Security Fix(es) :

  - It was found that the Linux kernel's IPv6 implementation     mishandled socket options. A local attacker could abuse     concurrent access to the socket options to escalate     their privileges, or cause a denial of service     (use-after-free and system crash) via a crafted sendmsg     system call. (CVE-2016-3841, Important)

(CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Additional Changes :

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain systems, HPET is mapped to userspace as part of vdso (vvar) and thus an unprivileged user may generate MMIO transactions (and enter the emulator) this way. (CVE-2010-5313, CVE-2014-7842, Moderate)

* It was found that the Linux kernel did not properly account file descriptors passed over the unix socket against the process limit. A local user could use this flaw to exhaust all available memory on the system. (CVE-2013-4312, Moderate)

* A buffer overflow flaw was found in the way the Linux kernel's virtio-net subsystem handled certain fraglists when the GRO (Generic Receive Offload) functionality was enabled in a bridged network configuration. An attacker on the local network could potentially use this flaw to crash the system, or, although unlikely, elevate their privileges on the system. (CVE-2015-5156, Moderate)

* It was found that the Linux kernel's IPv6 network stack did not properly validate the value of the MTU variable when it was set. A remote attacker could potentially use this flaw to disrupt a target system's networking (packet loss) by setting an invalid MTU value, for example, via a NetworkManager daemon that is processing router advertisement packets running on the target system. (CVE-2015-8215, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's network subsystem handled socket creation with an invalid protocol identifier. A local user could use this flaw to crash the system. (CVE-2015-8543, Moderate)

* It was found that the espfix functionality does not work for 32-bit KVM paravirtualized guests. A local, unprivileged guest user could potentially use this flaw to leak kernel stack addresses.
(CVE-2014-8134, Low)

* A flaw was found in the way the Linux kernel's ext4 file system driver handled non-journal file systems with an orphan list. An attacker with physical access to the system could use this flaw to crash the system or, although unlikely, escalate their privileges on the system. (CVE-2015-7509, Low)

* A NULL pointer dereference flaw was found in the way the Linux kernel's ext4 file system driver handled certain corrupted file system images. An attacker with physical access to the system could use this flaw to crash the system. (CVE-2015-8324, Low)

Red Hat would like to thank Nadav Amit for reporting CVE-2010-5313 and CVE-2014-7842, Andy Lutomirski for reporting CVE-2014-8134, and Dmitriy Monakhov (OpenVZ) for reporting CVE-2015-8324. The CVE-2015-5156 issue was discovered by Jason Wang (Red Hat).

Additional Changes :

* Refer to Red Hat Enterprise Linux 6.8 Release Notes for information on new kernel features and known issues, and Red Hat Enterprise Linux Technical Notes for information on device driver updates, important changes to external kernel parameters, notable bug fixes, and technology previews. Both of these documents are linked to in the References section.

USN-3083-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

Dmitry Vyukov discovered that the IPv6 implementation in the Linux kernel did not properly handle options data, including a use-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2016-3841)

It was discovered that a race condition existed when handling heartbeat- timeout events in the SCTP implementation of the Linux kernel. A remote attacker could use this to cause a denial of service.
(CVE-2015-8767).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1135:09 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any     Linux operating system.  The kernel handles the basic functions     of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2013-4312     The Linux kernel before 4.4.1 allows local users to bypass     file-descriptor limits and cause a denial of service (memory     consumption) by sending each descriptor over a UNIX socket before     closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
    CVE-2015-8374     fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles     compressed inline extents, which allows local users to obtain     sensitive pre-truncation information from a file via a clone action.
    CVE-2015-8543     The networking implementation in the Linux kernel through 4.3.3, as     used in Android and other products, does not validate protocol     identifiers for certain protocol families, which allows local users to     cause a denial of service (NULL function pointer dereference and     system crash) or possibly gain privileges by leveraging CLONE_NEWUSER     support to execute a crafted SOCK_RAW application.
    CVE-2015-8746     fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2     does not properly initialize memory for migration recovery operations,     which allows remote NFS servers to cause a denial of service (NULL     pointer dereference and panic) via crafted network traffic.
    CVE-2015-8812     drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5     does not properly identify error conditions, which allows remote     attackers to execute arbitrary code or cause a denial of service     (use-after-free) via crafted packets.
    CVE-2015-8844     The signal implementation in the Linux kernel before 4.3.5 on powerpc     platforms does not check for an MSR with both the S and T bits set,     which allows local users to cause a denial of service (TM Bad Thing     exception and panic) via a crafted application.
    CVE-2015-8845     The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the     Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM     suspend mode exists before proceeding with a tm_reclaim call, which     allows local users to cause a denial of service (TM Bad Thing     exception and panic) via a crafted application.
    CVE-2015-8956     The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the     Linux kernel before 4.2 allows local users to obtain sensitive     information or cause a denial of service (NULL pointer dereference)     via vectors involving a bind system call on a Bluetooth RFCOMM socket.
    CVE-2016-2053     The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux     kernel before 4.3 allows attackers to cause a denial of service     (panic) via an ASN.1 BER file that lacks a public key, leading to     mishandling by the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c.
    CVE-2016-2069     Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1     allows local users to gain privileges by triggering access to a paging     structure by a different CPU.
    CVE-2016-2117     The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in     the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O,     which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data.
    CVE-2016-2384     Double free vulnerability in the snd_usbmidi_create function in     sound/usb/midi.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (panic) or possibly     have unspecified other impact via vectors involving an invalid USB     descriptor.
    CVE-2016-2847     fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of     unread data in pipes, which allows local users to cause a denial of     service (memory consumption) by creating many pipes with non-default     sizes.
    CVE-2016-3070     The trace_writeback_dirty_page implementation in     include/trace/events/writeback.h in the Linux kernel before 4.4     improperly interacts with mm/migrate.c, which allows local users to     cause a denial of service (NULL pointer dereference and system crash)     or possibly have unspecified other impact by triggering a certain page     move.
    CVE-2016-3156     The IPv4 implementation in the Linux kernel before 4.5.2 mishandles     destruction of device objects, which allows guest OS users to cause a     denial of service (host OS networking outage) by arranging for a large     number of IP addresses.
    CVE-2016-3699     The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat     Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows     local users to bypass intended Secure Boot restrictions and execute     untrusted code by appending ACPI tables to the initrd.
    CVE-2016-3841     The IPv6 stack in the Linux kernel before 4.3.3 mishandles options     data, which allows local users to gain privileges or cause a denial of     service (use-after-free and system crash) via a crafted sendmsg system     call.
    CVE-2016-4569     The snd_timer_user_params function in sound/core/timer.c in the Linux     kernel through 4.6 does not initialize a certain data structure, which     allows local users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface.
    CVE-2016-4578     sound/core/timer.c in the Linux kernel through 4.6 does not initialize     certain r1 data structures, which allows local users to obtain     sensitive information from kernel stack memory via crafted use of the     ALSA timer interface, related to the (1) snd_timer_user_ccallback and     (2) snd_timer_user_tinterrupt functions.
    CVE-2016-4581     fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse     a mount propagation tree in a certain case involving a slave mount,     which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls.
    CVE-2016-4794     Use-after-free vulnerability in mm/percpu.c in the Linux kernel     through 4.6 allows local users to cause a denial of service (BUG) or     possibly have unspecified other impact via crafted use of the mmap and     bpf system calls.
    CVE-2016-5412     arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through     4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled,     allows guest OS users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence of a suspended     transaction.
    CVE-2016-5828     The start_thread function in arch/powerpc/kernel/process.c in the     Linux kernel through 4.6.3 on powerpc platforms mishandles     transactional state, which allows local users to cause a denial of     service (invalid process state or TM Bad Thing exception, and system     crash) or possibly have unspecified other impact by starting and     suspending a transaction before an exec system call.
    CVE-2016-5829     Multiple heap-based buffer overflows in the hiddev_ioctl_usage     function in drivers/hid/usbhid/hiddev.c in the Linux kernel through     4.6.3 allow local users to cause a denial of service or possibly have     unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2)     HIDIOCSUSAGES ioctl call.
    CVE-2016-6136     Race condition in the audit_log_single_execve_arg function in     kernel/auditsc.c in the Linux kernel through 4.7 allows local users to     bypass intended character-set restrictions or disrupt system-call     auditing by changing a certain string, aka a double fetch     vulnerability.
    CVE-2016-6198     The filesystem layer in the Linux kernel before 4.5.5 proceeds with     post-rename operations after an OverlayFS file is renamed to a     self-hardlink, which allows local users to cause a denial of service     (system crash) via a rename system call, related to fs/namei.c and     fs/open.c.
    CVE-2016-6327     drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1     allows local users to cause a denial of service (NULL pointer     dereference and system crash) by using an ABORT_TASK command to abort     a device write operation.
    CVE-2016-6480     Race condition in the ioctl_send_fib function in     drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows     local users to cause a denial of service (out-of-bounds access or     system crash) by changing a certain size value, aka a double fetch     vulnerability.
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4317 advisory.

    - ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Eric Dumazet)  [Orabug: 25059185]  {CVE-2016-3841}
    - ipv6: add complete rcu protection around np->opt (Eric Dumazet)  [Orabug: 25059185]  {CVE-2016-3841}
    - scsi: qla2xxx: Fix an integer overflow in sysfs code (Dan Carpenter)  [Orabug: 28220492]     {CVE-2017-14051}
    - ext4: fail ext4_iget for root directory if unallocated (Theodore Ts'o)  [Orabug: 28220543]     {CVE-2018-1092} {CVE-2018-1092}
    - ALSA: seq: Fix regression by incorrect ioctl_mutex usages (Takashi Iwai)  [Orabug: 29005191]     {CVE-2018-1000004}
    - netfilter: xt_osf: Add missing permission checks (Kevin Cernekee)  [Orabug: 29037833]  {CVE-2017-17450}
    - HID: debug: check length before copy_to_user() (Daniel Rosenberg)  [Orabug: 29128174]  {CVE-2018-9516}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000997 advisory.

    The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain     privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system     call.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2695 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker     could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of     service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

    Additional Changes:

    Space precludes documenting all of the bug fixes and enhancements included in this advisory. To see the     complete list of bug fixes and enhancements, refer to the following KnowledgeBase article:
    https://access.redhat.com/articles/2754251

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003097 advisory.

    The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain     privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system     call.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The snd_timer_interrupt function in sound/core/timer.c     in the Linux kernel before 4.4.1 does not properly     maintain a certain linked list, which allows local     users to cause a denial of service (race condition and     system crash) via a crafted ioctl call.(CVE-2016-2545)

  - sound/core/timer.c in the Linux kernel before 4.4.1     uses an incorrect type of mutex, which allows local     users to cause a denial of service (race condition,     use-after-free, and system crash) via a crafted ioctl     call.(CVE-2016-2546)

  - sound/core/timer.c in the Linux kernel before 4.4.1     employs a locking approach that does not consider slave     timer instances, which allows local users to cause a     denial of service (race condition, use-after-free, and     system crash) via a crafted ioctl call.(CVE-2016-2547)

  - sound/core/timer.c in the Linux kernel before 4.4.1     retains certain linked lists after a close or stop     action, which allows local users to cause a denial of     service (system crash) via a crafted ioctl call,     related to the (1) snd_timer_close and (2)
    _snd_timer_stop functions.(CVE-2016-2548)

  - sound/core/hrtimer.c in the Linux kernel before 4.4.1     does not prevent recursive callback access, which     allows local users to cause a denial of service     (deadlock) via a crafted ioctl call.(CVE-2016-2549)

  - A resource-exhaustion vulnerability was found in the     kernel, where an unprivileged process could allocate     and accumulate far more file descriptors than the     process' limit. A local, unauthenticated user could     exploit this flaw by sending file descriptors over a     Unix socket and then closing them to keep the process'     fd count low, thereby creating kernel-memory or     file-descriptors exhaustion (denial of     service).(CVE-2016-2550)

  - It is possible for a single process to cause an OOM     condition by filling large pipes with data that are     never read. A typical process filling 4096 pipes with 1     MB of data will use 4 GB of memory and there can be     multiple such processes, up to a     per-user-limit.(CVE-2016-2847)

  - A security flaw was found in the Linux kernel that an     attempt to move page mapped by AIO ring buffer to the     other node triggers NULL pointer dereference at     trace_writeback_dirty_page(), because     aio_fs_backing_dev_info.dev is 0.(CVE-2016-3070)

  - A security flaw was found in the Linux kernel in the     mark_source_chains() function in     'net/ipv4/netfilter/ip_tables.c'. It is possible for a     user-supplied 'ipt_entry' structure to have a large     'next_offset' field. This field is not bounds checked     prior to writing to a counter value at the supplied     offset.(CVE-2016-3134)

  - An integer overflow vulnerability was found in the     Linux kernel in xt_alloc_table_info, which on 32-bit     systems can lead to small structure allocation and a     copy_from_user based heap corruption.(CVE-2016-3135)

  - The mct_u232_msr_to_state function in     drivers/usb/serial/mct_u232.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted USB device without two     interrupt-in endpoint descriptors.(CVE-2016-3136)

  - drivers/usb/serial/cypress_m8.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions.(CVE-2016-3137)

  - The acm_probe function in drivers/usb/class/cdc-acm.c     in the Linux kernel before 4.5.1 allows physically     proximate attackers to cause a denial of service (NULL     pointer dereference and system crash) via a USB device     without both a control and a data endpoint     descriptor.(CVE-2016-3138)

  - The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     before 3.17 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-3139)

  - The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux     kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference and system crash) via a crafted endpoints     value in a USB device descriptor.(CVE-2016-3140)

  - 'A security flaw was found in the Linux kernel's     networking subsystem that destroying the network     interface with huge number of ipv4 addresses assigned     keeps ''rtnl_lock'' spinlock for a very long time (up     to hour). This blocks many network-related operations,     including creation of new incoming ssh connections.

  - The problem is especially important for containers, as     the container owner has enough permissions to trigger     this and block a network access on a whole host,     outside the container.(CVE-2016-3156)'

  - A weakness was found in the Linux ASLR implementation.
    Any user able to running 32-bit applications in a x86     machine can disable ASLR by setting the RLIMIT_STACK     resource to unlimited.(CVE-2016-3672)

  - The ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (system crash) via a USB device     without both a master and a slave     interface.(CVE-2016-3689)

  - It was found that the Linux kernel's IPv6     implementation mishandled socket options. A local     attacker could abuse concurrent access to the socket     options to escalate their privileges, or cause a denial     of service (use-after-free and system crash) via a     crafted sendmsg system call.(CVE-2016-3841)

  - The usbip_recv_xbuff function in     drivers/usb/usbip/usbip_common.c in the Linux kernel     before 4.5.3 allows remote attackers to cause a denial     of service (out-of-bounds write) or possibly have     unspecified other impact via a crafted length value in     a USB/IP packet.(CVE-2016-3955)

  - A flaw was found in the Linux kernel's keyring handling     code: the key_reject_and_link() function could be     forced to free an arbitrary memory block. An attacker     could use this flaw to trigger a use-after-free     condition on the system, potentially allowing for     privilege escalation.(CVE-2016-4470)

  - The proc_connectinfo() function in     'drivers/usb/core/devio.c' in the Linux kernel through     4.6 does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel stack memory via a crafted USBDEVFS_CONNECTINFO     ioctl call. The stack object 'ci' has a total size of 8     bytes. Its last 3 bytes are padding bytes which are not     initialized and are leaked to userland.(CVE-2016-4482)

  - A flaw was found in the way certain interfaces of the     Linux kernel's Infiniband subsystem used write() as     bi-directional ioctl() replacement, which could lead to     insufficient memory security checks when being invoked     using the splice() system call. A local unprivileged     user on a system with either Infiniband hardware     present or RDMA Userspace Connection Manager Access     module explicitly loaded, could use this flaw to     escalate their privileges on the system.(CVE-2016-4565)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2574 advisory.

    - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Larry Woodman) [1385124] {CVE-2016-5195}
    - [net] add recursion limit to GRO (Sabrina Dubroca) [1374191] {CVE-2016-7039}
    - [kernel] audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore) [1359306]     {CVE-2016-6136}
    - [scsi] aacraid: Check size values after double-fetch from user (Maurizio Lombardi) [1369771]     {CVE-2016-6480}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
95841	Scientific Linux Security Update : kernel on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/14	critical
91077	RHEL 6 : kernel (RHSA-2016:0855)	Nessus	Red Hat Local Security Checks	2016/5/12	2019/10/24	high
91170	CentOS 6 : kernel (CESA-2016:0855)	Nessus	CentOS Local Security Checks	2016/5/17	2021/1/4	high
93603	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3083-2)	Nessus	Ubuntu Local Security Checks	2016/9/20	2026/1/23	high
289409	MiracleLinux 7 : kernel-3.10.0-514.el7 (AXSA:2016-1135:09)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/9	critical
180641	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2019-4317)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/2/9	high
290493	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000997)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
94667	RHEL 7 : kernel (RHSA-2016:2695)	Nessus	Red Hat Local Security Checks	2016/11/10	2024/11/4	high
94537	RHEL 7 : kernel (RHSA-2016:2574)	Nessus	Red Hat Local Security Checks	2016/11/4	2026/1/20	critical
94547	RHEL 7 : kernel-rt (RHSA-2016:2584)	Nessus	Red Hat Local Security Checks	2016/11/4	2026/1/20	critical
287094	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003097)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
124816	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1492)	Nessus	Huawei Local Security Checks	2019/5/13	2024/5/23	critical
94697	Oracle Linux 7 : kernel (ELSA-2016-2574)	Nessus	Oracle Linux Local Security Checks	2016/11/11	2026/2/9	critical
95321	CentOS 7 : kernel (CESA-2016:2574)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	critical

检测

插件搜索

critical

high

high

high

critical

high

high

high

critical

critical

high

critical

critical

critical