A NULL pointer dereference flaw was discovered in the the Linux kernel's SCTP implementation when ASCONF is used. A remote attacker could exploit this flaw to cause a denial of service (system crash) via a malformed INIT chunk. (CVE-2014-7841)

A race condition with MMIO and PIO transactions in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel was discovered. A guest OS user could exploit this flaw to cause a denial of service (guest OS crash) via a specially crafted application. (CVE-2014-7842)

Milos Prchlik reported a flaw in how the ARM64 platform handles a single byte overflow in __clear_user. A local user could exploit this flaw to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary. (CVE-2014-7843)

A stack buffer overflow was discovered in the ioctl command handling for the Technotrend/Hauppauge USB DEC devices driver. A local user could exploit this flaw to cause a denial of service (system crash) or possibly gain privileges. (CVE-2014-8884).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c (CVE-2014-3688=.

Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a long unencrypted auth ticket (CVE-2014-6416).

net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket (CVE-2014-6417).

net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly validate auth replies, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via crafted data from the IP address of a Ceph Monitor (CVE-2014-6418).

The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk (CVE-2014-7841).

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313 (CVE-2014-7842).

arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).

Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call (CVE-2014-8884).

The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite (CVE-2014-9090).

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (CVE-2014-9322).

The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address (CVE-2014-9419).

The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image (CVE-2014-9420).

Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key (CVE-2014-9529).

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image (CVE-2014-9584).

The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD (CVE-2014-9585).

The updated packages provides a solution for these security issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0695 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the way the Linux kernel's SCTP implementation     validated INIT chunks when performing Address Configuration Change     (ASCONF). A remote attacker could use this flaw to crash the system by     sending a specially crafted SCTP packet to trigger a NULL pointer     dereference on the system. (CVE-2014-7841, Important)

    * It was found that the Linux kernel's Infiniband subsystem did not     properly sanitize input parameters while registering memory regions from     user space via the (u)verbs API. A local user with access to a     /dev/infiniband/uverbsX device could use this flaw to crash the system or,     potentially, escalate their privileges on the system. (CVE-2014-8159,     Important)

    * An integer overflow flaw was found in the way the Linux kernel's Frame     Buffer device implementation mapped kernel memory to user space via the     mmap syscall. A local user able to access a frame buffer device file     (/dev/fb*) could possibly use this flaw to escalate their privileges on the     system. (CVE-2013-2596, Important)

    * It was found that the parse_rock_ridge_inode_internal() function of the     Linux kernel's ISOFS implementation did not correctly check relocated     directories when processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a specially crafted ISO image     to crash the system or, potentially, escalate their privileges on the     system. (CVE-2014-5471, CVE-2014-5472, Low)

    Red Hat would like to thank Mellanox for reporting the CVE-2014-8159 issue.
    The CVE-2014-7841 issue was discovered by Liu Wei of Red Hat.

    This update also fixes the following bugs:

    * Previously, certain network device drivers did not accept ethtool     commands right after they were loaded. As a consequence, the current     setting of the specified device driver was not applied and an error message     was returned. The ETHTOOL_DELAY variable has been added, which makes sure     the ethtool utility waits for some time before it tries to apply the     options settings, thus fixing the bug. (BZ#1138299)

    * During the memory allocation for a new socket to communicate to the     server, the rpciod daemon released a clean page which needed to be     committed. However, the commit was queueing indefinitely as the commit     could only be provided with a socket connection. As a consequence, a     deadlock occurred in rpciod. This update sets the PF_FSTRANS flag on the     work queue task prior to the socket allocation, and adds the     nfs_release_page check for the flag when deciding whether to make a commit     call, thus fixing this bug. (BZ#1192326)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Non-maintainer upload by the Squeeze LTS and Kernel Teams.

New upstream stable release 2.6.32.65, see http://lkml.org/lkml/2014/12/13/81 for more information.

The stable release 2.6.32.65 includes the following new commits compared to the previous 2.6.32-48squeeze9 package :

  - USB: whiteheat: Added bounds checking for bulk command     response (CVE-2014-3185)

  - net: sctp: fix panic on duplicate ASCONF chunks     (CVE-2014-3687)

  - net: sctp: fix remote memory pressure from excessive     queueing (CVE-2014-3688)

  - udf: Avoid infinite loop when processing indirect ICBs     (CVE-2014-6410)

  - net: sctp: fix NULL pointer dereference in     af->from_addr_param on malformed packet (CVE-2014-7841)

  - mac80211: fix fragmentation code, particularly for     encryption (CVE-2014-8709)

  - ttusb-dec: buffer overflow in ioctl (CVE-2014-8884)

We recommend that you upgrade your linux-2.6 packages.

We apologize for a minor cosmetic glitch :

The following commits were already included in 2.6.32-48squeeze9 despite claims in debian/changelog they were only fixed in 2.6.32-48squeez10 :

  - vlan: Don't propagate flag changes on down interfaces.

  - sctp: Fix double-free introduced by bad backport in     2.6.32.62

  - md/raid6: Fix misapplied backport in 2.6.32.64

  - block: add missing blk_queue_dead() checks

  - block: Fix blk_execute_rq_nowait() dead queue handling

  - proc connector: Delete spurious memset in     proc_exit_connector()

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system. (CVE-2014-7841, Important)

* An integer overflow flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use this flaw to crash the system. (CVE-2014-4656, Moderate)

The CVE-2014-7841 issue was discovered by Liu Wei of Red Hat.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0087 advisory.

    - [x86] traps: stop using IST for #SS (Petr  Matousek) [1172810 1172811] {CVE-2014-9322}
    - [net] sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)     [1163090 1153980] {CVE-2014-7841}
    - [alsa] control: Make sure that id->index does not overflow (Jacob Tanenbaum) [1149140 1117312]     {CVE-2014-4656}
    - [alsa] control: Handle numid overflow (Jacob Tanenbaum) [1149140 1117312] {CVE-2014-4656}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- A flaw was found in the way the Linux kernel's SCTP     implementation validated INIT chunks when performing     Address Configuration Change (ASCONF). A remote attacker     could use this flaw to crash the system by sending a     specially crafted SCTP packet to trigger a NULL pointer     dereference on the system. (CVE-2014-7841, Important)

  - A race condition flaw was found in the way the Linux     kernel's mmap(2), madvise(2), and fallocate(2) system     calls interacted with each other while operating on     virtual memory file system files. A local user could use     this flaw to cause a denial of service. (CVE-2014-4171,     Moderate)

  - A NULL pointer dereference flaw was found in the way the     Linux kernel's Common Internet File System (CIFS)     implementation handled mounting of file system shares. A     remote attacker could use this flaw to crash a client     system that would mount a file system share from a     malicious server. (CVE-2014-7145, Moderate)

  - A flaw was found in the way the Linux kernel's splice()     system call validated its parameters. On certain file     systems, a local, unprivileged user could use this flaw     to write past the maximum file size, and thus crash the     system. (CVE-2014-7822, Moderate)

  - It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a specially     crafted ISO image to crash the system or, potentially,     escalate their privileges on the system. (CVE-2014-5471,     CVE-2014-5472, Low)

This update also fixes the following bugs :

  - Previously, a kernel panic could occur if a process     reading from a locked NFS file was killed and the lock     was not released properly before the read operations     finished. Consequently, the system crashed. The code     handling file locks has been fixed, and instead of     halting, the system now emits a warning about the     unreleased lock.

  - A race condition in the command abort handling logic of     the ipr device driver could cause the kernel to panic     when the driver received a response to an abort command     prior to receiving other responses to the aborted     command due to the support for multiple interrupts. With     this update, the abort handler waits for the aborted     command's responses first before completing an abort     operation.

  - Previously, a race condition could occur when changing a     Page Table Entry (PTE) or a Page Middle Directory (PMD)     to 'pte_numa' or 'pmd_numa', respectively, causing the     kernel to crash. This update removes the BUG_ON() macro     from the __handle_mm_fault() function, preventing the     kernel panic in the aforementioned scenario.

The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system. (CVE-2014-7841, Important)

* A race condition flaw was found in the way the Linux kernel's mmap(2), madvise(2), and fallocate(2) system calls interacted with each other while operating on virtual memory file system files. A local user could use this flaw to cause a denial of service.
(CVE-2014-4171, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's Common Internet File System (CIFS) implementation handled mounting of file system shares. A remote attacker could use this flaw to crash a client system that would mount a file system share from a malicious server. (CVE-2014-7145, Moderate)

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

* It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags.
An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low)

Red Hat would like to thank Akira Fujita of NEC for reporting the CVE-2014-7822 issue. The CVE-2014-7841 issue was discovered by Liu Wei of Red Hat.

This update also fixes the following bugs :

* Previously, a kernel panic could occur if a process reading from a locked NFS file was killed and the lock was not released properly before the read operations finished. Consequently, the system crashed.
The code handling file locks has been fixed, and instead of halting, the system now emits a warning about the unreleased lock. (BZ#1172266)

* A race condition in the command abort handling logic of the ipr device driver could cause the kernel to panic when the driver received a response to an abort command prior to receiving other responses to the aborted command due to the support for multiple interrupts. With this update, the abort handler waits for the aborted command's responses first before completing an abort operation. (BZ#1162734)

* Previously, a race condition could occur when changing a Page Table Entry (PTE) or a Page Middle Directory (PMD) to 'pte_numa' or 'pmd_numa', respectively, causing the kernel to crash. This update removes the BUG_ON() macro from the __handle_mm_fault() function, preventing the kernel panic in the aforementioned scenario.
(BZ#1170662)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-3004 advisory.

    - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)     [Orabug: 20425333]  {CVE-2014-7841}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-3005 advisory.

    kernel-uek     [2.6.32-400.36.14uek]
    - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)     [Orabug: 20425334]  {CVE-2014-7841}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
80515	Ubuntu 14.10 : linux vulnerabilities (USN-2468-1)	Nessus	Ubuntu Local Security Checks	1/14/2015	1/19/2021	medium
80578	Mandriva Linux Security Advisory : kernel (MDVSA-2015:027)	Nessus	Mandriva Local Security Checks	1/19/2015	1/6/2021	high
81906	RHEL 6 : kernel (RHSA-2015:0695)	Nessus	Red Hat Local Security Checks	3/18/2015	11/4/2024	high
82101	Debian DLA-118-1 : linux-2.6 security update	Nessus	Debian Local Security Checks	3/26/2015	1/11/2021	high
81054	CentOS 6 : kernel (CESA-2015:0087)	Nessus	CentOS Local Security Checks	1/29/2015	1/4/2021	medium
81065	Oracle Linux 6 : kernel (ELSA-2015-0087)	Nessus	Oracle Linux Local Security Checks	1/29/2015	2/9/2026	medium
81073	Scientific Linux Security Update : kernel on SL7.x x86_64 (20150128)	Nessus	Scientific Linux Local Security Checks	1/29/2015	1/14/2021	high
81089	CentOS 7 : kernel (CESA-2015:0102)	Nessus	CentOS Local Security Checks	1/30/2015	1/4/2021	high
81101	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3004)	Nessus	Oracle Linux Local Security Checks	1/30/2015	2/9/2026	medium
81102	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3005)	Nessus	Oracle Linux Local Security Checks	1/30/2015	2/9/2026	medium

Detections

Analytics

Plugins Search

medium

high

high

high

medium

medium

high

high

medium

medium