A flaw was discovered in the Linux kernel's handling of SCTP handshake. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2014-0101)

An error was discovered in the Linux kernel's DCCP protocol support. A remote attacked could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2014-2523).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Linux kernel security update fixes various security issues and bugs.

The Linux Kernel was updated to fix various security issues and bugs.

Main security issues fixed :

A security issue in the tty layer that was fixed that could be used by local attackers for code execution (CVE-2014-0196).

Two security issues in the floppy driver were fixed that could be used by local attackers on machines with the floppy to crash the kernel or potentially execute code in the kernel (CVE-2014-1737 CVE-2014-1738).

Other security issues and bugfixes :

  - netfilter: nf_nat: fix access to uninitialized buffer in     IRC NAT helper (bnc#860835 CVE-2014-1690).

  - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer     is AUTH (bnc#866102, CVE-2014-0101).

  - [media] ivtv: Fix Oops when no firmware is loaded     (bnc#875440).

  - ALSA: hda - Add dock pin setups for Thinkpad T440     (bnc#876699).

  - ip6tnl: fix double free of fb_tnl_dev on exit     (bnc#876531).

  - Update arm config files: Enable all USB-to-serial     drivers Specifically, enable USB_SERIAL_WISHBONE and     USB_SERIAL_QT2 on all arm flavors.

  - mei: limit the number of consecutive resets     (bnc#821619,bnc#852656).

  - mei: revamp mei reset state machine     (bnc#821619,bnc#852656).

  - mei: use hbm idle state to prevent spurious resets     (bnc#821619).

  - mei: do not run reset flow from the interrupt thread     (bnc#821619,bnc#852656).

  - mei: don't get stuck in select during reset     (bnc#821619).

  - mei: wake also writers on reset (bnc#821619).

  - mei: remove flash_work_queue (bnc#821619,bnc#852656).

  - mei: me: do not load the driver if the FW doesn't     support MEI interface (bnc#821619).

  - Update ec2 config files: Disable CONFIG_CAN CAN support     is disabled everywhere else, so disable it in ec2 too.

  - Refresh Xen patches (bnc#851244).

  - Update arm/exynos config file: disable AHCI_IMX This     driver is only used on Freescale i.MX systems so it     isn't needed on Exynos.

  - drm: Prefer noninterlace cmdline mode unless explicitly     specified (bnc#853350).

  - kabi/severities: add exception for irda. The changes     resulted in a 4x performance increase. Any external     users of this API will also want to rebuild their     modules.

  - i7core_edac: Fix PCI device reference count.

  - KABI: revert tcp: TSO packets automatic sizing.

  - KABI: revert tcp: TSQ can use a dynamic limit.

  - kabi: add exceptions for kvm and l2tp

  -     patches.fixes/sunrpc-add-an-info-file-for-the-dummy-gssd
    -pipe.patch: Move include of utsname.h to where it's     needed to avoid kABI breakage due to utsname becoming     defined.

  - Update kabi files. The kABI references were never     establishd at release.

  - Refresh patches.rpmify/chipidea-clean-up-dependencies     Replace OF_DEVICE by OF (OF_DEVICE does not exist     anymore.)

  - inet: fix addr_len/msg->msg_namelen assignment in     recv_error and rxpmtu functions (bnc#857643     CVE-2013-7263 CVE-2013-7264 CVE-2013-7265).

  - inet: prevent leakage of uninitialized memory to user in     recv syscalls (bnc#857643 CVE-2013-7263 CVE-2013-7264     CVE-2013-7265 CVE-2013-7281).

  - Update config files: re-enable twofish crypto support     Software twofish crypto support was disabled in several     architectures since openSUSE 10.3. For i386 and x86_64     it was on purpose, because hardware-accelerated     alternatives exist. However for all other architectures     it was by accident. Re-enable software twofish crypto     support in arm, ia64 and ppc configuration files, to     guarantee that at least one implementation is always     available (bnc#871325).

  - kvm: optimize away THP checks in kvm_is_mmio_pfn()     (bnc#871160).

  - Update patches.fixes/mm-close-PageTail-race.patch     (bnc#871160).

  - Update     patches.fixes/mm-hugetlbfs-fix-hugetlbfs-optimization.pa     tch (bnc#871160).

  - mm: close PageTail race (bnc#81660).

  - mm: hugetlbfs: fix hugetlbfs optimization (bnc#81660).

  - Update config files: disable CONFIG_TOUCHSCREEN_W90X900     The w90p910_ts driver only makes sense on the W90x900     architecture, which we do not support.

  - ath9k: protect tid->sched check     (bnc#871148,CVE-2014-2672).

  - Update ec2 config files: disable CONFIG_INPUT_FF_MEMLESS     This helper module is useless on EC2.

  - SELinux: Fix kernel BUG on empty security contexts     (bnc#863335,CVE-2014-1874).

  - hamradio/yam: fix info leak in ioctl     (bnc#858872,CVE-2014-1446).

  - netfilter: nf_conntrack_dccp: fix skb_header_pointer API     usages (bnc#868653 CVE-2014-2523).

  - ath9k_htc: properly set MAC address and BSSID mask     (bnc#851426,CVE-2013-4579).

  - drm/ttm: don't oops if no invalidate_caches()     (bnc#869414).

  - Btrfs: do not bug_on if we try to cow a free space cache     inode (bnc#863235).

  - Update vanilla config files: enable console rotation     It's enabled in all other kernel flavors so it should be     enabled in vanilla too.

  - Update config files. (CONFIG_EFIVAR_FS=m) Due to systemd     can auto-load efivarfs.ko, so wet CONFIG_EFIVAR_FS to     module on x86_64.

  - libata, freezer: avoid block device removal while system     is frozen (bnc#849334).

  - Enable CONFIG_IRDA_FAST_RR=y (bnc#860502)

  - [media] bttv: don't setup the controls if there are no     video devices (bnc#861750).

  - drm/i915/dp: add native aux defer retry limit     (bnc#867718).

  - drm/i915/dp: increase native aux defer retry timeout     (bnc#867718).

  - rpc_pipe: fix cleanup of dummy gssd directory when     notification fails (bnc#862746).

  - sunrpc: add an 'info' file for the dummy gssd pipe     (bnc#862746).

  - rpc_pipe: remove the clntXX dir if creating the pipe     fails (bnc#862746).

  - Delete rpm/_constraints after mismerge

Sat Mar 8 00:41:07 CET 2014 - jbohac@suse.cz

  - Refresh     patches.fixes/tcp-syncookies-reduce-cookie-lifetime-to-1     28-seconds.patch.

  - tcp: syncookies: reduce cookie lifetime to 128 seconds     (bnc#833968).

  - tcp: syncookies: reduce mss table to four values     (bnc#833968).

  - rpm/mkspec: Generate a per-architecture per-package
    _constraints file

  - rpm/mkspec: Remove dead code

  - Refresh     patches.fixes/rtc-cmos-add-an-alarm-disable-quirk.patch.

  - rtc-cmos: Add an alarm disable quirk (bnc#812592).

  - Refresh patches.xen/xen-x86-EFI.

  - Refresh     patches.apparmor/apparmor-compatibility-patch-for-v5-net     work-control.
    patches.drivers/pstore_disable_efi_backend_by_default.pa     tch. patches.fixes/dm-table-switch-to-readonly.
    patches.fixes/kvm-ioapic.patch.
    patches.fixes/kvm-macos.patch.
    patches.fixes/remount-no-shrink-dcache.
    patches.fixes/scsi-dh-queuedata-accessors.
    patches.suse/0001-vfs-Hooks-for-more-fine-grained-direct     ory-permission.patch.
    patches.suse/ovl01-vfs-add-i_op-dentry_open.patch.
    patches.suse/sd_init.mark_majors_busy.patch.

  - rpm/mkspec: Fix whitespace in NoSource lines

  - rpm/kernel-binary.spec.in: Do not zero modules.dep     before using it (bnc#866075)

  - rpm/kernel-obs-build.spec: Drop useless ExclusiveArch     statement

  - Update config files. Set CONFIG_EFIVAR_FS to build-in     for MOK support Update config files. Set     CONFIG_EFIVAR_FS to build-in for MOK support

  - nfs: always make sure page is up-to-date before     extending a write to cover the entire page (bnc#864867     bnc#865075).

  - x86, cpu, amd: Add workaround for family 16h, erratum     793 (bnc#852967 CVE-2013-6885).

  - Refresh patches.xen/xen3-patch-3.10.

  - cifs: ensure that uncached writes handle unmapped areas     correctly (bnc#864025 CVE-2014-0069).

  - x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround     (bnc#858638 CVE-2014-1438).

  - rpm/kernel-obs-build.spec: Do not mount /sys, the build     script does it

  - Update config files: Disable TS5500-specific drivers     These drivers are useless without TS5500 board support:
    mtd-ts5500, gpio-ts5500 and max197.

  - balloon: don't crash in HVM-with-PoD guests.

  - usbback: fix after c/s 1232:8806dfb939d4 (bnc#842553).

  - hwmon: (coretemp) Fix truncated name of alarm     attributes.

  - rpm/kernel-obs-build.spec: Fix for ppc64le

  - Scripts: .nosrc.rpm should contain only the specfile     (bnc #639379)

  - config: update arm7hl/exynos

  - Enhances exynos support :

  - Add USB support

  - Add sound support

  - Add devices (accelerometer, etc.) on arndale board

  - drm/cirrus: Fix cirrus drm driver for fbdev + qemu     (bnc#856760).

  - Spec: zeroing modules.dep to get identical builds among     different machines

  - doc/README.SUSE: Update to match the current package     layout

  - Add the README.SUSE file to the packaging branch

  - lockd: send correct lock when granting a delayed lock     (bnc#859342).

  - mm/page-writeback.c: do not count anon pages as     dirtyable memory (reclaim stalls).

  - mm/page-writeback.c: fix dirty_balance_reserve     subtraction from dirtyable memory (reclaim stalls).

Multiple vulnerabilities has been found and corrected in the Linux kernel :

kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number (CVE-2014-3917).

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification (CVE-2014-3153).

Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions (CVE-2014-2672).

The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the
__skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced (CVE-2014-3144).

The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced (CVE-2014-3145).

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter (CVE-2014-2851).

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the LECHO !OPOST case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings (CVE-2014-0196).

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device (CVE-2014-1738).

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device (CVE-2014-1737).

The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports (CVE-2014-2678).

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions (CVE-2014-0077).

The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets (CVE-2014-2309).

Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device (CVE-2013-2897).

net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function (CVE-2014-2523).

Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c (CVE-2014-2706).

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk (CVE-2014-0101).

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer (CVE-2014-0069).

arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction (CVE-2014-2039).

Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function (CVE-2012-2137).

The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context (CVE-2014-1874).

The updated packages provides a solution for these security issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The pn_recvmsg function in net/phonet/datagram.c in the     Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7265)

  - The mISDN_sock_recvmsg function in     drivers/isdn/mISDN/socket.c in the Linux kernel before     3.12.4 does not ensure that a certain length value is     consistent with the size of an associated data     structure, which allows local users to obtain sensitive     information from kernel memory via a (1) recvfrom, (2)     recvmmsg, or (3) recvmsg system call.(CVE-2013-7266)

  - The atalk_recvmsg function in net/appletalk/ddp.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7267)

  - The ipx_recvmsg function in net/ipx/af_ipx.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7268)

  - The nr_recvmsg function in net/netrom/af_netrom.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7269)

  - The packet_recvmsg function in net/packet/af_packet.c     in the Linux kernel before 3.12.4 updates a certain     length value before ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7270)

  - The x25_recvmsg function in net/x25/af_x25.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7271)

  - The dgram_recvmsg function in net/ieee802154/dgram.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel stack     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7281)

  - A NULL pointer dereference flaw was found in the     rds_ib_laddr_check() function in the Linux kernel's     implementation of Reliable Datagram Sockets (RDS). A     local, unprivileged user could use this flaw to crash     the system.(CVE-2013-7339)

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2013-7421)

  - A flaw was found in the Linux kernel's implementation     of Unix sockets. A server polling for client-socket     data could put the peer socket on a wait list the peer     socket could then close the connection, making the     reference on the wait list no longer valid. This could     lead to bypassing the permissions on a Unix socket and     packets being injected into the stream, and could also     panic the machine (denial of service).(CVE-2013-7446)

  - The compat_sys_recvmmsg function in net/compat.c in the     Linux kernel before 3.13.2, when CONFIG_X86_X32 is     enabled, allows local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter.(CVE-2014-0038)

  - Buffer overflow in the complete_emulated_mmio function     in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6     allows guest OS users to execute arbitrary code on the     host OS by leveraging a loop that triggers an invalid     memory copy affecting certain cancel_work_item     data.(CVE-2014-0049)

  - The cifs_iovec_write function in fs/cifs/file.c in the     Linux kernel through 3.13.5 does not properly handle     uncached write operations that copy fewer than the     requested number of bytes, which allows local users to     obtain sensitive information from kernel memory, cause     a denial of service (memory corruption and system     crash), or possibly gain privileges via a writev system     call with a crafted pointer.(CVE-2014-0069)

  - drivers/vhost/net.c in the Linux kernel before 3.13.10,     when mergeable buffers are disabled, does not properly     validate packet lengths, which allows guest OS users to     cause a denial of service (memory corruption and host     OS crash) or possibly gain privileges on the host OS     via crafted packets, related to the handle_rx and     get_rx_bufs functions.(CVE-2014-0077)

  - Race condition in the inet_frag_intern function in     net/ipv4/inet_fragment.c in the Linux kernel through     3.13.6 allows remote attackers to cause a denial of     service (use-after-free error) or possibly have     unspecified other impact via a large series of     fragmented ICMP Echo Request packets to a system with a     heavy CPU load.(CVE-2014-0100)

  - A flaw was found in the way the Linux kernel processed     an authenticated COOKIE_ECHO chunk during the     initialization of an SCTP connection. A remote attacker     could use this flaw to crash the system by initiating a     specially crafted SCTP handshake in order to trigger a     NULL pointer dereference on the system.(CVE-2014-0101)

  - The keyring_detect_cycle_iterator function in     security/keys/keyring.c in the Linux kernel through     3.13.6 does not properly determine whether keyrings are     identical, which allows local users to cause a denial     of service (OOPS) via crafted keyctl     commands.(CVE-2014-0102)

  - Use-after-free vulnerability in the skb_segment     function in net/core/skbuff.c in the Linux kernel     through 3.13.6 allows attackers to obtain sensitive     information from kernel memory by leveraging the     absence of a certain orphaning     operation.(CVE-2014-0131)

  - The ioapic_deliver function in virt/kvm/ioapic.c in the     Linux kernel through 3.14.1 does not properly validate     the kvm_irq_delivery_to_apic return value, which allows     guest OS users to cause a denial of service (host OS     crash) via a crafted entry in the redirection table of     an I/O APIC. NOTE: the affected code was moved to the     ioapic_service function before the vulnerability was     announced.(CVE-2014-0155)

  - It was found that the permission checks performed by     the Linux kernel when a netlink message was received     were not sufficient. A local, unprivileged user could     potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged     process and altering the output of this     process.(CVE-2014-0181)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002409 advisory.

    The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not     validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which     allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an     SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This kernel update contains a number of CVE fixes, all users are encouraged to update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-0343     George Kargiotakis reported an issue in the temporary     address handling of the IPv6 privacy extensions. Users     on the same LAN can cause a denial of service or obtain     access to sensitive information by sending router     advertisement messages that cause temporary address     generation to be disabled.

  - CVE-2013-2147     Dan Carpenter reported issues in the cpqarray driver for     Compaq Smart2 Controllers and the cciss driver for HP     Smart Array controllers allowing users to gain access to     sensitive kernel memory.

  - CVE-2013-2889     Kees Cook discovered missing input sanitization in the     HID driver for Zeroplus game pads that could lead to a     local denial of service.

  - CVE-2013-2893     Kees Cook discovered that missing input sanitization in     the HID driver for various Logitech force feedback     devices could lead to a local denial of service.

  - CVE-2013-2929     Vasily Kulikov discovered that a flaw in the     get_dumpable() function of the ptrace subsytsem could     lead to information disclosure. Only systems with the     fs.suid_dumpable sysctl set to a non-default value of     '2' are vulnerable.

  - CVE-2013-4162     Hannes Frederic Sowa discovered that incorrect handling     of IPv6 sockets using the UDP_CORK option could result     in denial of service.

  - CVE-2013-4299     Fujitsu reported an issue in the device-mapper     subsystem. Local users could gain access to sensitive     kernel memory.

  - CVE-2013-4345     Stephan Mueller found in bug in the ANSI pseudo random     number generator which could lead to the use of less     entropy than expected.

  - CVE-2013-4512     Nico Golde and Fabian Yamaguchi reported an issue in the     user mode linux port. A buffer overflow condition exists     in the write method for the /proc/exitcode file. Local     users with sufficient privileges allowing them to write     to this file could gain further elevated privileges.

  - CVE-2013-4587     Andrew Honig of Google reported an issue in the KVM     virtualization subsystem. A local user could gain     elevated privileges by passing a large vcpu_id     parameter.

  - CVE-2013-6367     Andrew Honig of Google reported an issue in the KVM     virtualization subsystem. A divide-by-zero condition     could allow a guest user to cause a denial of service on     the host (crash).

  - CVE-2013-6380     Mahesh Rajashekhara reported an issue in the aacraid     driver for storage products from various vendors. Local     users with CAP_SYS_ADMIN privileges could gain further     elevated privileges.

  - CVE-2013-6381     Nico Golde and Fabian Yamaguchi reported an issue in the     Gigabit Ethernet device support for s390 systems. Local     users could cause a denial of service or gain elevated     privileges via the SIOC_QETH_ADP_SET_SNMP_CONTROL ioctl.

  - CVE-2013-6382     Nico Golde and Fabian Yamaguchi reported an issue in the     XFS filesystem. Local users with CAP_SYS_ADMIN     privileges could gain further elevated privileges.

  - CVE-2013-6383     Dan Carpenter reported an issue in the aacraid driver     for storage devices from various vendors. A local user     could gain elevated privileges due to a missing     privilege level check in the aac_compat_ioctl function.

  - CVE-2013-7263 CVE-2013-7264 CVE-2013-7265     mpb reported an information leak in the recvfrom,     recvmmsg and recvmsg system calls. A local user could     obtain access to sensitive kernel memory.

  - CVE-2013-7339     Sasha Levin reported an issue in the RDS network     protocol over Infiniband. A local user could cause a     denial of service condition.

  - CVE-2014-0101     Nokia Siemens Networks reported an issue in the SCTP     network protocol subsystem. Remote users could cause a     denial of service (NULL pointer dereference).

  - CVE-2014-1444     Salva Peiro reported an issue in the FarSync WAN driver.
    Local users with the CAP_NET_ADMIN capability could gain     access to sensitive kernel memory.

  - CVE-2014-1445     Salva Peiro reported an issue in the wanXL serial card     driver. Local users could gain access to sensitive     kernel memory.

  - CVE-2014-1446     Salva Peiro reported an issue in the YAM radio modem     driver. Local users with the CAP_NET_ADMIN capability     could gain access to sensitive kernel memory.

  - CVE-2014-1874     Matthew Thode reported an issue in the SELinux     subsystem. A local user with CAP_MAC_ADMIN privileges     could cause a denial of service by setting an empty     security context on a file.

  - CVE-2014-2039     Martin Schwidefsky reported an issue on s390 systems. A     local user could cause a denial of service (kernel oops)     by executing an application with a linkage stack     instruction.

  - CVE-2014-2523     Daniel Borkmann provided a fix for an issue in the     nf_conntrack_dccp module. Remote users could cause a     denial of service (system crash) or potentially gain     elevated privileges.

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.4 Extended Update Support.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel processed an authenticated COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote attacker could use this flaw to crash the system by initiating a specially crafted SCTP handshake in order to trigger a NULL pointer dereference on the system. (CVE-2014-0101, Important)

Red Hat would like to thank Nokia Siemens Networks for reporting this issue.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0520 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the way the Linux kernel processed an authenticated     COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote     attacker could use this flaw to crash the system by initiating a specially     crafted SCTP handshake in order to trigger a NULL pointer dereference on     the system. (CVE-2014-0101, Important)

    * A race condition flaw, leading to heap-based buffer overflows, was found     in the way the Linux kernel's N_TTY line discipline (LDISC) implementation     handled concurrent processing of echo output and TTY write operations     originating from user space when the underlying TTY driver was PTY.
    An unprivileged, local user could use this flaw to crash the system or,     potentially, escalate their privileges on the system. (CVE-2014-0196,     Important)

    Red Hat would like to thank Nokia Siemens Networks for reporting     CVE-2014-0101.

    This update also fixes the following bug:

    * Prior to this update, a guest-provided value was used as the head length     of the socket buffer allocated on the host. If the host was under heavy     memory load and the guest-provided value was too large, the allocation     could have failed, resulting in stalls and packet drops in the guest's Tx     path. With this update, the guest-provided value has been limited to a     reasonable size so that socket buffer allocations on the host succeed     regardless of the memory load on the host, and guests can send packets     without experiencing packet drops or stalls. (BZ#1092349)

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0328 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the way the get_rx_bufs() function in the vhost_net     implementation in the Linux kernel handled error conditions reported by the     vhost_get_vq_desc() function. A privileged guest user could use this flaw     to crash the host. (CVE-2014-0055, Important)

    * A flaw was found in the way the Linux kernel processed an authenticated     COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote     attacker could use this flaw to crash the system by initiating a specially     crafted SCTP handshake in order to trigger a NULL pointer dereference on     the system. (CVE-2014-0101, Important)

    * A flaw was found in the way the Linux kernel's CIFS implementation     handled uncached write operations with specially crafted iovec structures.
    An unprivileged local user with access to a CIFS share could use this flaw     to crash the system, leak kernel memory, or, potentially, escalate their     privileges on the system. Note: the default cache settings for CIFS mounts     on Red Hat Enterprise Linux 6 prohibit a successful exploitation of this     issue. (CVE-2014-0069, Moderate)

    * A heap-based buffer overflow flaw was found in the Linux kernel's cdc-wdm     driver, used for USB CDC WCM device management. An attacker with physical     access to a system could use this flaw to cause a denial of service or,     potentially, escalate their privileges. (CVE-2013-1860, Low)

    Red Hat would like to thank Nokia Siemens Networks for reporting     CVE-2014-0101, and Al Viro for reporting CVE-2014-0069.

    This update also fixes several bugs. Documentation for these changes will     be available shortly from the Technical Notes document linked to in the     References section.

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3016 advisory.

    - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Daniel Borkmann)  [Orabug: 18462076]     {CVE-2014-2523}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-1738)

Matthew Daley reported a flaw in the handling of ioctl commands by the floppy disk driver in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges if the floppy disk module is loaded. (CVE-2014-1737)

A flaw was discovered in the Linux kernel's IPC reference counting. An unprivileged local user could exploit this flaw to cause a denial of service (OOM system crash). (CVE-2013-4483)

Al Viro discovered an error in how CIFS in the Linux kernel handles uncached write operations. An unprivileged local user could exploit this flaw to cause a denial of service (system crash), obtain sensitive information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)

A flaw was discovered in the handling of network packets when mergeable buffers are disabled for virtual machines in the Linux kernel. Guest OS users may exploit this flaw to cause a denial of service (host OS crash) or possibly gain privilege on the host OS.
(CVE-2014-0077)

A flaw was discovered in the Linux kernel's handling of the SCTP handshake. A remote attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2014-0101)

A flaw was discovered in the handling of routing information in Linux kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a denial of service (memory consumption) via a flood of ICMPv6 router advertisement packets. (CVE-2014-2309)

An error was discovered in the Linux kernel's DCCP protocol support. A remote attacked could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2014-2523)

Max Sydorenko discovered a race condition in the Atheros 9k wireless driver in the Linux kernel. This race could be exploited by remote attackers to cause a denial of service (system crash). (CVE-2014-2672)

An error was discovered in the Reliable Datagram Sockets (RDS) protocol stack in the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash) or possibly have unspecified other impact. (CVE-2014-2678)

Yaara Rozenblum discovered a race condition in the Linux kernel's Generic IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-2706)

A flaw was discovered in the Linux kernel's ping sockets. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or possibly gain privileges via a crafted application. (CVE-2014-2851).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.3 Extended Update Support.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel processed an authenticated COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote attacker could use this flaw to crash the system by initiating a specially crafted SCTP handshake in order to trigger a NULL pointer dereference on the system. (CVE-2014-0101, Important)

Red Hat would like to thank Nokia Siemens Networks for reporting this issue.

This update also fixes the following bug :

* Due to an incorrect call of the weak-modules script in the kernel spec file, the weak-modules directory was removed from the system when removing or upgrading certain kernel packages related to weak-modules, such as kernel-debug. With this update, the weak-modules call in the kernel spec file has been corrected, and the script now preserves the weak-modules directory on the system in this scenario. (BZ#1076599)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
73722	Ubuntu 10.04 LTS : linux vulnerabilities (USN-2173-1)	Nessus	Ubuntu Local Security Checks	2014/4/27	2021/1/19	critical
75363	openSUSE Security Update : kernel (openSUSE-SU-2014:0678-1)	Nessus	SuSE Local Security Checks	2014/6/13	2023/5/14	critical
74513	Mandriva Linux Security Advisory : kernel (MDVSA-2014:124)	Nessus	Mandriva Local Security Checks	2014/6/13	2023/5/14	critical
124801	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1477)	Nessus	Huawei Local Security Checks	2019/5/13	2025/11/20	medium
287647	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002409)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	high
72891	Fedora 19 : kernel-3.13.5-103.fc19 (2014-3448)	Nessus	Fedora Local Security Checks	2014/3/10	2021/1/11	high
73713	Debian DSA-2906-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	2014/4/27	2021/1/11	critical
79016	RHEL 6 : kernel (RHSA-2014:0432)	Nessus	Red Hat Local Security Checks	2014/11/8	2021/1/14	high
79021	RHEL 6 : kernel (RHSA-2014:0520)	Nessus	Red Hat Local Security Checks	2014/11/8	2025/4/15	medium
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	high
73198	RHEL 6 : kernel (RHSA-2014:0328)	Nessus	Red Hat Local Security Checks	2014/3/26	2024/11/4	high
73243	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3016)	Nessus	Oracle Linux Local Security Checks	2014/3/28	2026/2/9	high
74184	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2221-1)	Nessus	Ubuntu Local Security Checks	2014/5/27	2021/1/19	critical
76557	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9488 / 9491 / 9493)	Nessus	SuSE Local Security Checks	2014/7/17	2021/1/19	critical
79014	RHEL 6 : kernel (RHSA-2014:0419)	Nessus	Red Hat Local Security Checks	2014/11/8	2021/1/14	high

检测

插件搜索

critical

critical

critical

medium

high

high

critical

high

medium

high

high

high

critical

critical

high