リモートのOracle Linux 5 / 6ホストに、ELSA-2013-2538のアドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  -3.8.4以前のLinuxカーネルにおける kernel/signal.c 内のflush_signal_handlers関数が 1 回の実行操作でsa_restorer フィールドの値を保存し、これによってローカルユーザーは、sigactionシステムコールを含む細工されたアプリケーションを介して、ASLR保護メカニズムを簡単にバイパスできます。（CVE-2013-0914）

  -3.9-rc7以前のLinuxカーネルにおける net/atm/common.c 内のvcc_recvmsg関数は特定の長さの変数を初期化せず、これによってローカルユーザーが、細工されたrecvmsgまたはrecvfromシステムコールを介してカーネルスタックメモリから機密情報を取得することが可能です。（CVE-2013-3222）

  -3.9-rc7以前のLinuxカーネルのnet/bluetooth/af_bluetooth.cにある bt_sock_recvmsg関数は特定の長さの変数を正しく初期化せず、これによってローカルユーザーは、細工されたrecvmsgまたはrecvfromシステムコールを介してカーネルスタックメモリから機密情報を取得できます。（CVE-2013-3224）

  -3.6より前のLinuxカーネルにおける、fs/udf/namei.c 内のudf_encode_fh関数は、特定の構成要素を初期化しません。このため、ローカルユーザーが細工されたアプリケーションを介してカーネルヒープメモリから機密情報を取得する可能性があります。（CVE-2012-6548）

  -3.8.4以前のLinuxカーネルにおける、net/dcb/dcbnl.cは、特定の構成を初期化しません。このため、ローカルユーザーが細工されたアプリケーションを介してカーネルスタックメモリから機密情報を取得する可能性があります。
    (CVE-2013-2634)

  -3.8.4以前のLinuxカーネルにおける、net/core/rtnetlink.c 内のrtnl_fill_ifinfo関数は、特定の構成を初期化しません。このため、ローカルユーザーが細工されたアプリケーションを介してカーネルスタックメモリから機密情報を取得する可能性があります。（CVE-2013-2635）

  -3.9.4までのLinuxカーネルのBroadcom B43 ワイヤレスドライバーのdrivers/net/wireless/b43/main.cのb43_request_firmware関数の書式文字列の脆弱性により、ローカルユーザーが、rootアクセスを利用し、書式文字列指定子を fwpostfix modprobeパラメーターに含めることで、権限を取得し、不適切なエラーメッセージの構築を引き起こす可能性があります。（CVE-2013-2852）

  -3.9-rc7以前のLinuxカーネルにおける、net/bluetooth/rfcomm/sock.cのrfcomm_sock_recvmsg関数は特定の長さの変数を初期化しません。このため、細工されたrecvmsgまたはrecvfromシステムコールを介して、ローカルユーザーが機密情報をカーネルスタックメモリから取得する可能性があります。（CVE-2013-3225）

  -3.8.8より前のLinuxカーネルのftrace実装により、ローカルユーザーは、(1) set_ftrace_pidまたは(2) set_graph_functionファイルへの書き込みアクセスに対する CAP_SYS_ADMIN機能を利用し、続いて lseekシステムコールを行うことで、サービス拒否（NULL ポインターデリファレンスおよびシステムクラッシュ）を引き起こしたり、詳細不明のその他の影響を与える可能性があります。（CVE-2013-3301）

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548)

Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6549)

An integer overflow was discovered in the Direct Rendering Manager (DRM) subsystem for the i915 video driver in the Linux kernel. A local user could exploit this flaw to cause a denial of service (crash) or potentially escalate privileges. (CVE-2013-0913)

Andrew Honig discovered a flaw in guest OS time updates in the Linux kernel's KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to cause a denial of service (crash host system) or potentially escalate privilege to the host kernel level.
(CVE-2013-1796)

Andrew Honig discovered a use after free error in guest OS time updates in the Linux kernel's KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to escalate privilege to the host kernel level. (CVE-2013-1797)

Andrew Honig reported a flaw in the way KVM (Kernel-based Virtual Machine) emulated the IOAPIC. A privileged guest user could exploit this flaw to read host memory or cause a denial of service (crash the host). (CVE-2013-1798)

A format-string bug was discovered in the Linux kernel's ext3 filesystem driver. A local user could exploit this flaw to possibly escalate privileges on the system. (CVE-2013-1848)

A buffer overflow was discovered in the Linux Kernel's USB subsystem for devices reporting the cdc-wdm class. A specially crafted USB device when plugged-in could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2013-1860)

An information leak in the Linux kernel's dcb netlink interface was discovered. A local user could obtain sensitive information by examining kernel stack memory. (CVE-2013-2634)

A kernel stack information leak was discovered in the RTNETLINK component of the Linux kernel. A local user could read sensitive information from the kernel stack. (CVE-2013-2635).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.

The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.

The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.

The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.

The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.

net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.

net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application. (CVE-2013-1979)

The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3232)

net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
(CVE-2013-3235)

The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3234)

The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3233)

The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3231)

The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
(CVE-2013-3229)

The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
(CVE-2013-3228)

The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3227)

The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3225)

The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3224)

The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3223)

The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3222)

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
(CVE-2013-2596)

arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit. (CVE-2013-2146)

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call. (CVE-2013-2094)

The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application. (CVE-2013-1798)

Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation. (CVE-2013-1797)

The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application. (CVE-2013-1796)

The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
(CVE-2013-2141)

Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure. (CVE-2013-1929)

The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669. (CVE-2012-5532)

The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. (CVE-2012-6548)

The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. (CVE-2012-6549)

net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
(CVE-2013-2634)

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. (CVE-2013-2635)

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application. (CVE-2013-1848)

The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call. (CVE-2013-0914)

Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device. (CVE-2013-1860)

Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads. (CVE-2013-1792)

The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.
(CVE-2013-2546)

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability. (CVE-2013-2547)

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability. (CVE-2013-2548)

The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges. (CVE-2013-0311)

Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message. (CVE-2013-1763)

The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
(CVE-2013-0290)

Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option. (CVE-2013-1767)

The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.
(CVE-2013-0228)

Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions. (CVE-2013-0217)

The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. (CVE-2013-0216)

The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. (CVE-2012-6547)

The updated packages provides a solution for these security issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1080 advisory.

    Red Hat OpenStack 3.0 includes a custom Red Hat Enterprise Linux 6.4     kernel. These custom kernel packages include support for network     namespaces, this support is required to facilitate advanced OpenStack     Networking deployments.

    This update fixes the following security issues:

    * A flaw was found in the tcp_read_sock() function in the Linux kernel's     IPv4 TCP/IP protocol suite implementation in the way socket buffers (skb)     were handled. A local, unprivileged user could trigger this issue via a     call to splice(), leading to a denial of service. (CVE-2013-2128,     Moderate)

    * Information leak flaws in the Linux kernel could allow a local,     unprivileged user to leak kernel memory to user-space. (CVE-2012-6548,     CVE-2013-2634, CVE-2013-2635, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225,     Low)

    * An information leak was found in the Linux kernel's POSIX signals     implementation. A local, unprivileged user could use this flaw to bypass     the Address Space Layout Randomization (ASLR) security feature.
    (CVE-2013-0914, Low)

    * A format string flaw was found in the ext3_msg() function in the Linux     kernel's ext3 file system implementation. A local user who is able to mount     an ext3 file system could use this flaw to cause a denial of service or,     potentially, escalate their privileges. (CVE-2013-1848, Low)

    * A format string flaw was found in the b43_do_request_fw() function in the     Linux kernel's b43 driver implementation. A local user who is able to     specify the fwpostfix b43 module parameter could use this flaw to cause a     denial of service or, potentially, escalate their privileges.
    (CVE-2013-2852, Low)

    * A NULL pointer dereference flaw was found in the Linux kernel's ftrace     and function tracer implementations. A local user who has the CAP_SYS_ADMIN     capability could use this flaw to cause a denial of service.
    (CVE-2013-3301, Low)

    Red Hat would like to thank Kees Cook for reporting CVE-2013-2852.

    More information on the Red Hat Enterprise Linux 6.4 kernel packages upon     which these custom kernel packages are based is available in     RHSA-2013:1051:

    https://rhn.redhat.com/errata/RHSA-2013-1051.html

    All Red Hat OpenStack 3.0 users deploying the OpenStack Networking service     are advised to install these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 3.8.4 stable update includes a number of fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest upstream stable release, 3.8.4. Fixes across the entire tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1051 advisory.

    - [wireless] b43: stop format string leaking into error msgs (John Linville) [971387 971389]     {CVE-2013-2852}
    - [net] rtnl: fix info leak on RTM_GETLINK request for VF devices (Flavio Leitner) [923657 923659]     {CVE-2013-2634 CVE-2013-2635}
    - [net] dcbnl: fix various netlink info leaks (Flavio Leitner) [923657 923659] {CVE-2013-2634     CVE-2013-2635}
    - [net] tcp: Fix oops from tcp_collapse() when using splice() (Nikola Pajkovsky) [968871 863512]     {CVE-2013-2128}
    - [net] bluetooth/rfcomm: Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Weiping Pan) [955653     955654] {CVE-2013-3225}
    - [net] bluetooth: fix possible info leak in bt_sock_recvmsg() (Radomir Vrbovsky) [955603 955604]     {CVE-2013-3224}
    - [fs] udf: avoid info leak on export (Nikola Pajkovsky) [922354 922355] {CVE-2012-6548}
    - [kernel] tracing: Fix possible NULL pointer dereferences (Weiping Pan) [952212 952213] {CVE-2013-3301}
    - [kernel] tracing: Fix panic when lseek() called on 'trace' opened for writing (Weiping Pan) [952212     952213] {CVE-2013-3301}
    - [net] atm: update msg_namelen in vcc_recvmsg() (Nikola Pajkovsky) [955224 955225] {CVE-2013-3222}
    - [fs] ext3: Fix format string issues (Nikola Pajkovsky) [920784 920785] {CVE-2013-1848}
    - [kernel] signal: always clear sa_restorer on execve (Nikola Pajkovsky) [920505 920506] {CVE-2013-0914}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - A flaw was found in the tcp_read_sock() function in the     Linux kernel's IPv4 TCP/IP protocol suite implementation     in the way socket buffers (skb) were handled. A local,     unprivileged user could trigger this issue via a call to     splice(), leading to a denial of service.
    (CVE-2013-2128, Moderate)

  - Information leak flaws in the Linux kernel could allow a     local, unprivileged user to leak kernel memory to     user-space. (CVE-2012-6548, CVE-2013-2634,     CVE-2013-2635, CVE-2013-3222, CVE-2013-3224,     CVE-2013-3225, Low)

  - An information leak was found in the Linux kernel's     POSIX signals implementation. A local, unprivileged user     could use this flaw to bypass the Address Space Layout     Randomization (ASLR) security feature. (CVE-2013-0914,     Low)

  - A format string flaw was found in the ext3_msg()     function in the Linux kernel's ext3 file system     implementation. A local user who is able to mount an     ext3 file system could use this flaw to cause a denial     of service or, potentially, escalate their privileges.
    (CVE-2013-1848, Low)

  - A format string flaw was found in the     b43_do_request_fw() function in the Linux kernel's b43     driver implementation. A local user who is able to     specify the 'fwpostfix' b43 module parameter could use     this flaw to cause a denial of service or, potentially,     escalate their privileges. (CVE-2013-2852, Low)

  - A NULL pointer dereference flaw was found in the Linux     kernel's ftrace and function tracer implementations. A     local user who has the CAP_SYS_ADMIN capability could     use this flaw to cause a denial of service.
    (CVE-2013-3301, Low)

The system must be rebooted for this update to take effect.

Updated kernel-rt packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise MRG 2.3.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Security fixes :

* It was found that the kernel-rt update RHBA-2012:0044 introduced an integer conversion issue in the Linux kernel's Performance Events implementation. This led to a user-supplied index into the perf_swevent_enabled array not being validated properly, resulting in out-of-bounds kernel memory access. A local, unprivileged user could use this flaw to escalate their privileges. (CVE-2013-2094, Important)

A public exploit for CVE-2013-2094 that affects Red Hat Enterprise MRG 2 is available. Refer to Red Hat Knowledge Solution 373743, linked to in the References, for further information and mitigation instructions for users who are unable to immediately apply this update.

* An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the Intel i915 driver in the Linux kernel handled the allocation of the buffer used for relocation copies. A local user with console access could use this flaw to cause a denial of service or escalate their privileges. (CVE-2013-0913, Important)

* It was found that the Linux kernel used effective user and group IDs instead of real ones when passing messages with SCM_CREDENTIALS ancillary data. A local, unprivileged user could leverage this flaw with a set user ID (setuid) application, allowing them to escalate their privileges. (CVE-2013-1979, Important)

* A race condition in install_user_keyrings(), leading to a NULL pointer dereference, was found in the key management facility. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2013-1792, Moderate)

* A NULL pointer dereference flaw was found in the Linux kernel's XFS file system implementation. A local user who is able to mount an XFS file system could use this flaw to cause a denial of service.
(CVE-2013-1819, Moderate)

* An information leak was found in the Linux kernel's POSIX signals implementation. A local, unprivileged user could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2013-0914, Low)

* A use-after-free flaw was found in the tmpfs implementation. A local user able to mount and unmount a tmpfs file system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1767, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's USB Inside Out Edgeport Serial Driver implementation. A local user with physical access to a system and with access to a USB device's tty file could use this flaw to cause a denial of service. (CVE-2013-1774, Low)

* A format string flaw was found in the ext3_msg() function in the Linux kernel's ext3 file system implementation. A local user who is able to mount an ext3 file system could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2013-1848, Low)

* A heap-based buffer overflow flaw was found in the Linux kernel's cdc-wdm driver, used for USB CDC WCM device management. An attacker with physical access to a system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1860, Low)

* A heap-based buffer overflow in the way the tg3 Ethernet driver parsed the vital product data (VPD) of devices could allow an attacker with physical access to a system to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1929, Low)

* Information leaks in the Linux kernel's cryptographic API could allow a local user who has the CAP_NET_ADMIN capability to leak kernel stack memory to user-space. (CVE-2013-2546, CVE-2013-2547, CVE-2013-2548, Low)

* Information leaks in the Linux kernel could allow a local, unprivileged user to leak kernel stack memory to user-space.
(CVE-2013-2634, CVE-2013-2635, CVE-2013-3076, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225, CVE-2013-3231, Low)

Red Hat would like to thank Andy Lutomirski for reporting CVE-2013-1979. CVE-2013-1792 was discovered by Mateusz Guzik of Red Hat EMEA GSS SEG Team.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-592:07 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
     CVE-2012-6548     The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain     structure member, which allows local users to obtain sensitive information from kernel heap memory via a     crafted application.
     CVE-2013-0914     The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value     of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the     ASLR protection mechanism via a crafted application containing a sigaction system call.
     CVE-2013-1848     fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain     circumstances related to printk input, which allows local users to conduct format-string attacks and     possibly gain privileges via a crafted application.
     CVE-2013-2128     The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage     skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice     system call for a TCP socket.
     CVE-2013-2634     net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows     local users to obtain sensitive information from kernel stack memory via a crafted application.
     CVE-2013-2635     The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize     a certain structure member, which allows local users to obtain sensitive information from kernel stack     memory via a crafted application.
     CVE-2013-2852     Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the     Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by     leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading     to improper construction of an error message.
     CVE-2013-3222     The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a     certain length variable, which allows local users to obtain sensitive information from kernel stack memory     via a crafted recvmsg or recvfrom system call.
     CVE-2013-3224     The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not     properly initialize a certain length variable, which allows local users to obtain sensitive information     from kernel stack memory via a crafted recvmsg or recvfrom system call.
     CVE-2013-3225     The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does     not initialize a certain length variable, which allows local users to obtain sensitive information from     kernel stack memory via a crafted recvmsg or recvfrom system call.
     CVE-2013-3301     The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the     CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and     then making an lseek system call.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548)

Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6549)

An integer overflow was discovered in the Direct Rendering Manager (DRM) subsystem for the i915 video driver in the Linux kernel. A local user could exploit this flaw to cause a denial of service (crash) or potentially escalate privileges. (CVE-2013-0913)

Andrew Honig discovered a flaw in guest OS time updates in the Linux kernel's KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to cause a denial of service (crash host system) or potential escalate privilege to the host kernel level.
(CVE-2013-1796)

Andrew Honig discovered a use after free error in guest OS time updates in the Linux kernel;s KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to escalate privilege to the host kernel level. (CVE-2013-1797)

Andrew Honig reported a flaw in the way KVM (Kernel-based Virtual Machine) emulated the IOAPIC. A privileged guest user could exploit this flaw to read host memory or cause a denial of service (crash the host). (CVE-2013-1798)

A format-string bug was discovered in the Linux kernel's ext3 filesystem driver. A local user could exploit this flaw to possibly escalate privileges on the system. (CVE-2013-1848)

A buffer overflow was discovered in the Linux Kernel's USB subsystem for devices reporting the cdc-wdm class. A specially crafted USB device when plugged-in could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2013-1860)

An information leak in the Linux kernel's dcb netlink interface was discovered. A local user could obtain sensitive information by examining kernel stack memory. (CVE-2013-2634)

A kernel stack information leak was discovered in the RTNETLINK component of the Linux kernel. A local user could read sensitive information from the kernel stack. (CVE-2013-2635).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the tcp_read_sock() function in the Linux kernel's IPv4 TCP/IP protocol suite implementation in the way socket buffers (skb) were handled. A local, unprivileged user could trigger this issue via a call to splice(), leading to a denial of service.
(CVE-2013-2128, Moderate)

* Information leak flaws in the Linux kernel could allow a local, unprivileged user to leak kernel memory to user-space. (CVE-2012-6548, CVE-2013-2634, CVE-2013-2635, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225, Low)

* An information leak was found in the Linux kernel's POSIX signals implementation. A local, unprivileged user could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2013-0914, Low)

* A format string flaw was found in the ext3_msg() function in the Linux kernel's ext3 file system implementation. A local user who is able to mount an ext3 file system could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2013-1848, Low)

* A format string flaw was found in the b43_do_request_fw() function in the Linux kernel's b43 driver implementation. A local user who is able to specify the 'fwpostfix' b43 module parameter could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-2852, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's ftrace and function tracer implementations. A local user who has the CAP_SYS_ADMIN capability could use this flaw to cause a denial of service. (CVE-2013-3301, Low)

Red Hat would like to thank Kees Cook for reporting CVE-2013-2852.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2538 advisory.

    - Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Mathias Krause) [Orabug:
    17173830] {CVE-2013-3225}
    - Bluetooth: fix possible info leak in bt_sock_recvmsg() (Mathias Krause) [Orabug: 17173830]     {CVE-2013-3224}
    - atm: update msg_namelen in vcc_recvmsg() (Mathias Krause) [Orabug: 17173830] {CVE-2013-3222}
    - rtnl: fix info leak on RTM_GETLINK request for VF devices (Mathias Krause) [Orabug: 17173830]     {CVE-2013-2635}
    - dcbnl: fix various netlink info leaks (Mathias Krause) [Orabug: 17173830] {CVE-2013-2634}
    - udf: avoid info leak on export (Mathias Krause) [Orabug: 17173830] {CVE-2012-6548}
    - tracing: Fix possible NULL pointer dereferences (Namhyung Kim) [Orabug: 17173830] {CVE-2013-3301}
    - b43: stop format string leaking into error msgs (Kees Cook) [Orabug: 17173830] {CVE-2013-2852}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
68978	Oracle Linux 5/6：unbreakable enterprise kernel （ELSA-2013-2538）	Nessus	Oracle Linux Local Security Checks	2013/7/19	2026/2/9	high
66291	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1809-1)	Nessus	Ubuntu Local Security Checks	2013/5/2	2019/9/19	high
70222	Amazon Linux AMI : kernel (ALAS-2013-218)	Nessus	Amazon Linux Local Security Checks	2013/10/1	2020/8/4	medium
66975	Mandriva Linux Security Advisory : kernel (MDVSA-2013:176)	Nessus	Mandriva Local Security Checks	2013/6/25	2022/9/16	high
210186	RHEL 6 : kernel (RHSA-2013:1080)	Nessus	Red Hat Local Security Checks	2024/11/4	2024/11/4	medium
65664	Fedora 18 : kernel-3.8.4-202.fc18 (2013-4240)	Nessus	Fedora Local Security Checks	2013/3/24	2021/1/11	medium
65759	Fedora 17 : kernel-3.8.4-102.fc17 (2013-4357)	Nessus	Fedora Local Security Checks	2013/4/1	2021/1/11	medium
66292	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-1812-1)	Nessus	Ubuntu Local Security Checks	2013/5/2	2019/9/19	high
68920	Oracle Linux 6 : kernel (ELSA-2013-1051)	Nessus	Oracle Linux Local Security Checks	2013/7/17	2026/2/9	medium
68945	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20130716)	Nessus	Scientific Linux Local Security Checks	2013/7/18	2021/1/14	medium
76660	RHEL 6 : MRG (RHSA-2013:0829)	Nessus	Red Hat Local Security Checks	2014/7/22	2022/9/16	high
290033	MiracleLinux 4 : kernel-2.6.32-358.14.1.el6 (AXSA:2013-592:07)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/19	medium
66302	Ubuntu 12.10 : linux vulnerabilities (USN-1813-1)	Nessus	Ubuntu Local Security Checks	2013/5/3	2019/9/19	high
68921	RHEL 6 : kernel (RHSA-2013:1051)	Nessus	Red Hat Local Security Checks	2013/7/17	2021/1/14	medium
68978	Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2013-2538)	Nessus	Oracle Linux Local Security Checks	2013/7/19	2026/2/9	high
68940	CentOS 6 : kernel (CESA-2013:1051)	Nessus	CentOS Local Security Checks	2013/7/18	2021/1/4	medium
74878	openSUSE Security Update : kernel (openSUSE-SU-2013:1971-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
66344	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 7667 / 7669 / 7675)	Nessus	SuSE Local Security Checks	2013/5/8	2021/1/19	high

检测

插件搜索

high

high

medium

high

medium

medium

medium

high

medium

medium

high

medium

high

medium

high

medium

high

high