The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-14821 advisory.

    kernel
    - 2.6.18-419.0.0.0.2
    - [mm] support large stack guard gap between vmas [orabug 26366330]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[2.6.39-400.297.4.el6uek]
- mm: larger stack guard gap, between vmas (Hugh Dickins)  [Orabug: 26326145]  {CVE-2017-1000364}

This plugin has been deprecated because the recently released Oracle Linux 5 and 6, ELSA-2017-3592, does not fix any security problems relevant to already running systems. You do not need to take any action to update your systems.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2017-7487

Li Qiang reported a reference counter leak in the ipxitf_ioctl function which may result into a use-after-free vulnerability, triggerable when a IPX interface is configured.

CVE-2017-7645

Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that the NFSv2 and NFSv3 server implementations are vulnerable to an out-of-bounds memory access issue while processing arbitrarily long arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of service.

CVE-2017-7895

Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3 server implementations do not properly handle payload bounds checking of WRITE requests. A remote attacker with write access to a NFS mount can take advantage of this flaw to read chunks of arbitrary memory from both kernel-space and user-space.

CVE-2017-8890

It was discovered that the net_csk_clone_lock() function allows a remote attacker to cause a double free leading to a denial of service or potentially have other impact.

CVE-2017-8924

Johan Hovold found that the io_ti USB serial driver could leak sensitive information if a malicious USB device was connected.

CVE-2017-8925

Johan Hovold found a reference counter leak in the omninet USB serial driver, resulting in a use-after-free vulnerability. This can be triggered by a local user permitted to open tty devices.

CVE-2017-9074

Andrey Konovalov reported that the IPv6 fragmentation implementation could read beyond the end of a packet buffer. A local user or guest VM might be able to use this to leak sensitive information or to cause a denial of service (crash).

CVE-2017-9075

Andrey Konovalov reported that the SCTP/IPv6 implementation wrongly initialised address lists on connected sockets, resulting in a use-after-free vulnerability, a similar issue to CVE-2017-8890. This can be triggered by any local user.

CVE-2017-9076 / CVE-2017-9077 Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations wrongly initialised address lists on connected sockets, a similar issue to CVE-2017-9075.

CVE-2017-9242

Andrey Konovalov reported a packet buffer overrun in the IPv6 implementation. A local user could use this for denial of service (memory corruption; crash) and possibly for privilege escalation.

CVE-2017-1000364

The Qualys Research Labs discovered that the size of the stack guard page is not sufficiently large. The stack-pointer can jump over the guard-page and moving from the stack into another memory region without accessing the guard-page. In this case no page-fault exception is raised and the stack extends into the other memory region. An attacker can exploit this flaw for privilege escalation.

The default stack gap protection is set to 256 pages and can be configured via the stack_guard_gap kernel parameter on the kernel command line.

Further details can be found at https://www.qualys.com/2017/06/19/stack-clash/stack-clash.tx t

For Debian 7 'Wheezy', this problem has been fixed in version 3.2.89-2.

For Debian 8 'Jessie', this problem has been fixed in version 3.16.43-2+deb8u2.

For Debian 9 'Stretch', this problem has been fixed in version 4.9.30-2+deb9u2.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the size of the stack guard     page on Linux, specifically a 4k stack guard page is     not sufficiently large and can be 'jumped' over (the     stack guard page is bypassed), this affects Linux     Kernel versions 4.11.5 and earlier (the stackguard page     was introduced in 2010).(CVE-2017-1000364)

  - The make_response function in     drivers/block/xen-blkback/blkback.c in the Linux kernel     before 4.11.8 allows guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures, aka XSA-216.(CVE-2017-10911)

  - Multiple race conditions in the ext4 filesystem     implementation in the Linux kernel before 4.5 allow     local users to cause a denial of service (disk     corruption) by writing to a page that is associated     with a different user's file after unsynchronized hole     punching and page-fault handling.(CVE-2015-8839)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote Junos Space version is 18.4.x prior to 18.4R1. It is, therefore, affected by multiple vulnerabilities : 

  - An integer overflow issue exists in procps-ng. This is     related to CVE-2018-1124. (CVE-2018-1126)

  - A directory traversal issue exits in reposync, a part     of yum-utils.tory configuration files. If an attacker     controls a repository, they may be able to copy files     outside of the destination directory on the targeted     system via path traversal. (CVE-2018-10897)

  - An integer overflow flaw was found in the Linux     kernel's create_elf_tables() function. An unprivileged     local user with access to SUID binary could use this     flaw to escalate their privileges on the system.
    (CVE-2018-14634)

Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
180785	Oracle Linux 5 : ELSA-2017-1482-1: / kernel (ELSA-2017-14821)	Nessus	Oracle Linux Local Security Checks	9/7/2023	2/9/2026	high
101544	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2017-3592) (Stack Clash) (deprecated)	Nessus	Oracle Linux Local Security Checks	7/14/2017	10/6/2017	medium
100876	Debian DLA-993-2 : linux regression update (Stack Clash)	Nessus	Debian Local Security Checks	6/20/2017	12/16/2025	critical
102241	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1154)	Nessus	Huawei Local Security Checks	8/8/2017	12/4/2025	high
121068	Juniper Junos Space 18.4.x < 18.4R1 Multiple Vulnerabilities (JSA10917)	Nessus	Junos Local Security Checks	1/10/2019	1/26/2026	critical

Detections

Analytics

Plugins Search

high

medium

critical

high

critical