The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - Kernel
  - krb5
  - glibc
  - mtp2sas
  - mptsas
  - mptspi

Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.
(CVE-2010-3865)

Dan Rosenberg discovered that the CAN protocol on 64bit systems did not correctly calculate the size of certain buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2010-3874)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3877)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Dan Rosenberg discovered that the RME Hammerfall DSP audio interface driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, CVE-2010-4081)

Dan Rosenberg discovered that the VIA video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4082)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

James Bottomley discovered that the ICP vortex storage array controller driver did not validate certain sizes. A local attacker on a 64bit system could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-4157)

Dan Rosenberg discovered multiple flaws in the X.25 facilities parsing. If a system was using X.25, a remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2010-4164)

It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)

Nelson Elhage discovered that the kernel did not correctly handle process cleanup after triggering a recoverable kernel bug. If a local attacker were able to trigger certain kinds of kernel bugs, they could create a specially crafted process to gain root privileges.
(CVE-2010-4258)

Nelson Elhage discovered that Econet did not correctly handle AUN packets over UDP. A local attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2010-4342)

Tavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks. (CVE-2010-4346)

Dan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. (CVE-2010-4527)

Dan Rosenberg discovered that IRDA did not correctly check the size of buffers. On non-x86 systems, a local attacker could exploit this to read kernel heap memory, leading to a loss of privacy.
(CVE-2010-4529)

Dan Rosenburg discovered that the CAN subsystem leaked kernel addresses into the /proc filesystem. A local attacker could use this to increase the chances of a successful memory corruption exploit.
(CVE-2010-4565)

Kees Cook discovered that some ethtool functions did not correctly clear heap memory. A local attacker with CAP_NET_ADMIN privileges could exploit this to read portions of kernel heap memory, leading to a loss of privacy. (CVE-2010-4655)

Kees Cook discovered that the IOWarrior USB device driver did not correctly check certain size fields. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges. (CVE-2010-4656)

Goldwyn Rodrigues discovered that the OCFS2 filesystem did not correctly clear memory when writing certain file holes. A local attacker could exploit this to read uninitialized data from the disk, leading to a loss of privacy. (CVE-2011-0463)

Dan Carpenter discovered that the TTPCI DVB driver did not check certain values during an ioctl. If the dvb-ttpci module was loaded, a local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges. (CVE-2011-0521)

Jens Kuehnel discovered that the InfiniBand driver contained a race condition. On systems using InfiniBand, a local attacker could send specially crafted requests to crash the system, leading to a denial of service. (CVE-2011-0695)

Dan Rosenberg discovered that XFS did not correctly initialize memory. A local attacker could make crafted ioctl calls to leak portions of kernel stack memory, leading to a loss of privacy.
(CVE-2011-0711)

Rafael Dominguez Vega discovered that the caiaq Native Instruments USB driver did not correctly validate string lengths. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges.
(CVE-2011-0712)

Timo Warns discovered that the LDM disk partition handling code did not correctly handle certain values. By inserting a specially crafted disk device, a local attacker could exploit this to gain root privileges. (CVE-2011-1017)

Julien Tinnes discovered that the kernel did not correctly validate the signal structure from tkill(). A local attacker could exploit this to send signals to arbitrary threads, possibly bypassing expected restrictions. (CVE-2011-1182)

Dan Rosenberg discovered that MPT devices did not correctly validate certain values in ioctl calls. If these drivers were loaded, a local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy. (CVE-2011-1494, CVE-2011-1495)

Tavis Ormandy discovered that the pidmap function did not correctly handle large requests. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-1593)

Vasiliy Kulikov discovered that the AGP driver did not check certain ioctl values. A local attacker with access to the video subsystem could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges. (CVE-2011-1745, CVE-2011-2022)

Vasiliy Kulikov discovered that the AGP driver did not check the size of certain memory allocations. A local attacker with access to the video subsystem could exploit this to run the system out of memory, leading to a denial of service. (CVE-2011-1746, CVE-2011-1747)

Oliver Hartkopp and Dave Jones discovered that the CAN network driver did not correctly validate certain socket structures. If this driver was loaded, a local attacker could crash the system, leading to a denial of service. (CVE-2011-1748)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0004 advisory.

    - [virt] xen: fix netback hotplug regression in xenbus fix (Laszlo Ersek) [636412 635999] {CVE-2010-3699}
    - [misc] posix-cpu-timers: workaround for mt exec problems (Oleg Nesterov) [656265 656266] {CVE-2010-4248}
    - [fs] setup_arg_pages: diagnose excessive argument size (Oleg Nesterov) [645226 645227] {CVE-2010-3858}
    - [net] inet_diag: make sure we run audited bytecode (Jiri Pirko) [651266 651267] {CVE-2010-3880}
    - [net] limit sendto/recvfrom/iovec total length to INT_MAX (Jiri Pirko) [645871 645872] {CVE-2010-3859}
    - [bluetooth] hci_ldisc: fix missing NULL check (Jarod Wilson) [655664 655666] {CVE-2010-4242}
    - [virt] xen: add bounds req-process loop in blkback/blktap (Laszlo Ersek) [656208 654546] {CVE-2010-4247}
    - [virt] xen: don't leak dev refs on bad xenbus transitions (Laszlo Ersek) [636412 635999] {CVE-2010-3699}
    - [net] rds: fix rds_iovec page count overflow (Jiri Pirko) [647421 647422] {CVE-2010-3865}
    - [net] fix deadlock in sock_queue_rcv_skb (Danny Feng) [652536 652537] {CVE-2010-4161}
    - [net] packet: fix information leak to userland (Jiri Pirko) [649897 649898] {CVE-2010-3876}
    - [ipc] sys_semctl: fix kernel stack leakage (Danny Feng) [648721 648722] {CVE-2010-4083}
    - [net] sctp: do not reset packet during sctp_packet_config (Jiri Pirko) [637866 637867] {CVE-2010-3432}
    - [scsi] gdth: prevent integer overflow in ioc_general (Frantisek Hrbata) [651175 651176] {CVE-2010-4157}
    - [sound] core: prevent heap corruption in snd_ctl_new (Jerome Marchand) [638483 638484] {CVE-2010-3442}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues, several bugs, and add an enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in sctp_packet_config() in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could use this flaw to cause a denial of service.
(CVE-2010-3432, Important)

* A missing integer overflow check was found in snd_ctl_new() in the Linux kernel's sound subsystem. A local, unprivileged user on a 32-bit system could use this flaw to cause a denial of service or escalate their privileges. (CVE-2010-3442, Important)

* A heap overflow flaw in the Linux kernel's Transparent Inter-Process Communication protocol (TIPC) implementation could allow a local, unprivileged user to escalate their privileges. (CVE-2010-3859, Important)

* An integer overflow flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges. (CVE-2010-3865, Important)

* A flaw was found in the Xenbus code for the unified block-device I/O interface back end. A privileged guest user could use this flaw to cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-3699, Moderate)

* Missing sanity checks were found in setup_arg_pages() in the Linux kernel. When making the size of the argument and environment area on the stack very large, it could trigger a BUG_ON(), resulting in a local denial of service. (CVE-2010-3858, Moderate)

* A flaw was found in inet_csk_diag_dump() in the Linux kernel's module for monitoring the sockets of INET transport protocols. By sending a netlink message with certain bytecode, a local, unprivileged user could cause a denial of service. (CVE-2010-3880, Moderate)

* Missing sanity checks were found in gdth_ioctl_alloc() in the gdth driver in the Linux kernel. A local user with access to '/dev/gdth' on a 64-bit system could use this flaw to cause a denial of service or escalate their privileges. (CVE-2010-4157, Moderate)

* The fix for Red Hat Bugzilla bug 484590 as provided in RHSA-2009:1243 introduced a regression. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-4161, Moderate)

* A NULL pointer dereference flaw was found in the Bluetooth HCI UART driver in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-4242, Moderate)

* It was found that a malicious guest running on the Xen hypervisor could place invalid data in the memory that the guest shared with the blkback and blktap back-end drivers, resulting in a denial of service on the host system. (CVE-2010-4247, Moderate)

* A flaw was found in the Linux kernel's CPU time clocks implementation for the POSIX clock interface. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-4248, Moderate)

* Missing initialization flaws in the Linux kernel could lead to information leaks. (CVE-2010-3876, CVE-2010-4083, Low)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2010-3442, CVE-2010-4161, and CVE-2010-4083; Thomas Pollet for reporting CVE-2010-3865; Brad Spengler for reporting CVE-2010-3858; Nelson Elhage for reporting CVE-2010-3880; Alan Cox for reporting CVE-2010-4242; and Vasiliy Kulikov for reporting CVE-2010-3876.

This update also fixes several bugs and adds an enhancement.
Documentation for the bug fixes and the enhancement will be available shortly from the Technical Notes document, linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0162 advisory.

  - kernel: tipc: heap overflow in tipc_msg_build() (CVE-2010-3859)

  - kernel: net/packet/af_packet.c: reading uninitialized stack memory (CVE-2010-3876)

  - kernel: ipc/shm.c: reading uninitialized stack memory (CVE-2010-4072)

  - kernel: ipc/compat*.c: reading uninitialized stack memory (CVE-2010-4073)

  - kernel: drivers/serial/serial_core.c: reading uninitialized stack memory (CVE-2010-4075)

  - kernel: drivers/sound/pci/rme9652/hdsp.c: reading uninitialized stack memory (CVE-2010-4080)

  - kernel: ipc/sem.c: reading uninitialized stack memory (CVE-2010-4083)

  - kernel: gdth: integer overflow in ioc_general() (CVE-2010-4157)

  - kernel: socket filters infoleak (CVE-2010-4158)

  - kernel: missing tty ops write function presence check in hci_uart_tty_open() (CVE-2010-4242)

  - kernel: unix socket local dos (CVE-2010-4249)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This patch updates the SUSE Linux Enterprise Server 9 kernel to fix various security issues and some bugs.

The following security issues were fixed :

  - The hci_uart_tty_open function in the HCI UART driver     (drivers/bluetooth/hci_ldisc.c) in the Linux kernel did     not verify whether the tty has a write operation, which     allowed local users to cause a denial of service (NULL     pointer dereference) via vectors related to the     Bluetooth driver. (CVE-2010-4242)

  - The load_mixer_volumes function in sound/oss/soundcard.c     in the OSS sound subsystem in the Linux kernel     incorrectly expected that a certain name field ends with     a '\0' character, which allowed local users to conduct     buffer overflow attacks and gain privileges, or possibly     obtain sensitive information from kernel memory, via a     SOUND_MIXER_SETLEVELS ioctl call. (CVE-2010-4527)

  - Integer underflow in the irda_getsockopt function in     net/irda/af_irda.c in the Linux kernel on platforms     other than x86 allowed local users to obtain potentially     sensitive information from kernel heap memory via an     IRLMP_ENUMDEVICES getsockopt call. (CVE-2010-4529)

  - The aun_incoming function in net/econet/af_econet.c in     the Linux kernel, when Econet is enabled, allowed remote     attackers to cause a denial of service (NULL pointer     dereference and OOPS) by sending an Acorn Universal     Networking (AUN) packet over UDP. (CVE-2010-4342)

  - fs/jfs/xattr.c in the Linux kernel did not properly     handle a certain legacy format for storage of extended     attributes, which might have allowed local users by     bypass intended xattr namespace restrictions via an     'os2.' substring at the beginning of a name.
    (CVE-2010-2946)

  - Stack-based buffer overflow in the econet_sendmsg     function in net/econet/af_econet.c in the Linux kernel,     when an econet address is configured, allowed local     users to gain privileges by providing a large number of     iovec structures. (CVE-2010-3848)

  - The econet_sendmsg function in net/econet/af_econet.c in     the Linux kernel, when an econet address is configured,     allowed local users to cause a denial of service (NULL     pointer dereference and OOPS) via a sendmsg call that     specifies a NULL value for the remote address field.
    (CVE-2010-3849)

  - The ec_dev_ioctl function in net/econet/af_econet.c in     the Linux kernel does not require the CAP_NET_ADMIN     capability, which allowed local users to bypass intended     access restrictions and configure econet addresses via     an SIOCSIFADDR ioctl call. (CVE-2010-3850)

  - The do_exit function in kernel/exit.c in the Linux     kernel did not properly handle a KERNEL_DS get_fs value,     which allowed local users to bypass intended access_ok     restrictions, overwrite arbitrary kernel memory     locations, and gain privileges by leveraging a (1) BUG,     (2) NULL pointer dereference, or (3) page fault, as     demonstrated by vectors involving the clear_child_tid     feature and the splice system call. (CVE-2010-4258)

  - Multiple integer overflows in the (1) pppol2tp_sendmsg     function in net/l2tp/l2tp_ppp.c, and the (2)     l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the     PPPoL2TP and IPoL2TP implementations in the Linux kernel     allowed local users to cause a denial of service (heap     memory corruption and panic) or possibly gain privileges     via a crafted sendto call. (CVE-2010-4160)

  - Integer overflow in the ioc_general function in     drivers/scsi/gdth.c in the Linux kernel on 64-bit     platforms allowed local users to cause a denial of     service (memory corruption) or possibly have unspecified     other impact via a large argument in an ioctl call.
    (CVE-2010-4157)

  - Multiple integer underflows in the x25_parse_facilities     function in net/x25/x25_facilities.c in the Linux kernel     allowed remote attackers to cause a denial of service     (system crash) via malformed X.25 (1) X25_FAC_CLASS_A,     (2) X25_FAC_CLASS_B, (3) X25_FAC_CLASS_C, or (4)     X25_FAC_CLASS_D facility data, a different vulnerability     than CVE-2010-3873. (CVE-2010-4164)

  - The sk_run_filter function in net/core/filter.c in the     Linux kernel did not check whether a certain memory     location has been initialized before executing a (1)     BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which     allowed local users to obtain potentially sensitive     information from kernel stack memory via a crafted     socket filter. (CVE-2010-4158)

  - Multiple integer overflows in the snd_ctl_new function     in sound/core/control.c in the Linux kernel allowed     local users to cause a denial of service (heap memory     corruption) or possibly have unspecified other impact     via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2)     SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. (CVE-2010-3442)

  - The snd_hdspm_hwdep_ioctl function in     sound/pci/rme9652/hdspm.c in the Linux kernel did not     initialize a certain structure, which allowed local     users to obtain potentially sensitive information from     kernel stack memory via an     SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
    (CVE-2010-4081)

  - The ipc subsystem in the Linux kernel did not initialize     certain structures, which allowed local users to obtain     potentially sensitive information from kernel stack     memory via vectors related to the (1) compat_sys_semctl,     (2) compat_sys_msgctl, and (3) compat_sys_shmctl     functions in ipc/compat.c; and the (4)     compat_sys_mq_open and (5) compat_sys_mq_getsetattr     functions in ipc/compat_mq.c. (CVE-2010-4073)

  - The copy_shmid_to_user function in ipc/shm.c in the     Linux kernel did not initialize a certain structure,     which allowed local users to obtain potentially     sensitive information from kernel stack memory via     vectors related to the shmctl system call and the 'old     shm interface.'. (CVE-2010-4072)

  - The copy_semid_to_user function in ipc/sem.c in the     Linux kernel did not initialize a certain structure,     which allowed local users to obtain potentially     sensitive information from kernel stack memory via a (1)     IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT     command in a semctl system call. (CVE-2010-4083)

  - Integer overflow in the do_io_submit function in     fs/aio.c in the Linux kernel allowed local users to     cause a denial of service or possibly have unspecified     other impact via crafted use of the io_submit system     call. (CVE-2010-3067)

  - Multiple integer signedness errors in net/rose/af_rose.c     in the Linux kernel allowed local users to cause a     denial of service (heap memory corruption) or possibly     have unspecified other impact via a rose_getname     function call, related to the rose_bind and rose_connect     functions. (CVE-2010-3310)

Fixes multiple security bugs. All users should update to this version.

Also fixes :

  - Stall on boot on some systems with TPM devices.
    (RHBZ#530393)

    - Hard lockups with Radeon RV350 devices. (RHBZ#631310)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 11.3 kernel was updated to fix various bugs and security issues.

Following security issues have been fixed: CVE-2010-4347: A local user could inject ACPI code into the kernel via the world-writable 'custom_debug' file, allowing local privilege escalation.

CVE-2010-4258: A local attacker could use a Oops (kernel crash) caused by other flaws to write a 0 byte to a attacker controlled address in the kernel. This could lead to privilege escalation together with other issues.

CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc could lead to memory corruption in the GDTH driver.

CVE-2010-4165: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel did not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.

CVE-2010-4164: A remote (or local) attacker communicating over X.25 could cause a kernel panic by attempting to negotiate malformed facilities.

CVE-2010-4175: A local attacker could cause memory overruns in the RDS protocol stack, potentially crashing the kernel. So far it is considered not to be exploitable.

CVE-2010-4169: Use-after-free vulnerability in mm/mprotect.c in the Linux kernel allwed local users to cause a denial of service via vectors involving an mprotect system call.

CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable.

CVE-2010-4158: A memory information leak in berkely packet filter rules allowed local attackers to read uninitialized memory of the kernel stack.

CVE-2010-4162: A local denial of service in the blockdevice layer was fixed.

CVE-2010-4163: By submitting certain I/O requests with 0 length, a local user could have caused a kernel panic.

CVE-2010-0435: The Hypervisor in KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via vectors related to instruction emulation.

CVE-2010-3861: The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel did not initialize a certain block of heap memory, which allowed local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value.

CVE-2010-3442: Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.

CVE-2010-3437: A range checking overflow in pktcdvd ioctl was fixed.

CVE-2010-4078: The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.

CVE-2010-4080: The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.

CVE-2010-4081: The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.

CVE-2010-4082: The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call.

CVE-2010-4073: The ipc subsystem in the Linux kernel did not initialize certain structures, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c.

CVE-2010-4072: The copy_shmid_to_user function in ipc/shm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the 'old shm interface.'

CVE-2010-4083: The copy_semid_to_user function in ipc/sem.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call.

CVE-2010-3432: The sctp_packet_config function in net/sctp/output.c in the Linux kernel performed extraneous initializations of packet data structures, which allowed remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.

CVE-2010-3067: Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.

CVE-2010-3865: A iovec integer overflow in RDS sockets was fixed which could lead to local attackers gaining kernel privileges.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
89680	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)	Nessus	Misc.	2016/3/4	2023/5/14	high
55530	USN-1164-1 : linux-fsl-imx51 vulnerabilities	Nessus	Ubuntu Local Security Checks	2011/7/7	2016/12/1	high
68176	Oracle Linux 5 : kernel (ELSA-2011-0004)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
51417	RHEL 5 : kernel (RHSA-2011:0004)	Nessus	Red Hat Local Security Checks	2011/1/5	2021/1/14	high
51569	RHEL 4 : kernel (RHSA-2011:0162)	Nessus	Red Hat Local Security Checks	2011/1/19	2024/4/21	medium
51953	SuSE9 Security Update : the Linux kernel (YOU Patch Number 12672)	Nessus	SuSE Local Security Checks	2011/2/11	2021/1/14	high
51374	Fedora 13 : kernel-2.6.34.7-66.fc13 (2010-18983)	Nessus	Fedora Local Security Checks	2010/12/26	2021/1/11	high
75553	openSUSE Security Update : kernel (openSUSE-SU-2011:0004-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high

检测

插件搜索

high

high

high

high

medium

high

high

high