The SUSE Linux Enterprise 12 SP1 kernel was updated to fix the following two issues :

  - CVE-2017-5970: Remote attackers could have potentially     caused a denial of service by sending bad IP options on     a socket (bsc#1024938)

  - Fix a regression in MD RAID1 which could have caused     wrong data to be read (bsc#1020048)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.9.10 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.60-52_49 fixes one issue. The following security bug was fixed :

  - CVE-2017-5970: The ipv4_pktinfo_prepare function in     net/ipv4/ip_sockglue.c in the Linux kernel allowed     attackers to cause a denial of service (system crash)     via (1) an application that made crafted system calls or     possibly (2) IPv4 traffic with invalid IP options     (bsc#1025013).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.61-52_66 fixes one issue. The following security bug was fixed :

  - CVE-2017-5970: The ipv4_pktinfo_prepare function in     net/ipv4/ip_sockglue.c in the Linux kernel allowed     attackers to cause a denial of service (system crash)     via (1) an application that made crafted system calls or     possibly (2) IPv4 traffic with invalid IP options     (bsc#1025013).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options.
(CVE-2017-5970)

Impact

This vulnerability may allow a remote user to cause a denial of service (DoS) for the BIG-IP control plane.

Note : Only the BIG-IP control plane is vulnerable; the data plane is not affected by this vulnerability.

The openSUSE Leap 42.2 kernel was updated to 4.4.49 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2017-5986: A userlevel triggerable BUG_ON on     sctp_wait_for_sndbuf was fixed. (bsc#1025235)

  - CVE-2017-5970: The ipv4_pktinfo_prepare function in     net/ipv4/ip_sockglue.c in the Linux kernel allowed     attackers to cause a denial of service (system crash)     via (1) an application that made crafted system calls or     possibly (2) IPv4 traffic with invalid IP options     (bnc#1024938).

  - CVE-2017-5897: A potential remote denial of service     within the IPv6 GRE protocol was fixed. (bsc#1023762)

  - CVE-2017-6074: The dccp_rcv_state_process function in     net/dccp/input.c in the Linux kernel mishandled     DCCP_PKT_REQUEST packet data structures in the LISTEN     state, which allowed local users to cause a denial of     service (invalid free) or possibly have unspecified     other impact via an application that makes an     IPV6_RECVPKTINFO setsockopt system call. (bsc#1026024).

The following non-security bugs were fixed :

  - btrfs: fix btrfs_compat_ioctl failures on non-compat     ioctls (bsc#1018100).

  - iwlwifi: Expose the default fallback ucode API to module     info (boo#1021082, boo#1023884).

  - kabi: protect struct tcp_fastopen_cookie (kabi).

  - md: ensure md devices are freed before module is     unloaded (bsc#1022304).

  - md: Fix a regression reported by bsc#1020048 in     patches.fixes/0003-md-lockless-I-O-submission-for-RAID1.
    patch (bsc#982783,bsc#998106,bsc#1020048).

  - net: ethtool: Initialize buffer when querying device     channel settings (bsc#969479 FATE#320634).

  - net: implement netif_cond_dbg macro (bsc#1019168).

  - sfc: reduce severity of PIO buffer alloc failures     (bsc#1019168).

  - sfc: refactor debug-or-warnings printks (bsc#1019168).

  - xfs_dmapi: fix the debug compilation of xfs_dmapi     (bsc#989056).

  - xfs: do not allow di_size with high bit set     (bsc#1024234).

  - xfs: exclude never-released buffers from buftarg I/O     accounting (bsc#1024508).

  - xfs: fix broken multi-fsb buffer logging (bsc#1024081).

  - xfs: fix buffer overflow     dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).

  - xfs: fix up xfs_swap_extent_forks inline extent handling     (bsc#1023888).

  - xfs: track and serialize in-flight async buffers against     unmount (bsc#1024508).

  - xfs: track and serialize in-flight async buffers against     unmount - kABI (bsc#1024508).

Security Fix(es) :

  - An use-after-free flaw was found in the Linux kernel     which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw     to escalate their privileges or crash the system.
    (CVE-2016-10200, Important)

  - A flaw was found that can be triggered in     keyring_search_iterator in keyring.c if type->match is     NULL. A local user could use this flaw to crash the     system or, potentially, escalate their privileges.
    (CVE-2017-2647, Important)

  - It was found that the NFSv4 server in the Linux kernel     did not properly validate layout type when processing     NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A     remote attacker could use this flaw to soft- lockup the     system and thus cause denial of service. (CVE-2017-8797,     Important)

This update also fixes multiple Moderate and Low impact security issues :

  - CVE-2015-8839, CVE-2015-8970, CVE-2016-9576,     CVE-2016-7042, CVE-2016-7097, CVE-2016-8645,     CVE-2016-9576, CVE-2016-9588, CVE-2016-9806,     CVE-2016-10088, CVE-2016-10147, CVE-2017-2596,     CVE-2017-2671, CVE-2017-5970, CVE-2017-6001,     CVE-2017-6951, CVE-2017-7187, CVE-2017-7616,     CVE-2017-7889, CVE-2017-8890, CVE-2017-9074,     CVE-2017-8890, CVE-2017-9075, CVE-2017-8890,     CVE-2017-9076, CVE-2017-8890, CVE-2017-9077,     CVE-2017-9242, CVE-2014-7970, CVE-2014-7975,     CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3422-1 advisory.

    It was discovered that a buffer overflow existed in the Bluetooth stack of the Linux kernel when handling     L2CAP configuration responses. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2017-1000251)

    It was discovered that the asynchronous I/O (aio) subsystem of the Linux kernel did not properly set     permissions on aio memory mappings in some situations. An attacker could use this to more easily exploit     other vulnerabilities. (CVE-2016-10044)

    Baozeng Ding and Andrey Konovalov discovered a race condition in the L2TPv3 IP Encapsulation     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-10200)

    Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not     clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group     privileges. (CVE-2016-7097)

    Sergej Schumilo, Ralf Spenneberg, and Hendrik Schwartke discovered that the key management subsystem in     the Linux kernel did not properly allocate memory in some situations. A local attacker could use this to     cause a denial of service (system crash). (CVE-2016-8650)

    Vlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO PCI driver for the Linux kernel.
    A local attacker with access to a vfio PCI device file could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)

    It was discovered that an information leak existed in __get_user_asm_ex() in the Linux kernel. A local     attacker could use this to expose sensitive information. (CVE-2016-9178)

    CAI Qian discovered that the sysctl implementation in the Linux kernel did not properly perform reference     counting in some situations. An unprivileged attacker could use this to cause a denial of service (system     hang). (CVE-2016-9191)

    It was discovered that the keyring implementation in the Linux kernel in some situations did not prevent     special internal keyrings from being joined by userspace keyrings. A privileged local attacker could use     this to bypass module verification. (CVE-2016-9604)

    It was discovered that an integer overflow existed in the trace subsystem of the Linux kernel. A local     privileged attacker could use this to cause a denial of service (system crash). (CVE-2016-9754)

    Andrey Konovalov discovered that the IPv4 implementation in the Linux kernel did not properly handle     invalid IP options in some situations. An attacker could use this to cause a denial of service or possibly     execute arbitrary code. (CVE-2017-5970)

    Dmitry Vyukov discovered that the Linux kernel did not properly handle TCP packets with the URG flag. A     remote attacker could use this to cause a denial of service. (CVE-2017-6214)

    It was discovered that a race condition existed in the AF_PACKET handling code in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-6346)

    It was discovered that the keyring implementation in the Linux kernel did not properly restrict searches     for dead keys. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-6951)

    Dmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux kernel contained a stack-based     buffer overflow. A local attacker with access to an sg device could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-7187)

    Eric Biggers discovered a memory leak in the keyring implementation in the Linux kernel. A local attacker     could use this to cause a denial of service (memory consumption). (CVE-2017-7472)

    It was discovered that a buffer overflow existed in the Broadcom FullMAC WLAN driver in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-7541)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001623 advisory.

    The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows     attackers to cause a denial of service (system crash) via (1) an application that makes crafted system     calls or possibly (2) IPv4 traffic with invalid IP options.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for the Linux Kernel 3.12.55-52_42 fixes one issue. The following security bug was fixed :

  - CVE-2017-5970: The ipv4_pktinfo_prepare function in     net/ipv4/ip_sockglue.c in the Linux kernel allowed     attackers to cause a denial of service (system crash)     via (1) an application that made crafted system calls or     possibly (2) IPv4 traffic with invalid IP options     (bsc#1025013).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.60-52_60 fixes one issue. The following security bug was fixed :

  - CVE-2017-5970: The ipv4_pktinfo_prepare function in     net/ipv4/ip_sockglue.c in the Linux kernel allowed     attackers to cause a denial of service (system crash)     via (1) an application that made crafted system calls or     possibly (2) IPv4 traffic with invalid IP options     (bsc#1025013).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the Linux kernel where     having malicious IP options present would cause the     ipv4_pktinfo_prepare() function to drop/free the dst.
    This could result in a system crash or possible     privilege escalation.

  - A vulnerability was found in the implementation of SCTP     protocol in the Linux kernel. If the sctp module was     loaded on the host, a privileged user inside a     container could cause a kernel crash by triggering     use-after-free in the __sctp_connect() function with a     specially crafted sequence of system calls.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3533 advisory.

    - Revert 'x86/mm: Expand the exception table logic to allow new handling options' (Brian Maly)  [Orabug:
    25790387]  {CVE-2016-9644}
    - Revert 'fix minor infoleak in get_user_ex()' (Brian Maly)  [Orabug: 25790387]  {CVE-2016-9644}
    - x86/mm: Expand the exception table logic to allow new handling options (Tony Luck)  [Orabug: 25790387]     {CVE-2016-9644}
    - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766898]  {CVE-2016-8399}     {CVE-2016-8399}
    - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765436]     {CVE-2016-10088}
    - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751984]  {CVE-2017-7187}
    - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696677]  {CVE-2017-2636}
    - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696677]  {CVE-2017-2636}
    - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451520]  {CVE-2016-8633}
    - usbnet: cleanup after bind() in probe() (Oliver Neukum)  [Orabug: 25463898]  {CVE-2016-3951}
    - cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind (Bjorn Mork)  [Orabug: 25463898]     {CVE-2016-3951}
    - cdc_ncm: Add support for moving NDP to end of NCM frame (Enrico Mioso)  [Orabug: 25463898]     {CVE-2016-3951}
    - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463918]     {CVE-2016-3672}
    - kvm: fix page struct leak in handle_vmon (Paolo Bonzini)  [Orabug: 25507133]  {CVE-2017-2596}
    - crypto: mcryptd - Check mcryptd algorithm compatibility (tim)  [Orabug: 25507153]  {CVE-2016-10147}
    - kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (Jim Mattson)  [Orabug: 25507188]     {CVE-2016-9588}
    - KVM: x86: drop error recovery in em_jmp_far and em_ret_far (Radim Krcmar)  [Orabug: 25507213]     {CVE-2016-9756}
    - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507226]  {CVE-2016-8645}
    - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507226]  {CVE-2016-8645}
    - tipc: check minimum bearer MTU (Michal Kubecek)  [Orabug: 25507239]  {CVE-2016-8632} {CVE-2016-8632}
    - fix minor infoleak in get_user_ex() (Al Viro)  [Orabug: 25507269]  {CVE-2016-9178}
    - scsi: arcmsr: Simplify user_len checking (Borislav Petkov)  [Orabug: 25507319]  {CVE-2016-7425}
    - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507319]     {CVE-2016-7425}
    - tmpfs: clear S_ISGID when setting posix ACLs (Gu Zheng)  [Orabug: 25507341]  {CVE-2016-7097}     {CVE-2016-7097}
    - posix_acl: Clear SGID bit when setting file permissions (Jan Kara)  [Orabug: 25507341]  {CVE-2016-7097}     {CVE-2016-7097}
    - ext2: convert to mbcache2 (Jan Kara)  [Orabug: 25512366]  {CVE-2015-8952}
    - ext4: convert to mbcache2 (Jan Kara)  [Orabug: 25512366]  {CVE-2015-8952}
    - mbcache2: reimplement mbcache (Jan Kara)  [Orabug: 25512366]  {CVE-2015-8952}
    - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512466]     {CVE-2016-3140}
    - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682419]  {CVE-2017-6345}
    - ipv4: keep skb->dst around in presence of IP options (Eric Dumazet)  [Orabug: 25698300]  {CVE-2017-5970}
    - perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race (Peter Zijlstra)  [Orabug:
    25698751]  {CVE-2017-6001}
    - ip6_gre: fix ip6gre_err() invalid reads (Eric Dumazet)  [Orabug: 25699015]  {CVE-2017-5897}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1842 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * An use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system.
    (CVE-2016-10200, Important)

    * A flaw was found that can be triggered in keyring_search_iterator in keyring.c if type->match is NULL. A     local user could use this flaw to crash the system or, potentially, escalate their privileges.
    (CVE-2017-2647, Important)

    * It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when     processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-     lockup the system and thus cause denial of service. (CVE-2017-8797, Important)

    This update also fixes multiple Moderate and Low impact security issues:

    * CVE-2015-8839, CVE-2015-8970, CVE-2016-9576, CVE-2016-7042, CVE-2016-7097, CVE-2016-8645, CVE-2016-9576,     CVE-2016-9588, CVE-2016-9806, CVE-2016-10088, CVE-2016-10147, CVE-2017-2596, CVE-2017-2671, CVE-2017-5970,     CVE-2017-6001, CVE-2017-6951, CVE-2017-7187, CVE-2017-7616, CVE-2017-7889, CVE-2017-8890, CVE-2017-9074,     CVE-2017-8890, CVE-2017-9075, CVE-2017-8890, CVE-2017-9076, CVE-2017-8890, CVE-2017-9077, CVE-2017-9242,     CVE-2014-7970, CVE-2014-7975, CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

    Documentation for these issues is available from the Release Notes document linked from the References     section.

    Red Hat would like to thank Igor Redko (Virtuozzo) and Andrey Ryabinin (Virtuozzo) for reporting     CVE-2017-2647; Igor Redko (Virtuozzo) and Vasily Averin (Virtuozzo) for reporting CVE-2015-8970; Marco     Grassi for reporting CVE-2016-8645; and Dmitry Vyukov (Google Inc.) for reporting CVE-2017-2596. The     CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat); the CVE-2016-7097 issue was discovered by     Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE); the CVE-2016-6213 and CVE-2016-9685 issues were     discovered by Qian Cai (Red Hat); and the CVE-2016-9604 issue was discovered by David Howells (Red Hat).

    Additional Changes:

    For detailed information on other changes in this release, see the Red Hat Enterprise Linux 7.4 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The perf_cpu_time_max_percent_handler function in     kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service     (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an     incorrect sample-rate calculation.(CVE-2017-18255)

  - In the Linux kernel before 4.13.5, a local user could     create keyrings for other users via keyctl commands,     setting unwanted defaults or causing a denial of     service.(CVE-2017-18270)

  - The timer_create syscall implementation in     kernel/time/posix-timers.c in the Linux kernel doesn't     properly validate the sigevent-i1/4zsigev_notify field,     which leads to out-of-bounds access in the show_timer     function.(CVE-2017-18344)

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584)

  - Linux kernel built with the KVM visualization support     (CONFIG_KVM), with nested visualization(nVMX) feature     enabled(nested=1), is vulnerable to host memory leakage     issue. It could occur while emulating VMXON instruction     in 'handle_vmon'. An L1 guest user could use this flaw     to leak host memory potentially resulting in     DoS.(CVE-2017-2596)

  - A race condition flaw was found in the N_HLDC Linux     kernel driver when accessing n_hdlc.tbuf list that can     lead to double free. A local, unprivileged user able to     set the HDLC line discipline on the tty device could     use this flaw to increase their privileges on the     system.(CVE-2017-2636)

  - A flaw was found that can be triggered in     keyring_search_iterator in keyring.c if type-i1/4zmatch     is NULL. A local user could use this flaw to crash the     system or, potentially, escalate their     privileges.(CVE-2017-2647)

  - A race condition leading to a NULL pointer dereference     was found in the Linux kernel's Link Layer Control     implementation. A local attacker with access to ping     sockets could use this flaw to crash the     system.(CVE-2017-2671)

  - A vulnerability was found in the Linux kernel in     'tmpfs' file system. When file permissions are modified     via 'chmod' and the user is not in the owning group or     capable of CAP_FSETID, the setgid bit is cleared in     inode_change_ok(). Setting a POSIX ACL via 'setxattr'     sets the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way this     allows to bypass the check in 'chmod'.(CVE-2017-5551)

  - The do_shmat function in ipc/shm.c in the Linux kernel,     through 4.9.12, does not restrict the address     calculated by a certain rounding operation. This allows     privileged local users to map page zero and,     consequently, bypass a protection mechanism that exists     for the mmap system call. This is possible by making     crafted shmget and shmat system calls in a privileged     context.(CVE-2017-5669)

  - A vulnerability was found in the Linux kernel where     having malicious IP options present would cause the     ipv4_pktinfo_prepare() function to drop/free the dst.
    This could result in a system crash or possible     privilege escalation.(CVE-2017-5970)

  - It was reported that with Linux kernel, earlier than     version v4.10-rc8, an application may trigger a BUG_ON     in sctp_wait_for_sndbuf if the socket tx buffer is     full, a thread is waiting on it to queue more data, and     meanwhile another thread peels off the association     being used by the first thread.(CVE-2017-5986)

  - It was found that the original fix for CVE-2016-6786     was incomplete. There exist a race between two     concurrent sys_perf_event_open() calls when both try     and move the same pre-existing software group into a     hardware context.(CVE-2017-6001)

  - A use-after-free flaw was found in the way the Linux     kernel's Datagram Congestion Control Protocol (DCCP)     implementation freed SKB (socket buffer) resources for     a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO     option is set on the socket. A local, unprivileged user     could use this flaw to alter the kernel memory,     allowing them to escalate their privileges on the     system.(CVE-2017-6074)

  - A flaw was found in the Linux kernel's handling of     packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality could     allow a remote attacker to force the kernel to enter a     condition in which it could loop     indefinitely.(CVE-2017-6214)

  - The hashbin_delete function in net/irda/irqueue.c in     the Linux kernel improperly manages lock dropping,     which allows local users to cause a denial of service     (deadlock) via crafted operations on IrDA     devices.(CVE-2017-6348)

  - It was found that the code in net/sctp/socket.c in the     Linux kernel through 4.10.1 does not properly restrict     association peel-off operations during certain wait     states, which allows local users to cause a denial of     service (invalid unlock and double free) via a     multithreaded application. This vulnerability was     introduced by CVE-2017-5986 fix (commit     2dcab5984841).(CVE-2017-6353)

  - The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel allows     local users to cause a denial of service via a     request_key system call for the 'dead' key     type.(CVE-2017-6951)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel allows local users to cause a denial of service     (stack-based buffer overflow) or possibly have     unspecified other impacts via a large command size in     an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds     write access in the sg_write function.(CVE-2017-7187)

  - In was found that in the Linux kernel, in     vmw_surface_define_ioctl() function in     'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file, a     'num_sizes' parameter is assigned a user-controlled     value which is not checked if it is zero. This is used     in a call to kmalloc() and later leads to dereferencing     ZERO_SIZE_PTR, which in turn leads to a GPF and     possibly to a kernel panic.(CVE-2017-7261)

  - An out-of-bounds write vulnerability was found in the     Linux kernel's vmw_surface_define_ioctl() function, in     the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is     unlikely.(CVE-2017-7294)

  - It was found that the packet_set_ring() function of the     Linux kernel's networking implementation did not     properly validate certain block-size data. A local     attacker with CAP_NET_RAW capability could use this     flaw to trigger a buffer overflow, resulting in the     crash of the system. Due to the nature of the flaw,     privilege escalation cannot be fully ruled     out.(CVE-2017-7308)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97298	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:0517-1)	Nessus	SuSE Local Security Checks	2017/2/21	2025/12/31	high
97310	Fedora 24 : kernel (2017-787bc0d5b4)	Nessus	Fedora Local Security Checks	2017/2/22	2025/12/31	medium
97847	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0769-1)	Nessus	SuSE Local Security Checks	2017/3/21	2025/12/29	high
97851	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0780-1)	Nessus	SuSE Local Security Checks	2017/3/21	2025/12/29	high
99444	F5 Networks BIG-IP : Linux kernel vulnerability (K60104355)	Nessus	F5 Networks Local Security Checks	2017/4/19	2025/12/25	high
97366	openSUSE Security Update : the Linux Kernel (openSUSE-2017-286)	Nessus	SuSE Local Security Checks	2017/2/24	2025/12/31	critical
102645	Scientific Linux Security Update : kernel on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	2017/8/22	2025/11/26	high
103326	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3422-1)	Nessus	Ubuntu Local Security Checks	2017/9/19	2024/8/27	high
290543	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001623)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
97849	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0771-1)	Nessus	SuSE Local Security Checks	2017/3/21	2025/12/29	high
97850	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0772-1)	Nessus	SuSE Local Security Checks	2017/3/21	2025/12/29	high
99732	Virtuozzo 7 : readykernel-patch (VZA-2017-032)	Nessus	Virtuozzo Local Security Checks	2017/5/1	2025/12/23	high
99159	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3533)	Nessus	Oracle Linux Local Security Checks	2017/4/3	2026/2/9	critical
102143	RHEL 7 : kernel (RHSA-2017:1842)	Nessus	Red Hat Local Security Checks	2017/8/3	2025/4/15	high
124825	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1502)	Nessus	Huawei Local Security Checks	2019/5/13	2022/5/20	high
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/4/3	2025/12/26	critical

检测

插件搜索

high

medium

high

high

high

critical

high

high

high

high

high

high

critical

high

high

critical