Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-3153, Important)

* A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

* It was discovered that the proc_ns_follow_link() function did not properly return the LAST_BIND value in the last pathname component as is expected for procfs symbolic links, which could lead to excessive freeing of memory and consequent slab corruption. A local, unprivileged user could use this flaw to crash the system.
(CVE-2014-0203, Moderate)

* A flaw was found in the way the Linux kernel handled exceptions when user-space applications attempted to use the linkage stack. On IBM S/390 systems, a local, unprivileged user could use this flaw to crash the system. (CVE-2014-2039, Moderate)

* An invalid pointer dereference flaw was found in the Marvell 8xxx Libertas WLAN (libertas) driver in the Linux kernel. A local user able to write to a file that is provided by the libertas driver and located on the debug file system (debugfs) could use this flaw to crash the system. Note: The debugfs file system must be mounted locally to exploit this issue. It is not mounted by default. (CVE-2013-6378, Low)

* A denial of service flaw was discovered in the way the Linux kernel's SELinux implementation handled files with an empty SELinux security context. A local user who has the CAP_MAC_ADMIN capability could use this flaw to crash the system. (CVE-2014-1874, Low)

Red Hat would like to thank Kees Cook of Google for reporting CVE-2014-3153, Matthew Daley for reporting CVE-2014-1737 and CVE-2014-1738, and Vladimir Davydov of Parallels for reporting CVE-2014-0203. Google acknowledges Pinkie Pie as the original reporter of CVE-2014-3153.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The Linux kernel was updated to fix various bugs and security issues :

  - mm/page-writeback.c: do not count anon pages as     dirtyable memory (reclaim stalls).

  - mm/page-writeback.c: fix dirty_balance_reserve     subtraction from dirtyable memory (reclaim stalls).

  - compat_sys_recvmmsg X32 fix (bnc#860993 CVE-2014-0038).

  - hwmon: (coretemp) Fix truncated name of alarm attributes

  - net: fib: fib6_add: fix potential NULL pointer     dereference (bnc#854173 CVE-2013-6431).

  - keys: fix race with concurrent install_user_keyrings()     (bnc#808358)(CVE-2013-1792).

  - KVM: x86: Convert vapic synchronization to _cached     functions (CVE-2013-6368) (bnc#853052 CVE-2013-6368).

  - wireless: radiotap: fix parsing buffer overrun     (bnc#854634 CVE-2013-7027).

  - KVM: x86: fix guest-initiated crash with x2apic     (CVE-2013-6376) (bnc#853053 CVE-2013-6376).

  - KVM: x86: Fix potential divide by 0 in lapic     (CVE-2013-6367) (bnc#853051 CVE-2013-6367).

  - KVM: Improve create VCPU parameter (CVE-2013-4587)     (bnc#853050 CVE-2013-4587).

  - staging: ozwpan: prevent overflow in oz_cdev_write()     (bnc#849023 CVE-2013-4513).

  - perf/x86: Fix offcore_rsp valid mask for SNB/IVB     (bnc#825006).

  - perf/x86: Add Intel IvyBridge event scheduling     constraints (bnc#825006).

  - libertas: potential oops in debugfs (bnc#852559     CVE-2013-6378).

  - aacraid: prevent invalid pointer dereference (bnc#852373     CVE-2013-6380).

  - staging: wlags49_h2: buffer overflow setting station     name (bnc#849029 CVE-2013-4514).

  - net: flow_dissector: fail on evil iph->ihl (bnc#848079     CVE-2013-4348).

  - Staging: bcm: info leak in ioctl (bnc#849034     CVE-2013-4515).

  - Refresh     patches.fixes/net-rework-recvmsg-handler-msg_name-and-ms     g_namelen-logic.patch.

  - ipv6: remove max_addresses check from     ipv6_create_tempaddr (bnc#805226, CVE-2013-0343).

  - net: rework recvmsg handler msg_name and msg_namelen     logic (bnc#854722).

  - crypto: ansi_cprng - Fix off by one error in non-block     size request (bnc#840226).

  - x6: Fix reserve_initrd so that acpi_initrd_override is     reached (bnc#831836).

  - Refresh other Xen patches.

  - aacraid: missing capable() check in compat ioctl     (bnc#852558).

  -     patches.fixes/gpio-ich-fix-ichx_gpio_check_available-ret     urn.patch: Update upstream reference

  - perf/ftrace: Fix paranoid level for enabling function     tracer (bnc#849362).

  - xhci: fix NULL pointer dereference on     ring_doorbell_for_active_rings (bnc#848255).

  - xhci: Fix oops happening after address device timeout     (bnc#848255).

  - xhci: Ensure a command structure points to the correct     trb on the command ring (bnc#848255).

  -     patches.arch/iommu-vt-d-remove-stack-trace-from-broken-i     rq-remapping-warning.patch: Update upstream reference.

  - Allow NFSv4 username mapping to work properly     (bnc#838024).

  - Refresh btrfs attribute publishing patchset to match     openSUSE-13.1 No user-visible changes, but uses     kobj_sysfs_ops and better kobject lifetime management.

  - Fix a few incorrectly checked [io_]remap_pfn_range()     calls (bnc#849021, CVE-2013-4511).

  - drm/radeon: don't set hpd, afmt interrupts when     interrupts are disabled.

  -     patches.fixes/cifs-fill-TRANS2_QUERY_FILE_INFO-ByteCount
    -fields.patch: Fix TRANS2_QUERY_FILE_INFO ByteCount     fields (bnc#804950).

  - iommu: Remove stack trace from broken irq remapping     warning (bnc#844513).

  - Disable patches related to bnc#840656     patches.suse/btrfs-cleanup-don-t-check-the-same-thing-tw     ice     patches.suse/btrfs-0220-fix-for-patch-cleanup-don-t-chec     k-the-same-thi.patch

  - btrfs: use feature attribute names to print better error     messages.

  - btrfs: add ability to change features via sysfs.

  - btrfs: add publishing of unknown features in sysfs.

  - btrfs: publish per-super features to sysfs.

  - btrfs: add per-super attributes to sysfs.

  - btrfs: export supported featured to sysfs.

  - kobject: introduce kobj_completion.

  - btrfs: add ioctls to query/change feature bits online.

  - btrfs: use btrfs_commit_transaction when setting     fslabel.

  - x86/iommu/vt-d: Expand interrupt remapping quirk to     cover x58 chipset (bnc#844513).

  - NFSv4: Fix issues in nfs4_discover_server_trunking     (bnc#811746).

  - iommu/vt-d: add quirk for broken interrupt remapping on     55XX chipsets (bnc#844513).

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002095 advisory.

    The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through     3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-     length write operation.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 3.11.10 stable update contains a number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to 3.0.101 and also includes various other bug and security fixes.

A new feature was added :

  - supported.conf: marked net/netfilter/xt_set as supported     (bnc#851066)(fate#313309) The following security bugs     have been fixed :

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value. (bnc#853050).
    (CVE-2013-4587)

  - The KVM subsystem in the Linux kernel through 3.12.5     allows local users to gain privileges or cause a denial     of service (system crash) via a VAPIC synchronization     operation involving a page-end address. (bnc#853052).
    (CVE-2013-6368)

  - The apic_get_tmcct function in arch/x86/kvm/lapic.c in     the KVM subsystem in the Linux kernel through 3.12.5     allows guest OS users to cause a denial of service     (divide-by-zero error and host OS crash) via crafted     modifications of the TMICT value. (bnc#853051).
    (CVE-2013-6367)

  - Memory leak in the __kvm_set_memory_region function in     virt/kvm/kvm_main.c in the Linux kernel before 3.9     allows local users to cause a denial of service (memory     consumption) by leveraging certain device access to     trigger movement of memory slots. (bnc#851101).
    (CVE-2013-4592)

  - The lbs_debugfs_write function in     drivers/net/wireless/libertas/debugfs.c in the Linux     kernel through 3.12.1 allows local users to cause a     denial of service (OOPS) by leveraging root privileges     for a zero-length write operation. (bnc#852559).
    (CVE-2013-6378)

  - Multiple buffer overflows in     drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel     before 3.12 allow local users to cause a denial of     service or possibly have unspecified other impact by     leveraging the CAP_NET_ADMIN capability and providing a     long station-name string, related to the (1)     wvlan_uil_put_info and (2) wvlan_set_station_nickname     functions. (bnc#849029). (CVE-2013-4514)

  - The bcm_char_ioctl function in     drivers/staging/bcm/Bcmchar.c in the Linux kernel before     3.12 does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO     ioctl call. (bnc#849034). (CVE-2013-4515)

  - The ieee80211_radiotap_iterator_init function in     net/wireless/radiotap.c in the Linux kernel before     3.11.7 does not check whether a frame contains any data     outside of the header, which might allow attackers to     cause a denial of service (buffer over-read) via a     crafted header. (bnc#854634). (CVE-2013-7027)

  - The ipc_rcu_putref function in ipc/util.c in the Linux     kernel before 3.10 does not properly manage a reference     count, which allows local users to cause a denial of     service (memory consumption or system crash) via a     crafted application. (bnc#848321). (CVE-2013-4483)

  - Multiple integer overflows in Alchemy LCD frame-buffer     drivers in the Linux kernel before 3.12 allow local     users to create a read-write memory mapping for the     entirety of kernel memory, and consequently gain     privileges, via crafted mmap operations, related to the     (1) au1100fb_fb_mmap function in     drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap     function in drivers/video/au1200fb.c. (bnc#849021).
    (CVE-2013-4511)

  - The aac_send_raw_srb function in     drivers/scsi/aacraid/commctrl.c in the Linux kernel     through 3.12.1 does not properly validate a certain size     value, which allows local users to cause a denial of     service (invalid pointer dereference) or possibly have     unspecified other impact via an FSACTL_SEND_RAW_SRB     ioctl call that triggers a crafted SRB command.
    (bnc#852373). (CVE-2013-6380)

  - Linux kernel built with the networking     support(CONFIG_NET) is vulnerable to an information     leakage flaw in the socket layer. It could occur while     doing recvmsg(2), recvfrom(2) socket calls. It occurs     due to improperly initialised msg_name &amp; msg_namelen     message header parameters. (bnc#854722). (CVE-2013-6463)

  - The aac_compat_ioctl function in     drivers/scsi/aacraid/linit.c in the Linux kernel before     3.11.8 does not require the CAP_SYS_RAWIO capability,     which allows local users to bypass intended access     restrictions via a crafted ioctl call. (bnc#852558).
    (CVE-2013-6383)

  - Off-by-one error in the get_prng_bytes function in     crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to     defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper     management of the state of the consumed data.
    (bnc#840226). (CVE-2013-4345)

Also the following non-security bugs have been fixed :

  - kabi: protect bind_conflict callback in struct     inet_connection_sock_af_ops. (bnc#823618)

  - printk: forcibly flush nmi ringbuffer if oops is in     progress. (bnc#849675)

  - blktrace: Send BLK_TN_PROCESS events to all running     traces. (bnc#838623)

  - x86/dumpstack: Fix printk_address for direct addresses.
    (bnc#845621)

  - futex: fix handling of read-only-mapped hugepages (VM     Functionality).

  - random: fix accounting race condition with lockless irq     entropy_count update. (bnc#789359)

  - Provide realtime priority kthread and workqueue boot     options. (bnc#836718)

  - sched: Fix several races in CFS_BANDWIDTH. (bnc#848336)

  - sched: Fix cfs_bandwidth misuse of     hrtimer_expires_remaining. (bnc#848336)

  - sched: Fix hrtimer_cancel()/rq->lock deadlock.
    (bnc#848336)

  - sched: Fix race on toggling cfs_bandwidth_used.
    (bnc#848336)

  - sched: Fix buglet in return_cfs_rq_runtime().

  - sched: Guarantee new group-entities always have weight.
    (bnc#848336)

  - sched: Use jump labels to reduce overhead when bandwidth     control is inactive. (bnc#848336)

  - watchdog: Get rid of MODULE_ALIAS_MISCDEV statements.
    (bnc#827767)

  - tcp: bind() fix autoselection to share ports.
    (bnc#823618)

  - tcp: bind() use stronger condition for bind_conflict.
    (bnc#823618)

  - tcp: ipv6: bind() use stronger condition for     bind_conflict. (bnc#823618)

  - macvlan: disable LRO on lower device instead of macvlan.
    (bnc#846984)

  - macvlan: introduce IFF_MACVLAN flag and helper function.
    (bnc#846984)

  - macvlan: introduce macvlan_dev_real_dev() helper     function. (bnc#846984)

  - xen: netback: bump tx queue length. (bnc#849404)

  - xen: xen_spin_kick fixed crash/lock release     (bnc#807434)(bnc#848652).

  - xen: fixed USB passthrough issue. (bnc#852624)

  - netxen: fix off by one bug in     netxen_release_tx_buffer(). (bnc#845729)

  - xfrm: invalidate dst on policy insertion/deletion.
    (bnc#842239)

  - xfrm: prevent ipcomp scratch buffer race condition.
    (bnc#842239)

  - crypto: Fix aes-xts parameter corruption (bnc#854546,     LTC#100718).

  - crypto: gf128mul - fix call to memset() (obvious fix).

  - autofs4: autofs4_wait() vs. autofs4_catatonic_mode()     race. (bnc#851314)

  - autofs4: catatonic_mode vs. notify_daemon race.
    (bnc#851314)

  - autofs4: close the races around autofs4_notify_daemon().
    (bnc#851314)

  - autofs4: deal with autofs4_write/autofs4_write races.
    (bnc#851314)

  - autofs4 - dont clear DCACHE_NEED_AUTOMOUNT on rootless     mount. (bnc#851314)

  - autofs4 - fix deal with autofs4_write races.
    (bnc#851314)

  - autofs4 - use simple_empty() for empty directory check.
    (bnc#851314)

  - blkdev_max_block: make private to fs/buffer.c.
    (bnc#820338)

  - Avoid softlockup in shrink_dcache_for_umount_subtree.
    (bnc#834473)

  - dlm: set zero linger time on sctp socket. (bnc#787843)

  - SUNRPC: Fix a data corruption issue when retransmitting     RPC calls. (bnc#855037)

  - nfs: Change NFSv4 to not recover locks after they are     lost. (bnc#828236)

  - nfs: Adapt readdirplus to application usage patterns.
    (bnc#834708)

  - xfs: Account log unmount transaction correctly.
    (bnc#849950)

  - xfs: improve ioend error handling. (bnc#846036)

  - xfs: reduce ioend latency. (bnc#846036)

  - xfs: use per-filesystem I/O completion workqueues.
    (bnc#846036)

  - xfs: Hide additional entries in struct xfs_mount.
    (bnc#846036 / bnc#848544)

  - vfs: avoid 'attempt to access beyond end of device'     warnings. (bnc#820338)

  - vfs: fix O_DIRECT read past end of block device.
    (bnc#820338)

  - cifs: Improve performance of browsing directories with     several files. (bnc#810323)

  - cifs: Ensure cifs directories do not show up as files.
    (bnc#826602)

  - sd: avoid deadlocks when running under multipath.
    (bnc#818545)

  - sd: fix crash when UA received on DIF enabled device.
    (bnc#841445)

  - sg: fix blk_get_queue usage. (bnc#834808)

  - block: factor out vector mergeable decision to a helper     function. (bnc#769644)

  - block: modify __bio_add_page check to accept pages that     do not start a new segment. (bnc#769644)

  - dm-multipath: abort all requests when failing a path.
    (bnc#798050)

  - scsi: Add 'eh_deadline' to limit SCSI EH runtime.
    (bnc#798050)

  - scsi: Allow error handling timeout to be specified.
    (bnc#798050)

  - scsi: Fixup compilation warning. (bnc#798050)

  - scsi: Retry failfast commands after EH. (bnc#798050)

  - scsi: Warn on invalid command completion. (bnc#798050)

  - scsi: kABI fixes. (bnc#798050)

  - scsi: remove check for 'resetting'. (bnc#798050)

  - advansys: Remove 'last_reset' references. (bnc#798050)

  - cleanup setting task state in scsi_error_handler().
    (bnc#798050)

  - dc395: Move 'last_reset' into internal host structure.
    (bnc#798050)

  - dpt_i2o: Remove DPTI_STATE_IOCTL. (bnc#798050)

  - dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset.
    (bnc#798050)

  - tmscsim: Move 'last_reset' into host structure.
    (bnc#798050)

  - scsi_dh: invoke callback if ->activate is not present.
    (bnc#708296)

  - scsi_dh: return individual errors in scsi_dh_activate().
    (bnc#708296)

  - scsi_dh_alua: Decode EMC Clariion extended inquiry.
    (bnc#708296)

  - scsi_dh_alua: Decode HP EVA array identifier.
    (bnc#708296)

  - scsi_dh_alua: Evaluate state for all port groups.
    (bnc#708296)

  - scsi_dh_alua: Fix missing close brace in     alua_check_sense. (bnc#843642)

  - scsi_dh_alua: Make stpg synchronous. (bnc#708296)

  - scsi_dh_alua: Pass buffer as function argument.
    (bnc#708296)

  - scsi_dh_alua: Re-evaluate port group states after STPG.
    (bnc#708296)

  - scsi_dh_alua: Recheck state on transitioning.
    (bnc#708296)

  - scsi_dh_alua: Rework rtpg workqueue. (bnc#708296)

  - scsi_dh_alua: Use separate alua_port_group structure.
    (bnc#708296)

  - scsi_dh_alua: Allow get_alua_data() to return NULL.
    (bnc#839407)

  - scsi_dh_alua: asynchronous RTPG. (bnc#708296)

  - scsi_dh_alua: correctly terminate target port strings.
    (bnc#708296)

  - scsi_dh_alua: defer I/O while workqueue item is pending.
    (bnc#708296)

  - scsi_dh_alua: Do not attach to RAID or enclosure     devices. (bnc#819979)

  - scsi_dh_alua: Do not attach to well-known LUNs.
    (bnc#821980)

  - scsi_dh_alua: fine-grained locking in alua_rtpg_work().
    (bnc#708296)

  - scsi_dh_alua: invalid state information for 'optimized'     paths. (bnc#843445)

  - scsi_dh_alua: move RTPG to workqueue. (bnc#708296)

  - scsi_dh_alua: move 'expiry' into PG structure.
    (bnc#708296)

  - scsi_dh_alua: move some sense code handling into generic     code. (bnc#813245)

  - scsi_dh_alua: multipath failover fails with error 15.
    (bnc#825696)

  - scsi_dh_alua: parse target device id. (bnc#708296)

  - scsi_dh_alua: protect accesses to struct     alua_port_group. (bnc#708296)

  - scsi_dh_alua: put sense buffer on stack. (bnc#708296)

  - scsi_dh_alua: reattaching device handler fails with     'Error 15'. (bnc#843429)

  - scsi_dh_alua: remove locking when checking state.
    (bnc#708296)

  - scsi_dh_alua: remove stale variable. (bnc#708296)

  - scsi_dh_alua: retry RTPG on UNIT ATTENTION. (bnc#708296)

  - scsi_dh_alua: retry command on 'mode parameter changed'     sense code. (bnc#843645)

  - scsi_dh_alua: simplify alua_check_sense(). (bnc#843642)

  - scsi_dh_alua: simplify state update. (bnc#708296)

  - scsi_dh_alua: use delayed_work. (bnc#708296)

  - scsi_dh_alua: use flag for RTPG extended header.
    (bnc#708296)

  - scsi_dh_alua: use local buffer for VPD inquiry.
    (bnc#708296)

  - scsi_dh_alua: use spin_lock_irqsave for port group.
    (bnc#708296)

  - lpfc: Do not free original IOCB whenever ABTS fails.
    (bnc#806988)

  - lpfc: Fix kernel warning on spinlock usage. (bnc#806988)

  - lpfc: Fixed system panic due to midlayer abort.
    (bnc#806988)

  - qla2xxx: Add module parameter to override the default     request queue size. (bnc#826756)

  - qla2xxx: Module parameter 'ql2xasynclogin'. (bnc#825896)

  - bna: do not register ndo_set_rx_mode callback.
    (bnc#847261)

  - hv: handle more than just WS2008 in KVP negotiation.
    (bnc#850640)

  - drm: do not add inferred modes for monitors that do not     support them. (bnc#849809)

  - pci/quirks: Modify reset method for Chelsio T4.
    (bnc#831168)

  - pci: fix truncation of resource size to 32 bits.
    (bnc#843419)

  - pci: pciehp: Retrieve link speed after link is trained.
    (bnc#820102)

  - pci: Separate pci_bus_read_dev_vendor_id from     pci_scan_device. (bnc#820102)

  - pci: pciehp: replace unconditional sleep with config     space access check. (bnc#820102)

  - pci: pciehp: make check_link_active more helpful.
    (bnc#820102)

  - pci: pciehp: Add pcie_wait_link_not_active().
    (bnc#820102)

  - pci: pciehp: Add Disable/enable link functions.
    (bnc#820102)

  - pci: pciehp: Disable/enable link during slot power     off/on. (bnc#820102)

  - mlx4: allocate just enough pages instead of always 4     pages. (bnc#835186 / bnc#835074)

  - mlx4: allow order-0 memory allocations in RX path.
    (bnc#835186 / bnc#835074)

  - net/mlx4: use one page fragment per incoming frame.
    (bnc#835186 / bnc#835074)

  - qeth: request length checking in snmp ioctl (bnc#849848,     LTC#99511).

  - cio: add message for timeouts on internal I/O     (bnc#837739,LTC#97047).

  - s390/cio: dont abort verification after missing irq     (bnc#837739,LTC#97047).

  - s390/cio: skip broken paths (bnc#837739,LTC#97047).

  - s390/cio: export vpm via sysfs (bnc#837739,LTC#97047).

  - s390/cio: handle unknown pgroup state     (bnc#837739,LTC#97047).

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2929)

A flaw in the handling of memory regions of the kernel virtual machine (KVM) subsystem was discovered. A local user with the ability to assign a device could exploit this flaw to cause a denial of service (memory consumption). (CVE-2013-4592)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

Nico Golde and Fabian Yamaguchi reported a flaw in the driver for Adaptec AACRAID scsi raid devices in the Linux kernel. A local user could use this flaw to cause a denial of service or possibly other unspecified impact. (CVE-2013-6380).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-454:03 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2013-6378     The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through     3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-     length write operation.
    CVE-2014-0203     The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the     last pathname component during use of certain filesystems, which allows local users to cause a denial of     service (incorrect free operations and system crash) via an open system call.
    CVE-2014-1737     The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly     handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger     kfree operations and gain privileges by leveraging write access to a /dev/fd device.
    CVE-2014-1738     The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not     properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows     local users to obtain sensitive information from kernel heap memory by leveraging write access to a     /dev/fd device.
    CVE-2014-1874     The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before     3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN     capability to set a zero-length security context.
    CVE-2014-2039     arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle     attempted use of the linkage stack, which allows local users to cause a denial of service (system crash)     by executing a crafted instruction     CVE-2014-3153     The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls     have two different futex addresses, which allows local users to gain privileges via a crafted     FUTEX_REQUEUE command that facilitates unsafe waiter modification.
    Fixed bugs:
    This update also fixes several bugs.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0771 advisory.

    - [kernel] futex: Make lookup_pi_state more robust (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
    - [kernel] futex: Always cleanup owner tid in unlock_pi (Jerome Marchand) [1104516 1104517]     {CVE-2014-3153}
    - [kernel] futex: Validate atomic acquisition in futex_lock_pi_atomic() (Jerome Marchand) [1104516     1104517] {CVE-2014-3153}
    - [kernel] futex: prevent requeue pi on same futex (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
    - [block] floppy: don't write kernel-only members to FDRAWCMD ioctl output (Denys Vlasenko) [1094308     1094310] {CVE-2014-1738 CVE-2014-1737}
    - [block] floppy: ignore kernel-only members in FDRAWCMD ioctl input (Denys Vlasenko) [1094308 1094310]     {CVE-2014-1738 CVE-2014-1737}
    - [fs] vfs: fix autofs/afs/etc magic mountpoint breakage (Frantisek Hrbata) [1094370 1079347]     {CVE-2014-0203}
    - [char] n_tty: Fix n_tty_write crash when echoing in raw mode (Aristeu Rozanski) [1094236 1094237]     {CVE-2014-0196}
    - [security] selinux: Fix kernel BUG on empty security contexts (Paul Moore) [1062502 1064545]     {CVE-2014-1874}
    - [netdrv] libertas: potential oops in debugfs (Denys Vlasenko) [1034176 1034177] {CVE-2013-6378}
    - [s390] fix kernel crash due to linkage stack instructions (Hendrik Brueckner) [1067678 1067679]     {CVE-2014-2039}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. (CVE-2013-4345)

A flaw was discovered in the Linux kernel's IP Virtual Server (IP_VS) support. A local user with the CAP_NET_ADMIN capability could exploit this flaw to gain additional administrative privileges.
(CVE-2013-4588)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h (CVE-2013-2929).

The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application (CVE-2013-2930).

Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c (CVE-2013-4511).

Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation (CVE-2013-4512).

Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions (CVE-2013-4514).

The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call (CVE-2013-4515).

Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots (CVE-2013-4592).

The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation (CVE-2013-6378).

The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command (CVE-2013-6380).

Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size (CVE-2013-6381).

The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call (CVE-2013-6383).

The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different vulnerability than CVE-2013-4511 (CVE-2013-6763).

The updated packages provides a solution for these security issues.

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote authenticated user could exploit this flaw to obtain sensitive information or modify/corrupt data. (CVE-2013-4299)

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP Fragmentation Offload (UFO). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2013-4470)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

A flaw in the handling of memory regions of the kernel virtual machine (KVM) subsystem was discovered. A local user with the ability to assign a device could exploit this flaw to cause a denial of service (memory consumption). (CVE-2013-4592)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

Evan Huus reported a buffer overflow in the Linux kernel's radiotap header parsing. A remote attacker could cause a denial of service (buffer over- read) via a specially crafted header. (CVE-2013-7027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

* A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-3153, Important)

* A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

* It was discovered that the proc_ns_follow_link() function did not properly return the LAST_BIND value in the last pathname component as is expected for procfs symbolic links, which could lead to excessive freeing of memory and consequent slab corruption. A local, unprivileged user could use this flaw to crash the system.
(CVE-2014-0203, Moderate)

* A flaw was found in the way the Linux kernel handled exceptions when user-space applications attempted to use the linkage stack. On IBM S/390 systems, a local, unprivileged user could use this flaw to crash the system. (CVE-2014-2039, Moderate)

* An invalid pointer dereference flaw was found in the Marvell 8xxx Libertas WLAN (libertas) driver in the Linux kernel. A local user able to write to a file that is provided by the libertas driver and located on the debug file system (debugfs) could use this flaw to crash the system. Note: The debugfs file system must be mounted locally to exploit this issue. It is not mounted by default. (CVE-2013-6378, Low)

* A denial of service flaw was discovered in the way the Linux kernel's SELinux implementation handled files with an empty SELinux security context. A local user who has the CAP_MAC_ADMIN capability could use this flaw to crash the system. (CVE-2014-1874, Low)

The system must be rebooted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
76170	CentOS 6 : kernel (CESA-2014:0771)	Nessus	CentOS Local Security Checks	2014/6/23	2022/5/25	medium
75251	openSUSE Security Update : kernel (openSUSE-SU-2014:0204-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
286435	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002095)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	high
71249	Fedora 19 : kernel-3.11.10-200.fc19 (2013-22669)	Nessus	Fedora Local Security Checks	2013/12/8	2021/1/11	medium
71283	Fedora 18 : kernel-3.11.10-100.fc18 (2013-22695)	Nessus	Fedora Local Security Checks	2013/12/10	2021/1/11	medium
72163	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 8779 / 8791 / 8792)	Nessus	SuSE Local Security Checks	2014/1/28	2021/1/19	high
72325	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 8823 / 8827)	Nessus	SuSE Local Security Checks	2014/2/5	2021/1/19	high
72577	Ubuntu 12.10 : linux vulnerabilities (USN-2114-1)	Nessus	Ubuntu Local Security Checks	2014/2/19	2021/1/19	medium
291494	MiracleLinux 4 : kernel-2.6.32-431.20.3.el6 (AXSA:2014-454:03)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/2/5	high
76155	Oracle Linux 6 : kernel (ELSA-2014-0771)	Nessus	Oracle Linux Local Security Checks	2014/6/20	2026/2/9	high
71791	Ubuntu 10.04 LTS : linux vulnerabilities (USN-2064-1)	Nessus	Ubuntu Local Security Checks	2014/1/5	2021/1/19	medium
71792	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2065-1)	Nessus	Ubuntu Local Security Checks	2014/1/5	2021/1/19	medium
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	high
71511	Mandriva Linux Security Advisory : kernel (MDVSA-2013:291)	Nessus	Mandriva Local Security Checks	2013/12/18	2021/1/6	medium
71793	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2066-1)	Nessus	Ubuntu Local Security Checks	2014/1/5	2021/1/19	medium
76157	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20140619)	Nessus	Scientific Linux Local Security Checks	2014/6/20	2022/5/25	medium

检测

插件搜索

medium

high

high

medium

medium

high

high

medium

high

high

medium

medium

high

medium

medium

medium