Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-7487     Li Qiang reported a reference counter leak in the     ipxitf_ioctl function which may result into a     use-after-free vulnerability, triggerable when a IPX     interface is configured.

  - CVE-2017-7645     Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd     discovered that the NFSv2 and NFSv3 server     implementations are vulnerable to an out-of-bounds     memory access issue while processing arbitrarily long     arguments sent by NFSv2/NFSv3 PRC clients, leading to a     denial of service.

  - CVE-2017-7895     Ari Kauppi from Synopsys Ltd discovered that the NFSv2     and NFSv3 server implementations do not properly handle     payload bounds checking of WRITE requests. A remote     attacker with write access to a NFS mount can take     advantage of this flaw to read chunks of arbitrary     memory from both kernel-space and user-space.

  - CVE-2017-8064     Arnd Bergmann found that the DVB-USB core misused the     device logging system, resulting in a use-after-free     vulnerability, with unknown security impact.

  - CVE-2017-8890     It was discovered that the net_csk_clone_lock() function     allows a remote attacker to cause a double free leading     to a denial of service or potentially have other impact.

  - CVE-2017-8924     Johan Hovold found that the io_ti USB serial driver     could leak sensitive information if a malicious USB     device was connected.

  - CVE-2017-8925     Johan Hovold found a reference counter leak in the     omninet USB serial driver, resulting in a use-after-free     vulnerability. This can be triggered by a local user     permitted to open tty devices.

  - CVE-2017-9074     Andrey Konovalov reported that the IPv6 fragmentation     implementation could read beyond the end of a packet     buffer. A local user or guest VM might be able to use     this to leak sensitive information or to cause a denial     of service (crash).

  - CVE-2017-9075     Andrey Konovalov reported that the SCTP/IPv6     implementation wrongly initialised address lists on     connected sockets, resulting in a use-after-free     vulnerability, a similar issue to CVE-2017-8890. This     can be triggered by any local user.

  - CVE-2017-9076 / CVE-2017-9077     Cong Wang found that the TCP/IPv6 and DCCP/IPv6     implementations wrongly initialised address lists on     connected sockets, a similar issue to CVE-2017-9075.

  - CVE-2017-9242     Andrey Konovalov reported a packet buffer overrun in the     IPv6 implementation. A local user could use this for     denial of service (memory corruption; crash) and     possibly for privilege escalation.

  - CVE-2017-1000364     The Qualys Research Labs discovered that the size of the     stack guard page is not sufficiently large. The     stack-pointer can jump over the guard-page and moving     from the stack into another memory region without     accessing the guard-page. In this case no page-fault     exception is raised and the stack extends into the other     memory region. An attacker can exploit this flaw for     privilege escalation.

  The default stack gap protection is set to 256 pages and can be   configured via the stack_guard_gap kernel parameter on the kernel   command line.

  Further details can be found at   https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3360-1 advisory.

    It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2014-9900)

    It was discovered that the Linux kernel did not properly restrict access to /proc/iomem. A local attacker     could use this to expose sensitive information. (CVE-2015-8944)

    It was discovered that a use-after-free vulnerability existed in the performance events and counters     subsystem of the Linux kernel for ARM64. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2015-8955)

    It was discovered that the SCSI generic (sg) driver in the Linux kernel contained a double-free     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2015-8962)

    Sasha Levin discovered that a race condition existed in the performance events and counters subsystem of     the Linux kernel when handling CPU unplug events. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2015-8963)

    Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2015-8964)

    It was discovered that the fcntl64() system call in the Linux kernel did not properly set memory limits     when returning on 32-bit ARM processors. A local attacker could use this to gain administrative     privileges. (CVE-2015-8966)

    It was discovered that the system call table for ARM 64-bit processors in the Linux kernel was not write-     protected. An attacker could use this in conjunction with another kernel vulnerability to execute     arbitrary code. (CVE-2015-8967)

    It was discovered that the generic SCSI block layer in the Linux kernel did not properly restrict write     operations in certain situations. A local attacker could use this to cause a denial of service (system     crash) or possibly gain administrative privileges. (CVE-2016-10088)

    Alexander Potapenko discovered a race condition in the Advanced Linux Sound Architecture (ALSA) subsystem     in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2017-1000380)

    Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the Linux kernel did not properly     validate some ioctl arguments. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-7346)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly check for the end of buffer. A remote attacker could use this to craft requests     that cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-7895)

    It was discovered that an integer underflow existed in the Edgeport USB Serial Converter device driver of     the Linux kernel. An attacker with physical access could use this to expose sensitive information (kernel     memory). (CVE-2017-8924)

    It was discovered that the USB ZyXEL omni.net LCD PLUS driver in the Linux kernel did not properly perform     reference counting. A local attacker could use this to cause a denial of service (tty exhaustion).
    (CVE-2017-8925)

    Murray McAllister discovered that the DRM driver for VMware Virtual GPUs in the Linux kernel did not     properly initialize memory. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2017-9605)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003184 advisory.

    The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local     users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5879 advisory.

    - USB: serial: omninet: fix reference leaks at open (Mark Nicholson)  [Orabug: 30484762]  {CVE-2017-8925}
    - GFS2: don't set rgrp gl_object until it's inserted into rgrp tree (Bob Peterson)  [Orabug: 30254252]     {CVE-2016-10905}
    - GFS2: Fix rgrp end rounding problem for bsize < page size (Bob Peterson)  [Orabug: 30254252]     {CVE-2016-10905}
    - GFS2: Use range based functions for rgrp sync/invalidation (Steven Whitehouse)  [Orabug: 30254252]     {CVE-2016-10905}
    - fs/proc/proc_sysctl.c: Fix a NULL pointer dereference (YueHaibing)  [Orabug: 30732940]  {CVE-2019-20054}
    - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links (YueHaibing)  [Orabug: 30732940]     {CVE-2019-20054}
    - scsi: libsas: stop discovering if oob mode is disconnected (Jason Yan)  [Orabug: 30770914]     {CVE-2019-19965}
    - ath9k_htc: release allocated buffer if timed out (Navid Emamdoost)  [Orabug: 31351573]  {CVE-2019-19073}
    - USB: serial: io_ti: fix information leak in completion handler (Johan Hovold)  [Orabug: 31352085]     {CVE-2017-8924}
    - mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song)  [Orabug: 31884241]     {CVE-2020-25285}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2016-5243: The tipc_nl_compat_link_dump function in     net/tipc/netlink_compat.c in the Linux kernel did not     properly copy a certain string, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#983212)

  - CVE-2016-10200: Race condition in the L2TPv3 IP     Encapsulation feature in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) by making multiple bind system calls     without properly ascertaining whether a socket has the     SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and     net/l2tp/l2tp_ip6.c (bnc#1028415)

  - CVE-2017-2647: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash)     via vectors involving a NULL value for a certain match     field, related to the keyring_search_iterator function     in keyring.c (bsc#1030593).

  - CVE-2017-2671: The ping_unhash function in     net/ipv4/ping.c in the Linux kernel was too late in     obtaining a certain lock and consequently could not     ensure that disconnect function calls are safe, which     allowed local users to cause a denial of service (panic)     by leveraging access to the protocol value of     IPPROTO_ICMP in a socket system call (bnc#1031003)

  - CVE-2017-5669: The do_shmat function in ipc/shm.c in the     Linux kernel did not restrict the address calculated by     a certain rounding operation, which allowed local users     to map page zero, and consequently bypass a protection     mechanism that exists for the mmap system call, by     making crafted shmget and shmat system calls in a     privileged context (bnc#1026914)

  - CVE-2017-5970: The ipv4_pktinfo_prepare function in     net/ipv4/ip_sockglue.c in the Linux kernel allowed     attackers to cause a denial of service (system crash)     via (1) an application that made crafted system calls or     possibly (2) IPv4 traffic with invalid IP options     (bsc#1024938)

  - CVE-2017-5986: Race condition in the     sctp_wait_for_sndbuf function in net/sctp/socket.c in     the Linux kernel allowed local users to cause a denial     of service (assertion failure and panic) via a     multithreaded application that peels off an association     in a certain buffer-full state (bsc#1025235)

  - CVE-2017-6074: The dccp_rcv_state_process function in     net/dccp/input.c in the Linux kernel mishandled     DCCP_PKT_REQUEST packet data structures in the LISTEN     state, which allowed local users to obtain root     privileges or cause a denial of service (double free)     via an application that made an IPV6_RECVPKTINFO     setsockopt system call (bnc#1026024)

  - CVE-2017-6214: The tcp_splice_read function in     net/ipv4/tcp.c in the Linux kernel allowed remote     attackers to cause a denial of service (infinite loop     and soft lockup) via vectors involving a TCP packet with     the URG flag (bnc#1026722)

  - CVE-2017-6348: The hashbin_delete function in     net/irda/irqueue.c in the Linux kernel improperly     managed lock dropping, which allowed local users to     cause a denial of service (deadlock) via crafted     operations on IrDA devices (bnc#1027178)

  - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did     not properly restrict association peel-off operations     during certain wait states, which allowed local users to     cause a denial of service (invalid unlock and double     free) via a multithreaded application. NOTE: this     vulnerability exists because of an incorrect fix for     CVE-2017-5986 (bnc#1027066)

  - CVE-2017-6951: The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a request_key system call for     the 'dead' type (bsc#1029850).

  - CVE-2017-7184: The xfrm_replay_verify_len function in     net/xfrm/xfrm_user.c in the Linux kernel did not     validate certain size data after an XFRM_MSG_NEWAE     update, which allowed local users to obtain root     privileges or cause a denial of service (heap-based     out-of-bounds access) by leveraging the CAP_NET_ADMIN     capability (bsc#1030573)

  - CVE-2017-7187: The sg_ioctl function in     drivers/scsi/sg.c in the Linux kernel allowed local     users to cause a denial of service (stack-based buffer     overflow) or possibly have unspecified other impact via     a large command size in an SG_NEXT_CMD_LEN ioctl call,     leading to out-of-bounds write access in the sg_write     function (bnc#1030213)

  - CVE-2017-7261: The vmw_surface_define_ioctl function in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel did not check for a zero value of certain levels     data, which allowed local users to cause a denial of     service (ZERO_SIZE_PTR dereference, and GPF and possibly     panic) via a crafted ioctl call for a /dev/dri/renderD*     device (bnc#1031052)

  - CVE-2017-7294: The vmw_surface_define_ioctl function in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel did not validate addition of certain levels data,     which allowed local users to trigger an integer overflow     and out-of-bounds write, and cause a denial of service     (system hang or crash) or possibly gain privileges, via     a crafted ioctl call for a /dev/dri/renderD* device     (bnc#1031440)

  - CVE-2017-7308: The packet_set_ring function in     net/packet/af_packet.c in the Linux kernel did not     properly validate certain block-size data, which allowed     local users to cause a denial of service (overflow) or     possibly have unspecified other impact via crafted     system calls (bnc#1031579)

  - CVE-2017-7482: Several missing length checks ticket     decode allowing for information leak or potentially code     execution (bsc#1046107).

  - CVE-2017-7487: The ipxitf_ioctl function in     net/ipx/af_ipx.c in the Linux kernel mishandled     reference counts, which allowed local users to cause a     denial of service (use-after-free) or possibly have     unspecified other impact via a failed SIOCGIFADDR ioctl     call for an IPX interface (bsc#1038879).

  - CVE-2017-7533: Race condition in the fsnotify     implementation in the Linux kernel allowed local users     to gain privileges or cause a denial of service (memory     corruption) via a crafted application that leverages     simultaneous execution of the inotify_handle_event and     vfs_rename functions (bnc#1049483 1050677 ).

  - CVE-2017-7542: The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel allowed local     users to cause a denial of service (integer overflow and     infinite loop) by leveraging the ability to open a raw     socket (bnc#1049882).

  - CVE-2017-7616: Incorrect error handling in the     set_mempolicy and mbind compat syscalls in     mm/mempolicy.c in the Linux kernel allowed local users     to obtain sensitive information from uninitialized stack     data by triggering failure of a certain bitmap operation     (bsc#1033336)

  - CVE-2017-8831: The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds array access) or possibly have     unspecified other impact by changing a certain     sequence-number value, aka a 'double fetch'     vulnerability. This requires a malicious PCI Card.
    (bnc#1037994).

  - CVE-2017-8890: The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allowed attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call (bsc#1038544).

  - CVE-2017-8924: The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel allowed     local users to obtain sensitive information (in the     dmesg ringbuffer and syslog) from uninitialized kernel     memory by using a crafted USB device (posing as an io_ti     USB serial device) to trigger an integer underflow     (bnc#1037182).

  - CVE-2017-8925: The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel allowed     local users to cause a denial of service (tty     exhaustion) by leveraging reference count mishandling     (bnc#1038981).

  - CVE-2017-9074: The IPv6 fragmentation implementation in     the Linux kernel did not consider that the nexthdr field     may be associated with an invalid option, which allowed     local users to cause a denial of service (out-of-bounds     read and BUG) or possibly have unspecified other impact     via crafted socket and send system calls (bnc#1039882).

  - CVE-2017-9075: The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bsc#1039883).

  - CVE-2017-9076: The dccp_v6_request_recv_sock function in     net/dccp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039885).

  - CVE-2017-9077: The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bsc#1040069).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel was too late     in checking whether an overwrite of an skb data     structure may occur, which allowed local users to cause     a denial of service (system crash) via crafted system     calls (bnc#1041431).

  - CVE-2017-10661: Race condition in fs/timerfd.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (list corruption or     use-after-free) via simultaneous file-descriptor     operations that leverage improper might_cancel queueing     (bnc#1053152).

  - CVE-2017-11176: The mq_notify function in the Linux     kernel did not set the sock pointer to NULL upon entry     into the retry logic. During a user-space close of a     Netlink socket, it allowed attackers to cause a denial     of service (use-after-free) or possibly have unspecified     other impact (bnc#1048275).

  - CVE-2017-11473: Buffer overflow in the     mp_override_legacy_irq() function in     arch/x86/kernel/acpi/boot.c in the Linux kernel allowed     local users to gain privileges via a crafted ACPI table     (bnc#1049603).

  - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A     user-controlled buffer is copied into a local buffer of     constant size using strcpy without a length check which     can cause a buffer overflow. (bnc#1053148).

  - CVE-2017-14051: An integer overflow in the     qla2x00_sysfs_write_optrom_ctl function in     drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash) by leveraging root access     (bnc#1056588).

  - CVE-2017-1000112: Fixed a race condition in net-packet     code that could have been exploited by unprivileged     users to gain root access. (bsc#1052311).

  - CVE-2017-1000363: Linux drivers/char/lp.c Out-of-Bounds     Write. Due to a missing bounds check, and the fact that     parport_ptr integer is static, a 'secure boot' kernel     command line adversary could have overflowed the     parport_nr array in the following code (bnc#1039456).

  - CVE-2017-1000365: The Linux Kernel imposes a size     restriction on the arguments and environmental strings     passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the     size), but did not take the argument and environment     pointers into account, which allowed attackers to bypass     this limitation (bnc#1039354).

  - CVE-2017-1000380: sound/core/timer.c in the Linux kernel     was vulnerable to a data race in the ALSA /dev/snd/timer     driver resulting in local users being able to read     information belonging to other users, i.e.,     uninitialized memory contents may be disclosed when a     read and an ioctl happen at the same time (bnc#1044125).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
100877	Debian DSA-3886-1 : linux - security update (Stack Clash)	Nessus	Debian Local Security Checks	2017/6/20	2025/12/16	critical
101928	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3360-1)	Nessus	Ubuntu Local Security Checks	2017/7/24	2024/8/27	critical
287311	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003184)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	medium
141367	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5879)	Nessus	Oracle Linux Local Security Checks	2020/10/12	2026/2/9	high
103354	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:2525-1) (Stack Clash)	Nessus	SuSE Local Security Checks	2017/9/20	2025/11/20	critical

检测

插件搜索

critical

critical

medium

high

critical