Updated kernel-rt packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

* A buffer overflow flaw was found in the way the Linux kernel's Intel AES-NI instructions optimized version of the RFC4106 GCM mode decryption functionality handled fragmented packets. A remote attacker could use this flaw to crash, or potentially escalate their privileges on, a system over a connection with an active AEC-GCM mode IPSec security association. (CVE-2015-3331, Important)

This update provides a build of the kernel-rt package for Red Hat Enterprise MRG 2.5, which is layered on Red Hat Enterprise Linux 6.
The kernel-rt sources have been updated to include fixes for the following issues :

* Audit subsystem not resolving path name on directory watches

* audit watches do not track correctly after a rename

* auditctl output is changed in RHEL 7

* megaraid_sas: non-booting system with intel_iommu=on kernel parameter

* GFS2: kernel NULL pointer dereference in gfs2_inplace_reserve

* Crypto adapter cannot be brought online - affect all HW

* crypto/seqiv.c: wrong check of return code from crypto_rng_get_bytes

* Backport crypto: sha256_ssse3 - also test for BMI2

* NULL pointer at team_handle_frame+0x62/0x100 [team]

* AES CTR x86_64 'by8' AVX optimization

* Intel RDSEED - Fix for entropy counting

* Intel SHA1 multi-buffer crypto implementation

* Intel SHA1 AVX2 optimization support

* mlx4_en: HW timestamp ends up in error queue of socket which does not have SO_TIMESTAMPING enabled

(BZ#1213945)

All kernel-rt users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. The system must be rebooted for this update to take effect.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2614-1 advisory.

    Vincent Tondellier discovered an integer overflow in the Linux kernel's netfilter connection tracking     accounting of loaded extensions. An attacker on the local area network (LAN) could potential exploit this     flaw to cause a denial of service (system crash of targeted system). (CVE-2014-9715)

    Jan Beulich discovered the Xen virtual machine subsystem of the Linux kernel did not properly restrict     access to PCI command registers. A local guest user could exploit this flaw to cause a denial of service     (host crash). (CVE-2015-2150)

    A privilege escalation was discovered in the fork syscall via the int80 entry on 64 bit kernels with 32     bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges     on the system. (CVE-2015-2830)

    A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code     path. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     escalate privileges on Intel base machines with AEC-GCM mode IPSec security association. (CVE-2015-3331)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix various bugs and security issues.

The following vulnerabilities have been fixed :

CVE-2015-3636: A missing sk_nulls_node_init() in ping_unhash() inside the ipv4 stack can cause crashes if a disconnect is followed by another connect() attempt. (bnc#929525)

CVE-2015-3339: Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bnc#928130)

CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bnc#927257)

CVE-2015-2922: The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message. (bnc#922583)

CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16. (bnc#926240)

CVE-2015-2150: XSA-120: Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
(bnc#919463)

CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.
(bnc#919018)

CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.
(bnc#919007)

CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.
(bnc#915577)

CVE-2015-0777: drivers/xen/usbback/usbback.c in 1 -2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors. (bnc#917830)

CVE-2014-9683: Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename. (bnc#918333)

CVE-2014-9529: Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key. (bnc#912202)

CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. (bnc#911326)

CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bnc#914742)

CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.
(bnc#900881)

Also 

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0037 for details.

Updated kernel packages that fix two security issues and three bugs are now available for Red Hat Enterprise Linux 6.5 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-1805, Important)

* A buffer overflow flaw was found in the way the Linux kernel's Intel AES-NI instructions optimized version of the RFC4106 GCM mode decryption functionality handled fragmented packets. A remote attacker could use this flaw to crash, or potentially escalate their privileges on, a system over a connection with an active AES-GCM mode IPSec security association. (CVE-2015-3331, Important)

The security impact of the CVE-2015-1805 issue was discovered by Red Hat.

This update also fixes the following bugs :

* Parallel extending direct I/O writes to a file could previously race to update the size of the file. If executed in an incorrect order, the file size could move backwards and push a previously completed write beyond the end of the file, which resulted in losing the write. With this update, file size updates always execute in appropriate order, thus fixing this bug. (BZ#1218498)

* When the load rose and run queues were busy due to the effects of the enqueue_entity() function, tasks with large sched_entity.vruntime values could previously be prevented from using the CPU time. A patch eliminating the entity_key() function in the sched_fair.c latency value has been backported from upstream, and all tasks are now provided with fair CPU runtime. (BZ# 1219121)

* Previously, running the clock_gettime() function quickly in a loop could result in a jump back in time. Consequently, programs could behave unexpectedly when they assumed that clock_getime() returned an equal or greater time in subsequent calls. With this update, if the time delta between calls is negative, the clock is no longer updated.
As a result, a subsequent call to clock_gettime() is guaranteed to return a time greater than or equal to a previous call. (BZ#1219500)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3036 advisory.

    - crypto: aesni - fix memory usage in GCM decryption (Stephan Mueller)  [Orabug: 21077389]     {CVE-2015-3331}
    - xen/pciback: Don't disable PCI_COMMAND on PCI device reset. (Konrad Rzeszutek Wilk)  [Orabug: 20807440]     {CVE-2015-2150}
    - isofs: Fix unchecked printing of ER records (Jan Kara)  [Orabug: 20930552]  {CVE-2014-9584}
    - selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID. (Stephen Smalley)  [Orabug: 20930502]     {CVE-2014-3215}
    - Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs (Andy Lutomirski)  [Orabug:
    20930518]  {CVE-2014-3215}
    - IB/core: Prevent integer overflow in ib_umem_get address arithmetic (Shachar Raindel)  [Orabug:
    20788393]  {CVE-2014-8159} {CVE-2014-8159}
    - xen-pciback: limit guest control of command register (Jan Beulich)  [Orabug: 20704156]  {CVE-2015-2150}     {CVE-2015-2150}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2615-1 advisory.

    Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes     (xattrs). A local attacker could exploit this flaw to bypass ACLs and potentially escalate privileges.
    (CVE-2014-9710)

    A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code     path. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     escalate privileges on Intel base machines with AEC-GCM mode IPSec security association. (CVE-2015-3331)

    A flaw was discovered in the Linux kernel's IPv4 networking when using TCP fast open to initiate a     connection. An unprivileged local user could exploit this flaw to cause a denial of service (system     crash). (CVE-2015-3332)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-178:05 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any     Linux operating system. The kernel handles the basic functions     of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2014-9419     CVE-2014-9420     CVE-2014-9585     CVE-2015-1805     CVE-2015-3331

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - crypto: aesni

  - fix memory usage in GCM decryption (Stephan Mueller)     [Orabug: 21077385] (CVE-2015-3331)

  - xen/pciback: Don't disable PCI_COMMAND on PCI device     reset. (Konrad Rzeszutek Wilk) [Orabug: 20807438]     (CVE-2015-2150)

  - xen-blkfront: fix accounting of reqs when migrating     (Roger Pau Monne) [Orabug: 20860817]

  - Doc/cpu-hotplug: Specify race-free way to register CPU     hotplug callbacks (Srivatsa S. Bhat) [Orabug: 20917697]

  - net/iucv/iucv.c: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - net/core/flow.c: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - mm, vmstat: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697] 

  - profile: Fix CPU hotplug callback registration (Srivatsa     S. Bhat) 

  - trace, ring-buffer: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - hwmon, via-cputemp: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) 

  - hwmon, coretemp: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - octeon, watchdog: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - oprofile, nmi-timer: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - intel-idle: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - drivers/base/topology.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - acpi-cpufreq: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - scsi, fcoe: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697] 

  - scsi, bnx2fc: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - scsi, bnx2i: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - arm64, debug-monitors: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - arm64, hw_breakpoint.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, kvm: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, oprofile, nmi: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, pci, amd-bus: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, hpet: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, intel, cacheinfo: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, amd, ibs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, therm_throt.c: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, mce: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, intel, uncore: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, vsyscall: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, cpuid: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - x86, msr: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - powerpc, sysfs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) 

  - sparc, sysfs: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - s390, smp: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - s390, cacheinfo: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) 

  - arm, hw-breakpoint: Fix CPU hotplug callback     registration (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, err-inject: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, topology: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - ia64, palinfo: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - CPU hotplug, perf: Fix CPU hotplug callback registration     (Srivatsa S. Bhat) [Orabug: 20917697]

  - CPU hotplug: Provide lockless versions of callback     registration functions (Srivatsa S. Bhat) [Orabug:
    20917697]

  - isofs: Fix unchecked printing of ER records (Jan Kara)     [Orabug: 20930551] (CVE-2014-9584)

  - KEYS: close race between key lookup and freeing (Sasha     Levin) [Orabug: 20930548] (CVE-2014-9529)     (CVE-2014-9529)

  - mm: memcg: do not allow task about to OOM kill to bypass     the limit (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not declare OOM from __GFP_NOFAIL     allocations (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - fs: buffer: move allocation failure loop into the     allocator (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: handle non-error OOM situations more     gracefully (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - mm: memcg: do not trap chargers with full callstack on     OOM (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: rework and document OOM waiting and wakeup     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - mm: memcg: enable memcg OOM killer only for user faults     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - x86: finish user fault error path with fatal signal     (Johannes Weiner) [Orabug: 20930539] (CVE-2014-8171)

  - arch: mm: pass userspace fault flag to generic fault     handler (Johannes Weiner) [Orabug: 20930539]     (CVE-2014-8171)

  - selinux: Permit bounded transitions under NO_NEW_PRIVS     or NOSUID. (Stephen Smalley) [Orabug: 20930501]     (CVE-2014-3215)

  - IB/core: Prevent integer overflow in ib_umem_get address     arithmetic (Shachar Raindel) [Orabug: 20799875]     (CVE-2014-8159) (CVE-2014-8159)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
83410	RHEL 6 : MRG (RHSA-2015:0989)	Nessus	Red Hat Local Security Checks	2015/5/13	2021/2/5	high
83760	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2614-1)	Nessus	Ubuntu Local Security Checks	2015/5/21	2024/8/27	medium
84545	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2015:1174-1)	Nessus	SuSE Local Security Checks	2015/7/6	2021/1/6	medium
90019	OracleVM 3.2 : kernel-uek (OVMSA-2016-0037)	Nessus	OracleVM Local Security Checks	2016/3/18	2021/1/4	critical
84486	RHEL 6 : kernel (RHSA-2015:1199)	Nessus	Red Hat Local Security Checks	2015/7/1	2019/10/24	high
83449	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3036)	Nessus	Oracle Linux Local Security Checks	2015/5/14	2026/2/9	medium
83761	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2615-1)	Nessus	Ubuntu Local Security Checks	2015/5/21	2024/8/27	medium
289934	MiracleLinux 4 : kernel-2.6.32-504.23.4.el6 (AXSA:2015-178:05)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/9	medium
83485	OracleVM 3.3 : kernel-uek (OVMSA-2015-0060)	Nessus	OracleVM Local Security Checks	2015/5/15	2021/1/4	medium

检测

插件搜索

high

medium

medium

critical

high

medium

medium

medium

medium