The SUSE Linux Enterprise Server 11 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-5707: An integer overflow in the SCSI generic     driver could be potentially used by local attackers to     crash the kernel or execute code.

  - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux     kernel did not prevent the TS_COMPAT flag from reaching     a user-mode task, which might have allowed local users     to bypass the seccomp or audit protection mechanism via     a crafted application that uses the (1) fork or (2)     close system call, as demonstrated by an attack against     seccomp before 3.16 (bnc#926240).

  - CVE-2015-0777: drivers/xen/usbback/usbback.c in the     Linux kernel allowed guest OS users to obtain sensitive     information from uninitialized locations in host OS     kernel memory via unspecified vectors (bnc#917830).

  - CVE-2015-2150: Xen and the Linux kernel did not properly     restrict access to PCI command registers, which might     have allowed local guest users to cause a denial of     service (non-maskable interrupt and host crash) by     disabling the (1) memory or (2) I/O decoding for a PCI     Express device and then accessing the device, which     triggers an Unsupported Request (UR) response     (bnc#919463).

  - CVE-2015-5364: A remote denial of service (hang) via UDP     flood with incorrect package checksums was fixed.
    (bsc#936831).

  - CVE-2015-5366: A remote denial of service (unexpected     error returns) via UDP flood with incorrect package     checksums was fixed. (bsc#936831).

  - CVE-2015-1420: CVE-2015-1420: Race condition in the     handle_to_path function in fs/fhandle.c in the Linux     kernel allowed local users to bypass intended size     restrictions and trigger read operations on additional     memory locations by changing the handle_bytes value of a     file handle during the execution of this function     (bnc#915517).

  - CVE-2015-4700: A local user could have created a bad     instruction in the JIT processed BPF code, leading to a     kernel crash (bnc#935705).

  - CVE-2015-1805: The (1) pipe_read and (2) pipe_write     implementations in fs/pipe.c in the Linux kernel did not     properly consider the side effects of failed
    __copy_to_user_inatomic and __copy_from_user_inatomic     calls, which allowed local users to cause a denial of     service (system crash) or possibly gain privileges via a     crafted application, aka an 'I/O vector array overrun'     (bnc#933429).

  - CVE-2015-3331: The __driver_rfc4106_decrypt function in     arch/x86/crypto/aesni-intel_glue.c in the Linux kernel     did not properly determine the memory locations used for     encrypted data, which allowed context-dependent     attackers to cause a denial of service (buffer overflow     and system crash) or possibly execute arbitrary code by     triggering a crypto API call, as demonstrated by use of     a libkcapi test program with an AF_ALG(aead) socket     (bnc#927257).

  - CVE-2015-2922: The ndisc_router_discovery function in     net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol     implementation in the IPv6 stack in the Linux kernel     allowed remote attackers to reconfigure a hop-limit     setting via a small hop_limit value in a Router     Advertisement (RA) message (bnc#922583).

  - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux     kernel used an incorrect data type in a sysctl table,     which allowed local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry (bnc#919007).

  - CVE-2015-3636: The ping_unhash function in     net/ipv4/ping.c in the Linux kernel did not initialize a     certain list data structure during an unhash operation,     which allowed local users to gain privileges or cause a     denial of service (use-after-free and system crash) by     leveraging the ability to make a SOCK_DGRAM socket     system call for the IPPROTO_ICMP or IPPROTO_ICMPV6     protocol, and then making a connect system call after a     disconnect (bnc#929525).

  - CVE-2014-8086: Race condition in the     ext4_file_write_iter function in fs/ext4/file.c in the     Linux kernel allowed local users to cause a denial of     service (file unavailability) via a combination of a     write action and an F_SETFL fcntl operation for the     O_DIRECT flag (bnc#900881).

  - CVE-2014-8159: The InfiniBand (IB) implementation in the     Linux kernel did not properly restrict use of User Verbs     for registration of memory regions, which allowed local     users to access arbitrary physical memory locations, and     consequently cause a denial of service (system crash) or     gain privileges, by leveraging permissions on a uverbs     device under /dev/infiniband/ (bnc#914742).

  - CVE-2014-9683: Off-by-one error in the     ecryptfs_decode_from_filename function in     fs/ecryptfs/crypto.c in the eCryptfs subsystem in the     Linux kernel allowed local users to cause a denial of     service (buffer overflow and system crash) or possibly     gain privileges via a crafted filename (bnc#918333).

  - CVE-2015-2042: net/rds/sysctl.c in the Linux kernel used     an incorrect data type in a sysctl table, which allowed     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry (bnc#919018).

  - CVE-2015-1421: Use-after-free vulnerability in the     sctp_assoc_update function in net/sctp/associola.c in     the Linux kernel allowed remote attackers to cause a     denial of service (slab corruption and panic) or     possibly have unspecified other impact by triggering an     INIT collision that leads to improper handling of     shared-key data (bnc#915577).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000567 advisory.

    net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially sensitive information from kernel memory or possibly have     unspecified other impact by accessing a sysctl entry.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. (CVE-2015-1421)

Marcelo Leitner discovered a flaw in the Linux kernel's routing of packets to too many different dsts/too fast. A remote attacker can exploit this flaw to cause a denial of service (system crash).
(CVE-2015-1465)

An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)

An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.
(CVE-2015-2041)

An information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings.
(CVE-2015-2042).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2563-1 advisory.

    Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP (Stream Control Transmission     Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of     service (system crash) or potentially escalate their privileges on the system. (CVE-2015-1421)

    Marcelo Leitner discovered a flaw in the Linux kernel's routing of packets to too many different dsts/too     fast. A remote attacker on the same subnet can exploit this flaw to cause a denial of service (system     crash). (CVE-2015-1465)

    An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit     platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization     (ASLR) protection mechanism. (CVE-2015-1593)

    An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link     layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.
    (CVE-2015-2041)

    An information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets     (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings.
    (CVE-2015-2042)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that the Linux kernel's implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already     processed when retrying after a failed atomic access     operation, potentially resulting in memory corruption     due to an I/O vector array overrun. A local,     unprivileged user could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-1805)

  - net/llc/sysctl_net_llc.c in the Linux kernel before     3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry.(CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042)

  - Xen 3.3.x through 4.5.x and the Linux kernel through     3.19.1 do not properly restrict access to PCI command     registers, which might allow local guest OS users to     cause a denial of service (non-maskable interrupt and     host crash) by disabling the (1) memory or (2) I/O     decoding for a PCI Express device and then accessing     the device, which triggers an Unsupported Request (UR)     response.(CVE-2015-2150)

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666)

  - The xsave/xrstor implementation in     arch/x86/include/asm/xsave.h in the Linux kernel before     3.19.2 creates certain .altinstr_replacement pointers     and consequently does not provide any protection     against instruction faulting, which allows local users     to cause a denial of service (panic) by triggering a     fault, as demonstrated by an unaligned memory operand     or a non-canonical address memory     operand.(CVE-2015-2672)

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830)

  - It was found that the Linux kernel's TCP/IP protocol     suite implementation for IPv6 allowed the Hop Limit     value to be set to a smaller value than the default     one. An attacker on a local network could use this flaw     to prevent systems on that network from sending or     receiving network packets.(CVE-2015-2922)

  - A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in     which the source was inside and the destination was     outside of a bind mount. A privileged user inside a     container could use this flaw to escape the bind mount     and, potentially, escalate their privileges on the     system.(CVE-2015-2925)

  - A race condition flaw was found in the way the Linux     kernel's SCTP implementation handled Address     Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could     use this flaw to crash the system via a race condition     triggered by setting certain ASCONF options on a     socket.(CVE-2015-3212)

  - mm/memory.c in the Linux kernel before 4.1.4 mishandles     anonymous pages, which allows local users to gain     privileges or cause a denial of service (page tainting)     via a crafted application that triggers writing to page     zero.(CVE-2015-3288)

  - A flaw was found in the way the Linux kernel's nested     NMI handler and espfix64 functionalities interacted     during NMI processing. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system.(CVE-2015-3290)

  - It was found that if a Non-Maskable Interrupt (NMI)     occurred immediately after a SYSCALL call or before a     SYSRET call with the user RSP pointing to the NMI IST     stack, the kernel could skip that NMI.(CVE-2015-3291)

  - A buffer overflow flaw was found in the way the Linux     kernel's Intel AES-NI instructions optimized version of     the RFC4106 GCM mode decryption functionality handled     fragmented packets. A remote attacker could use this     flaw to crash, or potentially escalate their privileges     on, a system over a connection with an active AES-GCM     mode IPSec security association.(CVE-2015-3331)

  - A race condition flaw was found between the chown and     execve system calls. When changing the owner of a     setuid user binary to root, the race condition could     momentarily make the binary setuid root. A local,     unprivileged user could potentially use this flaw to     escalate their privileges on the system.(CVE-2015-3339)

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636)

  - An inode data validation error was found in Linux     kernels built with UDF file system (CONFIG_UDF_FS)     support. An attacker able to mount a     corrupted/malicious UDF file system image could cause     the kernel to crash.(CVE-2015-4167)

  - A flaw was discovered in the way the Linux kernel's TTY     subsystem handled the tty shutdown phase. A local,     unprivileged user could use this flaw to cause denial     of service on the system by holding a reference to the     ldisc lock during tty shutdown, causing a     deadlock.(CVE-2015-4170)

  - A flaw was discovered in the kernel's collect_mounts     function. If the kernel's audit subsystem called     collect_mounts to audit an unmounted path, it could     panic the system. With this flaw, an unprivileged user     could call umount(MNT_DETACH) to launch a     denial-of-service attack.(CVE-2015-4177)

  - A DoS flaw was found for a Linux kernel built for the     x86 architecture which had the KVM virtualization     support(CONFIG_KVM) enabled. The kernel would be     vulnerable to a NULL pointer dereference flaw in Linux     kernel's kvm_apic_has_events() function while doing an     ioctl. An unprivileged user able to access the     '/dev/kvm' device could use this flaw to crash the     system kernel.(CVE-2015-4692)

  - A flaw was found in the kernel's implementation of the     Berkeley Packet Filter (BPF). A local attacker could     craft BPF code to crash the system by creating a     situation in which the JIT compiler would fail to     correctly optimize the JIT image on the last pass. This     would lead to the CPU executing instructions that were     not part of the JIT code.(CVE-2015-4700)

  - A buffer overflow flaw was found in the way the Linux     kernel's virtio-net subsystem handled certain fraglists     when the GRO (Generic Receive Offload) functionality     was enabled in a bridged network configuration. An     attacker on the local network could potentially use     this flaw to crash the system, or, although unlikely,     elevate their privileges on the system.(CVE-2015-5156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)

An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.
(CVE-2015-2041)

An information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings.
(CVE-2015-2042).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2564-1 advisory.

    An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit     platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization     (ASLR) protection mechanism. (CVE-2015-1593)

    An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link     layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.
    (CVE-2015-2041)

    An information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets     (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings.
    (CVE-2015-2042)

    A memory corruption flaw was discovered in the Linux kernel's scsi subsystem. A local attacker could     potentially exploit this flaw to cause a denial of service (system crash). (CVE-2015-4036)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2014-8159     It was found that the Linux kernel's InfiniBand/RDMA     subsystem did not properly sanitize input parameters     while registering memory regions from user space via the     (u)verbs API. A local user with access to a     /dev/infiniband/uverbsX device could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.

  - CVE-2014-9715     It was found that the netfilter connection tracking     subsystem used too small a type as an offset within each     connection's data structure, following a bug fix in     Linux 3.2.33 and 3.6. In some configurations, this would     lead to memory corruption and crashes (even without     malicious traffic). This could potentially also result     in violation of the netfilter policy or remote code     execution.

  This can be mitigated by disabling connection tracking   accounting:sysctl net.netfilter.nf_conntrack_acct=0

  - CVE-2015-2041     Sasha Levin discovered that the LLC subsystem exposed     some variables as sysctls with the wrong type. On a     64-bit kernel, this possibly allows privilege escalation     from a process with CAP_NET_ADMIN capability; it also     results in a trivial information leak.

  - CVE-2015-2042     Sasha Levin discovered that the RDS subsystem exposed     some variables as sysctls with the wrong type. On a     64-bit kernel, this results in a trivial information     leak.

  - CVE-2015-2150     Jan Beulich discovered that Xen guests are currently     permitted to modify all of the (writable) bits in the     PCI command register of devices passed through to them.
    This in particular allows them to disable memory and I/O     decoding on the device unless the device is an SR-IOV     virtual function, which can result in denial of service     to the host.

  - CVE-2015-2830     Andrew Lutomirski discovered that when a 64-bit task on     an amd64 kernel makes a fork(2) or clone(2) system call     using int $0x80, the 32-bit compatibility flag is set     (correctly) but is not cleared on return. As a result,     both seccomp and audit will misinterpret the following     system call by the task(s), possibly leading to a     violation of security policy.

  - CVE-2015-2922     Modio AB discovered that the IPv6 subsystem would     process a router advertisement that specifies no route     but only a hop limit, which would then be applied to the     interface that received it. This can result in loss of     IPv6 connectivity beyond the local network.

  This may be mitigated by disabling processing of IPv6 router   advertisements if they are not needed:sysctl   net.ipv6.conf.default.accept_ra=0sysctl   net.ipv6.conf.<interface>.accept_ra=0

  - CVE-2015-3331     Stephan Mueller discovered that the optimised     implementation of RFC4106 GCM for x86 processors that     support AESNI miscalculated buffer addresses in some     cases. If an IPsec tunnel is configured to use this mode     (also known as AES-GCM-ESP) this can lead to memory     corruption and crashes (even without malicious traffic).
    This could potentially also result in remote code     execution.

  - CVE-2015-3332     Ben Hutchings discovered that the TCP Fast Open feature     regressed in Linux 3.16.7-ckt9, resulting in a kernel     BUG when it is used. This can be used as a local denial     of service.

  - CVE-2015-3339     It was found that the execve(2) system call can race     with inode attribute changes made by chown(2). Although     chown(2) clears the setuid/setgid bits of a file if it     changes the respective owner ID, this race condition     could result in execve(2) setting effective uid/gid to     the new owner ID, a privilege escalation.

The SUSE Linux Enterprise 12 kernel was updated to version 3.12.43 to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM     subsystem in the Linux kernel through 3.17.2 did not     properly perform RIP changes, which allowed guest OS     users to cause a denial of service (guest OS crash) via     a crafted application (bsc#899192).

  - CVE-2014-8086: Race condition in the     ext4_file_write_iter function in fs/ext4/file.c in the     Linux kernel through 3.17 allowed local users to cause a     denial of service (file unavailability) via a     combination of a write action and an F_SETFL fcntl     operation for the O_DIRECT flag (bsc#900881).

  - CVE-2014-8159: The InfiniBand (IB) implementation did     not properly restrict use of User Verbs for registration     of memory regions, which allowed local users to access     arbitrary physical memory locations, and consequently     cause a denial of service (system crash) or gain     privileges, by leveraging permissions on a uverbs device     under /dev/infiniband/ (bsc#914742).

  - CVE-2015-1465: The IPv4 implementation in the Linux     kernel before 3.18.8 did not properly consider the     length of the Read-Copy Update (RCU) grace period for     redirecting lookups in the absence of caching, which     allowed remote attackers to cause a denial of service     (memory consumption or system crash) via a flood of     packets (bsc#916225).

  - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux     kernel before 3.19 used an incorrect data type in a     sysctl table, which allowed local users to obtain     potentially sensitive information from kernel memory or     possibly have unspecified other impact by accessing a     sysctl entry (bsc#919007).

  - CVE-2015-2042: net/rds/sysctl.c in the Linux kernel     before 3.19 used an incorrect data type in a sysctl     table, which allowed local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry (bsc#919018).

  - CVE-2015-2666: Fixed a flaw that allowed crafted     microcode to overflow the kernel stack (bsc#922944).

  - CVE-2015-2830: Fixed int80 fork from 64-bit tasks     mishandling (bsc#926240).

  - CVE-2015-2922: Fixed possible denial of service (DoS)     attack against IPv6 network stacks due to improper     handling of Router Advertisements (bsc#922583).

  - CVE-2015-3331: Fixed buffer overruns in RFC4106     implementation using AESNI (bsc#927257).

  - CVE-2015-3332: Fixed TCP Fast Open local DoS     (bsc#928135).

  - CVE-2015-3339: Fixed race condition flaw between the     chown() and execve() system calls which could have lead     to local privilege escalation (bsc#928130).

  - CVE-2015-3636: Fixed use-after-free in ping sockets     which could have lead to local privilege escalation     (bsc#929525).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.1 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2014-8989: The Linux kernel did not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allowed local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c (bnc#906545).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandles IRET faults in     processing NMIs that occurred during userspace     execution, which might allow local users to gain     privileges by triggering an NMI (bnc#937969).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel through     4.2.3 did not ensure that certain slot numbers are     valid, which allowed local users to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #DB (aka Debug)     exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #AC (aka Alignment     Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key     (bnc#912202).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2015-6937 (bnc#952384     953052).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-7885: The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 did not initialize a certain structure     member, which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951627).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Disable 64bit address for Creative HDA     controllers (bnc#814440).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y     (boo#956934).

  - KVM: x86: update masterclock values on TSC writes     (bsc#961739).

  - NFS: Fix a NULL pointer dereference of migration     recovery ops for v4.2 client (bsc#960839).

  - apparmor: allow SYS_CAP_RESOURCE to be sufficient to     prlimit another task (bsc#921949).

  - blktap: also call blkif_disconnect() when frontend     switched to closed (bsc#952976).

  - blktap: refine mm tracking (bsc#952976).

  - cdrom: Random writing support for BD-RE media     (bnc#959568).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - ipv4: Do not increase PMTU with Datagram Too Big message     (bsc#955224).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - ipv6: fix tunnel error handling (bsc#952579).

  - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224).

  - uas: Add response iu handling (bnc#954138).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/evtchn: make use of PHYSDEVOP_map_pirq.

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - net/llc/sysctl_net_llc.c in the Linux kernel before 3.19     uses an incorrect data type in a sysctl table, which     allows local users to obtain potentially sensitive     information from kernel memory or possibly have     unspecified other impact by accessing a sysctl entry.
    (CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses an     incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry. (CVE-2015-2042)

  - The xfrm_migrate() function in the     net/xfrm/xfrm_policy.c file in the Linux kernel built     with CONFIG_XFRM_MIGRATE does not verify if the dir     parameter is less than XFRM_POLICY_MAX. This allows a     local attacker to cause a denial of service (out-of-     bounds access) or possibly have unspecified other impact     by sending a XFRM_MSG_MIGRATE netlink message. This flaw     is present in the Linux kernel since an introduction of     XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3.
    (CVE-2017-11600)

  - A flaw was found in the Linux kernel's skcipher     component, which affects the skcipher_recvmsg function.
    Attackers using a specific input can lead to a privilege     escalation. (CVE-2017-13215)

  - The Linux kernel is vulerable to a use-after-free flaw     when Transformation User configuration     interface(CONFIG_XFRM_USER) compile-time configuration     were enabled. This vulnerability occurs while closing a     xfrm netlink socket in xfrm_dump_policy_done. A     user/process could abuse this flaw to potentially     escalate their privileges on a system. (CVE-2017-16939)

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2017-8890)

  - An address corruption flaw was discovered in the Linux     kernel built with hardware breakpoint     (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a     h/w breakpoint via 'modify_user_hw_breakpoint' routine,     an unprivileged user/process could use this flaw to     crash the system kernel resulting in DoS OR to     potentially escalate privileges on a the system.
    (CVE-2018-1000199)

  - The do_get_mempolicy() function in mm/mempolicy.c in the     Linux kernel allows local users to hit a use-after-free     bug via crafted system calls and thus cause a denial of     service (DoS) or possibly have unspecified other impact.
    Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2018-10675)

  - A flaw was found in the Linux kernel's implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory. (CVE-2018-1068)

  - A Floating Point Unit (FPU) state information leakage     flaw was found in the way the Linux kernel saved and     restored the FPU state during task switch. Linux kernels     that follow the Lazy FPU Restore scheme are vulnerable     to the FPU state information leakage issue. An     unprivileged local attacker could use this flaw to read     FPU state bits by conducting targeted cache side-channel     attacks, similar to the Meltdown vulnerability disclosed     earlier this year. (CVE-2018-3665)

  - A flaw was found in the way the Linux kernel handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged system user could use this flaw to crash     the system kernel resulting in the denial of service.
    (CVE-2018-8897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002204 advisory.

    net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially sensitive information from kernel memory or possibly have     unspecified other impact by accessing a sysctl entry.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85764	SUSE SLES11 Security Update : kernel (SUSE-SU-2015:1478-1)	Nessus	SuSE Local Security Checks	2015/9/3	2021/1/19	medium
290935	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000567)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
82661	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2562-1)	Nessus	Ubuntu Local Security Checks	2015/4/9	2021/1/19	critical
82662	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2563-1)	Nessus	Ubuntu Local Security Checks	2015/4/9	2024/8/27	critical
124811	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1487)	Nessus	Huawei Local Security Checks	2019/5/13	2024/5/23	high
82660	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2560-1)	Nessus	Ubuntu Local Security Checks	2015/4/9	2021/1/19	medium
82695	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2564-1)	Nessus	Ubuntu Local Security Checks	2015/4/10	2024/8/27	high
83065	Debian DSA-3237-1 : linux - security update	Nessus	Debian Local Security Checks	2015/4/27	2021/1/11	high
84227	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:1071-1)	Nessus	SuSE Local Security Checks	2015/6/17	2021/1/6	medium
88545	openSUSE Security Update : the Linux Kernel (openSUSE-2016-124)	Nessus	SuSE Local Security Checks	2016/2/3	2021/1/19	high
127192	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0028)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	high
284842	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002204)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	high

检测

插件搜索

medium

high

critical

critical

high

medium

high

high

medium

high

high

high

high