It was discovered that a use-after-free vulnerability existed in the AF_UNIX implementation in the Linux kernel. A local attacker could use crafted epoll_ctl calls to cause a denial of service (system crash) or expose sensitive information. (CVE-2013-7446)

It was discovered that the KVM implementation in the Linux kernel did not properly restore the values of the Programmable Interrupt Timer (PIT). A user-assisted attacker in a KVM guest could cause a denial of service in the host (system crash). (CVE-2015-7513)

Guoyong Gang discovered that the ppp implementation in the Linux kernel did not ensure that certain slot numbers are valid. A local attacker with the privilege to call ioctl() on /dev/ppp could cause a denial of service (system crash). (CVE-2015-7799)

Sasha Levin discovered that the Reliable Datagram Sockets (RDS) implementation in the Linux kernel had a race condition when checking whether a socket was bound or not. A local attacker could use this to cause a denial of service (system crash). (CVE-2015-7990)

It was discovered that the Btrfs implementation in the Linux kernel incorrectly handled compressed inline extants on truncation. A local attacker could use this to expose sensitive information.
(CVE-2015-8374)

Guoyong Gang discovered that the Linux kernel networking implementation did not validate protocol identifiers for certain protocol families, A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges.
(CVE-2015-8543)

Dmitry Vyukov discovered that the pptp implementation in the Linux kernel did not verify an address length when setting up a socket. A local attacker could use this to craft an application that exposed sensitive information from kernel memory. (CVE-2015-8569)

David Miller discovered that the Bluetooth implementation in the Linux kernel did not properly validate the socket address length for Synchronous Connection-Oriented (SCO) sockets. A local attacker could use this to expose sensitive information. (CVE-2015-8575)

It was discovered that the Linux kernel's Filesystem in Userspace (FUSE) implementation did not handle initial zero length segments properly. A local attacker could use this to cause a denial of service (unkillable task). (CVE-2015-8785).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian host is running a version of the Linux kernel prior to 3.2.73-2+deb7u1 on Debian 7 or is running a version of the Linux kernel prior to 3.16.7-ckt20-1+deb8u1 on Debian 8. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists in the unix_dgram_poll()     function within file net/unix/af_unix.c. A local     attacker can exploit this, via specially crafted     epoll_ctl calls, to cause a denial of service condition     or bypass AF_UNIX socket permissions. (CVE-2013-7446)

  - A NULL pointer dereference flaw exists in the     slhc_init() function within file drivers/net/slip/slhc.c     due to improper validation of slot numbers. A local     attacker can exploit this, via specially crafted     PPPIOCSMAXCID IOCTL calls, to cause a denial of service     condition. (CVE-2015-7799)

  - A flaw exists in the usbvision driver that allows a     local attacker, via a nonzero bInterfaceNumber value in     a USB device descriptor, to cause a kernel panic,     resulting in a denial of service condition.
    (CVE-2015-7833)

  - An infinite loop condition exists in the KVM subsystem     on some unspecified CPU chipsets. A local attacker who     has sufficient privileges within a virtual guest OS can     exploit this issue, by triggering many debug exceptions,     to cause a denial of service condition. (CVE-2015-8104)

  - A flaw exists in the truncate_space_check() function     within file /fs/btrfs/inode.c due to improper handling     of compressed file extents. A local attacker can exploit     this, via a clone action, to disclose sensitive     pre-truncation information from a file. (CVE-2015-8374)

  - A NULL pointer dereference flaw exists in the     inet_autobind() function within file net/ipv4/af_inet.c     when handling connection attempts via IPv6. A local     attacker can exploit this, via a specially crafted     SOCK_RAW application that makes use of CLONE_NEWUSER     support, to cause a denial of service condition or     possibly gain elevated privileges. (CVE-2015-8543)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2844-1 advisory.

    Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly     catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a     denial of service (system crash) in the host OS. (CVE-2015-8104)

     discovered that the ppp implementation in the Linux kernel did not ensure that certain slot     numbers are valid. A local attacker with the privilege to call ioctl() on /dev/ppp could cause a denial of     service (system crash). (CVE-2015-7799)

    It was discovered that the driver for Digi Neo and ClassicBoard devices did not properly initialize data     structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7885)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0100 for details.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that     certain slot numbers are valid, which allows local users to cause a denial of service (NULL pointer     dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call. (CVE-2015-7799)

Note that Nessus relies on the presence of the package as reported by the vendor.

The openSUSE Leap 42.1 kernel was updated to 4.1.20 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-1339: A memory leak in cuse could be used to     exhaust kernel memory. (bsc#969356).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936 951638).

  - CVE-2015-7872: The key_gc_unused_keys function in     security/keys/gc.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) via crafted     keyctl commands (bnc#951440).

  - CVE-2015-7884: The vivid_fb_ioctl function in     drivers/media/platform/vivid/vivid-osd.c in the Linux     kernel did not initialize a certain structure member,     which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951626).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #DB (aka     Debug) exceptions, related to svm.c (bnc#954404).

  - CVE-2015-8709: kernel/ptrace.c in the Linux kernel     mishandled uid and gid mappings, which allowed local     users to gain privileges by establishing a user     namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the     ptrace system call. NOTE: the vendor states 'there is no     kernel bug here (bnc#959709).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call. (bsc#961509)

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8787: The nf_nat_redirect_ipv4 function in     net/netfilter/nf_nat_redirect.c in the Linux kernel     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact by sending certain IPv4     packets to an incompletely configured interface, a     related issue to CVE-2003-1604 (bnc#963931).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario. (bsc#966437).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: When Linux invalidated a paging structure     that is not in use locally, it could, in principle, race     against another CPU that is switching to a process that     uses the paging structure in question. (bsc#963767)

  - CVE-2016-2184: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#971125)

  - CVE-2016-2383: Incorrect branch fixups for eBPF allow     arbitrary read of kernel memory. (bsc#966684)

  - CVE-2016-2384: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#966693)

The following non-security bugs were fixed :

  - alsa: hda - Apply clock gate workaround to Skylake, too     (bsc#966137).

  - alsa: hda - disable dynamic clock gating on Broxton     before reset (bsc#966137).

  - alsa: hda - Fix playback noise with 24/32 bit sample     size on BXT (bsc#966137).

  - alsa: seq: Fix double port list deletion (bsc#968018).

  - alsa: seq: Fix leak of pool buffer at concurrent writes     (bsc#968018).

  - alsa: timer: Fix race between stop and interrupt     (bsc#968018).

  - alsa: timer: Fix wrong instance passed to slave     callbacks (bsc#968018).

  - arm64: Add workaround for Cavium erratum 27456.

  - arm64: Backport arm64 patches from SLE12-SP1-ARM

  - btrfs: teach backref walking about backrefs with     underflowed (bsc#966259).

  - cgroup kabi fix for 4.1.19.

  - config: Disable CONFIG_DDR. CONFIG_DDR is selected     automatically by drivers which need it.

  - config: Disable MFD_TPS65218 The TPS65218 is a power     management IC for 32-bit ARM systems.

  - config: Modularize NF_REJECT_IPV4/V6 There is no reason     why these helper modules should be built-in when the     rest of netfilter is built as modules.

  - config: Update x86 config files: Enable Intel RAPL This     driver is useful when power caping is needed. It was     enabled in the SLE kernel 2 years ago.

  - Delete patches.fixes/bridge-module-get-put.patch. As     discussed in     http://lists.opensuse.org/opensuse-kernel/2015-11/msg000     46.html

  - drm/i915: Fix double unref in intelfb_alloc failure path     (boo#962866, boo#966179).

  - drm/i915: Fix failure paths around initial fbdev     allocation (boo#962866, boo#966179).

  - drm/i915: Pin the ifbdev for the info->system_base GGTT     mmapping (boo#962866, boo#966179).

  - e1000e: Avoid divide by zero error (bsc#965125).

  - e1000e: fix division by zero on jumbo MTUs (bsc#965125).

  - e1000e: fix systim issues (bsc#965125).

  - e1000e: Fix tight loop implementation of systime read     algorithm (bsc#965125).

  - ibmvnic: Fix ibmvnic_capability struct.

  - intel: Disable Skylake support in intel_idle driver     again (boo#969582) This turned out to bring a regression     on some machines, unfortunately. It should be addressed     in the upstream at first.

  - intel_idle: allow idle states to be freeze-mode specific     (boo#969582).

  - intel_idle: Skylake Client Support (boo#969582).

  - intel_idle: Skylake Client Support - updated     (boo#969582).

  - libceph: fix scatterlist last_piece calculation     (bsc#963746).

  - lio: Add LIO clustered RBD backend (fate#318836)

  - net kabi fixes for 4.1.19.

  - numa patches updated to v15

  - ocfs2: fix dlmglue deadlock issue(bnc#962257)

  - pci: thunder: Add driver for ThunderX-pass(1,2) on-chip     devices

  - pci: thunder: Add PCIe host driver for ThunderX     processors

  - sd: Optimal I/O size is in bytes, not sectors     (boo#961263).

  - sd: Reject optimal transfer length smaller than page     size (boo#961263).

  - series.conf: move cxgb3 patch to network drivers section

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (system crash) via a crafted no-journal     filesystem, a related issue to CVE-2013-2015     (bnc#956707).

  - CVE-2015-7515: An out of bounds memory access in the     aiptek USB driver could be used by physical local     attackers to crash the kernel (bnc#956708).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7566: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#961512).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988). (bsc#957988 XSA-155).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     do not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

  - CVE-2016-2143: On zSeries a fork of a large process     could have caused memory corruption due to incorrect     page table handling. (bnc#970504, LTC#138810).

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2185: A malicious USB device could cause kernel     crashes in the usb_driver_claim_interface function     (bnc#971124).

  - CVE-2016-2186: A malicious USB device could cause kernel     crashes in the powermate device driver (bnc#970958).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2543: A missing NULL check at remove_events     ioctl in the ALSA seq driver was fixed. (bsc#967972).

  - CVE-2016-2544: Fix race at timer setup and close in the     ALSA seq driver was fixed. (bsc#967973).

  - CVE-2016-2545: A double unlink of active_list in the     ALSA timer driver was fixed. (bsc#967974).

  - CVE-2016-2546: A race among ALSA timer ioctls was fixed     (bsc#967975).

  - CVE-2016-2547,CVE-2016-2548: The ALSA slave timer list     handling was hardened against hangs and races.
    (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012).

  - CVE-2016-2549: A stall in ALSA hrtimer handling was     fixed (bsc#968013).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3137: A malicious USB device could cause kernel     crashes in the cypress_m8 device driver (bnc#970970).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3140: A malicious USB device could cause kernel     crashes in the digi_acceleport device driver     (bnc#970892).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

  - CVE-2016-3955: A remote buffer overflow in the usbip     driver could be used by authenticated attackers to crash     the kernel. (bsc#975945)

  - CVE-2016-2847: A local user could exhaust kernel memory     by pushing lots of data into pipes. (bsc#970948).

  - CVE-2016-2188: A malicious USB device could cause kernel     crashes in the iowarrior device driver (bnc#970956).

  - CVE-2016-3138: A malicious USB device could cause kernel     crashes in the cdc-acm device driver (bnc#970911).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.2 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2014-8989: The Linux kernel did not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allowed local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c (bnc#906545).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandles IRET faults in     processing NMIs that occurred during userspace     execution, which might allow local users to gain     privileges by triggering an NMI (bnc#937969).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel through     4.2.3 did not ensure that certain slot numbers are     valid, which allowed local users to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #DB (aka Debug)     exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #AC (aka Alignment     Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key     (bnc#912202).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2015-6937 (bnc#952384     953052).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-7885: The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 did not initialize a certain structure     member, which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951627).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Disable 64bit address for Creative HDA     controllers (bnc#814440).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y     (boo#956934).

  - KVM: x86: update masterclock values on TSC writes     (bsc#961739).

  - NFS: Fix a NULL pointer dereference of migration     recovery ops for v4.2 client (bsc#960839).

  - apparmor: allow SYS_CAP_RESOURCE to be sufficient to     prlimit another task (bsc#921949).

  - blktap: also call blkif_disconnect() when frontend     switched to closed (bsc#952976).

  - blktap: refine mm tracking (bsc#952976).

  - cdrom: Random writing support for BD-RE media     (bnc#959568).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - ipv4: Do not increase PMTU with Datagram Too Big message     (bsc#955224).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - ipv6: fix tunnel error handling (bsc#952579).

  - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224).

  - uas: Add response iu handling (bnc#954138).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/evtchn: make use of PHYSDEVOP_map_pirq.

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.53 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-5707: Integer overflow in the sg_start_req     function in drivers/scsi/sg.c in the Linux kernel     allowed local users to cause a denial of service or     possibly have unspecified other impact via a large     iov_count value in a write request (bnc#940338).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that was (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272 (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988).

  - CVE-2015-8551: Xen PCI backend driver did not perform     proper sanity checks on the device's state, allowing for     DoS (bsc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8660: The ovl_setattr function in     fs/overlayfs/inode.c in the Linux kernel attempted to     merge distinct setattr operations, which allowed local     users to bypass intended access restrictions and modify     the attributes of arbitrary overlay files via a crafted     application (bnc#960281).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
88518	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2886-1)	Nessus	Ubuntu Local Security Checks	2/2/2016	1/17/2023	high
92679	Debian DSA-3426-1 : Linux Security Update	Nessus	Debian Local Security Checks	8/2/2016	1/29/2026	high
87471	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2844-1)	Nessus	Ubuntu Local Security Checks	12/17/2015	8/27/2024	low
93679	OracleVM 3.4 : Unbreakable / etc (OVMSA-2016-0100)	Nessus	OracleVM Local Security Checks	9/23/2016	1/23/2026	critical
218733	Linux Distros Unpatched Vulnerability : CVE-2015-7799	Nessus	Misc.	3/4/2025	7/17/2026	medium
90482	openSUSE Security Update : the Linux Kernel (openSUSE-2016-445)	Nessus	SuSE Local Security Checks	4/13/2016	1/19/2021	critical
90884	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:1203-1)	Nessus	SuSE Local Security Checks	5/4/2016	1/19/2021	critical
88605	openSUSE Security Update : the Linux Kernel (openSUSE-2016-136)	Nessus	SuSE Local Security Checks	2/8/2016	1/19/2021	high
89022	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0585-1)	Nessus	SuSE Local Security Checks	2/29/2016	1/6/2021	high

Detections

Analytics

Plugins Search

high

high

low

critical

medium

critical

critical

high

high