The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3006-1 advisory.

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables     scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from     kernel memory. (CVE-2016-2117)

    Jann Horn discovered that eCryptfs improperly attempted to use the mmap() handler of a lower filesystem     that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could     use to cause a denial of service (system crash) or possibly execute arbitrary code with administrative     privileges. (CVE-2016-1583)

    Multiple race conditions where discovered in the Linux kernel's ext4 file system. A local user could     exploit this flaw to cause a denial of service (disk corruption) by writing to a page that is associated     with a different users file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

    Ralf Spenneberg discovered that the Linux kernel's GTCO digitizer USB device driver did not properly     validate endpoint descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2187)

    Vitaly Kuznetsov discovered that the Linux kernel did not properly suppress hugetlbfs support in X86     paravirtualized guests. An attacker in the guest OS could cause a denial of service (guest system crash).
    (CVE-2016-3961)

    Kangjie Lu discovered an information leak in the ANSI/IEEE 802.2 LLC type 2 Support implementations in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-4485)

    Kangjie Lu discovered an information leak in the routing netlink socket interface (rtnetlink)     implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive     information from kernel memory. (CVE-2016-4486)

    Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     could overflow reference counters on systems with more than 32GB of physical ram and with RLIMIT_MEMLOCK     set to infinite. A local unprivileged attacker could use to create a use-after- free situation, causing a     denial of service (system crash) or possibly gain administrative privileges. (CVE-2016-4558)

    Jann Horn discovered that the InfiniBand interfaces within the Linux kernel could be coerced into     overwriting kernel memory. A local unprivileged attacker could use this to possibly gain administrative     privileges on systems where InifiniBand related kernel modules are loaded. (CVE-2016-4565)

    It was discovered that in some situations the Linux kernel did not handle propagated mounts correctly. A     local unprivileged attacker could use this to cause a denial of service (system crash). (CVE-2016-4581)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the size of the stack guard     page on Linux, specifically a 4k stack guard page is     not sufficiently large and can be 'jumped' over (the     stack guard page is bypassed), this affects Linux     Kernel versions 4.11.5 and earlier (the stackguard page     was introduced in 2010).(CVE-2017-1000364)

  - The make_response function in     drivers/block/xen-blkback/blkback.c in the Linux kernel     before 4.11.8 allows guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures, aka XSA-216.(CVE-2017-10911)

  - Multiple race conditions in the ext4 filesystem     implementation in the Linux kernel before 4.5 allow     local users to cause a denial of service (disk     corruption) by writing to a page that is associated     with a different user's file after unsynchronized hole     punching and page-fault handling.(CVE-2015-8839)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* An use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system.
(CVE-2016-10200, Important)

* A flaw was found that can be triggered in keyring_search_iterator in keyring.c if type->match is NULL. A local user could use this flaw to crash the system or, potentially, escalate their privileges.
(CVE-2017-2647, Important)

* It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-lockup the system and thus cause denial of service.
(CVE-2017-8797, Important)

This update also fixes multiple Moderate and Low impact security issues :

* CVE-2015-8839, CVE-2015-8970, CVE-2016-9576, CVE-2016-7042, CVE-2016-7097, CVE-2016-8645, CVE-2016-9576, CVE-2016-9588, CVE-2016-9806, CVE-2016-10088, CVE-2016-10147, CVE-2017-2596, CVE-2017-2671, CVE-2017-5970, CVE-2017-6001, CVE-2017-6951, CVE-2017-7187, CVE-2017-7616, CVE-2017-7889, CVE-2017-8890, CVE-2017-9074, CVE-2017-8890, CVE-2017-9075, CVE-2017-8890, CVE-2017-9076, CVE-2017-8890, CVE-2017-9077, CVE-2017-9242, CVE-2014-7970, CVE-2014-7975, CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

Documentation for these issues is available from the Release Notes document linked from the References section.

Red Hat would like to thank Igor Redko (Virtuozzo) and Andrey Ryabinin (Virtuozzo) for reporting CVE-2017-2647; Igor Redko (Virtuozzo) and Vasily Averin (Virtuozzo) for reporting CVE-2015-8970; Marco Grassi for reporting CVE-2016-8645; and Dmitry Vyukov (Google Inc.) for reporting CVE-2017-2596. The CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat); the CVE-2016-7097 issue was discovered by Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE); the CVE-2016-6213 and CVE-2016-9685 issues were discovered by Qian Cai (Red Hat); and the CVE-2016-9604 issue was discovered by David Howells (Red Hat).

Additional Changes :

For detailed information on other changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1758:07 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.
    Security issues fixed with this release:
    CVE-2016-10200
    ** Important **     An use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system.
    CVE-2017-2647
    ** Important **     A flaw was found that can be triggered in keyring_search_iterator in keyring.c if type->match is NULL. A     local user could use this flaw to crash the system or, potentially, escalate their privileges.
    CVE-2017-8797
    ** Important **     It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when     processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-     lockup the system and thus cause denial of service.
    CVE-2016-9576     The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly     restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory     locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
    CVE-2016-7042     The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU     Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout     data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading     the /proc/keys file.
    CVE-2016-10088     The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in     situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary     kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-9576.
    CVE-2015-8970     crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been     performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause     a denial of service (NULL pointer dereference and system crash) via a crafted application that does not     supply a key, related to the lrw_crypt function in crypto/lrw.c.
    CVE-2015-8839     Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling.
    CVE-2017-5551   The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves     the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group     privileges by leveraging the existence of a setgid program with restrictions on execute permissions. NOTE:
    this vulnerability exists because of an incomplete fix for CVE-2016-7097.
    CVE-2016-9806     Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3     allows local users to cause a denial of service (double free) or possibly have unspecified other impact     via a crafted application that makes sendmsg system calls, leading to a free operation associated with a     new dump that started earlier than anticipated.
    CVE-2016-9588     arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows     guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by     an L2 guest.
    CVE-2016-9576     The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly     restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory     locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
    CVE-2016-8645     The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c.
    CVE-2016-7097     The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr     call, which allows local users to gain group privileges by leveraging the existence of a setgid program     with restrictions on execute permissions.
    CVE-2017-5970     The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows     attackers to cause a denial of service (system crash) via (1) an application that makes crafted system     calls or possibly (2) IPv4 traffic with invalid IP options.
    CVE-2017-2671     The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a     certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local     users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a     socket system call.
    CVE-2017-2596     The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly     emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS     memory consumption) by leveraging the mishandling of page references.
    CVE-2016-10147     crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL     pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as     demonstrated by mcryptd(md5).
    CVE-2017-7889   The mm subsystem in the Linux kernel through 4.10.10 does not properly enforce the     CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory     locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that     opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
    CVE-2017-7616     Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux     kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by     triggering failure of a certain bitmap operation.
    CVE-2017-7187     The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause     a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large     command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write     function.
    CVE-2017-6951     The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows     local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call     for the dead type.
    CVE-2017-6001     Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain     privileges via a crafted application that makes concurrent perf_event_open system calls for moving a     software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2016-6786.
    CVE-2017-9077     The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890.
    CVE-2017-9076     The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890.
    CVE-2017-9075     The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890.
    CVE-2017-8890     The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15     allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by     leveraging use of the accept system call.
    CVE-2017-9242     The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in     checking whether an overwrite of an skb data structure may occur, which allows local users to cause a     denial of service (system crash) via crafted system calls.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux kernel did not properly suppress hugetlbfs support in x86 PV guests, which could allow local PV guest users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area. (CVE-2016-3961 / XSA-174)

A flaw was found in the way the Linux kernel's ASN.1 DER decoder processed certain certificate files with tags of indefinite length. A local, unprivileged user could use a specially crafted X.509 certificate DER file to crash the system or, potentially, escalate their privileges on the system. (CVE-2016-0758)

Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

The following flaws were also fixed in this version :

CVE-2016-4557 : Use after free vulnerability via double fdput

CVE-2016-4581 : Slave being first propagated copy causes oops in propagate_mnt

CVE-2016-4486 : Information leak in rtnetlink

CVE-2016-4485 : Information leak in llc module

CVE-2016-4558 : bpf: refcnt overflow

CVE-2016-4565 : infiniband: Unprivileged process can overwrite kernel memory using rdma_ucm.ko

CVE-2016-0758 : tags with indefinite length can corrupt pointers in asn1_find_indefinite_length()

CVE-2015-8839 : ext4 filesystem page fault race condition with fallocate call.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1842 advisory.

  - The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the     CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which     allows local users to cause a denial of service (loss of writability) by making certain unshare system     calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call. (CVE-2014-7975)

  - The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU     Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout     data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading     the /proc/keys file. (CVE-2016-7042)

  - Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3     allows local users to cause a denial of service (double free) or possibly have unspecified other impact     via a crafted application that makes sendmsg system calls, leading to a free operation associated with a     new dump that started earlier than anticipated. (CVE-2016-9806)

  - The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly     restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory     locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
    (CVE-2016-9576)

  - The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in     situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary     kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-9576. (CVE-2016-10088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002208 advisory.

    Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3007-1 advisory.

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables     scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from     kernel memory. (CVE-2016-2117)

    Jann Horn discovered that eCryptfs improperly attempted to use the mmap() handler of a lower filesystem     that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could     use to cause a denial of service (system crash) or possibly execute arbitrary code with administrative     privileges. (CVE-2016-1583)

    Multiple race conditions where discovered in the Linux kernel's ext4 file system. A local user could     exploit this flaw to cause a denial of service (disk corruption) by writing to a page that is associated     with a different users file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

    Ralf Spenneberg discovered that the Linux kernel's GTCO digitizer USB device driver did not properly     validate endpoint descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2187)

    Vitaly Kuznetsov discovered that the Linux kernel did not properly suppress hugetlbfs support in X86     paravirtualized guests. An attacker in the guest OS could cause a denial of service (guest system crash).
    (CVE-2016-3961)

    Kangjie Lu discovered an information leak in the ANSI/IEEE 802.2 LLC type 2 Support implementations in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-4485)

    Kangjie Lu discovered an information leak in the routing netlink socket interface (rtnetlink)     implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive     information from kernel memory. (CVE-2016-4486)

    Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     could overflow reference counters on systems with more than 32GB of physical ram and with RLIMIT_MEMLOCK     set to infinite. A local unprivileged attacker could use to create a use-after- free situation, causing a     denial of service (system crash) or possibly gain administrative privileges. (CVE-2016-4558)

    Jann Horn discovered that the InfiniBand interfaces within the Linux kernel could be coerced into     overwriting kernel memory. A local unprivileged attacker could use this to possibly gain administrative     privileges on systems where InifiniBand related kernel modules are loaded. (CVE-2016-4565)

    It was discovered that in some situations the Linux kernel did not handle propagated mounts correctly. A     local unprivileged attacker could use this to cause a denial of service (system crash). (CVE-2016-4581)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2077 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * An use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system.
    (CVE-2016-10200, Important)

    * A flaw was found that can be triggered in keyring_search_iterator in keyring.c if type->match is NULL. A     local user could use this flaw to crash the system or, potentially, escalate their privileges.
    (CVE-2017-2647, Important)

    * It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when     processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-     lockup the system and thus cause denial of service. (CVE-2017-8797, Important)

    This update also fixes multiple Moderate and Low impact security issues:

    * CVE-2015-8839, CVE-2015-8970, CVE-2016-9576, CVE-2016-7042, CVE-2016-7097, CVE-2016-8645, CVE-2016-9576,     CVE-2016-9588, CVE-2016-9806, CVE-2016-10088, CVE-2016-10147, CVE-2017-2596, CVE-2017-2671, CVE-2017-5970,     CVE-2017-6001, CVE-2017-6951, CVE-2017-7187, CVE-2017-7616, CVE-2017-7889, CVE-2017-8890, CVE-2017-9074,     CVE-2017-8890, CVE-2017-9075, CVE-2017-8890, CVE-2017-9076, CVE-2017-8890, CVE-2017-9077, CVE-2017-9242,     CVE-2014-7970, CVE-2014-7975, CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

    Documentation for these issues is available from the Release Notes document linked from the References     section.

    Red Hat would like to thank Igor Redko (Virtuozzo) and Andrey Ryabinin (Virtuozzo) for reporting     CVE-2017-2647; Igor Redko (Virtuozzo) and Vasily Averin (Virtuozzo) for reporting CVE-2015-8970; Marco     Grassi for reporting CVE-2016-8645; and Dmitry Vyukov (Google Inc.) for reporting CVE-2017-2596. The     CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat); the CVE-2016-7097 issue was discovered by     Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE); the CVE-2016-6213 and CVE-2016-9685 issues were     discovered by Qian Cai (Red Hat); and the CVE-2016-9604 issue was discovered by David Howells (Red Hat).

    Additional Changes:

    For detailed information on other changes in this release, see the Red Hat Enterprise Linux 7.4 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2669 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens     between threads of inotify_handle_event() and vfs_rename() while running the rename operation against the     same file. As a result of the race the next slab data or the slab's free list pointer can be corrupted     with attacker-controlled data, which may lead to the privilege escalation. (CVE-2017-7533, Important)

    * It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when     processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-     lockup the system and thus cause denial of service. (CVE-2017-8797, Important)

    This update also fixes multiple Moderate and Low impact security issues:

    CVE-2017-8797 CVE-2015-8839 CVE-2016-9576 CVE-2016-7042 CVE-2016-7097 CVE-2016-8645 CVE-2016-9576     CVE-2016-9806 CVE-2016-10088 CVE-2017-2671 CVE-2017-5970 CVE-2017-6001 CVE-2017-6951 CVE-2017-7187     CVE-2017-7889 CVE-2017-8890 CVE-2017-9074 CVE-2017-8890 CVE-2017-9075 CVE-2017-8890 CVE-2017-9076     CVE-2017-8890 CVE-2017-9077 CVE-2016-9604 CVE-2016-9685

    Documentation for these issues are available from the Technical Notes document linked to in the References     section.

    Red Hat would like to thank Leilei Lin (Alibaba Group), Fan Wu (The University of Hong Kong), and Shixiong     Zhao (The University of Hong Kong) for reporting CVE-2017-7533 and Marco Grassi for reporting     CVE-2016-8645. The CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat); the CVE-2016-7097 issue     was discovered by Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE); the CVE-2016-9604 issue was     discovered by David Howells (Red Hat); and the CVE-2016-9685 issue was discovered by Qian Cai (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update is now available for all supported architectures. For reference the original advisory text follows.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2015-8839

A race condition was found in the ext4 filesystem implementation. A local user could exploit this to cause a denial of service (filesystem corruption).

CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613

Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes could trigger a crash (Oops) and/or out-of-bounds memory access. An attacker able to mount such a volume could use this to cause a denial of service or possibly for privilege escalation.

CVE-2019-5108

Mitchell Frank of Cisco discovered that when the IEEE 802.11 (WiFi) stack was used in AP mode with roaming, it would trigger roaming for a newly associated station before the station was authenticated. An attacker within range of the AP could use this to cause a denial of service, either by filling up a switching table or by redirecting traffic away from other stations.

CVE-2019-19319

Jungyeon discovered that a crafted filesystem can cause the ext4 implementation to deallocate or reallocate journal blocks. A user permitted to mount filesystems could use this to cause a denial of service (crash), or possibly for privilege escalation.

CVE-2019-19447

It was discovered that the ext4 filesystem driver did not safely handle unlinking of an inode that, due to filesystem corruption, already has a link count of 0. An attacker able to mount arbitrary ext4 volumes could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19768

Tristan Madani reported a race condition in the blktrace debug facility that could result in a use-after-free. A local user able to trigger removal of block devices could possibly use this to cause a denial of service (crash) or for privilege escalation.

CVE-2019-20636

The syzbot tool found that the input subsystem did not fully validate keycode changes, which could result in a heap out-of-bounds write. A local user permitted to access the device node for an input or VT device could possibly use this to cause a denial of service (crash or memory corruption) or for privilege escalation.

CVE-2020-0009

Jann Horn reported that the Android ashmem driver did not prevent read-only files from being memory-mapped and then remapped as read-write. However, Android drivers are not enabled in Debian kernel configurations.

CVE-2020-0543

Researchers at VU Amsterdam discovered that on some Intel CPUs supporting the RDRAND and RDSEED instructions, part of a random value generated by these instructions may be used in a later speculative execution on any core of the same physical CPU. Depending on how these instructions are used by applications, a local user or VM guest could use this to obtain sensitive information such as cryptographic keys from other users or VMs.

This vulnerability can be mitigated by a microcode update, either as part of system firmware (BIOS) or through the intel-microcode package in Debian's non-free archive section. This kernel update only provides reporting of the vulnerability and the option to disable the mitigation if it is not needed.

CVE-2020-1749

Xiumei Mu reported that some network protocols that can run on top of IPv6 would bypass the Transformation (XFRM) layer used by IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result in disclosure of information over the network, since it would not be encrypted or routed according to the system policy.

CVE-2020-2732

Paulo Bonzini discovered that the KVM implementation for Intel processors did not properly handle instruction emulation for L2 guests when nested virtualization is enabled. This could allow an L2 guest to cause privilege escalation, denial of service, or information leaks in the L1 guest.

CVE-2020-8647, CVE-2020-8649

The Hulk Robot tool found a potential MMIO out-of-bounds access in the vgacon driver. A local user permitted to access a virtual terminal (/dev/tty1 etc.) on a system using the vgacon driver could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-8648

The syzbot tool found a race condition in the the virtual terminal driver, which could result in a use-after-free. A local user permitted to access a virtual terminal could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-9383

Jordy Zomer reported an incorrect range check in the floppy driver which could lead to a static out-of-bounds access. A local user permitted to access a floppy drive could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-10690

It was discovered that the PTP hardware clock subsystem did not properly manage device lifetimes. Removing a PTP hardware clock from the system while a user process was using it could lead to a use-after-free. The security impact of this is unclear.

CVE-2020-10751

Dmitry Vyukov reported that the SELinux subsystem did not properly handle validating multiple messages, which could allow a privileged attacker to bypass SELinux netlink restrictions.

CVE-2020-10942

It was discovered that the vhost_net driver did not properly validate the type of sockets set as back-ends. A local user permitted to access /dev/vhost-net could use this to cause a stack corruption via crafted system calls, resulting in denial of service (crash) or possibly privilege escalation.

CVE-2020-11494

It was discovered that the slcan (serial line CAN) network driver did not fully initialise CAN headers for received packets, resulting in an information leak from the kernel to user-space or over the CAN network.

CVE-2020-11565

Entropy Moe reported that the shared memory filesystem (tmpfs) did not correctly handle an 'mpol' mount option specifying an empty node list, leading to a stack-based out-of-bounds write. If user namespaces are enabled, a local user could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2020-11608, CVE-2020-11609, CVE-2020-11668

It was discovered that the ov519, stv06xx, and xirlink_cit media drivers did not properly validate USB device descriptors. A physically present user with a specially constructed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2020-12114

Piotr Krysiuk discovered a race condition between the umount and pivot_root operations in the filesystem core (vfs). A local user with the CAP_SYS_ADMIN capability in any user namespace could use this to cause a denial of service (crash).

CVE-2020-12464

Kyungtae Kim reported a race condition in the USB core that can result in a use-after-free. It is not clear how this can be exploited, but it could result in a denial of service (crash or memory corruption) or privilege escalation.

CVE-2020-12652

Tom Hatskevich reported a bug in the mptfusion storage drivers. An ioctl handler fetched a parameter from user memory twice, creating a race condition which could result in incorrect locking of internal data structures. A local user permitted to access /dev/mptctl could use this to cause a denial of service (crash or memory corruption) or for privilege escalation.

CVE-2020-12653

It was discovered that the mwifiex WiFi driver did not sufficiently validate scan requests, resulting a potential heap buffer overflow. A local user with CAP_NET_ADMIN capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-12654

It was discovered that the mwifiex WiFi driver did not sufficiently validate WMM parameters received from an access point (AP), resulting a potential heap buffer overflow. A malicious AP could use this to cause a denial of service (crash or memory corruption) or possibly to execute code on a vulnerable system.

CVE-2020-12769

It was discovered that the spi-dw SPI host driver did not properly serialise access to its internal state. The security impact of this is unclear, and this driver is not included in Debian's binary packages.

CVE-2020-12770

It was discovered that the sg (SCSI generic) driver did not correctly release internal resources in a particular error case. A local user permitted to access an sg device could possibly use this to cause a denial of service (resource exhaustion).

CVE-2020-12826

Adam Zabrocki reported a weakness in the signal subsystem's permission checks. A parent process can choose an arbitary signal for a child process to send when it exits, but if the parent has executed a new program then the default SIGCHLD signal is sent. A local user permitted to run a program for several days could bypass this check, execute a setuid program, and then send an arbitrary signal to it.
Depending on the setuid programs installed, this could have some security impact.

CVE-2020-13143

Kyungtae Kim reported a potential heap out-of-bounds write in the USB gadget subsystem. A local user permitted to write to the gadget configuration filesystem could use this to cause a denial of service (crash or memory corruption) or potentially for privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 3.16.84-1.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001930 advisory.

    Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 4.4.8 update contains a number of important fixes across the tree
---- The 4.4.7 update contains a number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3005-1 advisory.

    Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables     scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from     kernel memory. (CVE-2016-2117)

    Jann Horn discovered that eCryptfs improperly attempted to use the mmap() handler of a lower filesystem     that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could     use to cause a denial of service (system crash) or possibly execute arbitrary code with administrative     privileges. (CVE-2016-1583)

    Multiple race conditions where discovered in the Linux kernel's ext4 file system. A local user could     exploit this flaw to cause a denial of service (disk corruption) by writing to a page that is associated     with a different users file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

    Ralf Spenneberg discovered that the Linux kernel's GTCO digitizer USB device driver did not properly     validate endpoint descriptors. An attacker with physical access could use this to cause a denial of     service (system crash). (CVE-2016-2187)

    Vitaly Kuznetsov discovered that the Linux kernel did not properly suppress hugetlbfs support in X86     paravirtualized guests. An attacker in the guest OS could cause a denial of service (guest system crash).
    (CVE-2016-3961)

    Kangjie Lu discovered an information leak in the ANSI/IEEE 802.2 LLC type 2 Support implementations in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-4485)

    Kangjie Lu discovered an information leak in the routing netlink socket interface (rtnetlink)     implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive     information from kernel memory. (CVE-2016-4486)

    Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     could overflow reference counters on systems with more than 32GB of physical ram and with RLIMIT_MEMLOCK     set to infinite. A local unprivileged attacker could use to create a use-after- free situation, causing a     denial of service (system crash) or possibly gain administrative privileges. (CVE-2016-4558)

    Jann Horn discovered that the InfiniBand interfaces within the Linux kernel could be coerced into     overwriting kernel memory. A local unprivileged attacker could use this to possibly gain administrative     privileges on systems where InifiniBand related kernel modules are loaded. (CVE-2016-4565)

    It was discovered that in some situations the Linux kernel did not handle propagated mounts correctly. A     local unprivileged attacker could use this to cause a denial of service (system crash). (CVE-2016-4581)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91568	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3006-1)	Nessus	Ubuntu Local Security Checks	2016/6/10	2024/8/27	high
102241	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1154)	Nessus	Huawei Local Security Checks	2017/8/8	2025/12/4	high
102734	CentOS 7 : kernel (CESA-2017:1842) (Stack Clash)	Nessus	CentOS Local Security Checks	2017/8/25	2025/11/25	high
291567	MiracleLinux 7 : kernel-3.10.0-693.el7 (AXSA:2017-1758:07)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
102242	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1155)	Nessus	Huawei Local Security Checks	2017/8/8	2025/12/4	high
91241	Amazon Linux AMI : kernel (ALAS-2016-703)	Nessus	Amazon Linux Local Security Checks	2016/5/19	2019/4/11	high
102281	Oracle Linux 7 : kernel (ELSA-2017-1842)	Nessus	Oracle Linux Local Security Checks	2017/8/9	2026/2/9	high
287404	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002208)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	medium
91569	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3007-1)	Nessus	Ubuntu Local Security Checks	2016/6/10	2024/8/27	high
102151	RHEL 7 : kernel-rt (RHSA-2017:2077)	Nessus	Red Hat Local Security Checks	2017/8/3	2025/3/24	high
103046	RHEL 6 : kernel-rt (RHSA-2017:2669)	Nessus	Red Hat Local Security Checks	2017/9/8	2025/4/15	high
137283	Debian DLA-2241-2 : linux security update	Nessus	Debian Local Security Checks	2020/6/10	2024/3/7	high
245912	Linux Distros Unpatched Vulnerability : CVE-2015-8839	Nessus	Misc.	2025/8/8	2025/9/30	medium
286788	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001930)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	medium
90952	Fedora 22 : kernel-4.4.8-200.fc22 (2016-373c063e79)	Nessus	Fedora Local Security Checks	2016/5/9	2021/1/11	critical
91567	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3005-1)	Nessus	Ubuntu Local Security Checks	2016/6/10	2024/8/27	high

检测

插件搜索

high

high

high

high

high

high

high

medium

high

high

high

high

medium

medium

critical

high