers and thread-local storage (TLS) during a context switch. A local, unprivileged user could use this flaw to leak the user space TLS base address of an arbitrary process.
(CVE-2014-9419, Low)

* It was found that the Linux kernel's ISO file system implementation did not correctly limit the traversal of Rock Ridge extension Continuation Entries (CE). An attacker with physical access to the system could use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service. (CVE-2014-9420, Low)

* An information leak flaw was found in the way the Linux kernel's Virtual Dynamic Shared Object (vDSO) implementation performed address randomization. A local, unprivileged user could use this flaw to leak kernel memory addresses to user-space. (CVE-2014-9585, Low)

The system must be rebooted for this update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
83485	OracleVM 3.3 : kernel-uek (OVMSA-2015-0060)	Nessus	OracleVM Local Security Checks	5/15/2015	1/4/2021	medium
83761	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2615-1)	Nessus	Ubuntu Local Security Checks	5/21/2015	8/27/2024	medium
84486	RHEL 6 : kernel (RHSA-2015:1199)	Nessus	Red Hat Local Security Checks	7/1/2015	10/24/2019	high
289934	MiracleLinux 4 : kernel-2.6.32-504.23.4.el6 (AXSA:2015-178:05)	Nessus	Miracle Linux Local Security Checks	1/16/2026	2/9/2026	medium
83424	RHEL 7 : kernel-rt (RHSA-2015:0981)	Nessus	Red Hat Local Security Checks	5/13/2015	4/27/2024	critical
83493	Amazon Linux AMI : kernel (ALAS-2015-523)	Nessus	Amazon Linux Local Security Checks	5/18/2015	4/18/2018	high
83759	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2613-1)	Nessus	Ubuntu Local Security Checks	5/21/2015	1/19/2021	high
124811	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1487)	Nessus	Huawei Local Security Checks	5/13/2019	5/23/2024	high
84078	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20150609)	Nessus	Scientific Linux Local Security Checks	6/10/2015	1/14/2021	high

Detections

Analytics

Plugins Search

medium

medium

high

medium

critical

high

high

high

high