Solar Designer discovered that the z90crypt driver did not correctly check capabilities. A local attacker could exploit this to shut down the device, leading to a denial of service. Only affected Ubuntu 6.06.
(CVE-2009-1883)

Michael Buesch discovered that the SGI GRU driver did not correctly check the length when setting options. A local attacker could exploit this to write to the kernel stack, leading to root privilege escalation or a denial of service. Only affected Ubuntu 8.10 and 9.04.
(CVE-2009-2584)

It was discovered that SELinux did not fully implement the mmap_min_addr restrictions. A local attacker could exploit this to allocate the NULL memory page which could lead to further attacks against kernel NULL-dereference vulnerabilities. Ubuntu 6.06 was not affected. (CVE-2009-2695)

Cagri Coltekin discovered that the UDP stack did not correctly handle certain flags. A local user could send specially crafted commands and traffic to gain root privileges or crash the systeam, leading to a denial of service. Only affected Ubuntu 6.06. (CVE-2009-2698)

Hiroshi Shimamoto discovered that monotonic timers did not correctly validate parameters. A local user could make a specially crafted timer request to gain root privileges or crash the system, leading to a denial of service. Only affected Ubuntu 9.04. (CVE-2009-2767)

Michael Buesch discovered that the HPPA ISA EEPROM driver did not correctly validate positions. A local user could make a specially crafted request to gain root privileges or crash the system, leading to a denial of service. (CVE-2009-2846)

Ulrich Drepper discovered that kernel signal stacks were not being correctly padded on 64-bit systems. A local attacker could send specially crafted calls to expose 4 bytes of kernel stack memory, leading to a loss of privacy. (CVE-2009-2847)

Jens Rosenboom discovered that the clone method did not correctly clear certain fields. A local attacker could exploit this to gain privileges or crash the system, leading to a denial of service.
(CVE-2009-2848)

It was discovered that the MD driver did not check certain sysfs files. A local attacker with write access to /sys could exploit this to cause a system crash, leading to a denial of service. Ubuntu 6.06 was not affected. (CVE-2009-2849)

Mark Smith discovered that the AppleTalk stack did not correctly manage memory. A remote attacker could send specially crafted traffic to cause the system to consume all available memory, leading to a denial of service. (CVE-2009-2903)

Loic Minier discovered that eCryptfs did not correctly handle writing to certain deleted files. A local attacker could exploit this to gain root privileges or crash the system, leading to a denial of service.
Ubuntu 6.06 was not affected. (CVE-2009-2908)

It was discovered that the LLC, AppleTalk, IR, EConet, Netrom, and ROSE network stacks did not correctly initialize their data structures. A local attacker could make specially crafted calls to read kernel memory, leading to a loss of privacy. (CVE-2009-3001, CVE-2009-3002)

It was discovered that the randomization used for Address Space Layout Randomization was predictable within a small window of time. A local attacker could exploit this to leverage further attacks that require knowledge of userspace memory layouts. (CVE-2009-3238)

Eric Paris discovered that NFSv4 did not correctly handle file creation failures. An attacker with write access to an NFSv4 share could exploit this to create files with arbitrary mode bits, leading to privilege escalation or a loss of privacy. (CVE-2009-3286)

Bob Tracy discovered that the SCSI generic driver did not correctly use the right index for array access. A local attacker with write access to a CDR could exploit this to crash the system, leading to a denial of service. Only Ubuntu 9.04 was affected. (CVE-2009-3288)

Jan Kiszka discovered that KVM did not correctly validate certain hypercalls. A local unprivileged attacker in a virtual guest could exploit this to crash the guest kernel, leading to a denial of service. Ubuntu 6.06 was not affected. (CVE-2009-3290).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a single critical security issue in the SUSE Linux Enterprise 9 kernel.

  - A missing check in the MSG_PROBE handling can be used to     execute privileges to root. (CVE-2009-2698)

This update fixes a single critical security issues in the SUSE Linux Enterprise 10 SP 2 kernel.

  - A missing check in the MSG_PROBE handling can be used to     execute privileges to root. (CVE-2009-2698)

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a flaw was found in the SOCKOPS_WRAP macro in the Linux kernel. This macro did not initialize the sendpage operation in the proto_ops structure correctly. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges.
(CVE-2009-2692, Important)

* a flaw was found in the udp_sendmsg() implementation in the Linux kernel when using the MSG_MORE flag on UDP sockets. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2698, Important)

Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting these flaws.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

From Red Hat Security Advisory 2009:1223 :

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a flaw was found in the SOCKOPS_WRAP macro in the Linux kernel. This macro did not initialize the sendpage operation in the proto_ops structure correctly. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges.
(CVE-2009-2692, Important)

* a flaw was found in the udp_sendmsg() implementation in the Linux kernel when using the MSG_MORE flag on UDP sockets. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2698, Important)

Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting these flaws.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-387:10 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.
    Security bugs fixed by this release:
    CVE-2009-2692     The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function     pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer     dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and     then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function)     on a PF_PPPOX socket.
    CVE-2009-2698     The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the     Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL     pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
    Other bugs:
     - fixed the behaviour of ethtool when ONBOOT=no
     - fixed race and removed some debug code

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a flaw was found in the SOCKOPS_WRAP macro in the Linux kernel. This macro did not initialize the sendpage operation in the proto_ops structure correctly. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges.
(CVE-2009-2692, Important)

* a flaw was found in the udp_sendmsg() implementation in the Linux kernel when using the MSG_MORE flag on UDP sockets. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2698, Important)

Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting these flaws.

All Red Hat Enterprise Linux 3 users should upgrade to these updated packages, which contain backported patches to resolve these issues.
The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues and a bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a flaw was found in the SOCKOPS_WRAP macro in the Linux kernel. This macro did not initialize the sendpage operation in the proto_ops structure correctly. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges.
(CVE-2009-2692, Important)

* a flaw was found in the udp_sendmsg() implementation in the Linux kernel when using the MSG_MORE flag on UDP sockets. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2698, Important)

Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting these flaws.

These updated packages also fix the following bug :

* in the dlm code, a socket was allocated in tcp_connect_to_sock(), but was not freed in the error exit path. This bug led to a memory leak and an unresponsive system. A reported case of this bug occurred after running 'cman_tool kill -n [nodename]'. (BZ#515432)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix several security issues are now available for Red Hat Enterprise Linux 5.2 Extended Update Support.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in the Linux kernel. This driver allowed interfaces using this driver to receive frames larger than what could be handled. This could lead to a remote denial of service or code execution. (CVE-2009-1389, Important)

* Tavis Ormandy and Julien Tinnes of the Google Security Team reported a flaw in the SOCKOPS_WRAP macro in the Linux kernel. This macro did not initialize the sendpage operation in the proto_ops structure correctly. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2692, Important)

* Tavis Ormandy and Julien Tinnes of the Google Security Team reported a flaw in the udp_sendmsg() implementation in the Linux kernel when using the MSG_MORE flag on UDP sockets. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2698, Important)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1222 advisory.

    - [net] prevent null pointer dereference in udp_sendmsg (Vitaly Mayatskikh) [518047 518043]     {CVE-2009-2698}
    - [net] make sock_sendpage use kernel_sendpage (Jiri Pirko ) [517445 516955] {CVE-2009-2692}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to denial of service, privilege escalation or a leak of sensitive memory. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2698     Herbert Xu discovered an issue in the way UDP tracks     corking status that could allow local users to cause a     denial of service (system crash). Tavis Ormandy and     Julien Tinnes discovered that this issue could also be     used by local users to gain elevated privileges.

  - CVE-2009-2846     Michael Buesch noticed a typing issue in the eisa-eeprom     driver for the hppa architecture. Local users could     exploit this issue to gain access to restricted memory.

  - CVE-2009-2847     Ulrich Drepper noticed an issue in the do_sigalstack     routine on 64-bit systems. This issue allows local users     to gain access to potentially sensitive memory on the     kernel stack.

  - CVE-2009-2848     Eric Dumazet discovered an issue in the execve path,     where the clear_child_tid variable was not being     properly cleared. Local users could exploit this issue     to cause a denial of service (memory corruption).

  - CVE-2009-2849     Neil Brown discovered an issue in the sysfs interface to     md devices. When md arrays are not active, local users     can exploit this vulnerability to cause a denial of     service (oops).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42209	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : linux, linux-source-2.6.15 vulnerabilities (USN-852-1)	Nessus	Ubuntu Local Security Checks	2009/10/22	2021/1/19	high
41322	SuSE9 Security Update : Linux kernel (YOU Patch Number 12487)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
59139	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 6460)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high
40753	CentOS 4 : kernel (CESA-2009:1223)	Nessus	CentOS Local Security Checks	2009/8/25	2021/1/4	high
67915	Oracle Linux 4 : kernel (ELSA-2009-1223)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
283909	MiracleLinux 3 : kernel-2.6.18-128.9AXS3 (AXSA:2009-387:10)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	high
40795	RHEL 3 : kernel (RHSA-2009:1233)	Nessus	Red Hat Local Security Checks	2009/8/28	2021/1/14	high
43777	CentOS 5 : kernel (CESA-2009:1222)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high
63896	RHEL 5 : kernel (RHSA-2009:1457)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
67914	Oracle Linux 5 : kernel (ELSA-2009-1222)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
44737	Debian DSA-1872-1 : linux-2.6 - denial of service/privilege escalation/information leak	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high