It was discovered that KVM did not correctly initialize certain CPU registers. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3698)

Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.
(CVE-2010-3865)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3877)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Dan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4079)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)

Vegard Nossum discovered a leak in the kernel's inotify_init() system call. A local, unprivileged user could exploit this to cause a denial of service. (CVE-2010-4250)

Nelson Elhage discovered that Econet did not correctly handle AUN packets over UDP. A local attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2010-4342)

Tavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks.
(CVE-2010-4346)

Dan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. (CVE-2010-4527)

An error was reported in the kernel's ORiNOCO wireless driver's handling of TKIP countermeasures. This reduces the amount of time an attacker needs breach a wireless network using WPA+TKIP for security.
(CVE-2010-4648)

Dan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)

An error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)

A flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)

It was discovered that some import kernel threads can be blocked by a user level process. An unprivileged local user could exploit this flaw to cause a denial of service. (CVE-2011-4621).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-2011 advisory.

    - [sctp] Do not reset the packet during sctp_packet_con[CVE-2010-3432]
    - [drm/i915] Sanity check pread/pwrite [CVE-2010-2962]
    - [wireless] fix kernel heap content leak [CVE-2010-2955]
    - [sctp] Fix out-of-bounds reading in sctp_asoc_get_hmac() [CVE-2010-3705]
    - [niu] Fix kernel buffer overflow for ETHTOOL_GRXCLSRLALL [CVE-2010-3084]
    - Fix pktcdvd ioctl dev_minor range check [CVE-2010-3437]
    - Do not allow llseek to set_ftrace_filter [CVE-2010-3079]
    - [kvm] Fix fs/gs reload oops with invalid ldt [CVE-2010-3698]
    - [alsa] prevent heap corruption in snd_ctl_new() [CVE-2010-3442]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way QEMU-KVM handled the reloading of fs and gs segment registers when they had invalid selectors. A privileged host user with access to '/dev/kvm' could use this flaw to crash the host (denial of service). (CVE-2010-3698)

The following procedure must be performed before this update will take effect :

1) Stop all KVM guest virtual machines.

2) Either reboot the hypervisor machine or, as the root user, remove (using 'modprobe -r [module]') and reload (using 'modprobe [module]') all of the following modules which are currently running (determined using 'lsmod'): kvm, ksm, kvm-intel or kvm-amd.

3) Restart the KVM guest virtual machines.

Updated kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Red Hat Enterprise Linux kernel.

A flaw was found in the way QEMU-KVM handled the reloading of fs and gs segment registers when they had invalid selectors. A privileged host user with access to '/dev/kvm' could use this flaw to crash the host (denial of service). (CVE-2010-3698)

All KVM users should upgrade to these updated packages, which contain a backported patch to correct this issue. Note: The procedure in the Solution section must be performed before this update will take effect.

Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service. (CVE-2010-0435)

Dan Jacobson discovered that ThinkPad video output was not correctly access controlled. A local attacker could exploit this to hang the system, leading to a denial of service. (CVE-2010-3448)

It was discovered that KVM did not correctly initialize certain CPU registers. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3698)

Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. (CVE-2010-3859)

Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.
(CVE-2010-3865)

Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3873)

Dan Rosenberg discovered that the CAN protocol on 64bit systems did not correctly calculate the size of certain buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2010-3874)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3877)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Dan Rosenberg discovered that IPC structures were not correctly initialized on 64bit systems. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4073)

Dan Rosenberg discovered that the USB subsystem did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4074)

Dan Rosenberg discovered that the SiS video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4078)

Dan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4079)

Dan Rosenberg discovered that the RME Hammerfall DSP audio interface driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, CVE-2010-4081)

Dan Rosenberg discovered that the VIA video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4082)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

James Bottomley discovered that the ICP vortex storage array controller driver did not validate certain sizes. A local attacker on a 64bit system could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-4157)

Dan Rosenberg discovered that the Linux kernel L2TP implementation contained multiple integer signedness errors. A local attacker could exploit this to to crash the kernel, or possibly gain root privileges.
(CVE-2010-4160)

Steve Chen discovered that setsockopt did not correctly check MSS values. A local attacker could make a specially crafted socket call to crash the system, leading to a denial of service. (CVE-2010-4165)

Dave Jones discovered that the mprotect system call did not correctly handle merged VMAs. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4169)

It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)

Vegard Nossum discovered that memory garbage collection was not handled correctly for active sockets. A local attacker could exploit this to allocate all available kernel memory, leading to a denial of service. (CVE-2010-4249).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - Missing sanity checks in the Intel i915 driver in the     Linux kernel could allow a local, unprivileged user to     escalate their privileges. (CVE-2010-2962, Important)

  - compat_alloc_user_space() in the Linux kernel 32/64-bit     compatibility layer implementation was missing sanity     checks. This function could be abused in other areas of     the Linux kernel if its length argument can be     controlled from user-space. On 64-bit systems, a local,     unprivileged user could use this flaw to escalate their     privileges. (CVE-2010-3081, Important)

  - A buffer overflow flaw in niu_get_ethtool_tcam_all() in     the niu Ethernet driver in the Linux kernel, could allow     a local user to cause a denial of service or escalate     their privileges. (CVE-2010-3084, Important)

  - A flaw in the IA32 system call emulation provided in     64-bit Linux kernels could allow a local user to     escalate their privileges. (CVE-2010-3301, Important)

  - A flaw in sctp_packet_config() in the Linux kernel's     Stream Control Transmission Protocol (SCTP)     implementation could allow a remote attacker to cause a     denial of service. (CVE-2010-3432, Important)

  - A missing integer overflow check in snd_ctl_new() in the     Linux kernel's sound subsystem could allow a local,     unprivileged user on a 32-bit system to cause a denial     of service or escalate their privileges. (CVE-2010-3442,     Important)

  - A flaw was found in sctp_auth_asoc_get_hmac() in the     Linux kernel's SCTP implementation. When iterating     through the hmac_ids array, it did not reset the last id     element if it was out of range. This could allow a     remote attacker to cause a denial of service.
    (CVE-2010-3705, Important)

  - A function in the Linux kernel's Reliable Datagram     Sockets (RDS) protocol implementation was missing sanity     checks, which could allow a local, unprivileged user to     escalate their privileges. (CVE-2010-3904, Important)

  - A flaw in drm_ioctl() in the Linux kernel's Direct     Rendering Manager (DRM) implementation could allow a     local, unprivileged user to cause an information leak.
    (CVE-2010-2803, Moderate)

  - It was found that wireless drivers might not always     clear allocated buffers when handling a driver-specific     IOCTL information request. A local user could trigger     this flaw to cause an information leak. (CVE-2010-2955,     Moderate)

  - A NULL pointer dereference flaw in ftrace_regex_lseek()     in the Linux kernel's ftrace implementation could allow     a local, unprivileged user to cause a denial of service.
    Note: The debugfs file system must be mounted locally to     exploit this issue. It is not mounted by default.
    (CVE-2010-3079, Moderate)

  - A flaw in the Linux kernel's packet writing driver could     be triggered via the PKT_CTRL_CMD_STATUS IOCTL request,     possibly allowing a local, unprivileged user with access     to '/dev/pktcdvd/control' to cause an information leak.
    Note: By default, only users in the cdrom group have     access to '/dev/pktcdvd/control'. (CVE-2010-3437,     Moderate)

  - A flaw was found in the way KVM (Kernel-based Virtual     Machine) handled the reloading of fs and gs segment     registers when they had invalid selectors. A privileged     host user with access to '/dev/kvm' could use this flaw     to crash the host. (CVE-2010-3698, Moderate)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Fixes multiple security bugs. All users should update to this version.

Also fixes :

  - Stall on boot on some systems with TPM devices.
    (RHBZ#530393)

    - Hard lockups with Radeon RV350 devices. (RHBZ#631310)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0898 advisory.

    - Related: bz#639886       (CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic [rhel-5.5.z])
    - Resolves: bz#639886       (CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic [rhel-5.5.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment     registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl     call in conjunction with a modified Local Descriptor Table (LDT). (CVE-2010-3698)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0842 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * Missing sanity checks in the Intel i915 driver in the Linux kernel could     allow a local, unprivileged user to escalate their privileges.
    (CVE-2010-2962, Important)

    * compat_alloc_user_space() in the Linux kernel 32/64-bit compatibility     layer implementation was missing sanity checks. This function could be     abused in other areas of the Linux kernel if its length argument can be     controlled from user-space. On 64-bit systems, a local, unprivileged user     could use this flaw to escalate their privileges. (CVE-2010-3081,     Important)

    * A buffer overflow flaw in niu_get_ethtool_tcam_all() in the niu Ethernet     driver in the Linux kernel, could allow a local user to cause a denial of     service or escalate their privileges. (CVE-2010-3084, Important)

    * A flaw in the IA32 system call emulation provided in 64-bit Linux kernels     could allow a local user to escalate their privileges. (CVE-2010-3301,     Important)

    * A flaw in sctp_packet_config() in the Linux kernel's Stream Control     Transmission Protocol (SCTP) implementation could allow a remote attacker     to cause a denial of service. (CVE-2010-3432, Important)

    * A missing integer overflow check in snd_ctl_new() in the Linux kernel's     sound subsystem could allow a local, unprivileged user on a 32-bit system     to cause a denial of service or escalate their privileges. (CVE-2010-3442,     Important)

    * A flaw was found in sctp_auth_asoc_get_hmac() in the Linux kernel's SCTP     implementation. When iterating through the hmac_ids array, it did not reset     the last id element if it was out of range. This could allow a remote     attacker to cause a denial of service. (CVE-2010-3705, Important)

    * A function in the Linux kernel's Reliable Datagram Sockets (RDS) protocol     implementation was missing sanity checks, which could allow a local,     unprivileged user to escalate their privileges. (CVE-2010-3904, Important)

    * A flaw in drm_ioctl() in the Linux kernel's Direct Rendering Manager     (DRM) implementation could allow a local, unprivileged user to cause an     information leak. (CVE-2010-2803, Moderate)

    * It was found that wireless drivers might not always clear allocated     buffers when handling a driver-specific IOCTL information request. A local     user could trigger this flaw to cause an information leak. (CVE-2010-2955,     Moderate)

    * A NULL pointer dereference flaw in ftrace_regex_lseek() in the Linux     kernel's ftrace implementation could allow a local, unprivileged user to     cause a denial of service. Note: The debugfs file system must be mounted     locally to exploit this issue. It is not mounted by default.
    (CVE-2010-3079, Moderate)

    * A flaw in the Linux kernel's packet writing driver could be triggered     via the PKT_CTRL_CMD_STATUS IOCTL request, possibly allowing a local,     unprivileged user with access to /dev/pktcdvd/control to cause an     information leak. Note: By default, only users in the cdrom group have     access to /dev/pktcdvd/control. (CVE-2010-3437, Moderate)

    * A flaw was found in the way KVM (Kernel-based Virtual Machine) handled     the reloading of fs and gs segment registers when they had invalid     selectors. A privileged host user with access to /dev/kvm could use this     flaw to crash the host. (CVE-2010-3698, Moderate)

    Red Hat would like to thank Kees Cook for reporting CVE-2010-2962 and     CVE-2010-2803; Ben Hawkes for reporting CVE-2010-3081 and CVE-2010-3301;
    Dan Rosenberg for reporting CVE-2010-3442, CVE-2010-3705, CVE-2010-3904,     and CVE-2010-3437; and Robert Swiecki for reporting CVE-2010-3079.

    This update also fixes several bugs. Documentation for these bug fixes will     be available shortly from the Technical Notes document linked to in the     References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The system must be rebooted for this     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
52500	Ubuntu 10.10 : linux vulnerabilities (USN-1081-1)	Nessus	Ubuntu Local Security Checks	2011/3/2	2019/9/19	high
68175	Oracle Linux 5 : Unbreakable enterprise kernel (ELSA-2010-2011)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	medium
60913	Scientific Linux Security Update : kvm on SL5.x x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
63959	RHEL 5 : kvm (RHSA-2010:0898)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	medium
52476	Ubuntu 9.10 : linux, linux-ec2 vulnerabilities (USN-1073-1)	Nessus	Ubuntu Local Security Checks	2011/3/1	2019/10/16	high
60893	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2023/5/14	high
51374	Fedora 13 : kernel-2.6.34.7-66.fc13 (2010-18983)	Nessus	Fedora Local Security Checks	2010/12/26	2021/1/11	high
68148	Oracle Linux 5 : kvm (ELSA-2010-0898)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	medium
217228	Linux Distros Unpatched Vulnerability : CVE-2010-3698	Nessus	Misc.	2025/3/3	2026/1/28	high
50629	RHEL 6 : kernel (RHSA-2010:0842)	Nessus	Red Hat Local Security Checks	2010/11/18	2025/4/14	high

检测

插件搜索

high

medium

medium

medium

high

high

high

medium

high

high