The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

Updated kernel packages that fix several security issues and bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* A race condition flaw was found in the way the Linux kernel's KVM subsystem handled PIT (Programmable Interval Timer) emulation. A guest user who has access to the PIT I/O ports could use this flaw to crash the host. (CVE-2014-3611, Important)

* A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system. (CVE-2014-5077, Important)

* It was found that the Linux kernel's KVM subsystem did not handle the VM exits gracefully for the invept (Invalidate Translations Derived from EPT) and invvpid (Invalidate Translations Based on VPID) instructions. On hosts with an Intel processor and invept/invppid VM exit support, an unprivileged guest user could use these instructions to crash the guest. (CVE-2014-3645, CVE-2014-3646, Moderate)

* A use-after-free flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use this flaw to crash the system. (CVE-2014-4653, Moderate)

Red Hat would like to thank Lars Bull of Google for reporting CVE-2014-3611, and the Advanced Threat Research team at Intel Security for reporting CVE-2014-3645 and CVE-2014-3646.

Bug fixes :

* A known issue that could prevent Chelsio adapters using the cxgb4 driver from being initialized on IBM POWER8 systems has been fixed.
These adapters can now be used on IBM POWER8 systems as expected.
(BZ#1130548)

* When bringing a hot-added CPU online, the kernel did not initialize a CPU mask properly, which could result in a kernel panic. This update corrects the bug by ensuring that the CPU mask is properly initialized and the correct NUMA node selected. (BZ#1134715)

* The kernel could fail to bring a CPU online if the hardware supported both, the acpi-cpufreq and intel_pstate modules. This update ensures that the acpi-cpufreq module is not loaded in the intel_pstate module is loaded. (BZ#1134716)

* Due to a bug in the time accounting of the kernel scheduler, a divide error could occur when hot adding a CPU. To fix this problem, the kernel scheduler time accounting has been reworked. (BZ#1134717)

* The kernel did not handle exceptions caused by an invalid floating point control (FPC) register, resulting in a kernel oops. This problem has been fixed by placing the label to handle these exceptions to the correct place in the code. (BZ#1138733)

* A previous change to the kernel for the PowerPC architecture changed implementation of the compat_sys_sendfile() function. Consequently, the 64-bit sendfile() system call stopped working for files larger than 2 GB on PowerPC. This update restores previous behavior of sendfile() on PowerPC, and it again process files bigger than 2 GB as expected. (BZ#1139126)

* Previously, the kernel scheduler could schedule a CPU topology update even though the topology did not change. This could negatively affect the CPU load balancing, cause degradation of the system performance, and eventually result in a kernel oops. This problem has been fixed by skipping the CPU topology update if the topology has not actually changed. (BZ#1140300)

* Previously, recovery of a double-degraded RAID6 array could, under certain circumstances, result in data corruption. This could happen because the md driver was using an optimization that is safe to use only for single-degraded arrays. This update ensures that this optimization is skipped during the recovery of double-degraded RAID6 arrays. (BZ#1143850)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1843 advisory.

    - [x86] kvm: fix PIT timer race condition (mguzik) [1149592 1149593] {CVE-2014-3611}
    - [x86] kvm: vmx: handle invept and invvpid vm exits gracefull (mguzik) [1144826 1144837 1144827 1144838]     {CVE-2014-3646 CVE-2014-3645}
    - [usb] serial: memory corruption flaw (Jacob Tanenbaum) [1141401 1141402] {CVE-2014-3185}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Nadav Amit reported that the KVM (Kernel Virtual Machine) mishandles noncanonical addresses when emulating instructions that change the rip (Instruction Pointer). A guest user with access to I/O or the MMIO can use this flaw to cause a denial of service (system crash) of the guest. (CVE-2014-3647)

A flaw was discovered with the handling of the invept instruction in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel. An unprivileged guest user could exploit this flaw to cause a denial of service (system crash) on the guest. (CVE-2014-3646)

A flaw was discovered with invept instruction support when using nested EPT in the KVM (Kernel Virtual Machine). An unprivileged guest user could exploit this flaw to cause a denial of service (system crash) on the guest. (CVE-2014-3645)

Lars Bull reported a race condition in the PIT (programmable interrupt timer) emulation in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel. A local guest user with access to PIT i/o ports could exploit this flaw to cause a denial of service (crash) on the host.
(CVE-2014-3611)

Lars Bull and Nadav Amit reported a flaw in how KVM (the Kernel Virtual Machine) handles noncanonical writes to certain MSR registers.
A privileged guest user can exploit this flaw to cause a denial of service (kernel panic) on the host. (CVE-2014-3610)

A flaw in the handling of malformed ASCONF chunks by SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel was discovered. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2014-3673)

A flaw in the handling of duplicate ASCONF chunks by SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel was discovered. A remote attacker could exploit this flaw to cause a denial of service (panic). (CVE-2014-3687)

It was discovered that excessive queuing by SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel can cause memory pressure. A remote attacker could exploit this flaw to cause a denial of service. (CVE-2014-3688)

A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual Machine) subsystem handles the CR4 control register at VM entry on Intel processors. A local host OS user can exploit this to cause a denial of service (kill arbitrary processes, or system disruption) by leveraging /dev/kvm access. (CVE-2014-3690)

Don Bailey discovered a flaw in the LZO decompress algorithm used by the Linux kernel. An attacker could exploit this flaw to cause a denial of service (memory corruption or OOPS). (CVE-2014-4608)

It was discovered the Linux kernel's implementation of IPv6 did not properly validate arguments in the ipv6_select_ident function. A local user could exploit this flaw to cause a denial of service (system crash) by leveraging tun or macvtap device access. (CVE-2014-7207)

Andy Lutomirski discovered that the Linux kernel was not checking the CAP_SYS_ADMIN when remounting filesystems to read-only. A local user could exploit this flaw to cause a denial of service (loss of writability). (CVE-2014-7975).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2014-3185

Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.

CVE-2014-3611 Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.

CVE-2014-3645 arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.

CVE-2014-3646 arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.

Impact

An attacker may be able to gain access to unauthorized information, perform unauthorized modification of data, or cause disruption of services. CVE-2014-3185 require physical access to the device.
CVE-2014-3611, CVE-2014-3645, and CVE-2014-3646 are considered local, as they are exploitable only by an authenticated user.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.5 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A race condition flaw was found in the way the Linux kernel's KVM subsystem handled PIT (Programmable Interval Timer) emulation. A guest user who has access to the PIT I/O ports could use this flaw to crash the host. (CVE-2014-3611, Important)

* A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system. (CVE-2014-7841, Important)

* A flaw was found in the way the ipc_rcu_putref() function in the Linux kernel's IPC implementation handled reference counter decrementing. A local, unprivileged user could use this flaw to trigger an Out of Memory (OOM) condition and, potentially, crash the system. (CVE-2013-4483, Moderate)

* A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate)

* It was found that the Linux kernel's KVM subsystem did not handle the VM exits gracefully for the invept (Invalidate Translations Derived from EPT) and invvpid (Invalidate Translations Based on VPID) instructions. On hosts with an Intel processor and invept/invppid VM exit support, an unprivileged guest user could use these instructions to crash the guest. (CVE-2014-3645, CVE-2014-3646, Moderate)

* A flaw was found in the way the Linux kernel's netfilter subsystem handled generic protocol tracking. As demonstrated in the Stream Control Transmission Protocol (SCTP) case, a remote attacker could use this flaw to bypass intended iptables rule restrictions when the associated connection tracking module was not loaded on the system.
(CVE-2014-8160, Moderate)

Red Hat would like to thank Lars Bull of Google for reporting CVE-2014-3611, Vladimir Davydov (Parallels) for reporting CVE-2013-4483, and the Advanced Threat Research team at Intel Security for reporting CVE-2014-3645 and CVE-2014-3646. The CVE-2014-7841 issue was discovered by Liu Wei of Red Hat.

Bug fixes :

* When forwarding a packet, the iptables target TCPOPTSTRIP used the tcp_hdr() function to locate the option space. Consequently, TCPOPTSTRIP located the incorrect place in the packet, and therefore did not match options for stripping. TCPOPTSTRIP now uses the TCP header itself to locate the option space, and the options are now properly stripped. (BZ#1172026)

* The ipset utility computed incorrect values of timeouts from an old IP set, and these values were then supplied to a new IP set. A resize on an IP set with a timeouts option enabled could then supply corrupted data from an old IP set. This bug has been fixed by properly reading timeout values from an old set before supplying them to a new set. (BZ#1172763)

* Incorrect processing of errors from the BCM5719 LAN controller could result in incoming packets being dropped. Now, received errors are handled properly, and incoming packets are no longer randomly dropped.
(BZ#1180405)

* When the NVMe driver allocated a name-space queue, it was recognized as a request-based driver, whereas it was a BIO-based driver. While trying to access data during the loading of NVMe along with a request-based DM device, the system could terminate unexpectedly or become unresponsive. Now, NVMe does not set the QUEUE_FLAG_STACKABLE flag during the allocation of a name-space queue, and the system no longer attempts to insert a request into the queue, preventing a crash. (BZ#1180554)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A double free vulnerability was found in netlink_dump,     which could cause a denial of service or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9806i1/4%0

  - Memory leak in drivers/media/video/videobuf-core.c in     the videobuf subsystem in the Linux kernel 2.6.x     through 4.x allows local users to cause a denial of     service (memory consumption) by leveraging /dev/video     access for a series of mmap calls that require new     allocations, a different vulnerability than     CVE-2007-6761. NOTE: as of 2016-06-18, this affects     only 11 drivers that have not been updated to use     videobuf2 instead of videobuf.(CVE-2010-5321i1/4%0

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2018-1108i1/4%0

  - The KVM implementation in the Linux kernel through     4.20.5 has an Information Leak.(CVE-2019-7222i1/4%0

  - The adreno_perfcounter_query_group function in     drivers/gpu/msm/adreno_perfcounter.c in the Adreno GPU     driver for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, uses an incorrect integer     data type, which allows attackers to cause a denial of     service (integer overflow, heap-based buffer overflow,     and incorrect memory allocation) or possibly have     unspecified other impact via a crafted     IOCTL_KGSL_PERFCOUNTER_QUERY ioctl     call.(CVE-2016-2062i1/4%0

  - drivers/hid/hid-ntrig.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_NTRIG is enabled, allows physically     proximate attackers to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted     device.(CVE-2013-2896i1/4%0

  - The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     before 3.17 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-3139i1/4%0

  - An integer overflow vulnerability in     ip6_find_1stfragopt() function was found. A local     attacker that has privileges (of CAP_NET_RAW) to open     raw socket can cause an infinite loop inside the     ip6_find_1stfragopt() function.(CVE-2017-7542i1/4%0

  - Memory leak in the virtio_gpu_object_create function in     drivers/gpu/drm/virtio/virtgpu_object.c in the Linux     kernel through 4.11.8 allows attackers to cause a     denial of service (memory consumption) by triggering     object-initialization failures.(CVE-2017-10810i1/4%0

  - The ping_recvmsg function in net/ipv4/ping.c in the     Linux kernel before 3.12.4 does not properly interact     with read system calls on ping sockets, which allows     local users to cause a denial of service (NULL pointer     dereference and system crash) by leveraging unspecified     privileges to execute a crafted     application.(CVE-2013-6432i1/4%0

  - The madvise_willneed function in the Linux kernel     allows local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping.(CVE-2017-18208i1/4%0

  - An issue was discovered in the Linux kernel through     4.18.8. The vmacache_flush_all function in     mm/vmacache.c mishandles sequence number overflows. An     attacker can trigger a use-after-free (and possibly     gain privileges) via certain thread creation, map,     unmap, invalidation, and dereference     operations.(CVE-2018-17182i1/4%0

  - The ieee80211_radiotap_iterator_init function in     net/wireless/radiotap.c in the Linux kernel before     3.11.7 does not check whether a frame contains any data     outside of the header, which might allow attackers to     cause a denial of service (buffer over-read) via a     crafted header.(CVE-2013-7027i1/4%0

  - The Btrfs implementation in the Linux kernel before     3.19 does not ensure that the visible xattr state is     consistent with a requested replacement, which allows     local users to bypass intended ACL settings and gain     privileges via standard filesystem operations (1)     during an xattr-replacement time window, related to a     race condition, or (2) after an xattr-replacement     attempt that fails because the data does not     fit.(CVE-2014-9710i1/4%0

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled duplicate Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3687i1/4%0

  - A syntax vulnerability was discovered in the kernel's     ASN1.1 DER decoder, which could lead to memory     corruption or a complete local denial of service     through x509 certificate DER files. A local system user     could use a specially created key file to trigger     BUG_ON() in the public_key_verify_signature() function     (crypto/asymmetric_keys/public_key.c), to cause a     kernel panic and crash the system.(CVE-2016-2053i1/4%0

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT)     instructions. On hosts with an Intel processor and     invept VM exit support, an unprivileged guest user     could use these instructions to crash the     guest.(CVE-2014-3645i1/4%0

  - The packet_recvmsg function in net/packet/af_packet.c     in the Linux kernel before 3.12.4 updates a certain     length value before ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7270i1/4%0

  - The init_new_context function in     arch/x86/include/asm/mmu_context.h in the Linux kernel,     before 4.12.10, does not correctly handle errors from     LDT table allocation when forking a new process. This     could allow a local attacker to achieve a     use-after-free or possibly have unspecified other     impact by running a specially crafted     program.(CVE-2017-17053i1/4%0

  - It was found that the sanity_check_raw_super() function     in 'fs/f2fs/super.c' file in the Linux kernel before     version 4.12-rc1 does not validate the f2fs filesystem     segment count. This allows an unprivileged local user     to cause a system panic and DoS. Due to the nature of     the flaw, privilege escalation cannot be fully ruled     out, although we believe it is     unlikely.(CVE-2017-10662i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1724 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    Security fixes:

    * A race condition flaw was found in the way the Linux kernel's KVM     subsystem handled PIT (Programmable Interval Timer) emulation. A guest user     who has access to the PIT I/O ports could use this flaw to crash the host.
    (CVE-2014-3611, Important)

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     Stream Control Transmission Protocol (SCTP) implementation handled     simultaneous connections between the same hosts. A remote attacker could     use this flaw to crash the system. (CVE-2014-5077, Important)

    * It was found that the Linux kernel's KVM subsystem did not handle the VM     exits gracefully for the invept (Invalidate Translations Derived from EPT)     and invvpid (Invalidate Translations Based on VPID) instructions. On hosts     with an Intel processor and invept/invppid VM exit support, an unprivileged     guest user could use these instructions to crash the guest. (CVE-2014-3645,     CVE-2014-3646, Moderate)

    * A use-after-free flaw was found in the way the Linux kernel's Advanced     Linux Sound Architecture (ALSA) implementation handled user controls. A     local, privileged user could use this flaw to crash the system.
    (CVE-2014-4653, Moderate)

    Red Hat would like to thank Lars Bull of Google for reporting     CVE-2014-3611, and the Advanced Threat Research team at Intel Security for     reporting CVE-2014-3645 and CVE-2014-3646.

    Bug fixes:

    * A known issue that could prevent Chelsio adapters using the cxgb4 driver     from being initialized on IBM POWER8 systems has been fixed. These     adapters can now be used on IBM POWER8 systems as expected. (BZ#1130548)

    * When bringing a hot-added CPU online, the kernel did not initialize a     CPU mask properly, which could result in a kernel panic. This update     corrects the bug by ensuring that the CPU mask is properly initialized and     the correct NUMA node selected. (BZ#1134715)

    * The kernel could fail to bring a CPU online if the hardware supported     both, the acpi-cpufreq and intel_pstate modules. This update ensures that     the acpi-cpufreq module is not loaded in the intel_pstate module is     loaded. (BZ#1134716)

    * Due to a bug in the time accounting of the kernel scheduler, a divide     error could occur when hot adding a CPU. To fix this problem, the kernel     scheduler time accounting has been reworked. (BZ#1134717)

    * The kernel did not handle exceptions caused by an invalid floating point     control (FPC) register, resulting in a kernel oops. This problem has been     fixed by placing the label to handle these exceptions to the correct place     in the code. (BZ#1138733)

    * A previous change to the kernel for the PowerPC architecture changed     implementation of the compat_sys_sendfile() function. Consequently, the     64-bit sendfile() system call stopped working for files larger than 2 GB     on PowerPC. This update restores previous behavior of sendfile() on     PowerPC, and it again process files bigger than 2 GB as expected.
    (BZ#1139126)

    * Previously, the kernel scheduler could schedule a CPU topology update     even though the topology did not change. This could negatively affect the     CPU load balancing, cause degradation of the system performance, and     eventually result in a kernel oops. This problem has been fixed by     skipping the CPU topology update if the topology has not actually changed.
    (BZ#1140300)

    * Previously, recovery of a double-degraded RAID6 array could, under     certain circumstances, result in data corruption. This could happen     because the md driver was using an optimization that is safe to use only     for single-degraded arrays. This update ensures that this optimization is     skipped during the recovery of double-degraded RAID6 arrays. (BZ#1143850)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3084 advisory.

    - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw)  [Orabug: 19849334]     {CVE-2014-3185}
    - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849317]  {CVE-2014-3181}
    - kvm: vmx: handle invvpid vm exit gracefully (Petr Matousek)  [Orabug: 19906300]  {CVE-2014-3646}
    - nEPT: Nested INVEPT (Nadav Har'El)  [Orabug: 19906267]  {CVE-2014-3645}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service :

  - CVE-2014-3610     Lars Bull of Google and Nadav Amit reported a flaw in     how KVM handles noncanonical writes to certain MSR     registers. A privileged guest user can exploit this flaw     to cause a denial of service (kernel panic) on the host.

  - CVE-2014-3611     Lars Bull of Google reported a race condition in the PIT     emulation code in KVM. A local guest user with access to     PIT i/o ports could exploit this flaw to cause a denial     of service (crash) on the host.

  - CVE-2014-3645/ CVE-2014-3646     The Advanced Threat Research team at Intel Security     discovered that the KVM subsystem did not handle the VM     exits gracefully for the invept (Invalidate Translations     Derived from EPT) and invvpid (Invalidate Translations     Based on VPID) instructions. On hosts with an Intel     processor and invept/invppid VM exit support, an     unprivileged guest user could use these instructions to     crash the guest.

  - CVE-2014-3647     Nadav Amit reported that KVM mishandles noncanonical     addresses when emulating instructions that change rip,     potentially causing a failed VM-entry. A guest user with     access to I/O or the MMIO can use this flaw to cause a     denial of service (system crash) of the guest.

  - CVE-2014-3673     Liu Wei of Red Hat discovered a flaw in     net/core/skbuff.c leading to a kernel panic when     receiving malformed ASCONF chunks. A remote attacker     could use this flaw to crash the system.

  - CVE-2014-3687     A flaw in the sctp stack was discovered leading to a     kernel panic when receiving duplicate ASCONF chunks. A     remote attacker could use this flaw to crash the system.

  - CVE-2014-3688     It was found that the sctp stack is prone to a remotely     triggerable memory pressure issue caused by excessive     queueing. A remote attacker could use this flaw to cause     denial-of-service conditions on the system.

  - CVE-2014-3690     Andy Lutomirski discovered that incorrect register     handling in KVM may lead to denial of service.

  - CVE-2014-7207     Several Debian developers reported an issue in the IPv6     networking subsystem. A local user with access to tun or     macvtap devices, or a virtual machine connected to such     a device, can cause a denial of service (system crash).

This update includes a bug fix related to CVE-2014-7207 that disables UFO (UDP Fragmentation Offload) in the macvtap, tun, and virtio_net drivers. This will cause migration of a running VM from a host running an earlier kernel version to a host running this kernel version to fail, if the VM has been assigned a virtio network device. In order to migrate such a VM, it must be shut down first.

Security fixes :

  - A race condition flaw was found in the way the Linux     kernel's KVM subsystem handled PIT (Programmable     Interval Timer) emulation. A guest user who has access     to the PIT I/O ports could use this flaw to crash the     host. (CVE-2014-3611, Important)

  - A NULL pointer dereference flaw was found in the way the     Linux kernel's Stream Control Transmission Protocol     (SCTP) implementation handled simultaneous connections     between the same hosts. A remote attacker could use this     flaw to crash the system. (CVE-2014-5077, Important)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT) and invvpid     (Invalidate Translations Based on VPID) instructions. On     hosts with an Intel processor and invept/invppid VM exit     support, an unprivileged guest user could use these     instructions to crash the guest. (CVE-2014-3645,     CVE-2014-3646, Moderate)

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the system.
    (CVE-2014-4653, Moderate)

Bug fixes :

  - A known issue that could prevent Chelsio adapters using     the cxgb4 driver from being initialized on IBM POWER8     systems has been fixed. These adapters can now be used     on IBM POWER8 systems as expected.

  - When bringing a hot-added CPU online, the kernel did not     initialize a CPU mask properly, which could result in a     kernel panic. This update corrects the bug by ensuring     that the CPU mask is properly initialized and the     correct NUMA node selected.

  - The kernel could fail to bring a CPU online if the     hardware supported both, the acpi-cpufreq and     intel_pstate modules. This update ensures that the     acpi-cpufreq module is not loaded in the intel_pstate     module is loaded.

  - Due to a bug in the time accounting of the kernel     scheduler, a divide error could occur when hot adding a     CPU. To fix this problem, the kernel scheduler time     accounting has been reworked.

  - The kernel did not handle exceptions caused by an     invalid floating point control (FPC) register, resulting     in a kernel oops. This problem has been fixed by placing     the label to handle these exceptions to the correct     place in the code.

  - A previous change to the kernel for the PowerPC     architecture changed implementation of the     compat_sys_sendfile() function. Consequently, the 64-bit     sendfile() system call stopped working for files larger     than 2 GB on PowerPC. This update restores previous     behavior of sendfile() on PowerPC, and it again process     files bigger than 2 GB as expected.

  - Previously, the kernel scheduler could schedule a CPU     topology update even though the topology did not change.
    This could negatively affect the CPU load balancing,     cause degradation of the system performance, and     eventually result in a kernel oops. This problem has     been fixed by skipping the CPU topology update if the     topology has not actually changed.

  - Previously, recovery of a double-degraded RAID6 array     could, under certain circumstances, result in data     corruption. This could happen because the md driver was     using an optimization that is safe to use only for     single-degraded arrays. This update ensures that this     optimization is skipped during the recovery of     double-degraded RAID6 arrays.

The system must be rebooted for this update to take effect.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for     the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a     crafted application. (CVE-2014-3645)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1724 advisory.

    - [virt] kvm: fix PIT timer race condition (Petr  Matousek) [1144879 1144880] {CVE-2014-3611}
    - [virt] kvm/vmx: handle invept and invvpid vm exits gracefully (Petr  Matousek) [1145449 1116936]     [1144828 1144829] {CVE-2014-3645 CVE-2014-3646}
    - [net] sctp: inherit auth_capable on INIT collisions (Daniel Borkmann) [1124337 1123763] {CVE-2014-5077}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1843 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A race condition flaw was found in the way the Linux kernel's KVM     subsystem handled PIT (Programmable Interval Timer) emulation. A guest user     who has access to the PIT I/O ports could use this flaw to crash the host.
    (CVE-2014-3611, Important)

    * A memory corruption flaw was found in the way the USB ConnectTech     WhiteHEAT serial driver processed completion commands sent via USB Request     Blocks buffers. An attacker with physical access to the system could use     this flaw to crash the system or, potentially, escalate their privileges on     the system. (CVE-2014-3185, Moderate)

    * It was found that the Linux kernel's KVM subsystem did not handle the VM     exits gracefully for the invept (Invalidate Translations Derived from EPT)     and invvpid (Invalidate Translations Based on VPID) instructions. On hosts     with an Intel processor and invept/invppid VM exit support, an unprivileged     guest user could use these instructions to crash the guest. (CVE-2014-3645,     CVE-2014-3646, Moderate)

    Red Hat would like to thank Lars Bull of Google for reporting     CVE-2014-3611, and the Advanced Threat Research team at Intel Security for     reporting CVE-2014-3645 and CVE-2014-3646.

    This update also fixes the following bugs:

    * This update fixes several race conditions between PCI error recovery     callbacks and potential calls of the ifup and ifdown commands in the tg3     driver. When triggered, these race conditions could cause a kernel crash.
    (BZ#1142570)

    * Previously, GFS2 failed to unmount a sub-mounted GFS2 file system if its     parent was also a GFS2 file system. This problem has been fixed by adding     the appropriate d_op->d_hash() routine call for the last component of the     mount point path in the path name lookup mechanism code (namei).
    (BZ#1145193)

    * Due to previous changes in the virtio-net driver, a Red Hat Enterprise     Linux 6.6 guest was unable to boot with the mgr_rxbuf=off option     specified. This was caused by providing the page_to_skb() function with an     incorrect packet length in the driver's Rx path. This problem has been     fixed and the guest in the described scenario can now boot successfully.
    (BZ#1148693)

    * When using one of the newer IPSec Authentication Header (AH) algorithms     with Openswan, a kernel panic could occur. This happened because the     maximum truncated ICV length was too small. To fix this problem, the     MAX_AH_AUTH_LEN parameter has been set to 64. (BZ#1149083)

    * A bug in the IPMI driver caused the kernel to panic when an IPMI     interface was removed using the hotmod script. The IPMI driver has been     fixed to properly clean the relevant data when removing an IPMI interface.
    (BZ#1149578)

    * Due to a bug in the IPMI driver, the kernel could panic when adding an     IPMI interface that was previously removed using the hotmod script.
    This update fixes this bug by ensuring that the relevant shadow structure     is initialized at the right time. (BZ#1149580)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c (CVE-2014-3610).

Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation (CVE-2014-3611).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3645).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3646).

arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3647).

The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c (CVE-2014-3673).

The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter (CVE-2014-3687).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU (CVE-2014-3690).

kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application (CVE-2014-7825).

kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application (CVE-2014-7826).

The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call (CVE-2014-7970).

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601 (CVE-2014-8369).

The updated packages provides a solution for these security issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's futex     subsystem handled the requeuing of certain Priority     Inheritance (PI) futexes. A local, unprivileged user     could use this flaw to escalate their privileges on the     system.(CVE-2014-3153)

  - An out-of-bounds write flaw was found in the way the     Apple Magic Mouse/Trackpad multi-touch driver handled     Human Interface Device (HID) reports with an invalid     size. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3181)

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182)

  - Multiple out-of-bounds write flaws were found in the     way the Cherry Cymotion keyboard driver, KYE/Genius     device drivers, Logitech device drivers, Monterey     Genius KB29E keyboard driver, Petalynx Maxter remote     control driver, and Sunplus wireless desktop driver     handled HID reports with an invalid report descriptor     size. An attacker with physical access to the system     could use either of these flaws to write data past an     allocated memory buffer.(CVE-2014-3184)

  - A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed     completion commands sent via USB Request Blocks     buffers. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3185)

  - It was found that Linux kernel's ptrace subsystem did     not properly sanitize the address-space-control bits     when the program-status word (PSW) was being set. On     IBM S/390 systems, a local, unprivileged user could use     this flaw to set address-space-control bits to the     kernel space, and thus gain read and write access to     kernel memory.(CVE-2014-3534)

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601)

  - It was found that KVM's Write to Model Specific     Register (WRMSR) instruction emulation would write     non-canonical values passed in by the guest to certain     MSRs in the host's context. A privileged guest user     could use this flaw to crash the host.(CVE-2014-3610)

  - A race condition flaw was found in the way the Linux     kernel's KVM subsystem handled PIT (Programmable     Interval Timer) emulation. A guest user who has access     to the PIT I/O ports could use this flaw to crash the     host.(CVE-2014-3611)

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT)     instructions. On hosts with an Intel processor and     invept VM exit support, an unprivileged guest user     could use these instructions to crash the     guest.(CVE-2014-3645)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invvpid     (Invalidate Translations Based on VPID) instructions.
    On hosts with an Intel processor and invppid VM exit     support, an unprivileged guest user could use these     instructions to crash the guest.(CVE-2014-3646)

  - A flaw was found in the way the Linux kernel's KVM     subsystem handled non-canonical addresses when     emulating instructions that change the RIP (for     example, branches or calls). A guest user with access     to an I/O or MMIO region could use this flaw to crash     the guest.(CVE-2014-3647)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled malformed Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3673)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled duplicate Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3687)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled the association's output queue. A remote     attacker could send specially crafted packets that     would cause the system to use an excessive amount of     memory, leading to a denial of service.(CVE-2014-3688)

  - It was found that the Linux kernel's KVM implementation     did not ensure that the host CR4 control register value     remained unchanged across VM entries on the same     virtual CPU. A local, unprivileged user could use this     flaw to cause a denial of service on the     system.(CVE-2014-3690)

  - An out-of-bounds memory access flaw was found in the     Linux kernel's system call auditing implementation. On     a system with existing audit rules defined, a local,     unprivileged user could use this flaw to leak kernel     memory to user space or, potentially, crash the     system.(CVE-2014-3917)

  - A flaw was found in the way Linux kernel's Transparent     Huge Pages (THP) implementation handled non-huge page     migration. A local, unprivileged user could use this     flaw to crash the kernel by migrating transparent     hugepages.(CVE-2014-3940)

  - The capabilities implementation in the Linux kernel     before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows     local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by     setting the setgid bit on a file with group ownership     of root.(CVE-2014-4014)

  - An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) backend driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client.(CVE-2014-4027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/4/3	2025/12/26	critical
78702	CentOS 7 : kernel (CESA-2014:1724)	Nessus	CentOS Local Security Checks	2014/10/29	2021/1/4	medium
79201	Oracle Linux 6 : kernel (ELSA-2014-1843)	Nessus	Oracle Linux Local Security Checks	2014/11/12	2026/2/9	medium
79433	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2417-1)	Nessus	Ubuntu Local Security Checks	2014/11/25	2021/1/19	high
80059	F5 Networks BIG-IP : Linux kernel driver vulnerabilities (K15912)	Nessus	F5 Networks Local Security Checks	2014/12/17	2021/3/10	medium
81624	RHEL 6 : kernel (RHSA-2015:0284)	Nessus	Red Hat Local Security Checks	2015/3/5	2020/8/14	medium
124979	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1526)	Nessus	Huawei Local Security Checks	2019/5/14	2021/2/8	high
78722	RHEL 7 : kernel (RHSA-2014:1724)	Nessus	Red Hat Local Security Checks	2014/10/29	2025/4/15	medium
78756	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel Security (ELSA-2014-3084)	Nessus	Oracle Linux Local Security Checks	2014/10/31	2026/2/9	medium
78784	Debian DSA-3060-1 : linux - security update	Nessus	Debian Local Security Checks	2014/11/3	2021/1/11	high
78851	Scientific Linux Security Update : kernel on SL7.x x86_64 (20141028)	Nessus	Scientific Linux Local Security Checks	2014/11/4	2021/1/14	medium
218152	Linux Distros Unpatched Vulnerability : CVE-2014-3645	Nessus	Misc.	2025/3/4	2025/8/19	low
78721	Oracle Linux 7 : kernel (ELSA-2014-1724)	Nessus	Oracle Linux Local Security Checks	2014/10/29	2026/2/9	medium
79206	RHEL 6 : kernel (RHSA-2014:1843)	Nessus	Red Hat Local Security Checks	2014/11/12	2024/11/4	medium
79610	Mandriva Linux Security Advisory : kernel (MDVSA-2014:230)	Nessus	Mandriva Local Security Checks	2014/11/28	2021/1/6	high
124804	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1480)	Nessus	Huawei Local Security Checks	2019/5/13	2024/7/4	high

检测

插件搜索

critical

medium

medium

high

medium

medium

high

medium

medium

high

medium

low

medium

medium

high

high