Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4076, CVE-2010-4077)

Alex Shi and Eric Dumazet discovered that the network stack did not correctly handle packet backlogs. A remote attacker could exploit this by sending a large amount of network traffic to cause the system to run out of memory, leading to a denial of service. (CVE-2010-4251, CVE-2010-4805)

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities. (CVE-2011-1020)

Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. (CVE-2011-1493)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

It was discovered that CIFS incorrectly handled authentication. When a user had a CIFS share mounted that required authentication, a local user could mount the same share without knowing the correct password.
(CVE-2011-1585)

It was discovered that the GRE protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ip_gre module was loading, and crash the system, leading to a denial of service. (CVE-2011-1767)

It was discovered that the IP/IP protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ipip module was loading, and crash the system, leading to a denial of service. (CVE-2011-1768)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Andrea Righi discovered a race condition in the KSM memory merging support. If KSM was being used, a local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2183)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could exploit this to exhaust memory and CPU resources, leading to a denial of service. (CVE-2011-2484)

It was discovered that Bluetooth l2cap and rfcomm did not correctly initialize structures. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy.
(CVE-2011-2492)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Vasiliy Kulikov discovered that the Comedi driver did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-2909)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

A flaw was found in the Linux kernel's /proc/*/*map* interface. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-3637)

Ben Hutchings discovered several flaws in the Linux Rose (X.25 PLP) layer. A local user or a remote user on an X.25 network could exploit these flaws to execute arbitrary code as root. (CVE-2011-4914).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0928 advisory.

    - [net] fix netns vs proto registration ordering (Wade Mealing) [702305 702306] {CVE-2011-1767     CVE-2011-1768}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2024 advisory.

    - inet_diag: fix inet_diag_bc_audit() (Eric Dumazet) [CVE-2011-2213]
    - [net] gre: fix netns vs proto registration ordering {CVE-2011-1767}
    - [net] tunnels: fix netns vs proto registration ordering {CVE-2011-1768}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0928 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * It was found that the receive hook in the ipip_init() function in the     ipip module, and in the ipgre_init() function in the ip_gre module, could     be called before network namespaces setup is complete. If packets were     received at the time the ipip or ip_gre module was still being loaded into     the kernel, it could cause a denial of service. (CVE-2011-1767,     CVE-2011-1768, Moderate)

    * It was found that an mmap() call with the MAP_PRIVATE flag on /dev/zero     would create transparent hugepages and trigger a certain robustness check.
    A local, unprivileged user could use this flaw to cause a denial of     service. (CVE-2011-2479, Moderate)

    This update also fixes various bugs. Documentation for these bug fixes will     be available shortly from the Technical Notes document linked to in the     References section.

    Users should upgrade to these updated packages, which contain backported     patches to resolve these issues, and fix the bugs noted in the Technical     Notes. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4076, CVE-2010-4077)

Alex Shi and Eric Dumazet discovered that the network stack did not correctly handle packet backlogs. A remote attacker could exploit this by sending a large amount of network traffic to cause the system to run out of memory, leading to a denial of service. (CVE-2010-4251, CVE-2010-4805)

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities. (CVE-2011-1020)

Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. (CVE-2011-1493)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

It was discovered that CIFS incorrectly handled authentication. When a user had a CIFS share mounted that required authentication, a local user could mount the same share without knowing the correct password.
(CVE-2011-1585)

It was discovered that the GRE protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ip_gre module was loading, and crash the system, leading to a denial of service. (CVE-2011-1767)

It was discovered that the IP/IP protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ipip module was loading, and crash the system, leading to a denial of service. (CVE-2011-1768)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Andrea Righi discovered a race condition in the KSM memory merging support. If KSM was being used, a local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2183)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could expoit this to exhaust memory and CPU resources, leading to a denial of service. (CVE-2011-2484)

It was discovered that Bluetooth l2cap and rfcomm did not correctly initialize structures. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy.
(CVE-2011-2492)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Vasiliy Kulikov discovered that the Comedi driver did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-2909)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

A flaw was found in the Linux kernel's /proc/*/*map* interface. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-3637)

Ben Hutchings discovered several flaws in the Linux Rose (X.25 PLP) layer. A local user or a remote user on an X.25 network could exploit these flaws to execute arbitrary code as root. (CVE-2011-4914).

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - It was found that the receive hook in the ipip_init()     function in the ipip module, and in the ipgre_init()     function in the ip_gre module, could be called before     network namespaces setup is complete. If packets were     received at the time the ipip or ip_gre module was still     being loaded into the kernel, it could cause a denial of     service. (CVE-2011-1767, CVE-2011-1768, Moderate)

  - It was found that an mmap() call with the MAP_PRIVATE     flag on '/dev/zero' would create transparent hugepages     and trigger a certain robustness check. A local,     unprivileged user could use this flaw to cause a denial     of service. (CVE-2011-2479, Moderate)

This update also fixes various bugs. Documentation for these bug fixes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to resolve these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2021 advisory.

    - [net] gre: fix netns vs proto registration ordering {CVE-2011-1767}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that CIFS incorrectly handled authentication. When a user had a CIFS share mounted that required authentication, a local user could mount the same share without knowing the correct password.
(CVE-2011-1585)

It was discovered that the GRE protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ip_gre module was loading, and crash the system, leading to a denial of service. (CVE-2011-1767)

It was discovered that the IP/IP protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ipip module was loading, and crash the system, leading to a denial of service. (CVE-2011-1768)

Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly handled unlock requests. A local attacker could exploit this to cause a denial of service. (CVE-2011-2491)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-2524     David Howells reported an issue in the Common Internet     File System (CIFS). Local users could cause arbitrary     CIFS shares to be mounted by introducing malicious     redirects.

  - CVE-2010-3875     Vasiliy Kulikov discovered an issue in the Linux     implementation of the Amateur Radio AX.25 Level 2     protocol. Local users may obtain access to sensitive     kernel memory.

  - CVE-2010-4075     Dan Rosenberg reported an issue in the tty layer that     may allow local users to obtain access to sensitive     kernel memory.

  - CVE-2010-4655     Kees Cook discovered several issues in the ethtool     interface which may allow local users with the     CAP_NET_ADMIN capability to obtain access to sensitive     kernel memory.

  - CVE-2011-0695     Jens Kuehnel reported an issue in the InfiniBand stack.
    Remote attackers can exploit a race condition to cause a     denial of service (kernel panic).

  - CVE-2011-0710     Al Viro reported an issue in the /proc/<pid>/status     interface on the s390 architecture. Local users could     gain access to sensitive memory in processes they do not     own via the task_show_regs entry.

  - CVE-2011-0711     Dan Rosenberg reported an issue in the XFS filesystem.
    Local users may obtain access to sensitive kernel     memory.

  - CVE-2011-0726     Kees Cook reported an issue in the /proc/<pid>/stat     implementation. Local users could learn the text     location of a process, defeating protections provided by     address space layout randomization (ASLR).

  - CVE-2011-1010     Timo Warns reported an issue in the Linux support for     Mac partition tables. Local users with physical access     could cause a denial of service (panic) by adding a     storage device with a malicious map_count value.

  - CVE-2011-1012     Timo Warns reported an issue in the Linux support for     LDM partition tables. Local users with physical access     could cause a denial of service (Oops) by adding a     storage device with an invalid VBLK value in the VMDB     structure.

  - CVE-2011-1017     Timo Warns reported an issue in the Linux support for     LDM partition tables. Users with physical access can     gain access to sensitive kernel memory or gain elevated     privileges by adding a storage device with a specially     crafted LDM partition.

  - CVE-2011-1078     Vasiliy Kulikov discovered an issue in the Bluetooth     subsystem. Local users can obtain access to sensitive     kernel memory.

  - CVE-2011-1079     Vasiliy Kulikov discovered an issue in the Bluetooth     subsystem. Local users with the CAP_NET_ADMIN capability     can cause a denial of service (kernel Oops).

  - CVE-2011-1080     Vasiliy Kulikov discovered an issue in the Netfilter     subsystem. Local users can obtain access to sensitive     kernel memory.

  - CVE-2011-1090     Neil Horman discovered a memory leak in the setacl()     call on NFSv4 filesystems. Local users can exploit this     to cause a denial of service (Oops).

  - CVE-2011-1093     Johan Hovold reported an issue in the Datagram     Congestion Control Protocol (DCCP) implementation.
    Remote users could cause a denial of service by sending     data after closing a socket.

  - CVE-2011-1160     Peter Huewe reported an issue in the Linux kernel's     support for TPM security chips. Local users with     permission to open the device can gain access to     sensitive kernel memory.

  - CVE-2011-1163     Timo Warns reported an issue in the kernel support for     Alpha OSF format disk partitions. Users with physical     access can gain access to sensitive kernel memory by     adding a storage device with a specially crafted OSF     partition.

  - CVE-2011-1170     Vasiliy Kulikov reported an issue in the Netfilter arp     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1171     Vasiliy Kulikov reported an issue in the Netfilter IP     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1172     Vasiliy Kulikov reported an issue in the Netfilter IP6     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1173     Vasiliy Kulikov reported an issue in the Acorn Econet     protocol implementation. Local users can obtain access     to sensitive kernel memory on systems that use this rare     hardware.

  - CVE-2011-1180     Dan Rosenberg reported a buffer overflow in the     Information Access Service of the IrDA protocol, used     for Infrared devices. Remote attackers within IR device     range can cause a denial of service or possibly gain     elevated privileges.

  - CVE-2011-1182     Julien Tinnes reported an issue in the rt_sigqueueinfo     interface. Local users can generate signals with     falsified source pid and uid information.

  - CVE-2011-1477     Dan Rosenberg reported issues in the Open Sound System     driver for cards that include a Yamaha FM synthesizer     chip. Local users can cause memory corruption resulting     in a denial of service. This issue does not affect     official Debian Linux image packages as they no longer     provide support for OSS. However, custom kernels built     from Debians linux-source-2.6.26 may have enabled this     configuration and would therefore be vulnerable.

  - CVE-2011-1493     Dan Rosenburg reported two issues in the Linux     implementation of the Amateur Radio X.25 PLP (Rose)     protocol. A remote user can cause a denial of service by     providing specially crafted facilities fields.

  - CVE-2011-1577     Timo Warns reported an issue in the Linux support for     GPT partition tables. Local users with physical access     could cause a denial of service (Oops) by adding a     storage device with a malicious partition table header.

  - CVE-2011-1593     Robert Swiecki reported a signednes issue in the     next_pidmap() function, which can be exploited my local     users to cause a denial of service.

  - CVE-2011-1598     Dave Jones reported an issue in the Broadcast Manager     Controller Area Network (CAN/BCM) protocol that may     allow local users to cause a NULL pointer dereference,     resulting in a denial of service.

  - CVE-2011-1745     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the AGPIOC_BIND ioctl. On default     Debian installations, this is exploitable only by users     in the video group.

  - CVE-2011-1746     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the agp_allocate_memory and     agp_create_user_memory. On default Debian installations,     this is exploitable only by users in the video group.

  - CVE-2011-1748     Oliver Kartkopp reported an issue in the Controller Area     Network (CAN) raw socket implementation which permits     ocal users to cause a NULL pointer dereference,     resulting in a denial of service.

  - CVE-2011-1759     Dan Rosenberg reported an issue in the support for     executing 'old ABI' binaries on ARM processors. Local     users can obtain elevated privileges due to insufficient     bounds checking in the semtimedop system call.

  - CVE-2011-1767     Alexecy Dobriyan reported an issue in the GRE over IP     implementation. Remote users can cause a denial of     service by sending a packet during module     initialization.

  - CVE-2011-1768     Alexecy Dobriyan reported an issue in the IP tunnels     implementation. Remote users can cause a denial of     service by sending a packet during module     initialization.

  - CVE-2011-1776     Timo Warns reported an issue in the Linux implementation     for GUID partitions. Users with physical access can gain     access to sensitive kernel memory by adding a storage     device with a specially crafted corrupted invalid     partition table.

  - CVE-2011-2022     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the AGPIOC_UNBIND ioctl. On default     Debian installations, this is exploitable only by users     in the video group.

  - CVE-2011-2182     Ben Hutchings reported an issue with the fix for     CVE-2011-1017 (see above) that made it insufficient to     resolve the issue.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
56305	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1216-1)	Nessus	Ubuntu Local Security Checks	2011/9/27	2019/9/19	high
68305	Oracle Linux 6 : kernel (ELSA-2011-0928)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	medium
68420	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2011-2024)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	medium
55584	RHEL 6 : kernel (RHSA-2011:0928)	Nessus	Red Hat Local Security Checks	2011/7/13	2025/4/14	medium
56191	Ubuntu 10.04 LTS : linux-mvl-dove vulnerabilities (USN-1203-1)	Nessus	Ubuntu Local Security Checks	2011/9/14	2016/5/19	high
56343	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1218-1)	Nessus	Ubuntu Local Security Checks	2011/9/30	2019/9/19	high
61082	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
68419	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2021)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
56913	USN-1271-1 : linux-fsl-imx51 vulnerabilities	Nessus	Ubuntu Local Security Checks	2011/11/22	2016/12/1	medium
55170	Debian DSA-2264-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	2011/6/20	2021/1/4	high

检测

插件搜索

high

medium

medium

medium

high

high

medium

high

medium

high