The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3032 advisory.

    - isofs: Fix unchecked printing of ER records (Jan Kara)  [Orabug: 20930551]  {CVE-2014-9584}
    - KEYS: close race between key lookup and freeing (Sasha Levin)  [Orabug: 20930548]  {CVE-2014-9529}     {CVE-2014-9529}
    - mm: memcg: do not allow task about to OOM kill to bypass the limit (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - mm: memcg: do not declare OOM from __GFP_NOFAIL allocations (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - fs: buffer: move allocation failure loop into the allocator (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - mm: memcg: handle non-error OOM situations more gracefully (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - mm: memcg: do not trap chargers with full callstack on OOM (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - mm: memcg: rework and document OOM waiting and wakeup (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - mm: memcg: enable memcg OOM killer only for user faults (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - x86: finish user fault error path with fatal signal (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}
    - arch: mm: pass userspace fault flag to generic fault handler (Johannes Weiner)  [Orabug: 20930539]     {CVE-2014-8171}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of the SYSTENTER instruction when the guest OS does not initialize the SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of service of the guest OS (crash) or potentially gain privileges on the guest OS. (CVE-2015-0239)

A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges.
(CVE-2013-7421)

Andy Lutomirski discovered a flaw in how the Linux kernel handles pivot_root when used with a chroot directory. A local user could exploit this flaw to cause a denial of service (mount-tree loop).
(CVE-2014-7970)

A restriction bypass was discovered in iptables when conntrack rules are specified and the conntrack protocol handler module is not loaded into the Linux kernel. This flaw can cause the firewall rules on the system to be bypassed when conntrack rules are used. (CVE-2014-8160)

A race condition was discovered in the Linux kernel's key ring. A local user could cause a denial of service (memory corruption or panic) or possibly have unspecified impact via the keyctl commands.
(CVE-2014-9529)

A memory leak was discovered in the ISO 9660 CDROM file system when parsing rock ridge ER records. A local user could exploit this flaw to obtain sensitive information from kernel memory via a crafted iso9660 image. (CVE-2014-9584)

A flaw was discovered in the Address Space Layout Randomization (ASLR) of the Virtual Dynamically linked Shared Objects (vDSO) location. This flaw makes it easier for a local user to bypass the ASLR protection mechanism. (CVE-2014-9585)

A flaw was discovered in the crypto subsystem when screening module names for automatic module loading if the name contained a valid crypto module name, eg. vfat(aes). A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges.
(CVE-2014-9644).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2516-1 advisory.

    A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of the SYSTENTER instruction when     the guest OS does not initialize the SYSENTER MSRs. A guest OS user could exploit this flaw to cause a     denial of service of the guest OS (crash) or potentially gain privileges on the guest OS. (CVE-2015-0239)

    Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS)     implementation allowing users to bypass the espfix to obtain information that could be used to bypass the     Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to     obtain potentially sensitive information from kernel memory. (CVE-2014-8133)

    A restriction bypass was discovered in iptables when conntrack rules are specified and the conntrack     protocol handler module is not loaded into the Linux kernel. This flaw can cause the firewall rules on the     system to be bypassed when conntrack rules are used. (CVE-2014-8160)

    A flaw was discovered with file renaming in the linux kernel. A local user could exploit this flaw to     cause a denial of service (deadlock and system hang). (CVE-2014-8559)

    A flaw was discovered in how supplemental group memberships are handled in certain namespace scenarios. A     local user could exploit this flaw to bypass file permission restrictions. (CVE-2014-8989)

    A flaw was discovered in how Thread Local Storage (TLS) is handled by the task switching function in the     Linux kernel for x86_64 based machines. A local user could exploit this flaw to bypass the Address Space     Layout Radomization (ASLR) protection mechanism. (CVE-2014-9419)

    Prasad J Pandit reported a flaw in the rock_continue function of the Linux kernel's ISO 9660 CDROM file     system. A local user could exploit this flaw to cause a denial of service (system crash or hang).
    (CVE-2014-9420)

    A flaw was discovered in the fragment handling of the B.A.T.M.A.N. Advanced Meshing Protocol in the Linux     kernel. A remote attacker could exploit this flaw to cause a denial of service (mesh-node system crash)     via fragmented packets. (CVE-2014-9428)

    A race condition was discovered in the Linux kernel's key ring. A local user could cause a denial of     service (memory corruption or panic) or possibly have unspecified impact via the keyctl commands.
    (CVE-2014-9529)

    A memory leak was discovered in the ISO 9660 CDROM file system when parsing rock ridge ER records. A local     user could exploit this flaw to obtain sensitive information from kernel memory via a crafted iso9660     image. (CVE-2014-9584)

    A flaw was discovered in the Address Space Layout Randomization (ASLR) of the Virtual Dynamically linked     Shared Objects (vDSO) location. This flaw makes it easier for a local user to bypass the ASLR protection     mechanism. (CVE-2014-9585)

    Dmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file name decoding. A local     unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain     administrative privileges. (CVE-2014-9683)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel-rt packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-1805, Important)

* A race condition flaw was found in the way the Linux kernel keys management subsystem performed key garbage collection. A local attacker could attempt accessing a key while it was being garbage collected, which would cause the system to crash. (CVE-2014-9529, Moderate)

* A flaw was found in the way the Linux kernel's 32-bit emulation implementation handled forking or closing of a task with an 'int80' entry. A local user could potentially use this flaw to escalate their privileges on the system. (CVE-2015-2830, Low)

* It was found that the Linux kernel's ISO file system implementation did not correctly limit the traversal of Rock Ridge extension Continuation Entries (CE). An attacker with physical access to the system could use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service. (CVE-2014-9420, Low)

* An information leak flaw was found in the way the Linux kernel's ISO9660 file system implementation accessed data on an ISO9660 image with RockRidge Extension Reference (ER) records. An attacker with physical access to the system could use this flaw to disclose up to 255 bytes of kernel memory. (CVE-2014-9584, Low)

* A flaw was found in the way the nft_flush_table() function of the Linux kernel's netfilter tables implementation flushed rules that were referencing deleted chains. A local user who has the CAP_NET_ADMIN capability could use this flaw to crash the system. (CVE-2015-1573, Low)

* An integer overflow flaw was found in the way the Linux kernel randomized the stack for processes on certain 64-bit architecture systems, such as x86-64, causing the stack entropy to be reduced by four. (CVE-2015-1593, Low)

Red Hat would like to thank Carl Henrik Lunde for reporting CVE-2014-9420 and CVE-2014-9584. The security impact of CVE-2015-1805 was discovered by Red Hat.

This update provides a build of the kernel-rt package for Red Hat Enterprise MRG 2.5 that is layered on Red Hat Enterprise Linux 6, and fixes the following issues :

* storvsc: get rid of overly verbose warning messages

* storvsc: force discovery of LUNs that may have been removed

* storvsc: in responce to a scan event, scan the hos

* storvsc: NULL pointer dereference fix

* futex: Mention key referencing differences between shared and private futexes

* futex: Ensure get_futex_key_refs() always implies a barrier

* kernel module: set nx before marking module MODULE_STATE_COMING

* kernel module: Clean up ro/nx after early module load failures

* btrfs: make xattr replace operations atomic

* megaraid_sas: revert: Add release date and update driver version

* radeon: fix kernel segfault in hwmonitor

(BZ#1223077)

Bug fix :

* There is an XFS optimization that depended on a spinlock to disable preemption using the preempt_disable() function. When CONFIG_PREEMPT_RT is enabled on realtime kernels, spinlocks do not disable preemption while held, so the XFS critical section was not protected from preemption. Systems on the Realtime kernel-rt could lock up in this XFS optimization when a task that locked all the counters was then preempted by a realtime task, causing all callers of that lock to block indefinitely. This update disables the optimization when building a kernel with CONFIG_PREEMPT_RT_FULL enabled.
(BZ#1217849)

All kernel-rt users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. The system must be rebooted for this update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
83045	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3032)	Nessus	Oracle Linux Local Security Checks	4/24/2015	2/9/2026	medium
81567	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2513-1)	Nessus	Ubuntu Local Security Checks	2/27/2015	1/19/2021	medium
81569	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2516-1)	Nessus	Ubuntu Local Security Checks	2/27/2015	8/28/2024	medium
84357	RHEL 6 : MRG (RHSA-2015:1138)	Nessus	Red Hat Local Security Checks	6/24/2015	2/5/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium