The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-2 advisory.

    A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw     to gain access to any file by setting an ACL. (CVE-2016-1237)

    Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-5244)

    James Patrick-Evans discovered that the airspy USB device driver in the Linux kernel did not properly     handle certain error conditions. An attacker with physical access could use this to cause a denial of     service (memory consumption). (CVE-2016-5400)

    Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux     kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content     into an TCP stream. (CVE-2016-5696)

    Pengfei Wang discovered a race condition in the MIC VOP driver in the Linux kernel. A local attacker could     use this to cause a denial of service (system crash) or obtain potentially sensitive information from     kernel memory. (CVE-2016-5728)

    Cyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled transactional memory state on     exec(). A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2016-5828)

    It was discovered that a heap based buffer overflow existed in the USB HID driver in the Linux kernel. A     local attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2016-5829)

    It was discovered that the OverlayFS implementation in the Linux kernel did not properly verify dentry     state before proceeding with unlink and rename operations. A local attacker could use this to cause a     denial of service (system crash). (CVE-2016-6197)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was found that the Linux kernel's IPv6 implementation     mishandled socket options. A local attacker could abuse     concurrent access to the socket options to escalate     their privileges, or cause a denial of service     (use-after-free and system crash) via a crafted sendmsg     system call. (CVE-2016-3841, Important)

(CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Additional Changes :

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000955 advisory.

    The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc     platforms mishandles transactional state, which allows local users to cause a denial of service (invalid     process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by     starting and suspending a transaction before an exec system call.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002871 advisory.

    The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc     platforms mishandles transactional state, which allows local users to cause a denial of service (invalid     process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by     starting and suspending a transaction before an exec system call.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-1 advisory.

    A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw     to gain access to any file by setting an ACL. (CVE-2016-1237)

    Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-5244)

    James Patrick-Evans discovered that the airspy USB device driver in the Linux kernel did not properly     handle certain error conditions. An attacker with physical access could use this to cause a denial of     service (memory consumption). (CVE-2016-5400)

    Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux     kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content     into an TCP stream. (CVE-2016-5696)

    Pengfei Wang discovered a race condition in the MIC VOP driver in the Linux kernel. A local attacker could     use this to cause a denial of service (system crash) or obtain potentially sensitive information from     kernel memory. (CVE-2016-5728)

    Cyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled transactional memory state on     exec(). A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2016-5828)

    It was discovered that a heap based buffer overflow existed in the USB HID driver in the Linux kernel. A     local attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2016-5829)

    It was discovered that the OverlayFS implementation in the Linux kernel did not properly verify dentry     state before proceeding with unlink and rename operations. A local attacker could use this to cause a     denial of service (system crash). (CVE-2016-6197)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3071-1 advisory.

    Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-5244)

    Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux     kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content     into an TCP stream. (CVE-2016-5696)

    Pengfei Wang discovered a race condition in the MIC VOP driver in the Linux kernel. A local attacker could     use this to cause a denial of service (system crash) or obtain potentially sensitive information from     kernel memory. (CVE-2016-5728)

    Cyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled transactional memory state on     exec(). A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2016-5828)

    It was discovered that a heap based buffer overflow existed in the USB HID driver in the Linux kernel. A     local attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2016-5829)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2014-9904     It was discovered that the snd_compress_check_input     function used in the ALSA subsystem does not properly     check for an integer overflow, allowing a local user to     cause a denial of service.

  - CVE-2016-5728     Pengfei Wang discovered a race condition in the MIC VOP     driver that could allow a local user to obtain sensitive     information from kernel memory or cause a denial of     service.

  - CVE-2016-5828     Cyril Bur and Michael Ellerman discovered a flaw in the     handling of Transactional Memory on powerpc systems     allowing a local user to cause a denial of service     (kernel crash) or possibly have unspecified other     impact, by starting a transaction, suspending it, and     then calling any of the exec() class system calls.

  - CVE-2016-5829     A heap-based buffer overflow vulnerability was found in     the hiddev driver, allowing a local user to cause a     denial of service or, potentially escalate their     privileges.

  - CVE-2016-6130     Pengfei Wang discovered a flaw in the S/390 character     device drivers potentially leading to information leak     with /dev/sclp.

Additionally this update fixes a regression in the ebtables facility (#828914) that was introduced in DSA-3607-1.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2574 advisory.

    - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Larry Woodman) [1385124] {CVE-2016-5195}
    - [net] add recursion limit to GRO (Sabrina Dubroca) [1374191] {CVE-2016-7039}
    - [kernel] audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore) [1359306]     {CVE-2016-6136}
    - [scsi] aacraid: Check size values after double-fetch from user (Maurizio Lombardi) [1369771]     {CVE-2016-6480}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-3071-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-5244)

Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content into an TCP stream. (CVE-2016-5696)

Pengfei Wang discovered a race condition in the MIC VOP driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or obtain potentially sensitive information from kernel memory. (CVE-2016-5728)

Cyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled transactional memory state on exec(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-5828)

It was discovered that a heap based buffer overflow existed in the USB HID driver in the Linux kernel. A local attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2016-5829).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-3 advisory.

    A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw     to gain access to any file by setting an ACL. (CVE-2016-1237)

    Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-5244)

    James Patrick-Evans discovered that the airspy USB device driver in the Linux kernel did not properly     handle certain error conditions. An attacker with physical access could use this to cause a denial of     service (memory consumption). (CVE-2016-5400)

    Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux     kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content     into an TCP stream. (CVE-2016-5696)

    Pengfei Wang discovered a race condition in the MIC VOP driver in the Linux kernel. A local attacker could     use this to cause a denial of service (system crash) or obtain potentially sensitive information from     kernel memory. (CVE-2016-5728)

    Cyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled transactional memory state on     exec(). A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2016-5828)

    It was discovered that a heap based buffer overflow existed in the USB HID driver in the Linux kernel. A     local attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2016-5829)

    It was discovered that the OverlayFS implementation in the Linux kernel did not properly verify dentry     state before proceeding with unlink and rename operations. A local attacker could use this to cause a     denial of service (system crash). (CVE-2016-6197)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.62 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2014-9904: The snd_compress_check_input function in     sound/core/compress_offload.c in the ALSA subsystem in     the Linux kernel did not properly check for an integer     overflow, which allowed local users to cause a denial of     service (insufficient memory allocation) or possibly     have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl call (bnc#986811).

  - CVE-2015-7833: The usbvision driver in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (panic) via a nonzero bInterfaceNumber value     in a USB device descriptor (bnc#950998).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8845: The tm_reclaim_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms did not ensure that TM suspend mode     exists before proceeding with a tm_reclaim call, which     allowed local users to cause a denial of service (TM Bad     Thing exception and panic) via a crafted application     (bnc#975533).

  - CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in     the Linux kernel allowed local users to gain privileges     via crafted ASN.1 data (bnc#979867).

  - CVE-2016-1583: The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (stack memory consumption) via vectors involving crafted     mmap calls for /proc pathnames, leading to recursive     pagefault handling (bsc#983143).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-3672: The arch_pick_mmap_layout function in     arch/x86/mm/mmap.c in the Linux kernel did not properly     randomize the legacy base address, which made it easier     for local users to defeat the intended restrictions on     the ADDR_NO_RANDOMIZE flag, and bypass the ASLR     protection mechanism for a setuid or setgid program, by     disabling stack-consumption resource limits     (bnc#974308).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bsc#978401).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relied on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bsc#979213).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (memory corruption) by leveraging     in-container root access to provide a crafted offset     value that triggers an unintended decrement     (bsc#986362).

  - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging     in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary     (bsc#986365).

  - CVE-2016-5244: The rds_inc_info_copy function in     net/rds/recv.c in the Linux kernel did not initialize a     certain structure member, which allowed remote attackers     to obtain sensitive information from kernel stack memory     by reading an RDS message (bnc#983213).

  - CVE-2016-5828: The start_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms mishandled transactional state, which     allowed local users to cause a denial of service     (invalid process state or TM Bad Thing exception, and     system crash) or possibly have unspecified other impact     by starting and suspending a transaction an exec system     call (bsc#986569).

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allowed     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93241	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3070-2)	Nessus	Ubuntu Local Security Checks	2016/8/31	2024/8/27	high
95841	Scientific Linux Security Update : kernel on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/14	critical
290730	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000955)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
287315	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002871)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
93217	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3070-1)	Nessus	Ubuntu Local Security Checks	2016/8/30	2024/8/27	high
93218	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3071-1)	Nessus	Ubuntu Local Security Checks	2016/8/30	2024/8/27	high
91927	Debian DSA-3616-1 : linux - security update	Nessus	Debian Local Security Checks	2016/7/5	2021/1/11	high
94697	Oracle Linux 7 : kernel (ELSA-2016-2574)	Nessus	Oracle Linux Local Security Checks	2016/11/11	2026/2/9	critical
93219	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3071-2)	Nessus	Ubuntu Local Security Checks	2016/8/30	2026/1/27	high
93242	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3070-3)	Nessus	Ubuntu Local Security Checks	2016/8/31	2024/8/27	high
93299	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2105-1)	Nessus	SuSE Local Security Checks	2016/9/2	2026/1/27	high
95321	CentOS 7 : kernel (CESA-2016:2574)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	critical

检测

插件搜索

high

critical

high

high

high

high

high

critical

high

high

high

critical