The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0981 advisory.

  - Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1     allows local users to cause a denial of service (use-after-free and system crash) or possibly gain     privileges via a crafted application that leverages an improperly managed reference counter.
    (CVE-2014-2851)

  - The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact via a bind system call for an RDS socket on a system that lacks RDS transports. (CVE-2013-7339)

  - The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter     function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length     value is sufficiently large, which allows local users to cause a denial of service (integer underflow and     system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the vulnerability was announced. (CVE-2014-3144)

  - The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in     the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users     to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected     code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
    (CVE-2014-3145)

  - The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact via a bind system call for an RDS socket on a system that lacks RDS transports. (CVE-2014-2678)

  - The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that     calls have two different futex addresses, which allows local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have unspecified other impact via a crafted     FUTEX_WAIT_REQUEUE_PI command. (CVE-2012-6647)

  - Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux     kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large     amount of network traffic that triggers certain list deletions. (CVE-2014-2672)

  - Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to     cause a denial of service (system crash) via network traffic that improperly interacts with the     WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (CVE-2014-2706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A use-after-free flaw was found in the way the ping_init_sock() function of the Linux kernel handled the group_info reference counter.
A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-2851, Important)

* A NULL pointer dereference flaw was found in the way the futex_wait_requeue_pi() function of the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to crash the system.
(CVE-2012-6647, Moderate)

* A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2013-7339, Moderate)

* It was found that a remote attacker could use a race condition flaw in the ath_tx_aggr_sleep() function to crash the system by creating large network traffic on the system's Atheros 9k wireless network adapter. (CVE-2014-2672, Moderate)

* A NULL pointer dereference flaw was found in the rds_iw_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2014-2678, Moderate)

* A race condition flaw was found in the way the Linux kernel's mac80211 subsystem implementation handled synchronization between TX and STA wake-up code paths. A remote attacker could use this flaw to crash the system. (CVE-2014-2706, Moderate)

* An out-of-bounds memory access flaw was found in the Netlink Attribute extension of the Berkeley Packet Filter (BPF) interpreter functionality in the Linux kernel's networking implementation. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145, Moderate)

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3054 advisory.

  - The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly     manage tty driver access in the LECHO & !OPOST case, which allows local users to cause a denial of     service (memory corruption and system crash) or gain privileges by triggering a race condition involving     read and write operations with long strings. (CVE-2014-0196)

  - The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter     function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length     value is sufficiently large, which allows local users to cause a denial of service (integer underflow and     system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the vulnerability was announced. (CVE-2014-3144)

  - The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in     the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users     to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected     code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
    (CVE-2014-3145)

  - The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that     calls have two different futex addresses, which allows local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have unspecified other impact via a crafted     FUTEX_WAIT_REQUEUE_PI command. (CVE-2012-6647)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
76888	Oracle Linux 6 : kernel (ELSA-2014-0981)	Nessus	Oracle Linux Local Security Checks	7/30/2014	9/8/2021	high
76908	RHEL 6 : kernel (RHSA-2014:0981)	Nessus	Red Hat Local Security Checks	7/30/2014	1/14/2021	high
76948	CentOS 6 : kernel (CESA-2014:0981)	Nessus	CentOS Local Security Checks	8/1/2014	1/4/2021	high
76928	Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2014-3054)	Nessus	Oracle Linux Local Security Checks	7/31/2014	5/14/2023	high

Detections

Analytics

Plugins Search

high

high

high

high