The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003452 advisory.

    Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the     Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have     unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP 3 kernel was updated to fix two security issues. The following security bugs were fixed :

  - CVE-2016-9576: A use-after-free vulnerability in the     SCSI generic driver allows users with write access to     /dev/sg* or /dev/bsg* to elevate their privileges     (bsc#1013604).

  - CVE-2016-9794: A use-after-free vulnerability in the     ALSA pcm layer allowed local users to cause a denial of     service, memory corruption or possibly even to elevate     their privileges (bsc#1013533).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP 2 kernel was updated to fix two security issues. The following security bugs were fixed :

  - CVE-2016-9576: A use-after-free vulnerability in the     SCSI generic driver allows users with write access to     /dev/sg* or /dev/bsg* to elevate their privileges     (bsc#1013604).

  - CVE-2016-9794: A use-after-free vulnerability in the     ALSA pcm layer allowed local users to cause a denial of     service, memory corruption or possibly even to elevate     their privileges (bsc#1013533).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly initialize the Code Segment (CS) in certain error cases. A local attacker could use this to expose sensitive information (kernel memory).

Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-9794).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3169-1 advisory.

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly initialize the     Code Segment (CS) in certain error cases. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2016-9756)

    Andrey Konovalov discovered that signed integer overflows existed in the setsockopt() system call when     handling the SO_SNDBUFFORCE and SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability     could use this to cause a denial of service (system crash or memory corruption). (CVE-2016-9793)

    Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound     Architecture (ALSA) subsystem of the Linux kernel. A local attacker could use this to cause a denial of     service (system crash). (CVE-2016-9794)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for the Linux Kernel 3.12.60-52_54 fixes several issues.
The following security bugs were fixed :

  - CVE-2016-9806: Race condition in the netlink_dump     function in net/netlink/af_netlink.c in the Linux kernel     allowed local users to cause a denial of service (double     free) or possibly have unspecified other impact via a     crafted application that made sendmsg system calls,     leading to a free operation associated with a new dump     that started earlier than anticipated (bsc#1017589).

  - CVE-2016-9794: Race condition in the     snd_pcm_period_elapsed function in sound/core/pcm_lib.c     in the ALSA subsystem in the Linux kernel allowed local     users to cause a denial of service (use-after-free) or     possibly have unspecified other impact via a crafted     SNDRV_PCM_TRIGGER_START command (bsc#1013543).

  - CVE-2016-8632: The tipc_msg_build function in     net/tipc/msg.c in the Linux kernel did not validate the     relationship between the minimum fragment length and the     maximum packet size, which allowed local users to gain     privileges or cause a denial of service (heap-based     buffer overflow) by leveraging the CAP_NET_ADMIN     capability (bsc#1012852).

  - CVE-2016-9576: The blk_rq_map_user_iov function in     block/blk-map.c in the Linux kernel did not properly     restrict the type of iterator, which allowed local users     to read or write to arbitrary kernel memory locations or     cause a denial of service (use-after-free) by leveraging     access to a /dev/sg device (bsc#1014271).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.60-52_60 fixes several issues.
The following security bugs were fixed :

  - CVE-2016-9806: Race condition in the netlink_dump     function in net/netlink/af_netlink.c in the Linux kernel     allowed local users to cause a denial of service (double     free) or possibly have unspecified other impact via a     crafted application that made sendmsg system calls,     leading to a free operation associated with a new dump     that started earlier than anticipated (bsc#1017589).

  - CVE-2016-9794: Race condition in the     snd_pcm_period_elapsed function in sound/core/pcm_lib.c     in the ALSA subsystem in the Linux kernel allowed local     users to cause a denial of service (use-after-free) or     possibly have unspecified other impact via a crafted     SNDRV_PCM_TRIGGER_START command (bsc#1013543).

  - CVE-2016-9576: The blk_rq_map_user_iov function in     block/blk-map.c in the Linux kernel did not properly     restrict the type of iterator, which allowed local users     to read or write to arbitrary kernel memory locations or     cause a denial of service (use-after-free) by leveraging     access to a /dev/sg device (bsc#1014271).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.51-52_39 fixes several issues.
The following security bugs were fixed :

  - CVE-2016-9806: Race condition in the netlink_dump     function in net/netlink/af_netlink.c in the Linux kernel     allowed local users to cause a denial of service (double     free) or possibly have unspecified other impact via a     crafted application that made sendmsg system calls,     leading to a free operation associated with a new dump     that started earlier than anticipated (bsc#1017589).

  - CVE-2016-9794: Race condition in the     snd_pcm_period_elapsed function in sound/core/pcm_lib.c     in the ALSA subsystem in the Linux kernel allowed local     users to cause a denial of service (use-after-free) or     possibly have unspecified other impact via a crafted     SNDRV_PCM_TRIGGER_START command (bsc#1013543).

  - CVE-2016-8632: The tipc_msg_build function in     net/tipc/msg.c in the Linux kernel did not validate the     relationship between the minimum fragment length and the     maximum packet size, which allowed local users to gain     privileges or cause a denial of service (heap-based     buffer overflow) by leveraging the CAP_NET_ADMIN     capability (bsc#1012852).

  - CVE-2016-9576: The blk_rq_map_user_iov function in     block/blk-map.c in the Linux kernel did not properly     restrict the type of iterator, which allowed local users     to read or write to arbitrary kernel memory locations or     cause a denial of service (use-after-free) by leveraging     access to a /dev/sg device (bsc#1014271).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The openSUSE Leap 42.1 kernel was updated to 4.1.36 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2016-8655: A race condition in the af_packet     packet_set_ring function could be used by local     attackers to crash the kernel or gain privileges     (bsc#1012754).

  - CVE-2016-9794: A use-after-free in ALSA pcm could lead     to crashes or allowed local users to potentially gain     privileges (bsc#1013533).

  - CVE-2015-8962: Double free vulnerability in the     sg_common_write function in drivers/scsi/sg.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (memory corruption and system     crash) by detaching a device during an SG_IO ioctl call     (bnc#1010501).

  - CVE-2016-9178: The __get_user_asm_ex macro in     arch/x86/include/asm/uaccess.h in the Linux kernel did     not initialize a certain integer variable, which allowed     local users to obtain sensitive information from kernel     stack memory by triggering failure of a get_user_ex call     (bnc#1008650).

  - CVE-2016-7913: The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (use-after-free) via vectors involving     omission of the firmware name from a certain data     structure (bnc#1010478).

  - CVE-2016-9555: The sctp_sf_ootb function in     net/sctp/sm_statefuns.c in the Linux kernel lacks     chunk-length checking for the first chunk, which allowed     remote attackers to cause a denial of service     (out-of-bounds slab access) or possibly have unspecified     other impact via crafted SCTP data (bnc#1011685).

  - CVE-2015-8963: Race condition in kernel/events/core.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (use-after-free) by     leveraging incorrect handling of an swevent data     structure during a CPU unplug operation (bnc#1010502).

  - CVE-2015-8964: The tty_set_termios_ldisc function in     drivers/tty/tty_ldisc.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory by reading a tty data structure (bnc#1010507).

  - CVE-2016-8646: The hash_accept function in     crypto/algif_hash.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) by attempting     to trigger use of in-kernel hash algorithms for a socket     that has received zero bytes of data (bnc#1010150).

  - CVE-2016-8633: drivers/firewire/net.c in the Linux     kernel in certain unusual hardware configurations,     allowed remote attackers to execute arbitrary code via     crafted fragmented packets (bnc#1008833).

  - CVE-2016-8630: The x86_decode_insn function in     arch/x86/kvm/emulate.c in the Linux kernel, when KVM is     enabled, allowed local users to cause a denial of     service (host OS crash) via a certain use of a ModR/M     byte in an undefined instruction (bnc#1009222).

  - CVE-2016-9083: drivers/vfio/pci/vfio_pci.c in the Linux     kernel allowed local users to bypass integer overflow     checks, and cause a denial of service (memory     corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a     VFIO_DEVICE_SET_IRQS ioctl call, aka a 'state machine     confusion bug (bnc#1007197).

  - CVE-2016-9084: drivers/vfio/pci/vfio_pci_intrs.c in the     Linux kernel misuses the kzalloc function, which allowed     local users to cause a denial of service (integer     overflow) or have unspecified other impact by leveraging     access to a vfio PCI device file (bnc#1007197).

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel through 4.8.2,     when the GNU Compiler Collection (gcc) stack protector     is enabled, uses an incorrect buffer size for certain     timeout data, which allowed local users to cause a     denial of service (stack memory corruption and panic) by     reading the /proc/keys file (bnc#1004517).

  - CVE-2016-7097: The filesystem implementation in the     Linux kernel preserves the setgid bit during a setxattr     call, which allowed local users to gain group privileges     by leveraging the existence of a setgid program with     restrictions on execute permissions (bnc#995968).

  - CVE-2015-8956: The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel allowed     local users to obtain sensitive information or cause a     denial of service (NULL pointer dereference) via vectors     involving a bind system call on a Bluetooth RFCOMM     socket (bnc#1003925).

The following non-security bugs were fixed :

  - ata: ahci_xgene: dereferencing uninitialized pointer in     probe (bsc#1006580).

  - blacklist.conf: add some commits (bsc#1006580)

  - bna: Add synchronization for tx ring (bsc#993739).

  - bonding: set carrier off for devices created through     netlink (bsc#999577).

  - btrfs: deal with duplicates during extent_map insertion     in btrfs_get_extent (bsc#1001171).

  - btrfs: deal with existing encompassing extent map in     btrfs_get_extent() (bsc#1001171).

  - btrfs: fix extent tree corruption due to relocation     (bsc#990384).

  - btrfs: fix races on root_log_ctx lists (bsc#1007653).

  - ext4: fix data exposure after a crash (bsc#1012876).

  - ext4: fix reference counting bug on block allocation     error (bsc#1012876).

  - gre: Disable segmentation offloads w/ CSUM and we are     encapsulated via FOU (bsc#1001486).

  - gro: Allow tunnel stacking in the case of FOU/GUE     (bsc#1001486).

  - ipv6: send NEWLINK on RA managed/otherconf changes     (bsc#934067).

  - ipv6: send only one NEWLINK when RA causes changes     (bsc#934067).

  - isofs: Do not return EACCES for unknown filesystems     (bsc#1012876).

  - jbd2: fix checkpoint list cleanup (bsc#1012876).

  - jbd2: Fix unreclaimed pages after truncate in     data=journal mode (bsc#1010909).

  - locking/static_key: Fix concurrent static_key_slow_inc()     (bsc#1006580).

  - mmc: Fix kabi breakage of mmc-block in 4.1.36     (stable-4.1.36).

  - posix_acl: Added fix for f2fs.

  - Revert 'kbuild: add -fno-PIE' (stable-4.1.36).

  - Revert 'x86/mm: Expand the exception table logic to     allow new handling options' (stable-4.1.36).

  - tunnels: Remove encapsulation offloads on decap     (bsc#1001486).

  - usbhid: add ATEN CS962 to list of quirky devices     (bsc#1007615).

  - vmxnet3: Wake queue from reset work (bsc#999907).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - KEYS: Fix short sprintf buffer in /proc/keys show     function (David Howells) [Orabug: 25306361]     (CVE-2016-7042)

  - nvme: Limit command retries (Keith Busch) [Orabug:
    25374751]

  - fs/proc/task_mmu.c: fix mm_access mode parameter in     pagemap_read (Kenny Keslar) [Orabug: 25374977]

  - tcp: fix use after free in tcp_xmit_retransmit_queue     (Eric Dumazet) [Orabug: 25374364] (CVE-2016-6828)

  - tunnels: Don't apply GRO to multiple layers of     encapsulation. (Jesse Gross) [Orabug: 25036352]     (CVE-2016-8666)

  - i40e: Don't notify client(s) for DCB changes on all VSIs     (Neerav Parikh) [Orabug: 25046290]

  - packet: fix race condition in packet_set_ring (Philip     Pettersson) [Orabug: 25231617] (CVE-2016-8655)

  - netlink: Fix dump skb leak/double free (Herbert Xu)     [Orabug: 25231692] (CVE-2016-9806)

  - ALSA: pcm : Call kill_fasync in stream lock (Takashi     Iwai) [Orabug: 25231720] (CVE-2016-9794)

  - net: avoid signed overflows for SO_[SND|RCV]BUFFORCE     (Eric Dumazet) [Orabug: 25231751] (CVE-2016-9793)

  - rebuild bumping release

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
287858	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003452)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
96089	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:3248-1)	Nessus	SuSE Local Security Checks	2016/12/22	2026/1/7	high
96137	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:3252-1)	Nessus	SuSE Local Security Checks	2016/12/27	2026/1/7	high
96436	Ubuntu 12.04 LTS : linux vulnerabilities (USN-3167-1)	Nessus	Ubuntu Local Security Checks	2017/1/12	2026/1/6	high
96439	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3169-1)	Nessus	Ubuntu Local Security Checks	2017/1/12	2024/8/27	high
96699	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0246-1)	Nessus	SuSE Local Security Checks	2017/1/23	2026/1/5	high
96761	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0267-1)	Nessus	SuSE Local Security Checks	2017/1/25	2026/1/2	high
96762	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0268-1)	Nessus	SuSE Local Security Checks	2017/1/25	2026/1/2	high
95321	CentOS 7 : kernel (CESA-2016:2574)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	critical
95702	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1428)	Nessus	SuSE Local Security Checks	2016/12/12	2026/1/14	critical
96517	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0004)	Nessus	OracleVM Local Security Checks	2017/1/16	2026/1/5	high

检测

插件搜索

high

high

high

high

high

high

high

high

critical

critical

high