The version of Citrix XenServer running on the remote host is affected by multiple denial of service vulnerabilities :

  - An infinite loop condition exists in the KVM subsystem     that is triggered when handling a stream of #AC     (Alignment Check) exceptions. A local attacker within a     virtualized guest can exploit this to cause a host OS     panic or hang, resulting in a denial of service     condition. (CVE-2015-5307)

  - An infinite loop condition exists in the KVM subsystem     that is triggered when handling a stream of #DB (Debug)     exceptions. A local attacker within a virtualized guest     can exploit this to cause a host OS panic or hang,     resulting in a denial of service condition.
    (CVE-2015-8104)

Multiple vulnerabilities have been discovered in VirtualBox, an x86 virtualisation solution.

Upstream support for the 4.1 release series has ended and since no information is available which would allow backports of isolated security fixes, security support for virtualbox in wheezy/oldstable needed to be ended as well. If you use virtualbox with externally procured VMs (e.g. through vagrant) we advise you to update to Debian jessie.

x86: CPU lockup during exception delivery [XSA-156, CVE-2015-5307, CVE-2015-8104] ---- update to 4.5.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)     [Orabug: 22333698] (CVE-2015-8104)

  - KVM: x86: work around infinite loop in microcode when     #AC is delivered (Eric Northup) [Orabug: 22333689]     (CVE-2015-5307) (CVE-2015-5307)

  - KVM: x86: Defining missing x86 vectors (Nadav Amit)     [Orabug: 22333689]

This update fixes the following security issues :

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970 xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)     563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch

This update fixes the following security issues :

  - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour     readonly flag on disks with qemu-xen (xsa-142)

  - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by     triggering an infinite loop in microcode via #DB     exception

  - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during     fault delivery (XSA-156)

  - bsc#950704 - CVE-2015-7970: xen: x86: Long latency     populate-on-demand operation is not preemptible     (XSA-150)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2841-1 advisory.

    Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly     catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a     denial of service (system crash) in the host OS. (CVE-2015-8104)

     discovered that the ppp implementation in the Linux kernel did not ensure that certain slot     numbers are valid. A local attacker with the privilege to call ioctl() on /dev/ppp could cause a denial of     service (system crash). (CVE-2015-7799)

    It was discovered that the driver for Digi Neo and ClassicBoard devices did not properly initialize data     structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7885)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2842-2 advisory.

    Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly     catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a     denial of service (system crash) in the host OS. (CVE-2015-8104)

     discovered that the ppp implementation in the Linux kernel did not ensure that certain slot     numbers are valid. A local attacker with the privilege to call ioctl() on /dev/ppp could cause a denial of     service (system crash). (CVE-2015-7799)

    It was discovered that the virtual video osd test driver in the Linux kernel did not properly initialize     data structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7884)

    It was discovered that the driver for Digi Neo and ClassicBoard devices did not properly initialize data     structures. A local attacker could use this to obtain sensitive information from the kernel.
    (CVE-2015-7885)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their privileges on the system.
(CVE-2015-2925, Important)

* It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) and #DB (debug exception) is handled. A privileged user inside a guest could use these flaws to create denial of service conditions on the host kernel. (CVE-2015-5307, CVE-2015-8104, Important)

* A race condition flaw was found in the way the Linux kernel's IPC subsystem initialized certain fields in an IPC object structure that were later used for permission checking before inserting the object into a globally visible list. A local, unprivileged user could potentially use this flaw to elevate their privileges on the system.
(CVE-2015-7613, Important)

* It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2015-7872, Important)

Red Hat would like to thank Ben Serebrin of Google Inc. for reporting the CVE-2015-5307 issue.

This update also fixes the following bugs :

* Previously, Human Interface Device (HID) ran a report on an unaligned buffer, which could cause a page fault interrupt and an oops when the end of the report was read. This update fixes this bug by padding the end of the report with extra bytes, so the reading of the report never crosses a page boundary. As a result, a page fault and subsequent oops no longer occur. (BZ#1268203)

* The NFS client was previously failing to detect a directory loop for some NFS server directory structures. This failure could cause NFS inodes to remain referenced after attempting to unmount the file system, leading to a kernel crash. Loop checks have been added to VFS, which effectively prevents this problem from occurring. (BZ#1272858)

* Due to a race whereby the nfs_wb_pages_cancel() and nfs_commit_release_pages() calls both removed a request from the nfs_inode struct type, the kernel panicked with negative nfs_inode.npages count. The provided upstream patch performs the required serialization by holding the inode i_lock over the check of PagePrivate and locking the request, thus preventing the race and kernel panic from occurring. (BZ#1273721)

* Due to incorrect URB_ISO_ASAP semantics, playing an audio file using a USB sound card could previously fail for some hardware configurations. This update fixes the bug, and playing audio from a USB sound card now works as expected. (BZ#1273916)

* Inside hugetlb, region data structures were protected by a combination of a memory map semaphore and a single hugetlb instance mutex. However, a page-fault scalability improvement backported to the kernel on previous releases removed the single hugetlb instance mutex and introduced a new mutex table, making the locking combination insufficient, leading to possible race windows that could cause corruption and undefined behavior. This update fixes the problem by introducing a required spinlock to the region tracking functions for proper serialization. The problem only affects software using huge pages through hugetlb interface. (BZ#1274599)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

- A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in which     the source was inside and the destination was outside of     a bind mount. A privileged user inside a container could     use this flaw to escape the bind mount and, potentially,     escalate their privileges on the system. (CVE-2015-2925,     Important)

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as #AC     (alignment check exception) and #DB (debug exception) is     handled. A privileged user inside a guest could use     these flaws to create denial of service conditions on     the host kernel. (CVE-2015-5307, CVE-2015-8104,     Important)

  - A race condition flaw was found in the way the Linux     kernel's IPC subsystem initialized certain fields in an     IPC object structure that were later used for permission     checking before inserting the object into a globally     visible list. A local, unprivileged user could     potentially use this flaw to elevate their privileges on     the system. (CVE-2015-7613, Important)

  - It was found that the Linux kernel's keys subsystem did     not correctly garbage collect uninstantiated keyrings. A     local attacker could use this flaw to crash the system     or, potentially, escalate their privileges on the     system. (CVE-2015-7872, Important)

This update also fixes the following bugs :

  - Previously, Human Interface Device (HID) ran a report on     an unaligned buffer, which could cause a page fault     interrupt and an oops when the end of the report was     read. This update fixes this bug by padding the end of     the report with extra bytes, so the reading of the     report never crosses a page boundary. As a result, a     page fault and subsequent oops no longer occur.

  - The NFS client was previously failing to detect a     directory loop for some NFS server directory structures.
    This failure could cause NFS inodes to remain referenced     after attempting to unmount the file system, leading to     a kernel crash. Loop checks have been added to VFS,     which effectively prevents this problem from occurring.

  - Due to a race whereby the nfs_wb_pages_cancel() and     nfs_commit_release_pages() calls both removed a request     from the nfs_inode struct type, the kernel panicked with     negative nfs_inode.npages count. The provided upstream     patch performs the required serialization by holding the     inode i_lock over the check of PagePrivate and locking     the request, thus preventing the race and kernel panic     from occurring.

  - Due to incorrect URB_ISO_ASAP semantics, playing an     audio file using a USB sound card could previously fail     for some hardware configurations. This update fixes the     bug, and playing audio from a USB sound card now works     as expected.

  - Inside hugetlb, region data structures were protected by     a combination of a memory map semaphore and a single     hugetlb instance mutex. However, a page-fault     scalability improvement backported to the kernel on     previous releases removed the single hugetlb instance     mutex and introduced a new mutex table, making the     locking combination insufficient, leading to possible     race windows that could cause corruption and undefined     behavior. This update fixes the problem by introducing a     required spinlock to the region tracking functions for     proper serialization. The problem only affects software     using huge pages through hugetlb interface.

The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3502 advisory.

    - KEYS: Don't permit request_key() to construct a new keyring (David Howells)  [Orabug: 22373449]     {CVE-2015-7872}
    - crypto: add missing crypto module aliases (Mathias Krause)  [Orabug: 22249656]  {CVE-2013-7421}     {CVE-2014-9644}
    - crypto: include crypto- module prefix in template (Kees Cook)  [Orabug: 22249656]  {CVE-2013-7421}     {CVE-2014-9644}
    - crypto: prefix module autoloading with 'crypto-' (Kees Cook)  [Orabug: 22249656]  {CVE-2013-7421}     {CVE-2014-9644}
    - KVM: x86: Don't report guest userspace emulation error to userspace (Nadav Amit)  [Orabug: 22249615]     {CVE-2010-5313} {CVE-2014-7842}
    - msg_unlock() in wrong spot after applying 'Initialize msg/shm IPC objects before doing ipc_addid()'     (Chuck Anderson)  [Orabug: 22250044]  {CVE-2015-7613} {CVE-2015-7613}
    - ipc/sem.c: fully initialize sem_array before making it visible (Manfred Spraul)  [Orabug: 22250044]     {CVE-2015-7613}
    - Initialize msg/shm IPC objects before doing ipc_addid() (Linus Torvalds)  [Orabug: 22250044]     {CVE-2015-7613}
    - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)  [Orabug: 22333698]  {CVE-2015-8104}     {CVE-2015-8104}
    - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup)  [Orabug:
    22333689]  {CVE-2015-5307} {CVE-2015-5307}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-7509: Mounting ext4 filesystems in no-journal     mode could hav lead to a system crash (bsc#956709).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #DB (aka     Debug) exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #AC (aka     Alignment Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2015-7990: RDS: There was no verification that an     underlying transport exists when creating a connection,     causing usage of a NULL pointer (bsc#952384).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandled IRET faults in     processing NMIs that occurred during userspace     execution, which might have allowed local users to gain     privileges by triggering an NMI (bnc#938706).

  - CVE-2015-7872: The key_gc_unused_keys function in     security/keys/gc.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) via crafted     keyctl commands (bnc#951440).

  - CVE-2015-0272: Missing checks allowed remote attackers     to cause a denial of service (IPv6 traffic disruption)     via a crafted MTU value in an IPv6 Router Advertisement     (RA) message, a different vulnerability than     CVE-2015-8215 (bnc#944296).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
87012	Citrix XenServer Multiple Infinite Loop Guest-to-Host DoS (CTX202583)	Nessus	Misc.	2015/11/23	2019/11/20	medium
88423	Debian DSA-3454-1 : virtualbox - security update	Nessus	Debian Local Security Checks	2016/1/28	2021/1/11	medium
89212	Fedora 23 : xen-4.5.2-2.fc23 (2015-394835a3f6)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
87288	Debian DSA-3414-1 : xen - security update	Nessus	Debian Local Security Checks	2015/12/10	2021/1/11	medium
87333	OracleVM 3.3 : kernel-uek (OVMSA-2015-0154)	Nessus	OracleVM Local Security Checks	2015/12/14	2021/1/4	medium
87393	openSUSE Security Update : xen (openSUSE-2015-892)	Nessus	SuSE Local Security Checks	2015/12/16	2021/1/19	medium
87443	openSUSE Security Update : xen (openSUSE-2015-893)	Nessus	SuSE Local Security Checks	2015/12/17	2021/1/19	high
87466	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2841-1)	Nessus	Ubuntu Local Security Checks	2015/12/17	2024/8/27	low
87469	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2842-2)	Nessus	Ubuntu Local Security Checks	2015/12/17	2024/8/27	low
87381	CentOS 6 : kernel (CESA-2015:2636)	Nessus	CentOS Local Security Checks	2015/12/16	2021/1/4	medium
87403	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20151215)	Nessus	Scientific Linux Local Security Checks	2015/12/16	2021/1/14	medium
87835	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2016-3502)	Nessus	Oracle Linux Local Security Checks	2016/1/11	2026/2/9	critical
87651	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2015:2339-1)	Nessus	SuSE Local Security Checks	2015/12/29	2021/1/6	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

high

low

low

medium

medium

critical

medium