According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between     locked instructions and write-combined memory types, which allows local users to cause a denial of service     (system hang) via a crafted application, aka the errata 793 issue. (CVE-2013-6885)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call. (CVE-2022-45887)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error     in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.
    (CVE-2023-31085)

  - A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux     kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
    (CVE-2023-39197)

  - A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function     dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one     holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a     use-after-free issue, potentially leading to a denial of service or privilege escalation. (CVE-2023-39198)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation. When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
    (CVE-2023-4206)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. When u32_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.
    (CVE-2023-4208)

  - A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system. (CVE-2023-42754)

  - A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem. (CVE-2023-4387)

  - A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
    (CVE-2023-4459)

  - An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

  - An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-405:01 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
     CVE-2012-4398     The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain     killable attribute, which allows local users to cause a denial of service (memory consumption) via a     crafted application.
     CVE-2012-6638     The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote     attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a     different vulnerability than CVE-2012-2663.
     CVE-2013-2888     Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the     Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial     of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
     CVE-2013-0343     The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly     handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a     denial of service (excessive retries and address-generation outage), and consequently obtain sensitive     information, via ICMPv6 Router Advertisement (RA) messages.
     CVE-2013-4299      Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows     remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a     snapshot block device.
     CVE-2013-4345      Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper management of the state of the consumed data.
     CVE-2013-4368     The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment     override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain     sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a     segment register.
     CVE-2013-4355      Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain     hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations     related to addresses without associated memory.
     CVE-2013-4494     Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same     order, which allows local guest administrators with access to multiple vcpus to cause a denial of service     (host deadlock) via unspecified vectors.
     CVE-2013-2929     The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users     to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a     crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h.
     CVE-2013-4483      The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a     reference count, which allows local users to cause a denial of service (memory consumption or system     crash) via a crafted application.
     CVE-2013-4554      Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not     properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted     application running in ring 1 or 2.
     CVE-2013-6381     Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel     through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact     via an SNMP ioctl call with a length value that is incompatible with the command-buffer size.
     CVE-2013-6383     The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not     require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via     a crafted ioctl call.
     CVE-2013-6885      The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between     locked instructions and write-combined memory types, which allows local users to cause a denial of service     (system hang) via a crafted application, aka the errata 793 issue.
     CVE-2013-7263     The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data     structures have been initialized, which allows local users to obtain sensitive information from kernel     stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c,     net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.
    Fixed bugs:
     Re-ordered the tasks in the RPC wait queue to fix a race condition between the rpc_wake_up_task() and     rpc_wake_up_status() functions introduced by a recent modification to the sunrpc code.
     Previously, running a background process on a GFS2 file system could trigger a glock recursion error     leading to a kernel panic. This has been fixed and readpage operations do not attempt to take a glock that     was already held any longer.
     Fixed a kernel panic that happened when the kernel dereferenced a NULL pointer; this was due to an     incomplete backport to the IUCV code.
     Previously, GFS2 prevented glock work queues from freeing glock-related memory while the glock memory     shrinker queued a large number of demote requests. Because of this bug, glock work queues became     overloaded and resulted in a high CPU usage rendering GFS2 file systems unresponsive for a while. This has     been partially fixed: this still happens but only on extremely high work loads.
     With the recent addition of the NT LAN Manager Security Support Provider (NTLMSSP) authentication     mechanism, a regression was introduced resulting in the impossibility to mount multiple SMB shares with     different credentials to the same server. This has been fixed.
     The igb driver now uses a a 32-bit mask as expected, instead of the previous 16-bit mask that disrupted     the flow control a network device.
     Previously, when a kernel panic occurred on a system utilizing IPMI without Kdump being set up, it could     trigger a second kernel panic. This has been fixed.
    Enhancement:
     It is now possible to change the 60 seconds timeout for SCSI task management commands within the range     from 5 to 180 seconds: modify the lpfc_task_mgmt_tmo parameter for the lpfc driver.
    The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000974 advisory.

    The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between     locked instructions and write-combined memory types, which allows local users to cause a denial of service     (system hang) via a crafted application, aka the errata 793 issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Xen was updated to fix various bugs and security issues :

Update to Xen version 4.2.4 c/s 26280.

  - bnc#861256 - CVE-2014-1950: xen: XSA-88: use-after-free     in xc_cpupool_getinfo() under memory pressure. (fix     included with update)

  - bnc#863297: xend/pvscsi: recognize also SCSI CDROM     devices

  - bnc#858496 - CVE-2014-1642: Xen: XSA-83: Out-of-memory     condition yielding memory corruption during IRQ setup

  - bnc#860163 - xen: XSA-84: integer overflow in several     XSM/Flask hypercalls (CVE-2014-1891 CVE-2014-1892     CVE-2014-1893 CVE-2014-1894)

  - bnc#860165 - CVE-2014-1895: xen: XSA-85: Off-by-one     error in FLASK_AVC_CACHESTAT hypercall

  - bnc#860300 - CVE-2014-1896: xen: XSA-86: libvchan     failure handling malicious ring indexes

  - bnc#860302 - CVE-2014-1666: xen: XSA-87:
    PHYSDEVOP_(prepare,release)_msix exposed to unprivileged     guests

  - bnc#858311 - Server is not booting in kernel XEN after     latest updates - (XEN) setup 0000:00:18.0 for d0 failed     (-19)

  - bnc#858496 - CVE-2014-1642: Xen: XSA-83: Out-of-memory     condition yielding memory corruption during IRQ setup

  - bnc#853049 - CVE-2013-6885: xen: XSA-82: Guest     triggerable AMD CPU erratum may cause host hang

  - bnc#853048 - CVE-2013-6400: xen: XSA-80: IOMMU TLB     flushing may be inadvertently suppressed

  - bnc#831120 - CVE-2013-2212: xen: XSA-60: Excessive time     to disable caching with HVM guests with PCI passthrough

  - bnc#848014 - [HP HPS] Xen hypervisor panics on 8-blades     nPar with 46-bit memory addressing

  - bnc#833251 - [HP BCS SLES11 Bug]: In HPs UEFI x86_64     platform and with xen environment, in booting stage ,xen     hypervisor will panic.

  - pygrub: Support (/dev/xvda) style disk specifications

  - bnc#849667 - CVE-2014-1895: xen: XSA-74: Lock order     reversal between page_alloc_lock and mm_rwlock

  - bnc#849668 - CVE-2013-4554: xen: XSA-76: Hypercalls     exposed to privilege rings 1 and 2 of HVM guests

  - bnc#842417 - In HPs UEFI x86_64 platform and sles11sp3     with xen environment, dom0 will soft lockup on multiple     blades nPar.

  - bnc#848014 - [HP HPS] Xen hypervisor panics on 8-blades     nPar with 46-bit memory addressing

  - bnc#846849 - Soft lockup with PCI passthrough and many     VCPUs

  - bnc#833483 - Boot Failure with xen kernel in UEFI mode     with error 'No memory for trampoline'

  - bnc#849665 - CVE-2013-4551: xen: XSA-75: Host crash due     to guest VMX instruction execution

  - The upstream version of checking for xend when using the     'xl' command is used is not working.

  - bnc#840997 - It is possible to start a VM twice on the     same node.

  - bnc#848657 - xen: CVE-2013-4494: XSA-73: Lock order     reversal between page allocation and grant table locks

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or information leaks.

  - CVE-2013-6885     It was discovered that under specific circumstances, a     combination of write operations to write-combined memory     and locked CPU instructions may cause a core hang on AMD     16h 00h through 0Fh processors. A local user can use     this flaw to mount a denial of service (system hang) via     a crafted application.

  For more information please refer to the AMD CPU erratum 793 in   http://support.amd.com/TechDocs/51810_16h_00h-0Fh_Rev_Guide.pdf

  - CVE-2014-8133     It was found that the espfix funcionality can be     bypassed by installing a 16-bit RW data segment into GDT     instead of LDT (which espfix checks for) and using it     for stack. A local unprivileged user could potentially     use this flaw to leak kernel stack addresses and thus     allowing to bypass the ASLR protection mechanism.

  - CVE-2014-9419     It was found that on Linux kernels compiled with the 32     bit interfaces (CONFIG_X86_32) a malicious user program     can do a partial ASLR bypass through TLS base addresses     leak when attacking other programs.

  - CVE-2014-9529     It was discovered that the Linux kernel is affected by a     race condition flaw when doing key garbage collection,     allowing local users to cause a denial of service     (memory corruption or panic).

  - CVE-2014-9584     It was found that the Linux kernel does not validate a     length value in the Extensions Reference (ER) System Use     Field, which allows local users to obtain sensitive     information from kernel memory via a crafted iso9660     image.

This Linux kernel security update fixes various security issues and bugs.

The Linux Kernel was updated to fix various security issues and bugs.

Main security issues fixed :

A security issue in the tty layer that was fixed that could be used by local attackers for code execution (CVE-2014-0196).

Two security issues in the floppy driver were fixed that could be used by local attackers on machines with the floppy to crash the kernel or potentially execute code in the kernel (CVE-2014-1737 CVE-2014-1738).

Other security issues and bugfixes :

  - netfilter: nf_nat: fix access to uninitialized buffer in     IRC NAT helper (bnc#860835 CVE-2014-1690).

  - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer     is AUTH (bnc#866102, CVE-2014-0101).

  - [media] ivtv: Fix Oops when no firmware is loaded     (bnc#875440).

  - ALSA: hda - Add dock pin setups for Thinkpad T440     (bnc#876699).

  - ip6tnl: fix double free of fb_tnl_dev on exit     (bnc#876531).

  - Update arm config files: Enable all USB-to-serial     drivers Specifically, enable USB_SERIAL_WISHBONE and     USB_SERIAL_QT2 on all arm flavors.

  - mei: limit the number of consecutive resets     (bnc#821619,bnc#852656).

  - mei: revamp mei reset state machine     (bnc#821619,bnc#852656).

  - mei: use hbm idle state to prevent spurious resets     (bnc#821619).

  - mei: do not run reset flow from the interrupt thread     (bnc#821619,bnc#852656).

  - mei: don't get stuck in select during reset     (bnc#821619).

  - mei: wake also writers on reset (bnc#821619).

  - mei: remove flash_work_queue (bnc#821619,bnc#852656).

  - mei: me: do not load the driver if the FW doesn't     support MEI interface (bnc#821619).

  - Update ec2 config files: Disable CONFIG_CAN CAN support     is disabled everywhere else, so disable it in ec2 too.

  - Refresh Xen patches (bnc#851244).

  - Update arm/exynos config file: disable AHCI_IMX This     driver is only used on Freescale i.MX systems so it     isn't needed on Exynos.

  - drm: Prefer noninterlace cmdline mode unless explicitly     specified (bnc#853350).

  - kabi/severities: add exception for irda. The changes     resulted in a 4x performance increase. Any external     users of this API will also want to rebuild their     modules.

  - i7core_edac: Fix PCI device reference count.

  - KABI: revert tcp: TSO packets automatic sizing.

  - KABI: revert tcp: TSQ can use a dynamic limit.

  - kabi: add exceptions for kvm and l2tp

  -     patches.fixes/sunrpc-add-an-info-file-for-the-dummy-gssd
    -pipe.patch: Move include of utsname.h to where it's     needed to avoid kABI breakage due to utsname becoming     defined.

  - Update kabi files. The kABI references were never     establishd at release.

  - Refresh patches.rpmify/chipidea-clean-up-dependencies     Replace OF_DEVICE by OF (OF_DEVICE does not exist     anymore.)

  - inet: fix addr_len/msg->msg_namelen assignment in     recv_error and rxpmtu functions (bnc#857643     CVE-2013-7263 CVE-2013-7264 CVE-2013-7265).

  - inet: prevent leakage of uninitialized memory to user in     recv syscalls (bnc#857643 CVE-2013-7263 CVE-2013-7264     CVE-2013-7265 CVE-2013-7281).

  - Update config files: re-enable twofish crypto support     Software twofish crypto support was disabled in several     architectures since openSUSE 10.3. For i386 and x86_64     it was on purpose, because hardware-accelerated     alternatives exist. However for all other architectures     it was by accident. Re-enable software twofish crypto     support in arm, ia64 and ppc configuration files, to     guarantee that at least one implementation is always     available (bnc#871325).

  - kvm: optimize away THP checks in kvm_is_mmio_pfn()     (bnc#871160).

  - Update patches.fixes/mm-close-PageTail-race.patch     (bnc#871160).

  - Update     patches.fixes/mm-hugetlbfs-fix-hugetlbfs-optimization.pa     tch (bnc#871160).

  - mm: close PageTail race (bnc#81660).

  - mm: hugetlbfs: fix hugetlbfs optimization (bnc#81660).

  - Update config files: disable CONFIG_TOUCHSCREEN_W90X900     The w90p910_ts driver only makes sense on the W90x900     architecture, which we do not support.

  - ath9k: protect tid->sched check     (bnc#871148,CVE-2014-2672).

  - Update ec2 config files: disable CONFIG_INPUT_FF_MEMLESS     This helper module is useless on EC2.

  - SELinux: Fix kernel BUG on empty security contexts     (bnc#863335,CVE-2014-1874).

  - hamradio/yam: fix info leak in ioctl     (bnc#858872,CVE-2014-1446).

  - netfilter: nf_conntrack_dccp: fix skb_header_pointer API     usages (bnc#868653 CVE-2014-2523).

  - ath9k_htc: properly set MAC address and BSSID mask     (bnc#851426,CVE-2013-4579).

  - drm/ttm: don't oops if no invalidate_caches()     (bnc#869414).

  - Btrfs: do not bug_on if we try to cow a free space cache     inode (bnc#863235).

  - Update vanilla config files: enable console rotation     It's enabled in all other kernel flavors so it should be     enabled in vanilla too.

  - Update config files. (CONFIG_EFIVAR_FS=m) Due to systemd     can auto-load efivarfs.ko, so wet CONFIG_EFIVAR_FS to     module on x86_64.

  - libata, freezer: avoid block device removal while system     is frozen (bnc#849334).

  - Enable CONFIG_IRDA_FAST_RR=y (bnc#860502)

  - [media] bttv: don't setup the controls if there are no     video devices (bnc#861750).

  - drm/i915/dp: add native aux defer retry limit     (bnc#867718).

  - drm/i915/dp: increase native aux defer retry timeout     (bnc#867718).

  - rpc_pipe: fix cleanup of dummy gssd directory when     notification fails (bnc#862746).

  - sunrpc: add an 'info' file for the dummy gssd pipe     (bnc#862746).

  - rpc_pipe: remove the clntXX dir if creating the pipe     fails (bnc#862746).

  - Delete rpm/_constraints after mismerge

Sat Mar 8 00:41:07 CET 2014 - jbohac@suse.cz

  - Refresh     patches.fixes/tcp-syncookies-reduce-cookie-lifetime-to-1     28-seconds.patch.

  - tcp: syncookies: reduce cookie lifetime to 128 seconds     (bnc#833968).

  - tcp: syncookies: reduce mss table to four values     (bnc#833968).

  - rpm/mkspec: Generate a per-architecture per-package
    _constraints file

  - rpm/mkspec: Remove dead code

  - Refresh     patches.fixes/rtc-cmos-add-an-alarm-disable-quirk.patch.

  - rtc-cmos: Add an alarm disable quirk (bnc#812592).

  - Refresh patches.xen/xen-x86-EFI.

  - Refresh     patches.apparmor/apparmor-compatibility-patch-for-v5-net     work-control.
    patches.drivers/pstore_disable_efi_backend_by_default.pa     tch. patches.fixes/dm-table-switch-to-readonly.
    patches.fixes/kvm-ioapic.patch.
    patches.fixes/kvm-macos.patch.
    patches.fixes/remount-no-shrink-dcache.
    patches.fixes/scsi-dh-queuedata-accessors.
    patches.suse/0001-vfs-Hooks-for-more-fine-grained-direct     ory-permission.patch.
    patches.suse/ovl01-vfs-add-i_op-dentry_open.patch.
    patches.suse/sd_init.mark_majors_busy.patch.

  - rpm/mkspec: Fix whitespace in NoSource lines

  - rpm/kernel-binary.spec.in: Do not zero modules.dep     before using it (bnc#866075)

  - rpm/kernel-obs-build.spec: Drop useless ExclusiveArch     statement

  - Update config files. Set CONFIG_EFIVAR_FS to build-in     for MOK support Update config files. Set     CONFIG_EFIVAR_FS to build-in for MOK support

  - nfs: always make sure page is up-to-date before     extending a write to cover the entire page (bnc#864867     bnc#865075).

  - x86, cpu, amd: Add workaround for family 16h, erratum     793 (bnc#852967 CVE-2013-6885).

  - Refresh patches.xen/xen3-patch-3.10.

  - cifs: ensure that uncached writes handle unmapped areas     correctly (bnc#864025 CVE-2014-0069).

  - x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround     (bnc#858638 CVE-2014-1438).

  - rpm/kernel-obs-build.spec: Do not mount /sys, the build     script does it

  - Update config files: Disable TS5500-specific drivers     These drivers are useless without TS5500 board support:
    mtd-ts5500, gpio-ts5500 and max197.

  - balloon: don't crash in HVM-with-PoD guests.

  - usbback: fix after c/s 1232:8806dfb939d4 (bnc#842553).

  - hwmon: (coretemp) Fix truncated name of alarm     attributes.

  - rpm/kernel-obs-build.spec: Fix for ppc64le

  - Scripts: .nosrc.rpm should contain only the specfile     (bnc #639379)

  - config: update arm7hl/exynos

  - Enhances exynos support :

  - Add USB support

  - Add sound support

  - Add devices (accelerometer, etc.) on arndale board

  - drm/cirrus: Fix cirrus drm driver for fbdev + qemu     (bnc#856760).

  - Spec: zeroing modules.dep to get identical builds among     different machines

  - doc/README.SUSE: Update to match the current package     layout

  - Add the README.SUSE file to the packaging branch

  - lockd: send correct lock when granting a delayed lock     (bnc#859342).

  - mm/page-writeback.c: do not count anon pages as     dirtyable memory (reclaim stalls).

  - mm/page-writeback.c: fix dirty_balance_reserve     subtraction from dirtyable memory (reclaim stalls).

The SUSE Linux Enterprise Server 11 Service Pack 1 LTSS Xen hypervisor and toolset have been updated to fix various security issues and some bugs.

The following security issues have been addressed :

XSA-84: CVE-2014-1894: Xen 3.2 (and presumably earlier) exhibit both problems with the overflow issue being present for more than just the suboperations listed above. (bnc#860163)

XSA-84: CVE-2014-1892 CVE-2014-1893: Xen 3.3 through 4.1, while not affected by the above overflow, have a different overflow issue on FLASK_{GET,SET}BOOL and expose unreasonably large memory allocation to arbitrary guests.
(bnc#860163)

XSA-84: CVE-2014-1891: The FLASK_{GET,SET}BOOL, FLASK_USER and FLASK_CONTEXT_TO_SID suboperations of the flask hypercall are vulnerable to an integer overflow on the input size. The hypercalls attempt to allocate a buffer which is 1 larger than this size and is therefore vulnerable to integer overflow and an attempt to allocate then access a zero byte buffer. (bnc#860163)

XSA-82: CVE-2013-6885: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#853049)

XSA-76: CVE-2013-4554: Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2. (bnc#849668)

XSA-74: CVE-2013-4553: The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock). (bnc#849667)

XSA-73: CVE-2013-4494: Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors. (bnc#848657)

XSA-67: CVE-2013-4368: The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS:
segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register. (bnc#842511)

XSA-66: CVE-2013-4361: The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction. (bnc#841766)

XSA-63: CVE-2013-4355: Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.
(bnc#840592)

XSA-62: CVE-2013-1442: Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers. (bnc#839596)

XSA-61: CVE-2013-4329: The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction. (bnc#839618)

XSA-60: CVE-2013-2212: The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling chaches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range. (bnc#831120)

XSA-58: CVE-2013-1918: Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to 'deep page table traversal.' (bnc#826882)

XSA-58: CVE-2013-1432: Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possible gain privileges via unspecified vectors. (bnc#826882)

XSA-57: CVE-2013-2211: The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
(bnc#823608)

XSA-56: CVE-2013-2072: Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap. (bnc#819416)

XSA-55: CVE-2013-2196: Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'other problems' that are not CVE-2013-2194 or CVE-2013-2195. (bnc#823011)

XSA-55: CVE-2013-2195: The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'pointer dereferences' involving unexpected calculations. (bnc#823011)

XSA-55: CVE-2013-2194: Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel. (bnc#823011)

XSA-53: CVE-2013-2077: Xen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows local PV guest users to cause a denial of service (unhandled exception and hypervisor crash) via unspecified vectors.
(bnc#820919)

XSA-52: CVE-2013-2076: Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels. (bnc#820917)

XSA-50: CVE-2013-1964: Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possible have other impacts via unspecified vectors. (bnc#816156)

XSA-49: CVE-2013-1952: Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors. (bnc#816163)

XSA-47: CVE-2013-1920: Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running 'under memory pressure' and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors. (bnc#813677)

XSA-46: CVE-2013-1919: Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to 'passed-through IRQs or PCI devices.' (bnc#813675)

XSA-45: CVE-2013-1918: Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to 'deep page table traversal.' (bnc#816159)

XSA-44: CVE-2013-1917: Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction. (bnc#813673)

XSA-41: CVE-2012-6075: Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet. (bnc#797523)

XSA-37: CVE-2013-0154: The get_page_type function in xen/arch/x86/mm.c in Xen 4.2, when debugging is enabled, allows local PV or HVM guest administrators to cause a denial of service (assertion failure and hypervisor crash) via unspecified vectors related to a hypercall. (bnc#797031)

XSA-36: CVE-2013-0153: The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests.
(bnc#800275)

XSA-33: CVE-2012-5634: Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behind a legacy PCI Bridge, which allows local guests to cause a denial of service to other guests by injecting an interrupt.
(bnc#794316)

XSA-31: CVE-2012-5515: The (1) XENMEM_decrease_reservation, (2) XENMEM_populate_physmap, and (3) XENMEM_exchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service (long loop and hang) via a crafted extent_order value. (bnc#789950)

XSA-30: CVE-2012-5514: The guest_physmap_mark_populate_on_demand function in Xen 4.2 and earlier does not properly unlock the subject GFNs when checking if they are in use, which allows local guest HVM administrators to cause a denial of service (hang) via unspecified vectors. (bnc#789948)

XSA-29: CVE-2012-5513: The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range. (bnc#789951)

XSA-27: CVE-2012-6333: Multiple HVM control operations in Xen 3.4 through 4.2 allow local HVM guest OS administrators to cause a denial of service (physical CPU consumption) via a large input. (bnc#789944)

XSA-27: CVE-2012-5511: Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen 3.4 through 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) via a large bitmap image.
(bnc#789944)

XSA-26: CVE-2012-5510: Xen 4.x, when downgrading the grant table version, does not properly remove the status page from the tracking list when freeing the page, which allows local guest OS administrators to cause a denial of service (hypervisor crash) via unspecified vectors. (bnc#789945)

XSA-25: CVE-2012-4544: The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
(bnc#787163)

XSA-24: CVE-2012-4539: Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service (infinite loop and hang or crash) via invalid arguments to GNTTABOP_get_status_frames, aka 'Grant table hypercall infinite loop DoS vulnerability.' (bnc#786520)

XSA-23: CVE-2012-4538: The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors. (bnc#786519)

XSA-22: CVE-2012-4537: Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka 'Memory mapping failure DoS vulnerability.' (bnc#786517)

XSA-20: CVE-2012-4535: Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an 'inappropriate deadline.' (bnc#786516)

XSA-19: CVE-2012-4411: The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qemu monitor.
NOTE: this might be a duplicate of CVE-2007-0998.
(bnc#779212)

XSA-15: CVE-2012-3497: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id. (bnc#777890)

Also the following non-security bugs have been fixed :

  - xen hot plug attach/detach fails modified     blktap-pv-cdrom.patch. (bnc#805094)

  - guest 'disappears' after live migration Updated     block-dmmd script. (bnc#777628)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2014:0285 :

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A buffer overflow flaw was found in the way the qeth_snmp_command() function in the Linux kernel's QETH network device driver implementation handled SNMP IOCTL requests with an out-of-bounds length. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.
(CVE-2013-6381, Important)

* A flaw was found in the way the ipc_rcu_putref() function in the Linux kernel's IPC implementation handled reference counter decrementing. A local, unprivileged user could use this flaw to trigger an Out of Memory (OOM) condition and, potentially, crash the system. (CVE-2013-4483, Moderate)

* It was found that the Xen hypervisor implementation did not correctly check privileges of hypercall attempts made by HVM guests, allowing hypercalls to be invoked from protection rings 1 and 2 in addition to ring 0. A local attacker in an HVM guest able to execute code on privilege levels 1 and 2 could potentially use this flaw to further escalate their privileges in that guest. Note: Xen HVM guests running unmodified versions of Red Hat Enterprise Linux and Microsoft Windows are not affected by this issue because they are known to only use protection rings 0 (kernel) and 3 (userspace). (CVE-2013-4554, Moderate)

* A flaw was found in the way the Linux kernel's Adaptec RAID controller (aacraid) checked permissions of compat IOCTLs. A local attacker could use this flaw to bypass intended security restrictions.
(CVE-2013-6383, Moderate)

* It was found that, under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang on certain AMD CPUs (for more information, refer to AMD CPU erratum 793 linked in the References section). A privileged user in a guest running under the Xen hypervisor could use this flaw to cause a denial of service on the host system. This update adds a workaround to the Xen hypervisor implementation, which mitigates the AMD CPU issue. Note: this issue only affects AMD Family 16h Models 00h-0Fh Processors. Non-AMD CPUs are not vulnerable. (CVE-2013-6885, Moderate)

* It was found that certain protocol handlers in the Linux kernel's networking implementation could set the addr_len value without initializing the associated data structure. A local, unprivileged user could use this flaw to leak kernel stack memory to user space using the recvmsg, recvfrom, and recvmmsg system calls. (CVE-2013-7263, Low)

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low)

Red Hat would like to thank Vladimir Davydov of Parallels for reporting CVE-2013-4483 and the Xen project for reporting CVE-2013-4554 and CVE-2013-6885. Upstream acknowledges Jan Beulich as the original reporter of CVE-2013-4554 and CVE-2013-6885.

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0285 advisory.

    - [ipc] change refcount to atomic_t (Phillip Lougher) [1024866 1024868] {CVE-2013-4483}
    - [s390] qeth: buffer overflow in snmp ioctl (Jacob Tanenbaum) [1034402 1034404] {CVE-2013-6381}
    - [scsi] AACRAID Driver compat IOCTL missing capability check (Jacob Tanenbaum) [1033531 1033532]     {CVE-2013-6383}
    - [xen] x86/AMD: work around erratum 793 (Radim Krcmar) [1035834 1035836] {CVE-2013-6885}
    - [xen] do not expose hypercalls to rings 1 and 2 of HVM guests (Andrew Jones) [1029112 1029113]     {CVE-2013-4554}
    - [net] ipv6: fix leaking uninit port number of offender sockaddr (Florian Westphal) [1035880 1035881]     {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
    - [net] fix addr_len/msg->msg_namelen assign in recv_error funcs (Florian Westphal) [1035880 1035881]     {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
    - [net] prevent leakage of uninitialized memory to user in recv (Florian Westphal) [1035880 1035881]     {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
    - [fs] exec/ptrace: fix get_dumpable() incorrect tests (Petr Oros) [1039483 1039484] {CVE-2013-2929}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Xen was updated to fix security issues and bugs.

Update to bug fix release Xen 4.3.2 c/s 27404

  - CVE-2013-6885: xen: XSA-82: A guest triggerable AMD CPU     erratum may cause host hangs.

  - CVE-2013-6400: xen: XSA-80: IOMMU TLB flushing may be     inadvertently suppressed, potentially leaking     information to other guests.

  - CVE-2013-2212: xen: XSA-60: Excessive time to disable     caching with HVM guests with PCI passthrough

  - pygrub: Support (/dev/xvda) style disk specifications

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/AMD: work around erratum 793 The recommendation is     to set a bit in an MSR - do this if the firmware didn't,     considering that otherwise we expose ourselves to a     guest induced DoS. This is CVE-2013-6885 / XSA-82.
    (CVE-2013-6885)

This update fixes the CVEs described below.

A further issue, CVE-2014-9419, was considered, but appears to require extensive changes with a consequent high risk of regression. It is now unlikely to be fixed in squeeze-lts.

CVE-2013-6885

It was discovered that under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang on AMD 16h 00h through 0Fh processors. A local user can use this flaw to mount a denial of service (system hang) via a crafted application.

For more information please refer to the AMD CPU erratum 793 in http://support.amd.com/TechDocs/51810_16h_00h-0Fh_Rev_Guide.
pdf

CVE-2014-7822

It was found that the splice() system call did not validate the given file offset and length. A local unprivileged user can use this flaw to cause filesystem corruption on ext4 filesystems, or possibly other effects.

CVE-2014-8133

It was found that the espfix functionality can be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks for) and using it for stack. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8134

It was found that the espfix functionality is wrongly disabled in a 32-bit KVM guest. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8160

It was found that a netfilter (iptables or ip6tables) rule accepting packets to a specific SCTP, DCCP, GRE or UDPlite port/endpoint could result in incorrect connection tracking state. If only the generic connection tracking module (nf_conntrack) was loaded, and not the protocol-specific connection tracking module, this would allow access to any port/endpoint of the specified protocol.

CVE-2014-9420

It was found that the ISO-9660 filesystem implementation (isofs) follows arbitrarily long chains, including loops, of Continuation Entries (CEs). This allows local users to mount a denial of service via a crafted disc image.

CVE-2014-9584

It was found that the ISO-9660 filesystem implementation (isofs) does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted disc image.

CVE-2014-9585

It was discovered that address randomisation for the vDSO in 64-bit processes is extremely biassed. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

CVE-2015-1421

It was found that the SCTP implementation could free authentication state while it was still in use, resulting in heap corruption. This could allow remote users to cause a denial of service or privilege escalation.

CVE-2015-1593

It was found that address randomisation for the initial stack in 64-bit processes was limited to 20 rather than 22 bits of entropy. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS Xen hypervisor and toolset have been updated to fix various security issues.

The following security issues have been addressed :

  - XSA-82: CVE-2013-6885: The microcode on AMD 16h 00h     through 0Fh processors does not properly handle the     interaction between locked instructions and     write-combined memory types, which allows local users to     cause a denial of service (system hang) via a crafted     application, aka the errata 793 issue. (bnc#853049)

  - XSA-76: CVE-2013-4554: Xen 3.0.3 through 4.1.x (possibly     4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly     4.3.1) does not properly prevent access to hypercalls,     which allows local guest users to gain privileges via a     crafted application running in ring 1 or 2. (bnc#849668)

  - XSA-73: CVE-2013-4494: Xen before 4.1.x, 4.2.x, and     4.3.x does not take the page_alloc_lock and     grant_table.lock in the same order, which allows local     guest administrators with access to multiple vcpus to     cause a denial of service (host deadlock) via     unspecified vectors. (bnc#848657)

  - XSA-67: CVE-2013-4368: The outs instruction emulation in     Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or     GS: segment override, uses an uninitialized variable as     a segment base, which allows local 64-bit PV guests to     obtain sensitive information (hypervisor stack content)     via unspecified vectors related to stale data in a     segment register. (bnc#842511)

  - XSA-63: CVE-2013-4355: Xen 4.3.x and earlier does not     properly handle certain errors, which allows local HVM     guests to obtain hypervisor stack memory via a (1) port     or (2) memory mapped I/O write or (3) other unspecified     operations related to addresses without associated     memory. (bnc#840592)

  - XSA-55: CVE-2013-2196: Multiple unspecified     vulnerabilities in the Elf parser (libelf) in Xen 4.2.x     and earlier allow local guest administrators with     certain permissions to have an unspecified impact via a     crafted kernel, related to 'other problems' that are not     CVE-2013-2194 or CVE-2013-2195. (bnc#823011)

  - XSA-55: CVE-2013-2195: The Elf parser (libelf) in Xen     4.2.x and earlier allow local guest administrators with     certain permissions to have an unspecified impact via a     crafted kernel, related to 'pointer dereferences'     involving unexpected calculations. (bnc#823011)

  - XSA-55: CVE-2013-2194: Multiple integer overflows in the     Elf parser (libelf) in Xen 4.2.x and earlier allow local     guest administrators with certain permissions to have an     unspecified impact via a crafted kernel. (bnc#823011)

  - XSA-47: CVE-2013-1920: Xen 4.2.x, 4.1.x, and earlier,     when the hypervisor is running 'under memory pressure'     and the Xen Security Module (XSM) is enabled, uses the     wrong ordering of operations when extending the     per-domain event channel tracking table, which causes a     use-after-free and allows local guest kernels to inject     arbitrary events and gain privileges via unspecified     vectors. (bnc#813677)

  - XSA-44: CVE-2013-1917: Xen 3.1 through 4.x, when running     64-bit hosts on Intel CPUs, does not clear the NT flag     when using an IRET after a SYSENTER instruction, which     allows PV guest users to cause a denial of service     (hypervisor crash) by triggering a #GP fault, which is     not properly handled by another IRET instruction.
    (bnc#813673)

  - XSA-25: CVE-2012-4544: The PV domain builder in Xen 4.2     and earlier does not validate the size of the kernel or     ramdisk (1) before or (2) after decompression, which     allows local guest administrators to cause a denial of     service (domain 0 memory consumption) via a crafted (a)     kernel or (b) ramdisk. (bnc#787163)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 10 Service Pack 3 LTSS Xen hypervisor and toolset have been updated to fix various security issues :

The following security issues have been addressed :

XSA-20: CVE-2012-4535: Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an 'inappropriate deadline'. (bnc#786516)

XSA-22: CVE-2012-4537: Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka 'Memory mapping failure DoS vulnerability'. (bnc#786517)

XSA-25: CVE-2012-4544: The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
(bnc#787163)

XSA-29: CVE-2012-5513: The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range. (bnc#789951)

XSA-31: CVE-2012-5515: The (1) XENMEM_decrease_reservation, (2) XENMEM_populate_physmap, and (3) XENMEM_exchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service (long loop and hang) via a crafted extent_order value. (bnc#789950)

XSA-44: CVE-2013-1917: Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction. (bnc#813673)

XSA-47: CVE-2013-1920: Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running 'under memory pressure' and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors. (bnc#813677)

XSA-55: CVE-2013-2196: Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'other problems' that are not CVE-2013-2194 or CVE-2013-2195. (bnc#823011)

XSA-55: CVE-2013-2195: The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to 'pointer dereferences' involving unexpected calculations. (bnc#823011)

XSA-55: CVE-2013-2194: Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel. (bnc#823011)

XSA-63: CVE-2013-4355: Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.
(bnc#840592)

XSA-67: CVE-2013-4368: The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS:
segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register. (bnc#842511)

XSA-73: CVE-2013-4494: Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors. (bnc#848657)

XSA-76: CVE-2013-4554: Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2. (bnc#849668)

XSA-82: CVE-2013-6885: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#853049)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Vulnerability Summary for CVE-2023-39197(CVE-2023-39197)

    A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function     dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one     holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a     use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.(CVE-2023-45871)

    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write.(CVE-2023-45863)

    An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.(CVE-2023-45862)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure.(CVE-2023-39192)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure.(CVE-2023-39193)

    A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system.(CVE-2023-42754)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue().We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8.(CVE-2023-4921)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.When u32_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.(CVE-2023-4208)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free.We recommend upgrading past commit     b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.(CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.(CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free.We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f.(CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free.We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.(CVE-2023-4622)

    In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel(CVE-2021-39633)

    The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between     locked instructions and write-combined memory types, which allows local users to cause a denial of service     (system hang) via a crafted application, aka the errata 793 issue.(CVE-2013-6885)

    Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network     access.(CVE-2023-25775)

    A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during     cleanup.(CVE-2023-4459)

    A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem.(CVE-2023-4387)

    Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207,     CVE-2023-4208.  Reason: This record is a duplicate of CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Notes:
    All CVE users should reference CVE-2023-4206, CVE-2023-4207, CVE-2023-4208 instead of this record. All     references and descriptions in this record have been removed to prevent accidental usage.(CVE-2023-4128)

    An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error     in do_div(sz,mtd-erasesize), used indirectly by ctrl_cdev_ioctl, when mtd-erasesize is     0.(CVE-2023-31085)

    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
    We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.(CVE-2023-1829)

    An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-     free because of a vcc_recvmsg race condition.(CVE-2023-51780)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b.(CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1.(CVE-2023-6932)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer     (dmesg).(CVE-2023-6121)

    An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access.(CVE-2023-6040)

    Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0(CVE-2021-33631)

    A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system.(CVE-2023-6546)

    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel     information.(CVE-2023-6606)

    A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow.(CVE-2023-7192)

    A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file.(CVE-2024-0340)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux Kernel was updated to fix various security issues and bugs.

Main security issues fixed :

A security issue in the tty layer that was fixed that could be used by local attackers for code execution (CVE-2014-0196).

Two security issues in the floppy driver were fixed that could be used by local attackers on machines with the floppy to crash the kernel or potentially execute code in the kernel (CVE-2014-1737 CVE-2014-1738).

Other security issues and bugs that were fixed :

  - netfilter: nf_nat: fix access to uninitialized buffer in     IRC NAT helper (bnc#860835 CVE-2014-1690).

  - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer     is AUTH (bnc#866102, CVE-2014-0101).

  - n_tty: Fix a n_tty_write crash and code execution when     echoing in raw mode (bnc#871252 bnc#875690     CVE-2014-0196).

  - netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones     (bnc#873717).

  - Update config files: re-enable twofish crypto support     Software twofish crypto support was disabled in several     architectures since openSUSE 10.3. For i386 and x86_64     it was on purpose, because hardware-accelerated     alternatives exist. However for all other architectures     it was by accident. Re-enable software twofish crypto     support in arm, ia64 and ppc configuration files, to     guarantee that at least one implementation is always     available (bnc#871325).

  - Update config files: disable CONFIG_TOUCHSCREEN_W90X900     The w90p910_ts driver only makes sense on the W90x900     architecture, which we do not support.

  - ath9k: protect tid->sched check     (bnc#871148,CVE-2014-2672).

  - Fix dst_neigh_lookup/dst_neigh_lookup_skb return value     handling bug (bnc#869898).

  - SELinux: Fix kernel BUG on empty security contexts     (bnc#863335,CVE-2014-1874).

  - hamradio/yam: fix info leak in ioctl (bnc#858872,     CVE-2014-1446).

  - wanxl: fix info leak in ioctl (bnc#858870,     CVE-2014-1445).

  - farsync: fix info leak in ioctl (bnc#858869,     CVE-2014-1444).

  - ARM: 7809/1: perf: fix event validation for software     group leaders (CVE-2013-4254, bnc#837111).

  - netfilter: nf_conntrack_dccp: fix skb_header_pointer API     usages (bnc#868653, CVE-2014-2523).

  - ath9k_htc: properly set MAC address and BSSID mask     (bnc#851426, CVE-2013-4579).

  - drm/ttm: don't oops if no invalidate_caches()     (bnc#869414).

  - Apply missing     patches.fixes/drm-nouveau-hwmon-rename-fan0-to-fan1.patc     h

  - xfs: growfs: use uncached buffers for new headers     (bnc#858233).

  - xfs: use btree block initialisation functions in growfs     (bnc#858233).

  - Revert 'Delete     patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond
    -the-filesystem-end.' (bnc#858233) Put back again the     patch     patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond
    -the-filesystem-end back as there is a better fix than     reverting the affecting patch.

  - Delete     patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond
    -the-filesystem-end. It turned out that this patch     causes regressions (bnc#858233) The upstream 3.7.x also     reverted it in the end (commit c3793e0d94af2).

  - tcp: syncookies: reduce cookie lifetime to 128 seconds     (bnc#833968).

  - tcp: syncookies: reduce mss table to four values     (bnc#833968).

  - x86, cpu, amd: Add workaround for family 16h, erratum     793 (bnc#852967 CVE-2013-6885).

  - cifs: ensure that uncached writes handle unmapped areas     correctly (bnc#864025 CVE-2014-0691).

  - x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround     (bnc#858638 CVE-2014-1438).

  - xencons: generalize use of add_preferred_console()     (bnc#733022, bnc#852652).

  - balloon: don't crash in HVM-with-PoD guests.

  - hwmon: (coretemp) Fix truncated name of alarm     attributes.

  - NFS: Avoid PUTROOTFH when managing leases (bnc#811746).

  - cifs: delay super block destruction until all     cifsFileInfo objects are gone (bnc#862145).

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
190301	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2024-1144)	Nessus	Huawei Local Security Checks	2024/2/8	2024/2/8	critical
289145	MiracleLinux 3 : kernel-2.6.18-371.3.AXS3 (AXSA:2014-405:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/19	medium
290397	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000974)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
75312	openSUSE Security Update : xen (openSUSE-SU-2014:0483-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
80558	Debian DSA-3128-1 : linux - security update	Nessus	Debian Local Security Checks	2015/1/16	2021/1/11	high
75363	openSUSE Security Update : kernel (openSUSE-SU-2014:0678-1)	Nessus	SuSE Local Security Checks	2014/6/13	2023/5/14	critical
83616	SUSE SLES11 Security Update : Xen (SUSE-SU-2014:0446-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
73006	Oracle Linux 5 : kernel (ELSA-2014-0285-1)	Nessus	Oracle Linux Local Security Checks	2014/3/14	2021/1/14	medium
73007	Oracle Linux 5 : kernel (ELSA-2014-0285)	Nessus	Oracle Linux Local Security Checks	2014/3/14	2026/2/9	medium
75313	openSUSE Security Update : xen (openSUSE-SU-2014:0482-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
79527	OracleVM 3.1 : xen (OVMSA-2013-0091)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	medium
82138	Debian DLA-155-1 : linux-2.6 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	critical
83614	SUSE SLES10 Security Update : Xen (SUSE-SU-2014:0411-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium
83617	SUSE SLES10 Security Update : Xen (SUSE-SU-2014:0470-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium
197274	EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2024-1672)	Nessus	Huawei Local Security Checks	2024/5/17	2025/9/29	critical
75364	openSUSE Security Update : kernel (openSUSE-SU-2014:0677-1)	Nessus	SuSE Local Security Checks	2014/6/13	2023/5/14	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/4/3	2025/12/26	critical

检测

插件搜索

critical

medium

medium

high

high

critical

high

medium

medium

medium

medium

critical

medium

medium

critical

high

critical