The 4.11.6 update contains a number of important fixes across the tree, including the recently announced 'stack clash'

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3587 advisory.

    - mm: fix new crash in unmapped_area_topdown() (Hugh Dickins)  [Orabug: 26326143]  {CVE-2017-1000364}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult.
(CVE-2017-1000364, Important)

* A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment list(skb_shinfo(skb)->frag_list) in the socket buffer(skb_buff). The heap overflow occurred if 'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST' feature are both used together. A remote user or process could use this flaw to potentially escalate their privilege on a system. (CVE-2017-7477, Important)

* The NFS2/3 RPC client could send long arguments to the NFS server.
These encoded arguments are stored in an array of memory pages, and accessed using pointer variables. Arbitrarily long arguments could make these pointers point outside the array and cause an out-of-bounds memory access. A remote user or program could use this flaw to crash the kernel, resulting in denial of service. (CVE-2017-7645, Important)

* The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lacked certain checks for the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly cause other unspecified impacts using crafted requests related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c. (CVE-2017-7895, Important)

* Linux kernel built with the Kernel-based Virtual Machine (CONFIG_KVM) support was vulnerable to an incorrect segment selector(SS) value error. The error could occur while loading values into the SS register in long mode. A user or process inside a guest could use this flaw to crash the guest, resulting in DoS or potentially escalate their privileges inside the guest.
(CVE-2017-2583, Moderate)

* A flaw was found in the Linux kernel's handling of packets with the URG flag. Applications using the splice() and tcp_splice_read() functionality could allow a remote attacker to force the kernel to enter a condition in which it could loop indefinitely. (CVE-2017-6214, Moderate)

Red Hat would like to thank Qualys Research Labs for reporting CVE-2017-1000364; Ari Kauppi for reporting CVE-2017-7895; and Xiaohan Zhang (Huawei Inc.) for reporting CVE-2017-2583.

Bug Fix(es) :

* The kernel-rt packages have been upgraded to the 3.10.0-514.25.2 source tree, which provides a number of bug fixes over the previous version. (BZ# 1452742)

* Previously, a local lock acquisition around the ip_send_unicast_reply() function was incorrectly terminated.
Consequently, a list corruption occurred that led to a kernel panic.
This update adds locking functions around calls to ip_send_unicast_reply(). As a result, neither list corruption nor kernel panic occur under the described circumstances. (BZ# 1455239)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1647 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were adjacent to each other, an attacker could use this     flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue     more difficult. (CVE-2017-1000364, Important)

    * The NFS2/3 RPC client could send long arguments to the NFS server. These encoded arguments are stored in     an array of memory pages, and accessed using pointer variables. Arbitrarily long arguments could make     these pointers point outside the array and cause an out-of-bounds memory access. A remote user or program     could use this flaw to crash the kernel, resulting in denial of service. (CVE-2017-7645, Important)

    * The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lacked certain checks for     the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly cause other     unspecified impacts using crafted requests related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
    (CVE-2017-7895, Important)

    * A flaw was found in the Linux kernel's handling of packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality could allow a remote attacker to force the kernel to enter a     condition in which it could loop indefinitely. (CVE-2017-6214, Moderate)

    Red Hat would like to thank Qualys Research Labs for reporting CVE-2017-1000364 and Ari Kauppi for     reporting CVE-2017-7895.

    Bug Fix(es):

    * kernel-rt packages have been upgraded to the 3.10.0-514 source tree, which provides a number of bug     fixes over the previous version. (BZ#1452745)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New kernel packages are available for Slackware 14.1 to fix security issues.

The openSUSE Leap 42.2 kernel was updated to 4.4.72 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2017-1000364: An issue was discovered in the size of     the stack guard page on Linux, specifically a 4k stack     guard page is not sufficiently large and can be 'jumped'     over (the stack guard page is bypassed), this affects     Linux Kernel versions 4.11.5 and earlier (the stackguard     page was introduced in 2010) (bnc#1039348).

  - CVE-2017-1000380: sound/core/timer.c in the Linux kernel     is vulnerable to a data race in the ALSA /dev/snd/timer     driver resulting in local users being able to read     information belonging to other users, i.e.,     uninitialized memory contents may be disclosed when a     read and an ioctl happen at the same time (bnc#1044125).

  - CVE-2017-7346: The vmw_gb_surface_define_ioctl function     in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel did not validate certain levels data, which     allowed local users to cause a denial of service (system     hang) via a crafted ioctl call for a /dev/dri/renderD*     device (bnc#1031796).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel is too late in     checking whether an overwrite of an skb data structure     may occur, which allowed local users to cause a denial     of service (system crash) via crafted system calls     (bnc#1041431).

The following non-security bugs were fixed :

  - ASoC: Intel: Skylake: Uninitialized variable in     probe_codec() (bsc#1043231).

  - IB/core: Fix kernel crash during fail to initialize     device (bsc#1022595 FATE#322350).

  - IB/core: For multicast functions, verify that LIDs are     multicast LIDs (bsc#1022595 FATE#322350).

  - IB/core: If the MGID/MLID pair is not on the list return     an error (bsc#1022595 FATE#322350).

  - IB/ipoib: Fix deadlock between ipoib_stop and mcast join     flow (bsc#1022595 FATE#322350).

  - Make __xfs_xattr_put_listen preperly report errors     (bsc#1041242).

  - NFS: Fix an LOCK/OPEN race when unlinking an open file     (git-fixes).

  - NFSv4: Fix the underestimation of delegation XDR space     reservation (git-fixes).

  - NFSv4: fix a reference leak caused WARNING messages     (git-fixes).

  - PM / QoS: Fix memory leak on resume_latency.notifiers     (bsc#1043231).

  - SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use     (git-fixes).

  - SUNRPC: ensure correct error is reported by     xs_tcp_setup_socket() (git-fixes).

  - Update patches.fixes/xen-silence-efi-error-messge.patch     (bnc#1039900).

  - [media] vb2: Fix an off by one error in     'vb2_plane_vaddr' (bsc#1043231).

  - bcache: fix calling ida_simple_remove() with incorrect     minor (bsc#1038085).

  - bna: add missing per queue ethtool stat (bsc#966321     FATE#320156).

  - bna: integer overflow bug in debugfs (bsc#966321     FATE#320156).

  - bonding: avoid defaulting hard_header_len to ETH_HLEN on     slave removal (bsc#1042286).

  - bonding: do not use stale speed and duplex information     (bsc#1042286).

  - bonding: prevent out of bound accesses (bsc#1042286).

  - brcmfmac: add fallback for devices that do not report     per-chain values (bsc#1043231).

  - brcmfmac: avoid writing channel out of allocated array     (bsc#1043231).

  - ceph: fix potential use-after-free (bsc#1043371).

  - ceph: memory leak in ceph_direct_read_write callback     (bsc#1041810).

  - cfq-iosched: fix the delay of cfq_group's vdisktime     under iops mode (bsc#1012829).

  - cgroup: remove redundant cleanup in css_create     (bsc#1012829).

  - cifs: small underflow in cnvrtDosUnixTm() (bnc#1043935).

  - drm/mgag200: Fix to always set HiPri for G200e4     (bsc#1015452, bsc#995542).

  - drm/nouveau/tmr: fully separate alarm execution/pending     lists (bsc#1043467).

  - efi: Do not issue error message when booted under Xen     (bnc#1036638).

  - ext4: fix data corruption for mmap writes (bsc#1012829).

  - ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO     (bsc#1012829).

  - fuse: fix clearing suid, sgid for chown() (bsc#1012829).

  - ibmvnic: Check adapter state during ibmvnic_poll     (fate#322021, bsc#1040855).

  - ibmvnic: Deactivate RX pool buffer replenishment on     H_CLOSED (fate#322021, bsc#1040855).

  - ibmvnic: Fix cleanup of SKB's on driver close     (fate#322021, bsc#1040855).

  - ibmvnic: Halt TX and report carrier off on H_CLOSED     return code (fate#322021, bsc#1040855).

  - ibmvnic: Handle failover after failed init crq     (fate#322021, bsc#1040855).

  - ibmvnic: Non-fatal error handling (fate#322021,     bsc#1040855).

  - ibmvnic: Reset sub-crqs during driver reset     (fate#322021, bsc#1040855).

  - ibmvnic: Reset the CRQ queue during driver reset     (fate#322021, bsc#1040855).

  - ibmvnic: Reset tx/rx pools on driver reset (fate#322021,     bsc#1040855).

  - ibmvnic: Return failure on attempted mtu change     (bsc#1043236).

  - ibmvnic: Send gratuitous arp on reset (fate#322021,     bsc#1040855).

  - ibmvnic: Track state of adapter napis (fate#322021,     bsc#1040855).

  - ipv6: Do not use ufo handling on later transformed     packets (bsc#1042286).

  - ipv6: fix endianness error in icmpv6_err (bsc#1042286).

  - kABI: protect struct fib_info (kabi).

  - kABI: protect struct pglist_data (kabi).

  - kABI: protect struct xlog (bsc#1043598).

  - kernel-binary.spec: Propagate MAKE_ARGS to %build     (bsc#1012422)

  - l2tp: fix race in l2tp_recv_common() (bsc#1042286).

  - libceph: NULL deref on crush_decode() error path     (bsc#1044015).

  - md: allow creation of mdNNN arrays via     md_mod/parameters/new_array (bsc#1032339).

  - md: support disabling of create-on-open semantics     (bsc#1032339).

  - mm/hugetlb: check for reserved hugepages during memory     offline (bnc#971975 VM -- git fixes).

  - mm/hugetlb: fix incorrect hugepages count during mem     hotplug (bnc#971975 VM -- git fixes).

  - mmc: Downgrade error level (bsc#1042536).

  - module: fix memory leak on early load_module() failures     (bsc#1043014).

  - net: bridge: start hello timer only if device is up     (bnc#1012382).

  - net: fix compile error in skb_orphan_partial()     (bnc#1012382).

  - net: ipv6: set route type for anycast routes     (bsc#1042286).

  - netfilter: nf_conntrack_sip: extend request line     validation (bsc#1042286).

  - netfilter: nf_ct_expect: remove the redundant slash when     policy name is empty (bsc#1042286).

  - netfilter: nf_dup_ipv6: set again FLOWI_FLAG_KNOWN_NH at     flowi6_flags (bsc#1042286).

  - netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper     fails to register (bsc#1042286).

  - netfilter: nfnetlink_queue: reject verdict request from     different portid (bsc#1042286).

  - netfilter: restart search if moved to other chain     (bsc#1042286).

  - netfilter: use fwmark_reflect in nf_send_reset     (bsc#1042286).

  - netxen_nic: set rcode to the return status from the call     to netxen_issue_cmd (bsc#966339 FATE#320150).

  - nfs: Fix 'Do not increment lock sequence ID after     NFS4ERR_MOVED' (git-fixes).

  - nsfs: mark dentry with DCACHE_RCUACCESS (bsc#1012829).

  - nvme: submit nvme_admin_activate_fw to admin queue     (bsc#1044532).

  - percpu: remove unused chunk_alloc parameter from     pcpu_get_pages() (bnc#971975 VM -- git fixes).

  - perf/x86/intel/rapl: Make Knights Landings support     functional (bsc#1042517).

  - powerpc/64: Fix flush_(d|i)cache_range() called from     modules (bnc#863764 fate#315275, LTC#103998).

  - quota: fill in Q_XGETQSTAT inode information for     inactive quotas (bsc#1042356).

  - radix-tree: fix radix_tree_iter_retry() for tagged     iterators (bsc#1012829).

  - rpm/kernel-binary.spec: remove superfluous flags This     should make build logs more readable and people adding     more flags should have easier time finding a place to     add them in the spec file.

  - rpm/kernel-spec-macros: Fix the check if there is no     rebuild counter (bsc#1012060)

  - rtnl: reset calcit fptr in rtnl_unregister()     (bsc#1042286).

  - series.conf: remove silly comment

  - tcp: account for ts offset only if tsecr not zero     (bsc#1042286).

  - tcp: fastopen: accept data/FIN present in SYNACK message     (bsc#1042286).

  - tcp: fastopen: avoid negative sk_forward_alloc     (bsc#1042286).

  - tcp: fastopen: call tcp_fin() if FIN present in SYNACK     (bsc#1042286).

  - tcp: fastopen: fix rcv_wup initialization for TFO server     on SYN/data (bsc#1042286).

  - tpm: Downgrade error level (bsc#1042535).

  - udp: avoid ufo handling on IP payload compression     packets (bsc#1042286).

  - udplite: call proper backlog handlers (bsc#1042286).

  - x86/PCI: Mark Broadwell-EP Home Agent 1 as having     non-compliant BARs (bsc#9048891).

  - xen/mce: do not issue error message for failed     /dev/mcelog registration (bnc#1036638).

  - xen: add sysfs node for guest type (bnc#1037840).

  - xfrm: Fix memory leak of aead algorithm name     (bsc#1042286).

  - xfs: add missing include dependencies to xfs_dir2.h     (bsc#1042421).

  - xfs: do not warn on buffers not being recovered due to     LSN (bsc#1043598).

  - xfs: fix xfs_mode_to_ftype() prototype (bsc#1043598).

  - xfs: log recovery tracepoints to track current lsn and     buffer submission (bsc#1043598).

  - xfs: pass current lsn to log recovery buffer validation     (bsc#1043598).

  - xfs: refactor log record unpack and data processing     (bsc#1043598).

  - xfs: replace xfs_mode_to_ftype table with switch     statement (bsc#1042421).

  - xfs: rework log recovery to submit buffers on LSN     boundaries (bsc#1043598).

  - xfs: rework the inline directory verifiers     (bsc#1042421).

  - xfs: sanity check directory inode di_size (bsc#1042421).

  - xfs: sanity check inode di_mode (bsc#1042421).

  - xfs: update metadata LSN in buffers during log recovery     (bsc#1043598).

  - xfs: verify inline directory data forks (bsc#1042421).

  - zswap: do not param_set_charp while holding spinlock (VM     Functionality, bsc#1042886).

USN-3338-1 fixed vulnerabilities in the Linux kernel. However, the fix for CVE-2017-1000364 introduced regressions for some Java applications. This update addresses the issue. We apologize for the inconvenience.

It was discovered that the stack guard page for processes in the Linux kernel was not sufficiently large enough to prevent overlapping with the heap. An attacker could leverage this with another vulnerability to execute arbitrary code and gain administrative privileges (CVE-2017-1000364)

Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denial of service (system crash) or execute arbitrary code with administrative privileges. (CVE-2016-4997).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult.
(CVE-2017-1000364, Important)

Red Hat would like to thank Qualys Research Labs for reporting this issue.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.67-60_64_18 fixes several issues. The following security bugs were fixed :

  - CVE-2017-1000364: An issue was discovered in the size of     the stack guard page on Linux, specifically a 4k stack     guard page is not sufficiently large and can be 'jumped'     over (the stack guard page is bypassed) (bsc#1039496).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.74-60_64_40 fixes one issue. The following security bugs were fixed :

  - CVE-2017-1000364: An issue was discovered in the size of     the stack guard page on Linux, specifically a 4k stack     guard page is not sufficiently large and can be 'jumped'     over (the stack guard page is bypassed) (bsc#1039496).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0126 for details.

According to its self-reported version number, the version of Junos Space running on the remote device is < 17.1R1, and is therefore affected by multiple vulnerabilities.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0145 for details.

An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010). (CVE-2017-1000364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002948 advisory.

    An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page     is not sufficiently large and can be jumped over (the stack guard page is bypassed), this affects Linux     Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101068	Fedora 24 : kernel (2017-05f10e29f4) (Stack Clash)	Nessus	Fedora Local Security Checks	2017/6/28	2025/12/15	high
101098	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3587)	Nessus	Oracle Linux Local Security Checks	2017/6/29	2026/2/9	high
101102	RHEL 7 : kernel-rt (RHSA-2017:1616) (Stack Clash)	Nessus	Red Hat Local Security Checks	2017/6/29	2025/12/15	critical
101103	RHEL 6 : kernel-rt (RHSA-2017:1647)	Nessus	Red Hat Local Security Checks	2017/6/29	2025/12/15	critical
101115	Slackware 14.1 : Slackware 14.1 kernel (SSA:2017-180-01) (Stack Clash)	Nessus	Slackware Local Security Checks	2017/6/30	2025/12/15	high
101127	openSUSE Security Update : the Linux Kernel (openSUSE-2017-716) (Stack Clash)	Nessus	SuSE Local Security Checks	2017/6/30	2025/12/15	high
101149	Ubuntu 12.04 LTS : linux regression (USN-3338-2) (Stack Clash)	Nessus	Ubuntu Local Security Checks	2017/6/30	2025/12/15	high
101483	Virtuozzo 7 : kernel / kernel-abi-whitelists / kernel-debug / etc (VZLSA-2017-1484)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
101887	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1909-1) (Stack Clash)	Nessus	SuSE Local Security Checks	2017/7/21	2025/12/9	high
101945	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1943-1) (Stack Clash)	Nessus	SuSE Local Security Checks	2017/7/25	2025/12/9	high
102064	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0126) (Stack Clash)	Nessus	OracleVM Local Security Checks	2017/7/31	2025/12/4	critical
104100	Juniper Junos Space < 17.1R1 Multiple Vulnerabilities (JSA10826)	Nessus	Junos Local Security Checks	2017/10/23	2023/3/30	critical
102774	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0145) (Stack Clash)	Nessus	OracleVM Local Security Checks	2017/8/25	2025/11/25	critical
105469	F5 Networks BIG-IP : Linux kernel vulnerability (K51931024) (Stack Clash)	Nessus	F5 Networks Local Security Checks	2017/12/28	2025/11/10	high
287025	Unity Linux 20.1060a Security Update: kernel (UTSA-2026-002948)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/2/10	high

检测

插件搜索

high

high

critical

critical

high

high

high

high

high

high

critical

critical

critical

high

high