Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation.

  - CVE-2013-7421 / CVE-2014-9644     It was discovered that the Crypto API allowed     unprivileged users to load arbitrary kernel modules. A     local user can use this flaw to exploit vulnerabilities     in modules that would not normally be loaded.

  - CVE-2014-7822     Akira Fujita found that the splice() system call did not     validate the given file offset and length. A local     unprivileged user can use this flaw to cause filesystem     corruption on ext4 filesystems, or possibly other     effects.

  - CVE-2014-8160     Florian Westphal discovered that a netfilter     (iptables/ip6tables) rule accepting packets to a     specific SCTP, DCCP, GRE or UDPlite port/endpoint could     result in incorrect connection tracking state. If only     the generic connection tracking module (nf_conntrack)     was loaded, and not the protocol-specific connection     tracking module, this would allow access to any     port/endpoint of the specified protocol.

  - CVE-2014-8559     It was found that kernel functions that iterate over a     directory tree can dead-lock or live-lock in case some     of the directory entries were recently deleted or     dropped from the cache. A local unprivileged user can     use this flaw for denial of service.

  - CVE-2014-9585     Andy Lutomirski discovered that address randomisation     for the vDSO in 64-bit processes is extremely biased. A     local unprivileged user could potentially use this flaw     to bypass the ASLR protection mechanism.

  - CVE-2014-9683     Dmitry Chernenkov discovered that eCryptfs writes past     the end of the allocated buffer during encrypted     filename decoding, resulting in local denial of service.

  - CVE-2015-0239     It was found that KVM did not correctly emulate the x86     SYSENTER instruction. An unprivileged user within a     guest system that has not enabled SYSENTER, for example     because the emulated CPU vendor is AMD, could     potentially use this flaw to cause a denial of service     or privilege escalation in that guest.

  - CVE-2015-1420     It was discovered that the open_by_handle_at() system     call reads the handle size from user memory a second     time after validating it. A local user with the     CAP_DAC_READ_SEARCH capability could use this flaw for     privilege escalation.

  - CVE-2015-1421     It was found that the SCTP implementation could free an     authentication state while it was still in use,     resulting in heap corruption. This could allow remote     users to cause a denial of service or privilege     escalation.

  - CVE-2015-1593     It was found that address randomisation for the initial     stack in 64-bit processes was limited to 20 rather than     22 bits of entropy. A local unprivileged user could     potentially use this flaw to bypass the ASLR protection     mechanism.

This update fixes the CVEs described below.

A further issue, CVE-2014-9419, was considered, but appears to require extensive changes with a consequent high risk of regression. It is now unlikely to be fixed in squeeze-lts.

CVE-2013-6885

It was discovered that under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang on AMD 16h 00h through 0Fh processors. A local user can use this flaw to mount a denial of service (system hang) via a crafted application.

For more information please refer to the AMD CPU erratum 793 in http://support.amd.com/TechDocs/51810_16h_00h-0Fh_Rev_Guide.
pdf

CVE-2014-7822

It was found that the splice() system call did not validate the given file offset and length. A local unprivileged user can use this flaw to cause filesystem corruption on ext4 filesystems, or possibly other effects.

CVE-2014-8133

It was found that the espfix functionality can be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks for) and using it for stack. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8134

It was found that the espfix functionality is wrongly disabled in a 32-bit KVM guest. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8160

It was found that a netfilter (iptables or ip6tables) rule accepting packets to a specific SCTP, DCCP, GRE or UDPlite port/endpoint could result in incorrect connection tracking state. If only the generic connection tracking module (nf_conntrack) was loaded, and not the protocol-specific connection tracking module, this would allow access to any port/endpoint of the specified protocol.

CVE-2014-9420

It was found that the ISO-9660 filesystem implementation (isofs) follows arbitrarily long chains, including loops, of Continuation Entries (CEs). This allows local users to mount a denial of service via a crafted disc image.

CVE-2014-9584

It was found that the ISO-9660 filesystem implementation (isofs) does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted disc image.

CVE-2014-9585

It was discovered that address randomisation for the vDSO in 64-bit processes is extremely biassed. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

CVE-2015-1421

It was found that the SCTP implementation could free authentication state while it was still in use, resulting in heap corruption. This could allow remote users to cause a denial of service or privilege escalation.

CVE-2015-1593

It was found that address randomisation for the initial stack in 64-bit processes was limited to 20 rather than 22 bits of entropy. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001031 advisory.

    The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not     enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of     service (system crash) or possibly have unspecified other impact via a crafted splice system call, as     demonstrated by use of a file descriptor associated with an ext4 filesystem.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

Red Hat would like to thank Akira Fujita of NEC for reporting this issue.

This update also fixes the following bugs :

* Previously, hot-unplugging of a virtio-blk device could in some cases lead to a kernel panic, for example during in-flight I/O requests. This update fixes race condition in the hot-unplug code in the virtio_blk.ko module. As a result, hot unplugging of the virtio-blk device no longer causes the guest kernel oops when there are in-flight I/O requests. (BZ#1006536)

* Before this update, due to a bug in the error-handling path, a corrupted metadata block could be used as a valid block. With this update, the error handling path has been fixed and more checks have been added to verify the metadata block. Now, when a corrupted metadata block is encountered, it is properly marked as corrupted and handled accordingly. (BZ#1034403)

* Previously, an incorrectly initialized variable resulted in a random value being stored in the variable that holds the number of default ACLs, and is sent in the SET_PATH_INFO data structure. Consequently, the setfacl command could, under certain circumstances, fail with an 'Invalid argument' error. With this update, the variable is correctly initialized to zero, thus fixing the bug. (BZ#1105625)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0694 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    * A flaw was found in the way the Linux kernel's XFS file system handled     replacing of remote attributes under certain conditions. A local user with     access to XFS file system mount could potentially use this flaw to escalate     their privileges on the system. (CVE-2015-0274, Important)

    * A flaw was found in the way the Linux kernel's splice() system call     validated its parameters. On certain file systems, a local, unprivileged     user could use this flaw to write past the maximum file size, and thus     crash the system. (CVE-2014-7822, Moderate)

    * A race condition flaw was found in the Linux kernel's ext4 file system     implementation that allowed a local, unprivileged user to crash the system     by simultaneously writing to a file and toggling the O_DIRECT flag using     fcntl(F_SETFL) on that file. (CVE-2014-8086, Moderate)

    * It was found that due to excessive files_lock locking, a soft lockup     could be triggered in the Linux kernel when performing asynchronous I/O     operations. A local, unprivileged user could use this flaw to crash the     system. (CVE-2014-8172, Moderate)

    * A NULL pointer dereference flaw was found in the way the Linux kernel's     madvise MADV_WILLNEED functionality handled page table locking. A local,     unprivileged user could use this flaw to crash the system. (CVE-2014-8173,     Moderate)

    Red Hat would like to thank Eric Windisch of the Docker project for     reporting CVE-2015-0274, and Akira Fujita of NEC for reporting     CVE-2014-7822.

    Bug fixes:

    * A patch removing the xt_connlimit revision zero ABI was not reverted in     the kernel-rt package, which caused problems because the iptables package     requires this revision. A patch to remove the xt_connlimit revision 0 was     reverted from the kernel-rt sources to allow the iptables command to     execute correctly. (BZ#1169755)

    * With an older Mellanox Connect-IB (mlx4) driver present in the MRG     Realtime kernel, a race condition could occur that would cause a loss of     connection. The mlx4 driver was updated, resolving the race condition and     allowing proper connectivity. (BZ#1182246)

    * The MRG Realtime kernel did not contain the appropriate code to resume     after a device failed, causing the volume status after a repair to not be     properly updated. A refresh needed was still listed in the lvs output     after executing the lvchange --refresh command. A patch was added that     adds the ability to correctly restore a transiently failed device upon     resume. (BZ#1159803)

    * The sosreport executable would hang when reading     /proc/net/rpc/use-gss-proxy because of faulty wait_queue logic in the proc     handler. This wait_queue logic was removed from the proc handler, allowing     the reads to correctly return the current state. (BZ#1169900)

    Enhancements:

    * The MRG Realtime kernel-rt sources have been modified to take advantage     of the updated 3.10 kernel sources that are available with the Red Hat     Enterprise Linux 7 releases. (BZ#1172844)

    * The MRG Realtime version of the e1000e driver has been updated to provide     support for the Intel I218-LM network adapter. (BZ#1191767)

    * The MRG Realtime kernel was updated to provide support for the     Mellanox Connect-IB (mlx5). (BZ#1171363)

    * The rt-firmware package has been updated to provide additional firmware     files required by the new version of the Red Hat Enterprise MRG 2.5 kernel     (BZ#1184251)

    All kernel-rt users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add these     enhancements. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux kernel's splice system call did not correctly validate its parameters. A local, unprivileged user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-7822)

A flaw was discovered in how Thread Local Storage (TLS) is handled by the task switching function in the Linux kernel for x86_64 based machines. A local user could exploit this flaw to bypass the Address Space Layout Radomization (ASLR) protection mechanism. (CVE-2014-9419)

Dmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file name decoding. A local unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain administrative privileges. (CVE-2014-9683)

Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. (CVE-2015-1421).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002351 advisory.

    The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not     enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of     service (system crash) or possibly have unspecified other impact via a crafted splice system call, as     demonstrated by use of a file descriptor associated with an ext4 filesystem.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2544-1 advisory.

    Eric Windisch discovered flaw in how the Linux kernel's XFS file system replaces remote attributes. A     local access with access to an XFS file system could exploit this flaw to escalate their privileges.
    (CVE-2015-0274)

    A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A     local user could exploit this flaw to load installed kernel modules, increasing the attack surface and     potentially using this to gain administrative privileges. (CVE-2013-7421)

    The Linux kernel's splice system call did not correctly validate its parameters. A local, unprivileged     user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-7822)

    A flaw was discovered in the crypto subsystem when screening module names for automatic module loading if     the name contained a valid crypto module name, eg. vfat(aes). A local user could exploit this flaw to load     installed kernel modules, increasing the attack surface and potentially using this to gain administrative     privileges. (CVE-2014-9644)

    Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) failed to verify symlink size info. A     local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a     denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9728)

    Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not valid inode size information . A     local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a     denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9729)

    Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not correctly verify the component     length for symlinks. A local attacker, who is able to mount a malicous UDF file system image, could     exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors.
    (CVE-2014-9730)

    Carl H Lunde discovered an information leak in the UDF file system (CONFIG_UDF_FS). A local attacker, who     is able to mount a malicous UDF file system image, could exploit this flaw to read potential sensitve     kernel memory. (CVE-2014-9731)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.38 to receive various security and bugfixes.

This update contains the following feature enablements :

  - The remote block device (rbd) and ceph drivers have been     enabled and are now supported. (FATE#318350) These can     be used e.g. for accessing the SUSE Enterprise Storage     product services.

  - Support for Intel Select Bay trail CPUs has been added.
    (FATE#316038)

Following security issues were fixed :

  - CVE-2014-9419: The __switch_to function in     arch/x86/kernel/process_64.c in the Linux kernel through     3.18.1 did not ensure that Thread Local Storage (TLS)     descriptors were loaded before proceeding with other     steps, which made it easier for local users to bypass     the ASLR protection mechanism via a crafted application     that reads a TLS base address (bnc#911326).

  - CVE-2014-7822: A flaw was found in the way the Linux     kernels splice() system call validated its parameters.
    On certain file systems, a local, unprivileged user     could have used this flaw to write past the maximum file     size, and thus crash the system.

  - CVE-2014-8160: The connection tracking module could be     bypassed if a specific protocol module was not loaded,     e.g. allowing SCTP traffic while the firewall should     have filtered it.

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel before     3.18.2 did not validate a length value in the Extensions     Reference (ER) System Use Field, which allowed local     users to obtain sensitive information from kernel memory     via a crafted iso9660 image (bnc#912654).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0102 advisory.

    - [mm] shmem: fix splicing from a hole while it's punched (Denys Vlasenko) [1118244 1118245]     {CVE-2014-4171}
    - [mm] shmem: fix faulting into a hole, not taking i_mutex (Denys Vlasenko) [1118244 1118245]     {CVE-2014-4171}
    - [mm] shmem: fix faulting into a hole while it's punched (Denys Vlasenko) [118244 1118245]     {CVE-2014-4171}
    - [x86] traps: stop using IST for #SS (Petr  Matousek) [1172812 1172813] {CVE-2014-9322}
    - [fs] splice: perform generic write checks (Eric Sandeen) [1163799 1155907] {CVE-2014-7822}
    - [net] sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)     [1163094 1154002] {CVE-2014-7841}
    - [fs] cifs: NULL pointer dereference in SMB2_tcon (Jacob Tanenbaum) [1147528 1147529] {CVE-2014-7145}
    - [fs] isofs: unbound recursion when processing relocated directories (Jacob Tanenbaum) [1142270 1142271]     {CVE-2014-5471 CVE-2014-5472}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux kernel was updated to fix various bugs and security issues.

Following security issues were fixed :

  - CVE-2014-8173: A NULL pointer dereference flaw was found     in the way the Linux kernels madvise MADV_WILLNEED     functionality handled page table locking. A local,     unprivileged user could have used this flaw to crash the     system.

  - CVE-2015-1593: A integer overflow reduced the     effectiveness of the stack randomization on 64-bit     systems.

  - CVE-2014-7822: A flaw was found in the way the Linux     kernels splice() system call validated its parameters.
    On certain file systems, a local, unprivileged user     could have used this flaw to write past the maximum file     size, and thus crash the system.

  - CVE-2014-9419: The __switch_to function in     arch/x86/kernel/process_64.c in the Linux kernel did not     ensure that Thread Local Storage (TLS) descriptors are     loaded before proceeding with other steps, which made it     easier for local users to bypass the ASLR protection     mechanism via a crafted application that reads a TLS     base address.

  - CVE-2014-8134: The paravirt_ops_setup function in     arch/x86/kernel/kvm.c in the Linux kernel used an     improper paravirt_enabled setting for KVM guest kernels,     which made it easier for guest OS users to bypass the     ASLR protection mechanism via a crafted application that     reads a 16-bit value.

  - CVE-2014-8160:
    net/netfilter/nf_conntrack_proto_generic.c in the Linux     kernel generated incorrect conntrack entries during     handling of certain iptables rule sets for the SCTP,     DCCP, GRE, and UDP-Lite protocols, which allowed remote     attackers to bypass intended access restrictions via     packets with disallowed port numbers.

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key.

  - CVE-2014-8559: The d_walk function in fs/dcache.c in the     Linux kernel through did not properly maintain the     semantics of rename_lock, which allowed local users to     cause a denial of service (deadlock and system hang) via     a crafted application.

  - CVE-2014-9420: The rock_continue function in     fs/isofs/rock.c in the Linux kernel did not restrict the     number of Rock Ridge continuation entries, which allowed     local users to cause a denial of service (infinite loop,     and system crash or hang) via a crafted iso9660 image.

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel did not     validate a length value in the Extensions Reference (ER)     System Use Field, which allowed local users to obtain     sensitive information from kernel memory via a crafted     iso9660 image.

  - CVE-2014-9585: The vdso_addr function in     arch/x86/vdso/vma.c in the Linux kernel did not properly     choose memory locations for the vDSO area, which made it     easier for local users to bypass the ASLR protection     mechanism by guessing a location at the end of a PMD.

Following bugs were fixed :

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 0103 (bnc#920901).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 016f (bnc#920901).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen 009b (bnc#920901).

  - HID: usbhid: add another mouse that needs     QUIRK_ALWAYS_POLL (bnc#920901).

  - HID: usbhid: fix PIXART optical mouse (bnc#920901).

  - HID: usbhid: enable always-poll quirk for Elan     Touchscreen (bnc#920901).

  - HID: usbhid: add always-poll quirk (bnc#920901).

  - storvsc: ring buffer failures may result in I/O freeze     (bnc#914175).

  - mm, vmscan: prevent kswapd livelock due to     pfmemalloc-throttled process being killed (VM     Functionality bnc#910150).

  - Input: evdev - fix EVIOCG(type) ioctl (bnc#904899).

  - mnt: Implicitly add MNT_NODEV on remount when it was     implicitly added by mount (bsc#907988).

  - DocBook: Do not exceed argument list limit.

  - DocBook: Make mandocs parallel-safe.

  - mm: free compound page with correct order (bnc#913695).

  - udf: Check component length before reading it.

  - udf: Check path length when reading symlink.

  - udf: Verify symlink size before loading it.

  - udf: Verify i_size when loading inode.

  - xfs: remote attribute overwrite causes transaction     overrun.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
81449	Debian DSA-3170-1 : linux - security update	Nessus	Debian Local Security Checks	2015/2/24	2021/1/11	critical
82138	Debian DLA-155-1 : linux-2.6 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	critical
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/4/3	2025/12/26	critical
290358	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001031)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
81276	CentOS 5 : kernel (CESA-2015:0164)	Nessus	CentOS Local Security Checks	2015/2/11	2021/1/4	high
81905	RHEL 6 : kernel-rt (RHSA-2015:0694)	Nessus	Red Hat Local Security Checks	2015/3/18	2024/11/4	medium
82069	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2541-1)	Nessus	Ubuntu Local Security Checks	2015/3/25	2021/1/19	critical
286703	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002351)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	high
82071	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2544-1)	Nessus	Ubuntu Local Security Checks	2015/3/25	2024/8/27	medium
83702	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0529-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/6	high
81067	Oracle Linux 7 : kernel (ELSA-2015-0102)	Nessus	Oracle Linux Local Security Checks	2015/1/29	2026/2/9	medium
82755	openSUSE Security Update : the Linux Kernel (openSUSE-2015-301)	Nessus	SuSE Local Security Checks	2015/4/14	2021/1/19	high

检测

插件搜索

critical

critical

critical

high

high

medium

critical

high

medium

high

medium

high