The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3645 advisory.

    - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060050]     {CVE-2016-6480} {CVE-2016-6480}
    - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche)  [Orabug: 25060011]  {CVE-2016-6327}
    - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059945]     {CVE-2016-6136}
    - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059899]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059899]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059753]  {CVE-2016-4569}
    - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058991]     {CVE-2016-3699}
    - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug:
    25058903]  {CVE-2015-8956}
    - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059046]     {CVE-2016-2053}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - acpi: Disable ACPI table override if securelevel is set     (Linn Crosetto) [Orabug: 25058966] (CVE-2016-3699)

  - aacraid: Check size values after double-fetch from user     (Dave Carroll) [Orabug: 25060060] (CVE-2016-6480)     (CVE-2016-6480)

  - audit: fix a double fetch in audit_log_single_execve_arg     (Paul Moore) [Orabug: 25059969] (CVE-2016-6136)

  - ecryptfs: don't allow mmap when the lower fs doesn't     support it (Jeff Mahoney) [Orabug: 25023269]     (CVE-2016-1583) (CVE-2016-1583)

  - Revert 'ecryptfs: forbid opening files without mmap     handler' (Chuck Anderson) [Orabug: 24971921]     (CVE-2016-1583)

  - percpu: fix synchronization between synchronous map     extension and chunk destruction (Tejun Heo) [Orabug:
    25060084] (CVE-2016-4794)

  - percpu: fix synchronization between     chunk->map_extend_work and chunk destruction (Tejun Heo)     [Orabug: 25060084] (CVE-2016-4794)

  - ALSA: timer: Fix leak in events via     snd_timer_user_tinterrupt (Kangjie Lu) [Orabug:
    25059898] (CVE-2016-4578)

  - ALSA: timer: Fix leak in events via     snd_timer_user_ccallback (Kangjie Lu) [Orabug: 25059898]     (CVE-2016-4578)

  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS     (Kangjie Lu) [Orabug: 25059752] (CVE-2016-4569)

  - Bluetooth: Fix potential NULL dereference in RFCOMM bind     callback (Jaganath Kanakkassery) [Orabug: 25058894]     (CVE-2015-8956)

  - ASN.1: Fix non-match detection failure on data overrun     (David Howells) [Orabug: 25059037] (CVE-2016-2053)

  - mm: migrate dirty page without clear_page_dirty_for_io     etc (Hugh Dickins) [Orabug: 25059188] (CVE-2016-3070)

  - uek-rpm ol7: change uek-rpm/ol7/update-el release value     from 7.1 to 7.3 (Chuck Anderson) [Orabug: 25050614]

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1135:09 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any     Linux operating system.  The kernel handles the basic functions     of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2013-4312     The Linux kernel before 4.4.1 allows local users to bypass     file-descriptor limits and cause a denial of service (memory     consumption) by sending each descriptor over a UNIX socket before     closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
    CVE-2015-8374     fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles     compressed inline extents, which allows local users to obtain     sensitive pre-truncation information from a file via a clone action.
    CVE-2015-8543     The networking implementation in the Linux kernel through 4.3.3, as     used in Android and other products, does not validate protocol     identifiers for certain protocol families, which allows local users to     cause a denial of service (NULL function pointer dereference and     system crash) or possibly gain privileges by leveraging CLONE_NEWUSER     support to execute a crafted SOCK_RAW application.
    CVE-2015-8746     fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2     does not properly initialize memory for migration recovery operations,     which allows remote NFS servers to cause a denial of service (NULL     pointer dereference and panic) via crafted network traffic.
    CVE-2015-8812     drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5     does not properly identify error conditions, which allows remote     attackers to execute arbitrary code or cause a denial of service     (use-after-free) via crafted packets.
    CVE-2015-8844     The signal implementation in the Linux kernel before 4.3.5 on powerpc     platforms does not check for an MSR with both the S and T bits set,     which allows local users to cause a denial of service (TM Bad Thing     exception and panic) via a crafted application.
    CVE-2015-8845     The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the     Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM     suspend mode exists before proceeding with a tm_reclaim call, which     allows local users to cause a denial of service (TM Bad Thing     exception and panic) via a crafted application.
    CVE-2015-8956     The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the     Linux kernel before 4.2 allows local users to obtain sensitive     information or cause a denial of service (NULL pointer dereference)     via vectors involving a bind system call on a Bluetooth RFCOMM socket.
    CVE-2016-2053     The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux     kernel before 4.3 allows attackers to cause a denial of service     (panic) via an ASN.1 BER file that lacks a public key, leading to     mishandling by the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c.
    CVE-2016-2069     Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1     allows local users to gain privileges by triggering access to a paging     structure by a different CPU.
    CVE-2016-2117     The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in     the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O,     which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data.
    CVE-2016-2384     Double free vulnerability in the snd_usbmidi_create function in     sound/usb/midi.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (panic) or possibly     have unspecified other impact via vectors involving an invalid USB     descriptor.
    CVE-2016-2847     fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of     unread data in pipes, which allows local users to cause a denial of     service (memory consumption) by creating many pipes with non-default     sizes.
    CVE-2016-3070     The trace_writeback_dirty_page implementation in     include/trace/events/writeback.h in the Linux kernel before 4.4     improperly interacts with mm/migrate.c, which allows local users to     cause a denial of service (NULL pointer dereference and system crash)     or possibly have unspecified other impact by triggering a certain page     move.
    CVE-2016-3156     The IPv4 implementation in the Linux kernel before 4.5.2 mishandles     destruction of device objects, which allows guest OS users to cause a     denial of service (host OS networking outage) by arranging for a large     number of IP addresses.
    CVE-2016-3699     The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat     Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows     local users to bypass intended Secure Boot restrictions and execute     untrusted code by appending ACPI tables to the initrd.
    CVE-2016-3841     The IPv6 stack in the Linux kernel before 4.3.3 mishandles options     data, which allows local users to gain privileges or cause a denial of     service (use-after-free and system crash) via a crafted sendmsg system     call.
    CVE-2016-4569     The snd_timer_user_params function in sound/core/timer.c in the Linux     kernel through 4.6 does not initialize a certain data structure, which     allows local users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface.
    CVE-2016-4578     sound/core/timer.c in the Linux kernel through 4.6 does not initialize     certain r1 data structures, which allows local users to obtain     sensitive information from kernel stack memory via crafted use of the     ALSA timer interface, related to the (1) snd_timer_user_ccallback and     (2) snd_timer_user_tinterrupt functions.
    CVE-2016-4581     fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse     a mount propagation tree in a certain case involving a slave mount,     which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls.
    CVE-2016-4794     Use-after-free vulnerability in mm/percpu.c in the Linux kernel     through 4.6 allows local users to cause a denial of service (BUG) or     possibly have unspecified other impact via crafted use of the mmap and     bpf system calls.
    CVE-2016-5412     arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through     4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled,     allows guest OS users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence of a suspended     transaction.
    CVE-2016-5828     The start_thread function in arch/powerpc/kernel/process.c in the     Linux kernel through 4.6.3 on powerpc platforms mishandles     transactional state, which allows local users to cause a denial of     service (invalid process state or TM Bad Thing exception, and system     crash) or possibly have unspecified other impact by starting and     suspending a transaction before an exec system call.
    CVE-2016-5829     Multiple heap-based buffer overflows in the hiddev_ioctl_usage     function in drivers/hid/usbhid/hiddev.c in the Linux kernel through     4.6.3 allow local users to cause a denial of service or possibly have     unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2)     HIDIOCSUSAGES ioctl call.
    CVE-2016-6136     Race condition in the audit_log_single_execve_arg function in     kernel/auditsc.c in the Linux kernel through 4.7 allows local users to     bypass intended character-set restrictions or disrupt system-call     auditing by changing a certain string, aka a double fetch     vulnerability.
    CVE-2016-6198     The filesystem layer in the Linux kernel before 4.5.5 proceeds with     post-rename operations after an OverlayFS file is renamed to a     self-hardlink, which allows local users to cause a denial of service     (system crash) via a rename system call, related to fs/namei.c and     fs/open.c.
    CVE-2016-6327     drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1     allows local users to cause a denial of service (NULL pointer     dereference and system crash) by using an ABORT_TASK command to abort     a device write operation.
    CVE-2016-6480     Race condition in the ioctl_send_fib function in     drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows     local users to cause a denial of service (out-of-bounds access or     system crash) by changing a certain size value, aka a double fetch     vulnerability.
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was found that the Linux kernel's IPv6 implementation     mishandled socket options. A local attacker could abuse     concurrent access to the socket options to escalate     their privileges, or cause a denial of service     (use-after-free and system crash) via a crafted sendmsg     system call. (CVE-2016-3841, Important)

(CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Additional Changes :

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - aacraid: Check size values after double-fetch from user     (Dave Carroll) [Orabug: 25060050] (CVE-2016-6480)     (CVE-2016-6480)

  - IB/srpt: Simplify srpt_handle_tsk_mgmt (Bart Van Assche)     [Orabug: 25060011] (CVE-2016-6327)

  - audit: fix a double fetch in audit_log_single_execve_arg     (Paul Moore) [Orabug: 25059945] (CVE-2016-6136)

  - ALSA: timer: Fix leak in events via     snd_timer_user_tinterrupt (Kangjie Lu) [Orabug:
    25059899] (CVE-2016-4578)

  - ALSA: timer: Fix leak in events via     snd_timer_user_ccallback (Kangjie Lu) [Orabug: 25059899]     (CVE-2016-4578)

  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS     (Kangjie Lu) [Orabug: 25059753] (CVE-2016-4569)

  - acpi: Disable ACPI table override if securelevel is set     (Linn Crosetto) [Orabug: 25058991] (CVE-2016-3699)

  - Bluetooth: Fix potential NULL dereference in RFCOMM bind     callback (Jaganath Kanakkassery) [Orabug: 25058903]     (CVE-2015-8956)

  - ASN.1: Fix non-match detection failure on data overrun     (David Howells) [Orabug: 25059046] (CVE-2016-2053)

  - mm: migrate dirty page without clear_page_dirty_for_io     etc (Hugh Dickins) [Orabug: 25059194] (CVE-2016-3070)

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3644 advisory.

    - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058966]     {CVE-2016-3699}
    - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060060]     {CVE-2016-6480} {CVE-2016-6480}
    - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059969]     {CVE-2016-6136}
    - ecryptfs: don't allow mmap when the lower fs doesn't support it (Jeff Mahoney)  [Orabug: 25023269]     {CVE-2016-1583} {CVE-2016-1583}
    - Revert 'ecryptfs: forbid opening files without mmap handler' (Chuck Anderson)  [Orabug: 24971921]     {CVE-2016-1583}
    - percpu: fix synchronization between synchronous map extension and chunk destruction (Tejun Heo)     [Orabug: 25060084]  {CVE-2016-4794}
    - percpu: fix synchronization between chunk->map_extend_work and chunk destruction (Tejun Heo)  [Orabug:
    25060084]  {CVE-2016-4794}
    - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059898]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059898]     {CVE-2016-4578}
    - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059752]  {CVE-2016-4569}
    - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug:
    25058894]  {CVE-2015-8956}
    - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059037]     {CVE-2016-2053}
    - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059188]     {CVE-2016-3070}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2574 advisory.

    - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Larry Woodman) [1385124] {CVE-2016-5195}
    - [net] add recursion limit to GRO (Sabrina Dubroca) [1374191] {CVE-2016-7039}
    - [kernel] audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore) [1359306]     {CVE-2016-6136}
    - [scsi] aacraid: Check size values after double-fetch from user (Maurizio Lombardi) [1369771]     {CVE-2016-6480}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
95043	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3645)	Nessus	Oracle Linux Local Security Checks	11/22/2016	2/9/2026	high
95045	OracleVM 3.4 : Unbreakable / etc (OVMSA-2016-0162)	Nessus	OracleVM Local Security Checks	11/22/2016	1/16/2026	high
289409	MiracleLinux 7 : kernel-3.10.0-514.el7 (AXSA:2016-1135:09)	Nessus	Miracle Linux Local Security Checks	1/16/2026	2/9/2026	critical
95841	Scientific Linux Security Update : kernel on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	12/15/2016	1/14/2026	critical
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	4/3/2017	12/26/2025	critical
95046	OracleVM 3.3 : Unbreakable / etc (OVMSA-2016-0163)	Nessus	OracleVM Local Security Checks	11/22/2016	1/16/2026	high
94537	RHEL 7 : kernel (RHSA-2016:2574)	Nessus	Red Hat Local Security Checks	11/4/2016	1/20/2026	critical
94547	RHEL 7 : kernel-rt (RHSA-2016:2584)	Nessus	Red Hat Local Security Checks	11/4/2016	1/20/2026	critical
95042	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3644)	Nessus	Oracle Linux Local Security Checks	11/22/2016	2/9/2026	high
94697	Oracle Linux 7 : kernel (ELSA-2016-2574)	Nessus	Oracle Linux Local Security Checks	11/11/2016	2/9/2026	critical
95321	CentOS 7 : kernel (CESA-2016:2574)	Nessus	CentOS Local Security Checks	11/28/2016	1/4/2021	critical

Detections

Analytics

Plugins Search

high

high

critical

critical

critical

high

critical

critical

high

critical

critical