Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service.

  - CVE-2015-3290     Andy Lutomirski discovered that the Linux kernel does     not properly handle nested NMIs. A local, unprivileged     user could use this flaw for privilege escalation.

  - CVE-2015-3291     Andy Lutomirski discovered that under certain conditions     a malicious userspace program can cause the kernel to     skip NMIs leading to a denial of service.

  - CVE-2015-4167     Carl Henrik Lunde discovered that the UDF implementation     is missing a necessary length check. A local user that     can mount devices could use this flaw to crash the     system.

  - CVE-2015-5157     Petr Matousek and Andy Lutomirski discovered that an NMI     that interrupts userspace and encounters an IRET fault     is incorrectly handled. A local, unprivileged user could     use this flaw for denial of service or possibly for     privilege escalation.

  - CVE-2015-5364     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     could exploit this flaw to cause a denial of service     using a flood of UDP packets with invalid checksums.

  - CVE-2015-5366     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     can cause a denial of service against applications that     use epoll by injecting a single packet with an invalid     checksum.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly     determine when nested NMI processing is occurring, which allows local users to cause a denial of service     (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.
    (CVE-2015-3291)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that the Linux kernel's implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already     processed when retrying after a failed atomic access     operation, potentially resulting in memory corruption     due to an I/O vector array overrun. A local,     unprivileged user could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-1805)

  - net/llc/sysctl_net_llc.c in the Linux kernel before     3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry.(CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042)

  - Xen 3.3.x through 4.5.x and the Linux kernel through     3.19.1 do not properly restrict access to PCI command     registers, which might allow local guest OS users to     cause a denial of service (non-maskable interrupt and     host crash) by disabling the (1) memory or (2) I/O     decoding for a PCI Express device and then accessing     the device, which triggers an Unsupported Request (UR)     response.(CVE-2015-2150)

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666)

  - The xsave/xrstor implementation in     arch/x86/include/asm/xsave.h in the Linux kernel before     3.19.2 creates certain .altinstr_replacement pointers     and consequently does not provide any protection     against instruction faulting, which allows local users     to cause a denial of service (panic) by triggering a     fault, as demonstrated by an unaligned memory operand     or a non-canonical address memory     operand.(CVE-2015-2672)

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830)

  - It was found that the Linux kernel's TCP/IP protocol     suite implementation for IPv6 allowed the Hop Limit     value to be set to a smaller value than the default     one. An attacker on a local network could use this flaw     to prevent systems on that network from sending or     receiving network packets.(CVE-2015-2922)

  - A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in     which the source was inside and the destination was     outside of a bind mount. A privileged user inside a     container could use this flaw to escape the bind mount     and, potentially, escalate their privileges on the     system.(CVE-2015-2925)

  - A race condition flaw was found in the way the Linux     kernel's SCTP implementation handled Address     Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could     use this flaw to crash the system via a race condition     triggered by setting certain ASCONF options on a     socket.(CVE-2015-3212)

  - mm/memory.c in the Linux kernel before 4.1.4 mishandles     anonymous pages, which allows local users to gain     privileges or cause a denial of service (page tainting)     via a crafted application that triggers writing to page     zero.(CVE-2015-3288)

  - A flaw was found in the way the Linux kernel's nested     NMI handler and espfix64 functionalities interacted     during NMI processing. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system.(CVE-2015-3290)

  - It was found that if a Non-Maskable Interrupt (NMI)     occurred immediately after a SYSCALL call or before a     SYSRET call with the user RSP pointing to the NMI IST     stack, the kernel could skip that NMI.(CVE-2015-3291)

  - A buffer overflow flaw was found in the way the Linux     kernel's Intel AES-NI instructions optimized version of     the RFC4106 GCM mode decryption functionality handled     fragmented packets. A remote attacker could use this     flaw to crash, or potentially escalate their privileges     on, a system over a connection with an active AES-GCM     mode IPSec security association.(CVE-2015-3331)

  - A race condition flaw was found between the chown and     execve system calls. When changing the owner of a     setuid user binary to root, the race condition could     momentarily make the binary setuid root. A local,     unprivileged user could potentially use this flaw to     escalate their privileges on the system.(CVE-2015-3339)

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636)

  - An inode data validation error was found in Linux     kernels built with UDF file system (CONFIG_UDF_FS)     support. An attacker able to mount a     corrupted/malicious UDF file system image could cause     the kernel to crash.(CVE-2015-4167)

  - A flaw was discovered in the way the Linux kernel's TTY     subsystem handled the tty shutdown phase. A local,     unprivileged user could use this flaw to cause denial     of service on the system by holding a reference to the     ldisc lock during tty shutdown, causing a     deadlock.(CVE-2015-4170)

  - A flaw was discovered in the kernel's collect_mounts     function. If the kernel's audit subsystem called     collect_mounts to audit an unmounted path, it could     panic the system. With this flaw, an unprivileged user     could call umount(MNT_DETACH) to launch a     denial-of-service attack.(CVE-2015-4177)

  - A DoS flaw was found for a Linux kernel built for the     x86 architecture which had the KVM virtualization     support(CONFIG_KVM) enabled. The kernel would be     vulnerable to a NULL pointer dereference flaw in Linux     kernel's kvm_apic_has_events() function while doing an     ioctl. An unprivileged user able to access the     '/dev/kvm' device could use this flaw to crash the     system kernel.(CVE-2015-4692)

  - A flaw was found in the kernel's implementation of the     Berkeley Packet Filter (BPF). A local attacker could     craft BPF code to crash the system by creating a     situation in which the JIT compiler would fail to     correctly optimize the JIT image on the last pass. This     would lead to the CPU executing instructions that were     not part of the JIT code.(CVE-2015-4700)

  - A buffer overflow flaw was found in the way the Linux     kernel's virtio-net subsystem handled certain fraglists     when the GRO (Generic Receive Offload) functionality     was enabled in a bridged network configuration. An     attacker on the local network could potentially use     this flaw to crash the system, or, although unlikely,     elevate their privileges on the system.(CVE-2015-5156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2688-1 advisory.

    Andy Lutomirski discovered a flaw in the Linux kernel's handling of nested NMIs (non-maskable interrupts).
    An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or     potentially escalate their privileges. (CVE-2015-3290)

    Colin King discovered a flaw in the add_key function of the Linux kernel's keyring subsystem. A local user     could exploit this flaw to cause a denial of service (memory exhaustion). (CVE-2015-1333)

    Andy Lutomirski discovered a flaw that allows user to cause the Linux kernel to ignore some NMIs (non-     maskable interrupts). A local unprivileged user could exploit this flaw to potentially cause the system to     miss important NMIs resulting in unspecified effects. (CVE-2015-3291)

    Andy Lutomirski and Petr Matousek discovered that an NMI (non-maskable interrupt) that interrupts     userspace and encounters an IRET fault is incorrectly handled by the Linux kernel. An unprivileged local     user could exploit this flaw to cause a denial of service (kernel OOPs), corruption, or potentially     escalate privileges on the system. (CVE-2015-5157)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2690-1 advisory.

    Andy Lutomirski discovered a flaw in the Linux kernel's handling of nested NMIs (non-maskable interrupts).
    An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or     potentially escalate their privileges. (CVE-2015-3290)

    Colin King discovered a flaw in the add_key function of the Linux kernel's keyring subsystem. A local user     could exploit this flaw to cause a denial of service (memory exhaustion). (CVE-2015-1333)

    Andy Lutomirski discovered a flaw that allows user to cause the Linux kernel to ignore some NMIs (non-     maskable interrupts). A local unprivileged user could exploit this flaw to potentially cause the system to     miss important NMIs resulting in unspecified effects. (CVE-2015-3291)

    Andy Lutomirski and Petr Matousek discovered that an NMI (non-maskable interrupt) that interrupts     userspace and encounters an IRET fault is incorrectly handled by the Linux kernel. An unprivileged local     user could exploit this flaw to cause a denial of service (kernel OOPs), corruption, or potentially     escalate privileges on the system. (CVE-2015-5157)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
84965	Debian DSA-3313-1 : linux - security update	Nessus	Debian Local Security Checks	7/24/2015	1/11/2021	high
218949	Linux Distros Unpatched Vulnerability : CVE-2015-3291	Nessus	Misc.	3/4/2025	9/4/2025	high
124811	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1487)	Nessus	Huawei Local Security Checks	5/13/2019	5/23/2024	high
85076	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2688-1)	Nessus	Ubuntu Local Security Checks	7/29/2015	8/27/2024	high
85078	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2690-1)	Nessus	Ubuntu Local Security Checks	7/29/2015	8/28/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high