遠端 Ubuntu 14.04 LTS 主機上安裝的一個套件受到 USN-2797-1 公告中所提及的多個弱點影響。

  - GNOME NetworkManager 允許遠端攻擊者透過 IPv6 路由器公告 (RA) 訊息中的特製 MTU 值造成拒絕服務 (IPv6 流量中斷)，此弱點不同於 CVE-2015-8215。(CVE-2015-0272)

  在 4.2.4 版之前的 Linux 核心中，fs/dcache.c 的 prepend_path 函式未正確處理 bind 掛載內的重新命名動作，其允許本機使用者透過重新命名目錄，進而繞過預定的容器保護機制；此問題與「double-chroot 攻擊」有關。(CVE-2015-2925)

  在 Linux 核心 4.2.4 及之前版本中，drivers/net/usb/asix_devices.c 中存在一個錯誤，可讓本機使用者透過特製的 USB 裝置，造成拒絕服務 (NULL 指標解除參照和系統當機)，或可能造成其他不明影響。注意：此 ID 未正確用於 ID 為 CVE-2015-8320的 Apache Cordova 問題。 (CVE-2015-5257)

  在 4.2.3 版之前的 Linux 核心中，net/sctp/protocol.c 所用的 sctp_init 函式具有不正確的通訊協定初始化步驟順序，這讓本機使用者得以在所有步驟結束之前即建立 SCTP 通訊端，進而引發拒絕服務 (不穩定或記憶體損毀)。(CVE-2015-5283)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

kernel-4.1.10-100.fc21 - Linxu v4.1.10 - 新增修補程式以修正網路堆疊中的軟鎖定 (rhbz 1266691)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - drivers/soc/qcom/qdsp6v2/voice_svc.c in the QDSP6v2     Voice Service driver for the Linux kernel 3.x, as used     in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via a write request, as demonstrated by a     voice_svc_send_req buffer overflow.(CVE-2016-5343i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4655i1/4%0

  - Race condition in the handle_to_path function in     fs/fhandle.c in the Linux kernel through 3.19.1 allows     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function.(CVE-2015-1420i1/4%0

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631i1/4%0

  - A flaw was found in the ext4 subsystem. This     vulnerability is a use after free vulnerability was     found in __ext4_journal_stop(). Attackers could abuse     this to allow any code which attempts to deal with the     journal failure to be mishandled or not fail at all.
    This could lead to data corruption or     crashes.(CVE-2015-8961i1/4%0

  - Buffer overflow in the oz_cdev_write function in     drivers/staging/ozwpan/ozcdev.c in the Linux kernel     before 3.12 allows local users to cause a denial of     service or possibly have unspecified other impact via a     crafted write operation.(CVE-2013-4513i1/4%0

  - The nfnetlink_rcv_batch() function in     'net/netfilter/nfnetlink.c' in the Linux kernel before     4.5 does not check whether a batch message's length     field is large enough, which allows local users to     obtain sensitive information from kernel memory or     cause a denial of service (infinite loop or     out-of-bounds read) by leveraging the CAP_NET_ADMIN     capability.(CVE-2016-7917i1/4%0

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value.(CVE-2013-4587i1/4%0

  - A leak of information was possible when issuing a     netlink command of the stack memory area leading up to     this function call. An attacker could use this to     determine stack information for use in a later     exploit.(CVE-2016-5243i1/4%0

  - An issue was discovered in the Linux kernel in the F2FS     filesystem code. A NULL pointer dereference in     fscrypt_do_page_crypto() in the fs/crypto/crypto.c     function can occur when operating on a file on a     corrupted f2fs image.(CVE-2018-14616i1/4%0

  - An out-of-bounds flaw was found in the kernel, where     the sco_sock_bind() function (bluetooth/sco) did not     check the length of its sockaddr parameter. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8575i1/4%0

  - A denial of service vulnerability was found in the     WhiteHEAT USB Serial Driver (whiteheat_attach function     in drivers/usb/serial/whiteheat.c). In the driver, the     COMMAND_PORT variable was hard coded and set to 4 (5th     element). The driver assumed that the number of ports     would always be 5 and used port number 5 as the command     port. However, when using a USB device in which the     number of ports was set to a number less than 5 (for     example, 3), the driver triggered a kernel NULL-pointer     dereference. A non-privileged attacker could use this     flaw to panic the host.(CVE-2015-5257i1/4%0

  - The LLC subsystem in the Linux kernel does not ensure     that a certain destructor exists in required     circumstances, which allows local users to cause a     denial of service (BUG_ON) or possibly have unspecified     other impact via crafted system calls.(CVE-2017-6345i1/4%0

  - A vulnerability was found in Linux kernel. There is an     information leak in file sound/core/timer.c of the     latest mainline Linux kernel. The stack object aEURoer1aEUR     has a total size of 32 bytes. Its field aEURoeeventaEUR and     aEURoevalaEUR both contain 4 bytes padding. These 8 bytes     padding bytes are sent to user without being     initialized.(CVE-2016-4578i1/4%0

  - An information leak flaw was found in the way the Linux     kernel changed certain segment registers and     thread-local storage (TLS) during a context switch. A     local, unprivileged user could use this flaw to leak     the user space TLS base address of an arbitrary     process.(CVE-2014-9419i1/4%0

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1     MiB to make successful exploitation of this issue more     difficult.(CVE-2017-1000364i1/4%0

  - A flaw was found in the Linux kernel's handling of     clearing SELinux attributes on /proc/pid/attr files. An     empty (null) write to this file can crash the system by     causing the system to attempt to access unmapped kernel     memory.(CVE-2017-2618i1/4%0

  - A use-after-free vulnerability was found in ALSA pcm     layer, which allows local users to cause a denial of     service, memory corruption, or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9794i1/4%0

  - A flaw was found in the way the Linux kernel's floppy     driver handled user space provided data in certain     error code paths while processing FDRAWCMD IOCTL     commands. A local user with write access to /dev/fdX     could use this flaw to free (using the kfree()     function) arbitrary kernel memory. (CVE-2014-1737,     Important)t was found that the Linux kernel's floppy     driver leaked internal kernel memory addresses to user     space during the processing of the FDRAWCMD IOCTL     command. A local user with write access to /dev/fdX     could use this flaw to obtain information about the     kernel heap arrangement. (CVE-2014-1738, Low)Note: A     local user with write access to /dev/fdX could use     these two flaws (CVE-2014-1737 in combination with     CVE-2014-1738) to escalate their privileges on the     system.(CVE-2014-1737i1/4%0

  - An out-of-bounds memory access flaw was found in the     Linux kernel's aiptek USB tablet driver (aiptek_probe()     function in drivers/input/tablet/aiptek.c). The driver     assumed that the interface always had at least one     endpoint. By using a specially crafted USB device with     no endpoints on one of its interfaces, an unprivileged     user with physical access to the system could trigger a     kernel NULL pointer dereference, causing the system to     panic.(CVE-2015-7515i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, unauthorised information disclosure or unauthorised information modification.

  - CVE-2015-2925     Jann Horn discovered that when a subdirectory of a     filesystem was bind-mounted into a chroot or mount     namespace, a user that should be confined to that chroot     or namespace could access the whole of that filesystem     if they had write permission on an ancestor of the     subdirectory. This is not a common configuration for     wheezy, and the issue has previously been fixed for     jessie.

  - CVE-2015-5257     Moein Ghasemzadeh of Istuary Innovation Labs reported     that a USB device could cause a denial of service     (crash) by imitating a Whiteheat USB serial device but     presenting a smaller number of endpoints.

  - CVE-2015-5283     Marcelo Ricardo Leitner discovered that creating     multiple SCTP sockets at the same time could cause a     denial of service (crash) if the sctp module had not     previously been loaded. This issue only affects jessie.

  - CVE-2015-7613     Dmitry Vyukov discovered that System V IPC objects     (message queues and shared memory segments) were made     accessible before their ownership and other attributes     were fully initialised. If a local user can race against     another user or service creating a new IPC object, this     may result in unauthorised information disclosure,     unauthorised information modification, denial of service     and/or privilege escalation.

  A similar issue existed with System V semaphore arrays, but was less   severe because they were always cleared before being fully   initialised.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2797-1 advisory.

    It was discovered that the Linux kernel did not check if a new IPv6 MTU set by a user space application     was valid. A remote attacker could forge a route advertisement with an invalid MTU that a user space     daemon like NetworkManager would honor and apply to the kernel, causing a denial of service.
    (CVE-2015-0272)

    It was discovered that in certain situations, a directory could be renamed outside of a bind mounted     location. An attacker could use this to escape bind mount containment and gain access to sensitive     information. (CVE-2015-2925)

    Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver contained hardcoded attributes about the     USB devices. An attacker could construct a fake WhiteHEAT USB device that, when inserted, causes a denial     of service (system crash). (CVE-2015-5257)

    It was discovered that the SCTP protocol implementation in the Linux kernel performed an incorrect     sequence of protocol-initialization steps. A local attacker could use this to cause a denial of service     (system crash). (CVE-2015-5283)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

kernel-4.1.10-100.fc21 - Linxu v4.1.10 - Add patch to fix soft lockups in network stack (rhbz 1266691)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

远程 OracleVM 系统缺少解决关键安全更新的必要补丁：

  - nfsd：更严格的解码 write-like NFSv2/v3 操作 (J.
    Bruce Fields) [Orabug：25986990] (CVE-2017-7895)

  - fnic：将 fnic 驱动程序版本更新至 1.6.0.24 (John Sobecki) [Orabug：24448585]

  - xen-netfront：重做补丁，修复 OOM 和网络压力期间的 Rx 停止 (Dongli Zhang) [Orabug：25450703]

  - xen-netfront：修复网络压力和 OOM 期间的 Rx 停止 (Dongli Zhang) [Orabug：25450703]

  - ipv6：如果套接字缓存中的 dst_entry 有效，则跳过 XFRM 查找 (Jakub Sitnicki)

  - uek-rpm：启用 CONFIG_KSPLICE。(Jamie Iles) [Orabug：
    25549809]

  - ksplice：添加 sysctls，以确定 Ksplice 功能。
    (Jamie Iles) 

  - signal：防止 SIGNAL_UNKILLABLE 意外清除。(Jamie Iles) [Orabug：25549809]

  - VSOCK：修复 lockdep 问题。(Dongli Zhang) [Orabug：
    25559937]

  - VSOCK：sock_put 不安全，无法在中断上下文中调用 (Dongli Zhang) [Orabug：25559937]

  - IB/CORE：同步 fmr_pool 中的资源访问 (Wengang Wang) [Orabug：25677469]

  - KVM：x86：修复“MOV SS，空选择器”的仿真 (Paolo Bonzini) [Orabug：25719675] (CVE-2017-2583) (CVE-2017-2583)

  - ext4：挂载时验证 s_first_meta_bg (Eryu Guan) [Orabug：25719738] (CVE-2016-10208)

  - sctp：避免 sctp_wait_for_sndbuf 上的 BUG_ON (Marcelo Ricardo Leitner) [Orabug：25719810] (CVE-2017-5986)

  - tcp：避免 tcp_splice_read 中的无限循环 (Eric Dumazet) [Orabug：25720813] (CVE-2017-6214)

  - lpfc 无法与在 P2P 模式下发送 PRLI 的目标建立连接 (Joe Jin) [Orabug：25759083]

  - USB：visor：修复探测时的空取消引用 (Johan Hovold) [Orabug：25796594] (CVE-2016-2782)

  - ipc/shm：修复 shmat mmap nil-page 保护 (Davidlohr Bueso) [Orabug：25797012] (CVE-2017-5669)

  - vhost：实际跟踪日志 eventfd 文件 (Marc-Andr&eacute Lureau) [Orabug：25797052] (CVE-2015-6252)

  - xfrm_user：更难验证 XFRM_MSG_NEWAE 传入的 ESN 大小 (Andy Whitcroft) [Orabug：25814663] (CVE-2017-7184)

  - xfrm_user：验证 XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Andy Whitcroft) [Orabug：25814663] (CVE-2017-7184)

  - KEYS：删除 key_type::match，以支持由 match_preparse 覆盖默认 (Aniket Alshi) [Orabug：
    25823962] (CVE-2017-2647) (CVE-2017-2647)

  - USB：whiteheat：修复探测时的潜在空取消引用 (Johan Hovold) [Orabug：25825105] (CVE-2015-5257) (CVE-2015-5257)

  - udf：在读取 symlink 时检查路径长度 (Jan Kara) [Orabug：25871102] (CVE-2015-9731)

  - udp：使用带截断的缓冲区正确支持 MSG_PEEK (Eric Dumazet) [Orabug：25876655] (CVE-2016-10229)

  - block：修复 seq 文件中的释放后使用 (Vegard Nossum) [Orabug：25877530] (CVE-2016-7910)

  - 恢复“修复 get_user_ex 中的次要信息泄露”(Brian Maly) [Orabug：25790392] (CVE-2016-9644)

  - net：ping：检查 ICMP 标头长度的最小大小 (Kees Cook) [Orabug：25766911] (CVE-2016-8399)

  - ipv6：停止为 MTU < 1280 发送 PTB 数据包 (Hagen Paul Pfeifer) [Orabug：25765776] (CVE-2016-10142)

  - 不适合在 KERNEL_DS 下调用 sg_write/bsg_write (Al Viro) [Orabug：25765445] (CVE-2016-10088)

  - scsi：sg：检查传递给 SG_NEXT_CMD_LEN 的长度 (peter chang) [Orabug：25751996] (CVE-2017-7187)

Dmitry Vyukov 发现在特定情况下，Linux 内核未能正确初始化 IPC 对象状态。本地攻击者可利用此问题升级其权限、暴露机密信息或造成拒绝服务（系统崩溃）。
(CVE-2015-7613)

已发现 Linux 内核未检查用户空间应用程序设置的新 IPv6 MTU 是否有效。远程攻击者可以使用无效 MTU 伪造路由公告，用户空间后台程序（如 NetworkManager）会遵从此公告并将其应用至内核，导致拒绝服务。(CVE-2015-0272)

已发现，特定情况下可在 bind 装载位置以外重命名目录。攻击者可利用这一点转义 bind 挂载包容，并获取敏感信息访问权限。(CVE-2015-2925)

Moein Ghasemzadeh 发现，USB WhiteHEAT 串行驱动程序中包含有关 USB 设备的硬编码属性。攻击者可构造假 WhiteHEAT USB 设备，在其插入时导致拒绝服务（系统崩溃）。(CVE-2015-5257)。

已发现，特定情况下可在 bind 装载位置以外重命名目录。攻击者可利用这一点转义 bind 挂载包容，并获取敏感信息访问权限。(CVE-2015-2925)

Moein Ghasemzadeh 发现，USB WhiteHEAT 串行驱动程序中包含有关 USB 设备的硬编码属性。攻击者可构造假 WhiteHEAT USB 设备，在其插入时导致拒绝服务（系统崩溃）。(CVE-2015-5257)。

远程 Ubuntu 14.04 LTS 主机上安装的一个程序包受到 USN-2798-1 公告中提及的多个漏洞影响。

  - 在 4.2.4 之前的 Linux 内核中，fs/dcache.c 的 prepend_path 函数未正确处理 bind 挂载内部的重命名操作，这允许本地用户通过重命名目录绕过预期容器保护机制，此问题与 double-chroot 攻击相关。(CVE-2015-2925)

  - 在低于 4.2.4 的 Linux 内核版本中，物理邻近攻击者可利用 drivers/usb/serial/whiteheat.c，通过构建的 USB 设备，造成拒绝服务（空指针取消引用和 OOPS），或可能造成其他不明影响。注意：Apache Cordova 问题所使用的 ID 不正确，正确的 ID 为 CVE-2015-8320。(CVE-2015-5257)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

此更新修复了如下所述的 CVE。

CVE-2015-2925

Jann Horn 发现，当文件系统的某个子目录被绑定挂载至 chroot 或挂载命名空间时，应被限制到该 chroot 或命名空间的用户在具备此子目录上级的写入权限时可访问整个文件系统。这不是此内核版本的常见配置。

CVE-2015-5257

Istuary Innovation Labs 的 Moein Ghasemzadeh 报告，USB 设备可通过在模仿 Whiteheat USB 串行设备时提供较少端点造成拒绝服务（崩溃）。

CVE-2015-7613

Dmitry Vyukov 发现，在对 System V IPC 对象（消息队列和共享内存段）的所有权和其他属性完全初始化之前，已将这些对象设为可访问。如果本地用户可以与创建新的 IPC 对象的其他用户或服务进行争用，这可能导致未经授权的信息泄露、未经授权的信息修改、拒绝服务和/或权限升级。

系统 V 信号量数组存在一个类似问题，但是其严重性较低，因为系统总是会在完全初始化之前清除这些数组。

对于旧稳定发行版本 (squeeze)，已在版本 2.6.32-48squeeze16 中修复了这些问题。

对于旧稳定发行版本 (wheezy)，将在版本 3.2.68-1+deb7u5 中修复这些问题。

对于稳定发行版本 (jessie)，这些问题将在版本 3.16.7-ckt11-1+deb8u5 中修复，或已在较早版本中修复。

注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

遠端 OracleVM 系統缺少可解決重大安全性更新的必要修補程式：

  - nfsd：更嚴格的解碼 write-like NFSv2/v3 操作 (J.
    Bruce Fields) [Orabug：25986990] (CVE-2017-7895)

  - fnic：將 fnic 驅動程式版本更新為 1.6.0.24 (John Sobecki) [Orabug：24448585]

  - xen-netfront：重建對 OOM 和網路壓力期間的 Rx 停止修復 (Dongli Zhang) [Orabug：25450703]

  - xen-netfront：修復網路壓力和 OOM 期間的 Rx 停止 (Dongli Zhang) [Orabug：25450703]

  - ipv6：如果通訊端快取中的 dst_entry 有效，則跳過 XFRM 查詢 (Jakub Sitnicki)

  - uek-rpm：啟用 CONFIG_KSPLICE。(Jamie Iles) [Orabug：
    25549809]

  - ksplice：新增用於確定 Ksplice 功能的 sysctls。
    (Jamie Iles) 

  - signal：防止 SIGNAL_UNKILLABLE 意外清除。(Jamie Iles) [Orabug：25549809]

  - VSOCK：修復 lockdep 問題。(Dongli Zhang) [Orabug：
    25559937]

  - VSOCK：sock_put 不安全，無法在中斷內容中呼叫 (Dongli Zhang) [Orabug：25559937]

  - IB/CORE：同步 fmr_pool 中的資源存取 (Wengang Wang) [Orabug：25677469]

  - KVM：x86：修復「MOV SS，空選擇器」的模擬 (Paolo Bonzini) [Orabug：25719675] (CVE-2017-2583) (CVE-2017-2583)

  - ext4：掛載時驗證 s_first_meta_bg (Eryu Guan) [Orabug：25719738] (CVE-2016-10208)

  - sctp：避免 sctp_wait_for_sndbuf 上的 BUG_ON (Marcelo Ricardo Leitner) [Orabug：25719810] (CVE-2017-5986)

  - tcp：避免 tcp_splice_read 中的無限迴圈 (Eric Dumazet) [Orabug：25720813] (CVE-2017-6214)

  - lpfc 無法與在 P2P 模式下傳送 PRLI 的目標建立連線 (Joe Jin) [Orabug：25759083]

  - USB: visor：修復探測時的空解除參照 (Johan Hovold) [Orabug：25796594] (CVE-2016-2782)

  - ipc/shm：修復 shmat mmap nil-page 保護 (Davidlohr Bueso) [Orabug：25797012] (CVE-2017-5669)

  - vhost：實際追蹤記錄 eventfd 檔案 (Marc-Andr&eacute) [Orabug：25797052] (CVE-2015-6252)

  - xfrm_user：更難驗證 XFRM_MSG_NEWAE 傳入的 ESN 大小 (Andy Whitcroft) [Orabug：25814663] (CVE-2017-7184)

  - xfrm_user：驗證 XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Andy Whitcroft) [Orabug：25814663] (CVE-2017-7184)

  - KEYS：移除 key_type::match，以支援由 match_preparse 覆寫預設 (Aniket Alshi) [Orabug：
    25823962] (CVE-2017-2647) (CVE-2017-2647)

  - USB：whiteheat：修復探測時潛在的空解除參照 (Johan Hovold) [Orabug：25825105] (CVE-2015-5257) (CVE-2015-5257)

  - udf：在讀取 symlink 時檢查路徑長度 (Jan Kara) [Orabug：25871102] (CVE-2015-9731)

  - udp：使用含截斷的緩衝區正確支援 MSG_PEEK (Eric Dumazet) [Orabug：25876655] (CVE-2016-10229)

  - block：修復 seq 檔案中的釋放後使用 (Vegard Nossum) [Orabug：25877530] (CVE-2016-7910)

  - 還原「修復 get_user_ex 中的次要資訊洩漏」(Brian Maly) [Orabug：25790392] (CVE-2016-9644)

  - net：ping：檢查 ICMP 標頭長度的最小大小 (Kees Cook) [Orabug：25766911] (CVE-2016-8399)

  - ipv6：停止為 MTU < 1280 傳送 PTB 封包 (Hagen Paul Pfeifer) [Orabug：25765776] (CVE-2016-10142)

  - 不適合在 KERNEL_DS 下呼叫 sg_write()/bsg_write (Al Viro) [Orabug：25765445] (CVE-2016-10088)

  - scsi：sg：檢查傳遞給 SG_NEXT_CMD_LEN 的長度 (peter chang) [Orabug：25751996] (CVE-2017-7187)

此更新可修正下列 CVE。

CVE-2015-2925

Jann Horn 發現，當檔案系統的子目錄 bind 掛載至 chroot 或掛載命名空間時，如果應限制為該 chroot 或命名空間的使用者擁有對子目錄上階的寫入權限，則可存取整個檔案系統。這並非此核心版本的常見組態。

CVE-2015-5257

Istuary Innovation Labs 的 Moein Ghasemzadeh 報告，USB 裝置可透過模仿 Whiteheat USB 序列裝置，但顯示少量端點，造成拒絕服務 (損毀)。

CVE-2015-7613

Dmitry Vyukov 發現，System V IPC 物件 (訊息佇列和共用記憶體區段) 在其擁有權和其他屬性完全初始化之前設定為可供存取。如果本機使用者與建立新 IPC 物件的其他使用者或服務爭用，這可能導致未經授權的資訊洩漏、未經授權的資訊修改、拒絕服務和/或權限提升。

System V semaphore 陣列存在一個類似問題，但嚴重度較低，因為這些陣列一律會在完全初始化前清除。

針對穩定的舊發行版本 (squeeze)，這些問題已在 2.6.32-48squeeze16 版本中修正。

針對舊的穩定發行版本 (wheezy)，這些問題將在 3.2.68-1+deb7u5 版中修正。

針對穩定的發行版本 (jessie)，這些問題將在 3.16.7-ckt11-1+deb8u5 版中修正，或已在更舊版本中修正。

注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Dmitry Vyukov 發現，某些情況下 Linux 核心並未正確初始化 IPC 物件狀態。本機攻擊者可加以惡意利用，藉此提升其權限、洩漏機密資訊或造成拒絕服務 (系統當機)。
(CVE-2015-7613)

據發現，Linux 核心並未檢查使用者空間應用程式設定的新 IPv6 MTU 是否有效。遠端攻擊者可使用無效的 MTU 偽造路由公告，讓 NetworkManager 等使用者空間程序接受並套用到核心，從而引發拒絕服務。(CVE-2015-0272)

據發現，在特定情況下，可以從 BIND 掛載位置以外重新命名目錄。攻擊者可利用此瑕疵，逸出 BIND 掛載包容，並取得敏感資訊的存取權。(CVE-2015-2925)

Moein Ghasemzadeh 發現 USB WhiteHEAT 序列驅動程式含有與 USB 裝置相關的硬式編碼屬性。攻擊者可建構假的 WhiteHEAT USB 裝置，一旦插入該裝置，即可引發拒絕服務 (系統當機)。(CVE-2015-5257)。

據發現，在特定情況下，可以從 BIND 掛載位置以外重新命名目錄。攻擊者可利用此瑕疵，逸出 BIND 掛載包容，並取得敏感資訊的存取權。(CVE-2015-2925)

Moein Ghasemzadeh 發現 USB WhiteHEAT 序列驅動程式含有與 USB 裝置相關的硬式編碼屬性。攻擊者可建構假的 WhiteHEAT USB 裝置，一旦插入該裝置，即可引發拒絕服務 (系統當機)。(CVE-2015-5257)。

遠端 Ubuntu 14.04 LTS 主機上安裝的一個套件受到 USN-2798-1 公告中所提及的多個弱點影響。

  在 4.2.4 版之前的 Linux 核心中，fs/dcache.c 的 prepend_path 函式未正確處理 bind 掛載內的重新命名動作，其允許本機使用者透過重新命名目錄，進而繞過預定的容器保護機制；此問題與「double-chroot 攻擊」有關。(CVE-2015-2925)

  在 Linux 核心 4.2.4 及之前版本中，drivers/net/usb/asix_devices.c 中存在一個錯誤，可讓本機使用者透過特製的 USB 裝置，造成拒絕服務 (NULL 指標解除參照和系統當機)，或可能造成其他不明影響。注意：此 ID 未正確用於 ID 為 CVE-2015-8320的 Apache Cordova 問題。 (CVE-2015-5257)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86787	Ubuntu 14.04 LTS：Linux 核心 (Utopic HWE) 弱點 (USN-2797-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2024/8/28	high
89427	Fedora 21：kernel-4.1.10-100.fc21 (2015-d7e074ba30)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
125301	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1508)	Nessus	Huawei Local Security Checks	2019/5/21	2022/5/20	critical
86375	Debian DSA-3372-1 : linux - security update	Nessus	Debian Local Security Checks	2015/10/14	2021/1/11	medium
86787	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2797-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2024/8/28	high
89427	Fedora 21 : kernel-4.1.10-100.fc21 (2015-d7e074ba30)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
100237	OracleVM 3.3：Unbreakable / 等 (OVMSA-2017-0105)	Nessus	OracleVM Local Security Checks	2017/5/17	2021/1/4	critical
86783	Ubuntu 12.04 LTS：Linux 漏洞 (USN-2792-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2021/1/19	medium
86786	Ubuntu 12.04 LTS：linux-lts-trusty 漏洞 (USN-2795-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2021/1/19	medium
86788	Ubuntu 14.04 LTS：Linux 内核 (Vivid HWE) 漏洞 (USN-2798-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2024/8/28	high
86357	Debian DLA-325-1：linux-2.6 安全更新	Nessus	Debian Local Security Checks	2015/10/13	2021/1/11	medium
100237	OracleVM 3.3：Unbreakable /等 (OVMSA-2017-0105)	Nessus	OracleVM Local Security Checks	2017/5/17	2021/1/4	critical
86357	Debian DLA-325-1：linux-2.6 安全性更新	Nessus	Debian Local Security Checks	2015/10/13	2021/1/11	medium
86783	Ubuntu 12.04 LTS : linux 弱點 (USN-2792-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2021/1/19	medium
86786	Ubuntu 12.04 LTS：linux-lts-trusty 弱點 (USN-2795-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2021/1/19	medium
86788	Ubuntu 14.04 LTS：Linux 核心 (Vivid HWE) 弱點 (USN-2798-1)	Nessus	Ubuntu Local Security Checks	2015/11/6	2024/8/28	high

检测

插件搜索

high

medium

critical

medium

high

medium

critical

medium

medium

high

medium

critical

medium

medium

medium

high