A race condition was discovered in the Linux kernel's file_handle size verification. A local user could exploit this flaw to read potentially sensative memory locations. (CVE-2015-1420)

A underflow error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4001)

A bounds check error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4002)

A division by zero error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver. A remote attacker could exploit this flaw to cause a denial of service (system crash).
(CVE-2015-4003)

Carl H Lunde discovered missing sanity checks in the the Linux kernel's UDF file system (CONFIG_UDF_FS). A local attacker could exploit this flaw to cause a denial of service (system crash) by using a corrupted file system image. (CVE-2015-4167)

Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service.

  - CVE-2015-3290     Andy Lutomirski discovered that the Linux kernel does     not properly handle nested NMIs. A local, unprivileged     user could use this flaw for privilege escalation.

  - CVE-2015-3291     Andy Lutomirski discovered that under certain conditions     a malicious userspace program can cause the kernel to     skip NMIs leading to a denial of service.

  - CVE-2015-4167     Carl Henrik Lunde discovered that the UDF implementation     is missing a necessary length check. A local user that     can mount devices could use this flaw to crash the     system.

  - CVE-2015-5157     Petr Matousek and Andy Lutomirski discovered that an NMI     that interrupts userspace and encounters an IRET fault     is incorrectly handled. A local, unprivileged user could     use this flaw for denial of service or possibly for     privilege escalation.

  - CVE-2015-5364     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     could exploit this flaw to cause a denial of service     using a flood of UDP packets with invalid checksums.

  - CVE-2015-5366     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     can cause a denial of service against applications that     use epoll by injecting a single packet with an invalid     checksum.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002416 advisory.

    The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain     length values, which allows local users to cause a denial of service (incorrect data representation or     integer overflow, and OOPS) via a crafted UDF filesystem.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-6252: Possible file descriptor leak for each     VHOST_SET_LOG_FDcommand issued, this could eventually     wasting available system resources and creating a denial     of service (bsc#942367).

  - CVE-2015-5707: Possible integer overflow in the     calculation of total number of pages in     bio_map_user_iov() (bsc#940338).

  - CVE-2015-5364: The (1) udp_recvmsg and (2) udpv6_recvmsg     functions in the Linux kernel before 4.0.6 do not     properly consider yielding a processor, which allowed     remote attackers to cause a denial of service (system     hang) via incorrect checksums within a UDP packet flood     (bsc#936831).

  - CVE-2015-5366: The (1) udp_recvmsg and (2) udpv6_recvmsg     functions in the Linux kernel before 4.0.6 provide     inappropriate -EAGAIN return values, which allowed     remote attackers to cause a denial of service (EPOLLET     epoll application read outage) via an incorrect checksum     in a UDP packet, a different vulnerability than     CVE-2015-5364 (bsc#936831).

  - CVE-2015-1420: Race condition in the handle_to_path     function in fs/fhandle.c in the Linux kernel through     3.19.1 allowed local users to bypass intended size     restrictions and trigger read operations on additional     memory locations by changing the handle_bytes value of a     file handle during the execution of this function     (bsc#915517).

  - CVE-2015-1805: The (1) pipe_read and (2) pipe_write     implementations in fs/pipe.c in the Linux kernel before     3.16 do not properly consider the side effects of failed
    __copy_to_user_inatomic and __copy_from_user_inatomic     calls, which allows local users to cause a denial of     service (system crash) or possibly gain privileges via a     crafted application, aka an 'I/O' vector array overrun.
    (bsc#933429)

  - CVE-2015-2150: Xen 3.3.x through 4.5.x and the Linux     kernel through 3.19.1 do not properly restrict access to     PCI command registers, which might allow local guest     users to cause a denial of service (non-maskable     interrupt and host crash) by disabling the (1) memory or     (2) I/O decoding for a PCI Express device and then     accessing the device, which triggers an Unsupported     Request (UR) response. (bsc#919463)

  - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux     kernel before 3.19.2 does not prevent the TS_COMPAT flag     from reaching a user-mode task, which might allow local     users to bypass the seccomp or audit protection     mechanism via a crafted application that uses the (1)     fork or (2) close system call, as demonstrated by an     attack against seccomp before 3.16. (bsc#926240)

  - CVE-2015-4700: The bpf_int_jit_compile function in     arch/x86/net/bpf_jit_comp.c in the Linux kernel before     4.0.6 allowed local users to cause a denial of service     (system crash) by creating a packet filter and then     loading crafted BPF instructions that trigger late     convergence by the JIT compiler (bsc#935705).

  - CVE-2015-4167: The udf_read_inode function in     fs/udf/inode.c in the Linux kernel before 3.19.1 did not     validate certain length values, which allowed local     users to cause a denial of service (incorrect data     representation or integer overflow, and OOPS) via a     crafted UDF filesystem (bsc#933907).

  - CVE-2015-0777: drivers/xen/usbback/usbback.c in     linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support     patches for the Linux kernel 2.6.18), as used in the     Linux kernel 2.6.x and 3.x in SUSE Linux distributions,     allows guest OS users to obtain sensitive information     from uninitialized locations in host OS kernel memory     via unspecified vectors. (bsc#917830)

  - CVE-2014-9728: The UDF filesystem implementation in the     Linux kernel before 3.18.2 did not validate certain     lengths, which allowed local users to cause a denial of     service (buffer over-read and system crash) via a     crafted filesystem image, related to fs/udf/inode.c and     fs/udf/symlink.c (bsc#933904).

  - CVE-2014-9730: The udf_pc_to_char function in     fs/udf/symlink.c in the Linux kernel before 3.18.2     relies on component lengths that are unused, which     allowed local users to cause a denial of service (system     crash) via a crafted UDF filesystem image (bsc#933904).

  - CVE-2014-9729: The udf_read_inode function in     fs/udf/inode.c in the Linux kernel before 3.18.2 did not     ensure a certain data-structure size consistency, which     allowed local users to cause a denial of service (system     crash) via a crafted UDF filesystem image (bsc#933904).

  - CVE-2014-9731: The UDF filesystem implementation in the     Linux kernel before 3.18.2 did not ensure that space is     available for storing a symlink target's name along with     a trailing \0 character, which allowed local users to     obtain sensitive information via a crafted filesystem     image, related to fs/udf/symlink.c and fs/udf/unicode.c     (bsc#933896).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.44 to receive various security and bugfixes.

These features were added :

  - mpt2sas: Added Reply Descriptor Post Queue (RDPQ) Array     support (bsc#854824).

  - mpt3sas: Bump mpt3sas driver version to 04.100.00.00     (bsc#854817).

Following security bugs were fixed :

  - CVE-2015-1805: iov overrun for failed atomic copy could     have lead to DoS or privilege escalation (bsc#933429).

  - CVE-2015-3212: A race condition in the way the Linux     kernel handled lists of associations in SCTP sockets     could have lead to list corruption and kernel panics     (bsc#936502).

  - CVE-2015-4036: DoS via memory corruption in vhost/scsi     driver (bsc#931988).

  - CVE-2015-4167: Linux kernel built with the UDF file     system(CONFIG_UDF_FS) support was vulnerable to a crash.
    It occurred while fetching inode information from a     corrupted/malicious udf file system image (bsc#933907).

  - CVE-2015-4692: DoS via NULL pointer dereference in     kvm_apic_has_events function (bsc#935542).

  - CVE-2015-5364: Remote DoS via flood of UDP packets with     invalid checksums (bsc#936831).

  - CVE-2015-5366: Remote DoS of EPOLLET epoll applications     via flood of UDP packets with invalid checksums     (bsc#936831).

Security issues already fixed in the previous update but not referenced by CVE :

  - CVE-2014-9728: Kernel built with the UDF file     system(CONFIG_UDF_FS) support were vulnerable to a crash     (bsc#933904).

  - CVE-2014-9729: Kernel built with the UDF file     system(CONFIG_UDF_FS) support were vulnerable to a crash     (bsc#933904).

  - CVE-2014-9730: Kernel built with the UDF file     system(CONFIG_UDF_FS) support were vulnerable to a crash     (bsc#933904).

  - CVE-2014-9731: Kernel built with the UDF file     system(CONFIG_UDF_FS) support were vulnerable to     information leakage (bsc#933896).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.1 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2014-8989: The Linux kernel did not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allowed local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c (bnc#906545).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandles IRET faults in     processing NMIs that occurred during userspace     execution, which might allow local users to gain     privileges by triggering an NMI (bnc#937969).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel through     4.2.3 did not ensure that certain slot numbers are     valid, which allowed local users to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #DB (aka Debug)     exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #AC (aka Alignment     Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key     (bnc#912202).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2015-6937 (bnc#952384     953052).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-7885: The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 did not initialize a certain structure     member, which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951627).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Disable 64bit address for Creative HDA     controllers (bnc#814440).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y     (boo#956934).

  - KVM: x86: update masterclock values on TSC writes     (bsc#961739).

  - NFS: Fix a NULL pointer dereference of migration     recovery ops for v4.2 client (bsc#960839).

  - apparmor: allow SYS_CAP_RESOURCE to be sufficient to     prlimit another task (bsc#921949).

  - blktap: also call blkif_disconnect() when frontend     switched to closed (bsc#952976).

  - blktap: refine mm tracking (bsc#952976).

  - cdrom: Random writing support for BD-RE media     (bnc#959568).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - ipv4: Do not increase PMTU with Datagram Too Big message     (bsc#955224).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - ipv6: fix tunnel error handling (bsc#952579).

  - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224).

  - uas: Add response iu handling (bnc#954138).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/evtchn: make use of PHYSDEVOP_map_pirq.

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain     length values, which allows local users to cause a denial of service (incorrect data representation or     integer overflow, and OOPS) via a crafted UDF filesystem. (CVE-2015-4167)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000712 advisory.

    The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain     length values, which allows local users to cause a denial of service (incorrect data representation or     integer overflow, and OOPS) via a crafted UDF filesystem.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel,     through 4.13.11, allows local users to cause a denial     of service (ims_pcu_parse_cdc_data out-of-bounds read     and system crash) or possibly have unspecified other     impact via a crafted USB device.(CVE-2017-16645i1/4%0

  - It was found that due to excessive files_lock locking,     a soft lockup could be triggered in the Linux kernel     when performing asynchronous I/O operations. A local,     unprivileged user could use this flaw to crash the     system.(CVE-2014-8172i1/4%0

  - A flaw was discovered in the kernel's collect_mounts     function. If the kernel's audit subsystem called     collect_mounts to audit an unmounted path, it could     panic the system. With this flaw, an unprivileged user     could call umount(MNT_DETACH) to launch a     denial-of-service attack.(CVE-2015-4177i1/4%0

  - A flaw was found in the way the Linux kernel's floppy     driver handled user space provided data in certain     error code paths while processing FDRAWCMD IOCTL     commands. A local user with write access to /dev/fdX     could use this flaw to free (using the kfree()     function) arbitrary kernel memory. (CVE-2014-1737,     Important) was found that the Linux kernel's floppy     driver leaked internal kernel memory addresses to user     space during the processing of the FDRAWCMD IOCTL     command. A local user with write access to /dev/fdX     could use this flaw to obtain information about the     kernel heap arrangement. (CVE-2014-1738, Low)Note: A     local user with write access to /dev/fdX could use     these two flaws (CVE-2014-1737 in combination with     CVE-2014-1738) to escalate their privileges on the     system.(CVE-2014-1738i1/4%0

  - A reference counter leak in Linux kernel in     ipxitf_ioctl function was found which results in a use     after free vulnerability that's triggerable from     unprivileged userspace when IPX interface is     configured.(CVE-2017-7487i1/4%0

  - The x25_recvmsg function in net/x25/af_x25.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7271i1/4%0

  - An inode data validation error was found in Linux     kernels built with UDF file system (CONFIG_UDF_FS)     support. An attacker able to mount a     corrupted/malicious UDF file system image could cause     the kernel to crash.(CVE-2015-4167i1/4%0

  - Double free vulnerability in the ioctx_alloc function     in fs/aio.c in the Linux kernel before 3.12.4 allows     local users to cause a denial of service (system crash)     or possibly have unspecified other impact via vectors     involving an error condition in the aio_setup_ring     function.(CVE-2013-7348i1/4%0

  - A flaw was found in the Linux kernel's implementation     of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt()     system call. Users with non-namespace CAP_NET_ADMIN are     able to trigger this call and create a situation in     which the sockets sendbuff data size could be negative.
    This could adversely affect memory allocations and     create situations where the system could crash or cause     memory corruption.(CVE-2016-9793i1/4%0

  - Use-after-free vulnerability in the     ffs_user_copy_worker function in     drivers/usb/gadget/function/f_fs.c in the Linux kernel     before 4.5.3 allows local users to gain privileges by     accessing an I/O data structure after a certain     callback call. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2016-7912i1/4%0

  - A flaw was found in the way the get_dumpable() function     return value was interpreted in the ptrace subsystem of     the Linux kernel. When 'fs.suid_dumpable' was set to 2,     a local, unprivileged local user could use this flaw to     bypass intended ptrace restrictions and obtain     potentially sensitive information.(CVE-2013-2929i1/4%0

  - A DoS flaw was found for a Linux kernel built for the     x86 architecture which had the KVM virtualization     support(CONFIG_KVM) enabled. The kernel would be     vulnerable to a NULL pointer dereference flaw in Linux     kernel's kvm_apic_has_events() function while doing an     ioctl. An unprivileged user able to access the     '/dev/kvm' device could use this flaw to crash the     system kernel.(CVE-2015-4692i1/4%0

  - The intr function in sound/oss/msnd_pinnacle.c in the     Linux kernel through 4.11.7 allows local users to cause     a denial of service (over-boundary access) or possibly     have unspecified other impact by changing the value of     a message queue head pointer between two kernel reads     of that value, aka a 'double fetch'     vulnerability.(CVE-2017-9986i1/4%0

  - sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the     MSM QDSP6 audio driver for the Linux kernel 3.x, as     used in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to cause a denial of service (buffer     over-read) or possibly have unspecified other impact     via a crafted application that makes an ioctl call     specifying many commands.(CVE-2016-2064i1/4%0

  - The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux     kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference and system crash) via a crafted endpoints     value in a USB device descriptor.(CVE-2016-3140i1/4%0

  - In the Linux kernel through 4.14.13, the     rds_cmsg_atomic function in net/rds/rdma.c mishandles     cases where page pinning fails or an invalid address is     supplied, leading to an rds_atomic_free_op NULL pointer     dereference.(CVE-2018-5333i1/4%0

  - Multiple buffer underflows in the XFS implementation in     the Linux kernel through 3.12.1 allow local users to     cause a denial of service (memory corruption) or     possibly have unspecified other impact by leveraging     the CAP_SYS_ADMIN capability for a (1)     XFS_IOC_ATTRLIST_BY_HANDLE or (2)     XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted     length value, related to the xfs_attrlist_by_handle     function in fs/xfs/xfs_ioctl.c and the     xfs_compat_attrlist_by_handle function in     fs/xfs/xfs_ioctl32.c.(CVE-2013-6382i1/4%0

  - In the Linux kernel through 5.0.2, the function     inotify_update_existing_watch() in     fs/notify/inotify/inotify_user.c neglects to call     fsnotify_put_mark() with IN_MASK_CREATE after     fsnotify_find_mark(), which will cause a memory leak     (aka refcount leak). Finally, this will cause a denial     of service.(CVE-2019-9857i1/4%0

  - It was found that stacking a file system over procfs in     the Linux kernel could lead to a kernel stack overflow     due to deep nesting, as demonstrated by mounting     ecryptfs over procfs and creating a recursion by     mapping /proc/environ. An unprivileged, local user     could potentially use this flaw to escalate their     privileges on the system.(CVE-2016-1583i1/4%0

  - A heap-based buffer overflow vulnerability was found in     the Linux kernel's hiddev driver. This flaw could allow     a local attacker to corrupt kernel memory, possible     privilege escalation or crashing the     system.(CVE-2016-5829i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that the Linux kernel's implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already     processed when retrying after a failed atomic access     operation, potentially resulting in memory corruption     due to an I/O vector array overrun. A local,     unprivileged user could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-1805)

  - net/llc/sysctl_net_llc.c in the Linux kernel before     3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry.(CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042)

  - Xen 3.3.x through 4.5.x and the Linux kernel through     3.19.1 do not properly restrict access to PCI command     registers, which might allow local guest OS users to     cause a denial of service (non-maskable interrupt and     host crash) by disabling the (1) memory or (2) I/O     decoding for a PCI Express device and then accessing     the device, which triggers an Unsupported Request (UR)     response.(CVE-2015-2150)

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666)

  - The xsave/xrstor implementation in     arch/x86/include/asm/xsave.h in the Linux kernel before     3.19.2 creates certain .altinstr_replacement pointers     and consequently does not provide any protection     against instruction faulting, which allows local users     to cause a denial of service (panic) by triggering a     fault, as demonstrated by an unaligned memory operand     or a non-canonical address memory     operand.(CVE-2015-2672)

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830)

  - It was found that the Linux kernel's TCP/IP protocol     suite implementation for IPv6 allowed the Hop Limit     value to be set to a smaller value than the default     one. An attacker on a local network could use this flaw     to prevent systems on that network from sending or     receiving network packets.(CVE-2015-2922)

  - A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in     which the source was inside and the destination was     outside of a bind mount. A privileged user inside a     container could use this flaw to escape the bind mount     and, potentially, escalate their privileges on the     system.(CVE-2015-2925)

  - A race condition flaw was found in the way the Linux     kernel's SCTP implementation handled Address     Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could     use this flaw to crash the system via a race condition     triggered by setting certain ASCONF options on a     socket.(CVE-2015-3212)

  - mm/memory.c in the Linux kernel before 4.1.4 mishandles     anonymous pages, which allows local users to gain     privileges or cause a denial of service (page tainting)     via a crafted application that triggers writing to page     zero.(CVE-2015-3288)

  - A flaw was found in the way the Linux kernel's nested     NMI handler and espfix64 functionalities interacted     during NMI processing. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system.(CVE-2015-3290)

  - It was found that if a Non-Maskable Interrupt (NMI)     occurred immediately after a SYSCALL call or before a     SYSRET call with the user RSP pointing to the NMI IST     stack, the kernel could skip that NMI.(CVE-2015-3291)

  - A buffer overflow flaw was found in the way the Linux     kernel's Intel AES-NI instructions optimized version of     the RFC4106 GCM mode decryption functionality handled     fragmented packets. A remote attacker could use this     flaw to crash, or potentially escalate their privileges     on, a system over a connection with an active AES-GCM     mode IPSec security association.(CVE-2015-3331)

  - A race condition flaw was found between the chown and     execve system calls. When changing the owner of a     setuid user binary to root, the race condition could     momentarily make the binary setuid root. A local,     unprivileged user could potentially use this flaw to     escalate their privileges on the system.(CVE-2015-3339)

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636)

  - An inode data validation error was found in Linux     kernels built with UDF file system (CONFIG_UDF_FS)     support. An attacker able to mount a     corrupted/malicious UDF file system image could cause     the kernel to crash.(CVE-2015-4167)

  - A flaw was discovered in the way the Linux kernel's TTY     subsystem handled the tty shutdown phase. A local,     unprivileged user could use this flaw to cause denial     of service on the system by holding a reference to the     ldisc lock during tty shutdown, causing a     deadlock.(CVE-2015-4170)

  - A flaw was discovered in the kernel's collect_mounts     function. If the kernel's audit subsystem called     collect_mounts to audit an unmounted path, it could     panic the system. With this flaw, an unprivileged user     could call umount(MNT_DETACH) to launch a     denial-of-service attack.(CVE-2015-4177)

  - A DoS flaw was found for a Linux kernel built for the     x86 architecture which had the KVM virtualization     support(CONFIG_KVM) enabled. The kernel would be     vulnerable to a NULL pointer dereference flaw in Linux     kernel's kvm_apic_has_events() function while doing an     ioctl. An unprivileged user able to access the     '/dev/kvm' device could use this flaw to crash the     system kernel.(CVE-2015-4692)

  - A flaw was found in the kernel's implementation of the     Berkeley Packet Filter (BPF). A local attacker could     craft BPF code to crash the system by creating a     situation in which the JIT compiler would fail to     correctly optimize the JIT image on the last pass. This     would lead to the CPU executing instructions that were     not part of the JIT code.(CVE-2015-4700)

  - A buffer overflow flaw was found in the way the Linux     kernel's virtio-net subsystem handled certain fraglists     when the GRO (Generic Receive Offload) functionality     was enabled in a bridged network configuration. An     attacker on the local network could potentially use     this flaw to crash the system, or, although unlikely,     elevate their privileges on the system.(CVE-2015-5156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leaks or data corruption.

  - CVE-2015-1805     Red Hat discovered that the pipe iovec read and write     implementations may iterate over the iovec twice but     will modify the iovec such that the second iteration     accesses the wrong memory. A local user could use this     flaw to crash the system or possibly for privilege     escalation. This may also result in data corruption and     information leaks in pipes between non-malicious     processes.

  - CVE-2015-3636     Wen Xu and wushi of KeenTeam discovered that users     allowed to create ping sockets can use them to crash the     system and, on 32-bit architectures, for privilege     escalation. However, by default, no users on a Debian     system have access to ping sockets.

  - CVE-2015-4167     Carl Henrik Lunde discovered that the UDF implementation     is missing a necessary length checks. A local user that     can mount devices could use this flaw to crash the     system.

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-5707: An integer overflow in the SCSI generic     driver could be potentially used by local attackers to     crash the kernel or execute code (bsc#940338).

  - CVE-2015-5364: A remote denial of service (hang) via UDP     flood with incorrect package checksums was fixed.
    (bsc#936831).

  - CVE-2015-5366: A remote denial of service (unexpected     error returns) via UDP flood with incorrect package     checksums was fixed. (bsc#936831).

  - CVE-2015-1420: A race condition in the handle_to_path     function in fs/fhandle.c in the Linux kernel allowed     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function (bnc#915517).

  - CVE-2015-4700: A local user could have created a bad     instruction in the JIT processed BPF code, leading to a     kernel crash (bnc#935705).

  - CVE-2015-4167: The UDF filesystem in the Linux kernel     was vulnerable to a crash which could occur while     fetching inode information from a corrupted/malicious     udf file system image. (bsc#933907).

  - CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731:
    Various issues in handling UDF filesystems in the Linux     kernel allowed the corruption of kernel memory and other     issues. An attacker able to mount a corrupted/malicious     UDF file system image could cause the kernel to crash.
    (bsc#933904 bsc#933896)

  - CVE-2015-2150: The Linux kernel did not properly     restrict access to PCI command registers, which might     have allowed local guest users to cause a denial of     service (non-maskable interrupt and host crash) by     disabling the (1) memory or (2) I/O decoding for a PCI     Express device and then accessing the device, which     triggers an Unsupported Request (UR) response     (bsc#919463).

  - CVE-2015-0777: drivers/xen/usbback/usbback.c as used in     the Linux kernel 2.6.x and 3.x in SUSE Linux     distributions, allowed guest OS users to obtain     sensitive information from uninitialized locations in     host OS kernel memory via unspecified vectors     (bnc#917830).

  - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux     kernel did not prevent the TS_COMPAT flag from reaching     a user-mode task, which might have allowed local users     to bypass the seccomp or audit protection mechanism via     a crafted application that uses the (1) fork or (2)     close system call, as demonstrated by an attack against     seccomp before 3.16 (bnc#926240).

  - CVE-2015-1805: The Linux kernels implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already processed     when retrying after a failed atomic access operation,     potentially resulting in memory corruption due to an I/O     vector array overrun. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system. (bsc#933429).

Also 

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001985 advisory.

    The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain     length values, which allows local users to cause a denial of service (incorrect data representation or     integer overflow, and OOPS) via a crafted UDF filesystem.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2663-1 advisory.

    Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes     (xattrs). A local attacker could exploit this flaw to bypass ACLs and potentially escalate privileges.
    (CVE-2014-9710)

    A race condition was discovered in the Linux kernel's file_handle size verification. A local user could     exploit this flaw to read potentially sensative memory locations. (CVE-2015-1420)

    A underflow error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver.
    A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     execute arbitrary code via a specially crafted packet. (CVE-2015-4001)

    A bounds check error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or     potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4002)

    A division by zero error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4003)

    Carl H Lunde discovered missing consistency checks in the Linux kernel's UDF file system (CONFIG_UDF_FS).
    A local attacker could exploit this flaw to cause a denial of service (system crash) by using a corrupted     file system image. (CVE-2015-4167)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2664-1 advisory.

    A race condition was discovered in the Linux kernel's file_handle size verification. A local user could     exploit this flaw to read potentially sensative memory locations. (CVE-2015-1420)

    A underflow error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver.
    A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     execute arbitrary code via a specially crafted packet. (CVE-2015-4001)

    A bounds check error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or     potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4002)

    A division by zero error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4003)

    Carl H Lunde discovered missing consistency checks in the Linux kernel's UDF file system (CONFIG_UDF_FS).
    A local attacker could exploit this flaw to cause a denial of service (system crash) by using a corrupted     file system image. (CVE-2015-4167)

    Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local     attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

    A double free flaw was discovered in the Linux kernel's path lookup. A local user could cause a denial of     service (Oops). (CVE-2015-5706)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
84617	Ubuntu 14.10 : linux vulnerabilities (USN-2666-1)	Nessus	Ubuntu Local Security Checks	2015/7/8	2021/1/19	high
84965	Debian DSA-3313-1 : linux - security update	Nessus	Debian Local Security Checks	2015/7/24	2021/1/11	high
287726	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002416)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	medium
86290	SUSE SLED11 / SLES11 Security Update : kernel-source (SUSE-SU-2015:1678-1)	Nessus	SuSE Local Security Checks	2015/10/6	2021/1/6	high
85180	SUSE SLED12 / SLES12 Security Update : SUSE Linux Enterprise 12 kernel (SUSE-SU-2015:1324-1)	Nessus	SuSE Local Security Checks	2015/8/3	2021/1/6	high
88545	openSUSE Security Update : the Linux Kernel (openSUSE-2016-124)	Nessus	SuSE Local Security Checks	2016/2/3	2021/1/19	high
218815	Linux Distros Unpatched Vulnerability : CVE-2015-4167	Nessus	Misc.	2025/3/4	2026/7/17	medium
283866	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000712)	Nessus	Unity Linux Local Security Checks	2026/1/14	2026/1/15	medium
124988	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1535)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high
124811	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1487)	Nessus	Huawei Local Security Checks	2019/5/13	2024/5/23	high
84277	Debian DSA-3290-1 : linux - security update	Nessus	Debian Local Security Checks	2015/6/19	2021/1/11	high
86121	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2015:1611-1)	Nessus	SuSE Local Security Checks	2015/9/24	2021/1/6	high
286410	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001985)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	medium
84614	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2663-1)	Nessus	Ubuntu Local Security Checks	2015/7/8	2024/8/27	high
84615	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2664-1)	Nessus	Ubuntu Local Security Checks	2015/7/8	2024/8/27	medium

检测

插件搜索

high

high

medium

high

high

high

medium

medium

high

high

high

high

medium

high

medium