Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 6. This is the sixth regular update.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system. (CVE-2014-5077, Important)

* An integer overflow flaw was found in the way the Linux kernel's Frame Buffer device implementation mapped kernel memory to user space via the mmap syscall. A local user able to access a frame buffer device file (/dev/fb*) could possibly use this flaw to escalate their privileges on the system. (CVE-2013-2596, Important)

* A flaw was found in the way the ipc_rcu_putref() function in the Linux kernel's IPC implementation handled reference counter decrementing. A local, unprivileged user could use this flaw to trigger an Out of Memory (OOM) condition and, potentially, crash the system. (CVE-2013-4483, Moderate)

* It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. A local, unprivileged user could potentially bypass these restrictions by passing a netlink socket as stdout or stderr to a more privileged process and altering the output of this process. (CVE-2014-0181, Moderate)

* It was found that the try_to_unmap_cluster() function in the Linux kernel's Memory Managment subsystem did not properly handle page locking in certain cases, which could potentially trigger the BUG_ON() macro in the mlock_vma_page() function. A local, unprivileged user could use this flaw to crash the system. (CVE-2014-3122, Moderate)

* A flaw was found in the way the Linux kernel's kvm_iommu_map_pages() function handled IOMMU mapping failures. A privileged user in a guest with an assigned host device could use this flaw to crash the host.
(CVE-2014-3601, Moderate)

* Multiple use-after-free flaws were found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use either of these flaws to crash the system. (CVE-2014-4653, CVE-2014-4654, CVE-2014-4655, Moderate)

* A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. (CVE-2014-5045, Moderate)

* An integer overflow flaw was found in the way the lzo1x_decompress_safe() function of the Linux kernel's LZO implementation processed Literal Runs. A local attacker could, in extremely rare cases, use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-4608, Low)

Red Hat would like to thank Vladimir Davydov of Parallels for reporting CVE-2013-4483, Jack Morgenstein of Mellanox for reporting CVE-2014-3601, Vasily Averin of Parallels for reporting CVE-2014-5045, and Don A. Bailey from Lab Mouse Security for reporting CVE-2014-4608.
The security impact of the CVE-2014-3601 issue was discovered by Michael Tsirkin of Red Hat.

This update also fixes several hundred bugs and adds numerous enhancements. Refer to the Red Hat Enterprise Linux 6.6 Release Notes for information on the most significant of these changes, and the Technical Notes for further information, both linked to in the References.

All Red Hat Enterprise Linux 6 users are advised to install these updated packages, which correct these issues, and fix the bugs and add the enhancements noted in the Red Hat Enterprise Linux 6.6 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.

This security upload has been prepared in cooperation of the Debian Kernel, Security and LTS Teams and features the upstream stable release 2.6.32.64 (see https://lkml.org/lkml/2014/11/23/181 for more information for that). It fixes the CVEs described below.

Note: if you are using the openvz flavors, please consider three things: a.) we haven't got any feedback on them (while we have for all other flavors) b.) so do your test before deploying them and c.) once you have done so, please give feedback to debian-lts@lists.debian.org. 

If you are not using openvz flavors, please still consider b+c :-)

CVE-2012-6657

Fix the sock_setsockopt function to prevent local users from being able to cause a denial of service (system crash) attack.

CVE-2013-0228

Fix a XEN priviledge escalation, which allowed guest OS users to gain guest OS priviledges.

CVE-2013-7266

Fix the mISDN_sock_recvmsg function to prevent local users from obtaining sensitive information from kernel memory.

CVE-2014-4157

MIPS platform: prevent local users from bypassing intended PR_SET_SECCOMP restrictions.

CVE-2014-4508

Prevent local users from causing a denial of service (OOPS and system crash) when syscall auditing is enabled .

CVE-2014-4653 CVE-2014-4654 CVE-2014-4655

Fix the ALSA control implementation to prevent local users from causing a denial of service attack and from obtaining sensitive information from kernel memory.

CVE-2014-4943

Fix PPPoL2TP feature to prevent local users to from gaining privileges.

CVE-2014-5077

Prevent remote attackers from causing a denial of service attack involving SCTP.

CVE-2014-5471 CVE-2014-5472

Fix the parse_rock_ridge_inode_internal function to prevent local users from causing a denial of service attack via a crafted iso9660 images.

CVE-2014-9090

Fix the do_double_fault function to prevent local users from causing a denial of service (panic) attack.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux Kernel was updated to fix various bugs and security issues.

CVE-2014-4699: The Linux kernel on Intel processors did not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allowed local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel did not properly manage a certain backlog value, which allowed remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.

CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.

CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not properly maintain the user_ctl_count value, which allowed local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.

CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allowed local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.

CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel did not ensure possession of a read/write lock, which allowed local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.

CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.

CVE-2014-4014: The capabilities implementation in the Linux kernel did not properly consider that namespaces are inapplicable to inodes, which allowed local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.

CVE-2014-2309: The ip6_route_add function in net/ipv6/route.c in the Linux kernel did not properly count the addition of routes, which allowed remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.

CVE-2014-3917: kernel/auditsc.c in the Linux kernel, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allowed local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.

CVE-2014-0131: Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel allowed attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.

CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel did not check whether a certain length value is sufficiently large, which allowed local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions.

CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel used the reverse order in a certain subtraction, which allowed local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the
__skb_get_nlattr_nest function before the vulnerability was announced.

Additional Bug fixed :

  - HID: logitech-dj: Fix USB 3.0 issue (bnc#788080).

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1083 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     Stream Control Transmission Protocol (SCTP) implementation handled     simultaneous connections between the same hosts. A remote attacker could     use this flaw to crash the system. (CVE-2014-5077, Important)

    * Multiple use-after-free flaws and an integer overflow flaw were found in     the way the Linux kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local, privileged user could use     either of these flaws to crash the system. (CVE-2014-4653, CVE-2014-4654,     CVE-2014-4655, CVE-2014-4656, Moderate)

    * An information leak flaw was found in the way the Linux kernel's Advanced     Linux Sound Architecture (ALSA) implementation handled access of the user     control's state. A local, privileged user could use this flaw to leak     kernel memory to user space. (CVE-2014-4652, Low)

    This update also fixes the following bug:

    * Prior to this update, the netconsole module was unavailable on MRG     Realtime kernels due to locking issues that disabled it. These locking     issues have been corrected, allowing the netconsole module to be re-enabled     and functional on Realtime kernels. (BZ#1088923)

    Users are advised to upgrade to these updated packages, which upgrade the     kernel-rt kernel to version kernel-rt-3.10.33-rt32.45 and correct these     issues. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1392 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     Stream Control Transmission Protocol (SCTP) implementation handled     simultaneous connections between the same hosts. A remote attacker could     use this flaw to crash the system. (CVE-2014-5077, Important)

    * An integer overflow flaw was found in the way the Linux kernel's Frame     Buffer device implementation mapped kernel memory to user space via the     mmap syscall. A local user able to access a frame buffer device file     (/dev/fb*) could possibly use this flaw to escalate their privileges on the     system. (CVE-2013-2596, Important)

    * A flaw was found in the way the ipc_rcu_putref() function in the Linux     kernel's IPC implementation handled reference counter decrementing.
    A local, unprivileged user could use this flaw to trigger an Out of Memory     (OOM) condition and, potentially, crash the system. (CVE-2013-4483,     Moderate)

    * It was found that the permission checks performed by the Linux kernel     when a netlink message was received were not sufficient. A local,     unprivileged user could potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged process and     altering the output of this process. (CVE-2014-0181, Moderate)

    * It was found that the try_to_unmap_cluster() function in the Linux     kernel's Memory Managment subsystem did not properly handle page locking in     certain cases, which could potentially trigger the BUG_ON() macro in the     mlock_vma_page() function. A local, unprivileged user could use this flaw     to crash the system. (CVE-2014-3122, Moderate)

    * A flaw was found in the way the Linux kernel's kvm_iommu_map_pages()     function handled IOMMU mapping failures. A privileged user in a guest with     an assigned host device could use this flaw to crash the host.
    (CVE-2014-3601, Moderate)

    * Multiple use-after-free flaws were found in the way the Linux kernel's     Advanced Linux Sound Architecture (ALSA) implementation handled user     controls. A local, privileged user could use either of these flaws to crash     the system. (CVE-2014-4653, CVE-2014-4654, CVE-2014-4655, Moderate)

    * A flaw was found in the way the Linux kernel's VFS subsystem handled     reference counting when performing unmount operations on symbolic links.
    A local, unprivileged user could use this flaw to exhaust all available     memory on the system or, potentially, trigger a use-after-free error,     resulting in a system crash or privilege escalation. (CVE-2014-5045,     Moderate)

    * An integer overflow flaw was found in the way the lzo1x_decompress_safe()     function of the Linux kernel's LZO implementation processed Literal Runs.
    A local attacker could, in extremely rare cases, use this flaw to crash the     system or, potentially, escalate their privileges on the system.
    (CVE-2014-4608, Low)

    Red Hat would like to thank Vladimir Davydov of Parallels for reporting     CVE-2013-4483, Jack Morgenstein of Mellanox for reporting CVE-2014-3601,     Vasily Averin of Parallels for reporting CVE-2014-5045, and Don A.
    Bailey from Lab Mouse Security for reporting CVE-2014-4608. The security     impact of the CVE-2014-3601 issue was discovered by Michael Tsirkin of     Red Hat.

    This update also fixes several hundred bugs and adds numerous enhancements.
    Refer to the Red Hat Enterprise Linux 6.6 Release Notes for information on     the most significant of these changes, and the Technical Notes for further     information, both linked to in the References.

    All Red Hat Enterprise Linux 6 users are advised to install these updated     packages, which correct these issues, and fix the bugs and add the     enhancements noted in the Red Hat Enterprise Linux 6.6 Release Notes and     Technical Notes. The system must be rebooted for this update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions (CVE-2013-4514).

Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation (CVE-2014-0131).

The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator (CVE-2014-4027).

Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run (CVE-2014-4608).

Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (CVE-2014-4652).

sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (CVE-2014-4653).

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call (CVE-2014-4654).

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls (CVE-2014-4655).

Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function (CVE-2014-4656).

The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (CVE-2014-4667).

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls (CVE-2014-4699).

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket (CVE-2014-4943).

The updated packages provides a solution for these security issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The SUSE Linux Enterprise Server 11 SP2 LTSS received a roll up update to fix several security and non-security issues.

The following security issues have been fixed :

  - CVE-2014-0055: The get_rx_bufs function in     drivers/vhost/net.c in the vhost-net subsystem in the     Linux kernel package before 2.6.32-431.11.2 on Red Hat     Enterprise Linux (RHEL) 6 does not properly handle     vhost_get_vq_desc errors, which allows guest OS users to     cause a denial of service (host OS crash) via     unspecified vectors. (bnc#870173)

  - CVE-2014-0077: drivers/vhost/net.c in the Linux kernel     before 3.13.10, when mergeable buffers are disabled,     does not properly validate packet lengths, which allows     guest OS users to cause a denial of service (memory     corruption and host OS crash) or possibly gain     privileges on the host OS via crafted packets, related     to the handle_rx and get_rx_bufs functions. (bnc#870576)

  - CVE-2014-1739: The media_device_enum_entities function     in drivers/media/media-device.c in the Linux kernel     before 3.14.6 does not initialize a certain data     structure, which allows local users to obtain sensitive     information from kernel memory by leveraging /dev/media0     read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
    (bnc#882804)

  - CVE-2014-2706: Race condition in the mac80211 subsystem     in the Linux kernel before 3.13.7 allows remote     attackers to cause a denial of service (system crash)     via network traffic that improperly interacts with the     WLAN_STA_PS_STA state (aka power-save mode), related to     sta_info.c and tx.c. (bnc#871797)

  - CVE-2014-2851: Integer overflow in the ping_init_sock     function in net/ipv4/ping.c in the Linux kernel through     3.14.1 allows local users to cause a denial of service     (use-after-free and system crash) or possibly gain     privileges via a crafted application that leverages an     improperly managed reference counter. (bnc#873374)

  - CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2)     BPF_S_ANC_NLATTR_NEST extension implementations in the     sk_run_filter function in net/core/filter.c in the Linux     kernel through 3.14.3 do not check whether a certain     length value is sufficiently large, which allows local     users to cause a denial of service (integer underflow     and system crash) via crafted BPF instructions. NOTE:
    the affected code was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the vulnerability     was announced. (bnc#877257)

  - CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension     implementation in the sk_run_filter function in     net/core/filter.c in the Linux kernel through 3.14.3     uses the reverse order in a certain subtraction, which     allows local users to cause a denial of service     (over-read and system crash) via crafted BPF     instructions. NOTE: the affected code was moved to the
    __skb_get_nlattr_nest function before the vulnerability     was announced. (bnc#877257)

  - CVE-2014-3917: kernel/auditsc.c in the Linux kernel     through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with     certain syscall rules, allows local users to obtain     potentially sensitive single-bit values from kernel     memory or cause a denial of service (OOPS) via a large     value of a syscall number. (bnc#880484)

  - CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux     kernel through 3.15.1 on 32-bit x86 platforms, when     syscall auditing is enabled and the sep CPU feature flag     is set, allows local users to cause a denial of service     (OOPS and system crash) via an invalid syscall number,     as demonstrated by number 1000. (bnc#883724)

  - CVE-2014-4652: Race condition in the tlv handler     functionality in the snd_ctl_elem_user_tlv function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 allows local users to     obtain sensitive information from kernel memory by     leveraging /dev/snd/controlCX access. (bnc#883795)

  - CVE-2014-4653: sound/core/control.c in the ALSA control     implementation in the Linux kernel before 3.15.2 does     not ensure possession of a read/write lock, which allows     local users to cause a denial of service     (use-after-free) and obtain sensitive information from     kernel memory by leveraging /dev/snd/controlCX access.
    (bnc#883795)

  - CVE-2014-4654: The snd_ctl_elem_add function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 does not check     authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands,     which allows local users to remove kernel controls and     cause a denial of service (use-after-free and system     crash) by leveraging /dev/snd/controlCX access for an     ioctl call. (bnc#883795)

  - CVE-2014-4655: The snd_ctl_elem_add function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 does not properly     maintain the user_ctl_count value, which allows local     users to cause a denial of service (integer overflow and     limit bypass) by leveraging /dev/snd/controlCX access     for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl     calls. (bnc#883795)

  - CVE-2014-4656: Multiple integer overflows in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 allow local users to     cause a denial of service by leveraging     /dev/snd/controlCX access, related to (1) index values     in the snd_ctl_add function and (2) numid values in the     snd_ctl_remove_numid_conflict function. (bnc#883795)

  - CVE-2014-4667: The sctp_association_free function in     net/sctp/associola.c in the Linux kernel before 3.15.2     does not properly manage a certain backlog value, which     allows remote attackers to cause a denial of service     (socket outage) via a crafted SCTP packet. (bnc#885422)

  - CVE-2014-4699: The Linux kernel before 3.15.4 on Intel     processors does not properly restrict use of a     non-canonical value for the saved RIP address in the     case of a system call that does not use IRET, which     allows local users to leverage a race condition and gain     privileges, or cause a denial of service (double fault),     via a crafted application that makes ptrace and fork     system calls. (bnc#885725)

  - CVE-2014-5077: The sctp_assoc_update function in     net/sctp/associola.c in the Linux kernel through 3.15.8,     when SCTP authentication is enabled, allows remote     attackers to cause a denial of service (NULL pointer     dereference and OOPS) by starting to establish an     association between two endpoints immediately after an     exchange of INIT and INIT ACK chunks to establish an     earlier association between these endpoints in the     opposite direction. (bnc#889173)

  - CVE-2013-4299: Interpretation conflict in     drivers/md/dm-snap-persistent.c in the Linux kernel     through 3.11.6 allows remote authenticated users to     obtain sensitive information or modify data via a     crafted mapping to a snapshot block device. (bnc#846404)

The following bugs have been fixed :

  - pagecachelimit: reduce lru_lock contention for heavy     parallel reclaim (bnc#878509, bnc#864464).

  - pagecachelimit: reduce lru_lock contention for heavy     parallel reclaim kabi fixup (bnc#878509, bnc#864464).

  - ACPI / PAD: call schedule() when need_resched() is true     (bnc#866911).

  - kabi: Fix breakage due to addition of user_ctl_lock     (bnc#883795).

  - cpuset: Fix memory allocator deadlock (bnc#876590).

  - tcp: allow to disable cwnd moderation in TCP_CA_Loss     state (bnc#879921).

  - tcp: adapt selected parts of RFC 5682 and PRR logic     (bnc#879921).

  - vlan: more careful checksum features handling     (bnc#872634).

  - bonding: fix vlan_features computing (bnc#872634).

  - NFSv4: Minor cleanups for nfs4_handle_exception and     nfs4_async_handle_error (bnc#889324).

  - NFS: Do not lose sockets when nfsd shutdown races with     connection timeout (bnc#871854).

  - reiserfs: call truncate_setsize under tailpack mutex     (bnc#878115).

  - reiserfs: drop vmtruncate (bnc#878115).

  - megaraid_sas: mask off flags in ioctl path (bnc#886474).

  - block: fix race between request completion and timeout     handling (bnc#881051).

  - drivers/rtc/interface.c: fix infinite loop in     initializing the alarm (bnc#871676).

  - xfrm: check peer pointer for null before calling     inet_putpeer() (bnc#877775).

  - supported.conf: Add firewire/nosy as supported. This     driver is the replacement for the ieee1394/pcilynx     driver, which was supported.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1724 advisory.

    - [virt] kvm: fix PIT timer race condition (Petr  Matousek) [1144879 1144880] {CVE-2014-3611}
    - [virt] kvm/vmx: handle invept and invvpid vm exits gracefully (Petr  Matousek) [1145449 1116936]     [1144828 1144829] {CVE-2014-3645 CVE-2014-3646}
    - [net] sctp: inherit auth_capable on INIT collisions (Daniel Borkmann) [1124337 1123763] {CVE-2014-5077}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000952 advisory.

    sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure     possession of a read/write lock, which allows local users to cause a denial of service (use-after-free)     and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3083 advisory.

    - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen)  [Orabug:
    19817787]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655}
    - ALSA: control: Fix replacing user controls (Lars-Peter Clausen)  [Orabug: 19817749]  {CVE-2014-4653}     {CVE-2014-4654} {CVE-2014-4655}
    - mm: try_to_unmap_cluster() should lock_page() before mlocking (Vlastimil Babka)  [Orabug: 19817324]     {CVE-2014-3122}
    - vm: convert fb_mmap to vm_iomap_memory() helper (Linus Torvalds)  [Orabug: 19816564]  {CVE-2013-2596}
    - vm: add vm_iomap_memory() helper function (Linus Torvalds)  [Orabug: 19816564]  {CVE-2013-2596}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2337-1 advisory.

    A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq).
    A guest OS user could exploit this flaw to cause a denial of service (host OS crash). (CVE-2014-0155)

    Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is     passed to a process of more privilege. A local user could exploit this flaw to bypass access restrictions     by having a privileged executable do something it was not intended to do. (CVE-2014-0181)

    An information leak was discovered in the Linux kernels aio_read_events_ring function. A local user could     exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-0206)

    A flaw was discovered in the Linux kernel's implementation of user namespaces with respect to inode     permissions. A local user could exploit this flaw by creating a user namespace to gain administrative     privileges. (CVE-2014-4014)

    An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux     kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by     leveraging access to a SCSI initiator. (CVE-2014-4027)

    Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range     notifications and hole punching. A local user could exploit this flaw to cause a denial of service.
    (CVE-2014-4171)

    Toralf Frster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local     user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

    An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture     (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information     from kernel memory. (CVE-2014-4652)

    A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control     implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service     (system crash). (CVE-2014-4653)

    A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound     Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service     (remove kernel controls). (CVE-2014-4654)

    A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled     a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and     limit bypass). (CVE-2014-4655)

    An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound     Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash).
    (CVE-2014-4656)

    An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain     SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a     crafted SCTP packet. (CVE-2014-4667)

    Vasily Averin discover a reference count flaw during attempts to umount in conjunction with a symlink. A     local user could exploit this flaw to cause a denial of service (memory consumption or use after free) or     possibly have other unspecified impact. (CVE-2014-5045)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
79181	CentOS 6 : kernel (CESA-2014:1392)	Nessus	CentOS Local Security Checks	2014/11/12	2022/9/16	high
82087	Debian DLA-103-1 : linux-2.6 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
76988	openSUSE Security Update : kernel (openSUSE-SU-2014:0957-1)	Nessus	SuSE Local Security Checks	2014/8/4	2021/1/19	medium
77298	RHEL 6 : kernel-rt (RHSA-2014:1083)	Nessus	Red Hat Local Security Checks	2014/8/21	2025/4/15	medium
78409	RHEL 6 : kernel (RHSA-2014:1392)	Nessus	Red Hat Local Security Checks	2014/10/14	2025/8/15	high
77074	Mandriva Linux Security Advisory : kernel (MDVSA-2014:155)	Nessus	Mandriva Local Security Checks	2014/8/8	2021/1/6	medium
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/4/3	2025/12/26	critical
76557	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9488 / 9491 / 9493)	Nessus	SuSE Local Security Checks	2014/7/17	2021/1/19	critical
83633	SUSE SLES11 Security Update : kernel (SUSE-SU-2014:1105-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
78721	Oracle Linux 7 : kernel (ELSA-2014-1724)	Nessus	Oracle Linux Local Security Checks	2014/10/29	2026/2/9	medium
290869	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000952)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
78580	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel Security (ELSA-2014-3083)	Nessus	Oracle Linux Local Security Checks	2014/10/20	2026/2/9	high
77492	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2337-1)	Nessus	Ubuntu Local Security Checks	2014/9/3	2024/8/28	medium

检测

插件搜索

high

medium

medium

medium

high

medium

critical

critical

high

medium

high

high

medium