更新后的 kernel-rt 程序包修复了三个安全问题和多个缺陷，并添加了多种增强，现在可用于 Red Hat Enterprise MRG 2.5。

Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

kernel-rt 程序包包含 Linux 内核，后者是任何 Linux 操作系统的核心。

在 Linux 内核的 XFS 文件系统于某些情况下实现有序的目录哈希的方式中发现拒绝服务缺陷。本地攻击者可利用此缺陷，以冲突的哈希值创建目录来损坏文件系统，从而导致系统崩溃。（CVE-2014-7283，中危）

在 Linux 内核的 perf 子系统的 syscall 跟踪功能中发现一个越界内存访问缺陷。本地非特权用户可利用此缺陷导致系统崩溃。
（CVE-2014-7825，中危）

在 Linux 内核的 ftrace 子系统的 syscall 跟踪功能中发现一个越界内存访问缺陷。在启用 ftrace syscall 跟踪功能的系统上，本地非特权用户可以利用该缺陷使系统崩溃或升级其权限。
（CVE-2014-7826，中危）

Red Hat 在此感谢 Robert Święcki 报告 CVE-2014-7825 和 CVE-2014-7826。

kernel-rt 程序包已升级到上游版本 3.10.58，其提供对之前版本的多项缺陷补丁和增强。(BZ#1158105)

此更新还修复以下缺陷：

* 低优先级线程上的自动 NUMA 平衡可造成与同一进程中运行的高优先级线程争用内存。
这种争用可触发系统的实时性能差。
为避免此潜在内存争用，MRG Realtime 内核现在禁用 NUMA_BALANCING_DEFAULT_ENABLED。(BZ#1158940)

* 在跟踪错误时，WARN*() 函数可淹没环缓冲区，造成跟踪无用甚至环缓冲区溢出。为解决此问题，traceoff_on_warning 选项已新增到内核命令行，并新增为 sysctl 选项。此选项禁止警告消息写入环缓冲区，造成用于调试的跟踪信息更清晰。(BZ#1155200)

此外，此更新还添加了以下增强：

* MRG Realtime 内核中现在启用了 XHCI (USB 3) 支持。
(BZ#1134095)

建议所有 kernel-rt 用户升级这些更新后的程序包，其中修正了这些问题并添加这些增强。必须重新启动系统才能使此更新生效。

現已提供適用於 Red Hat Enterprise MRG 2.5 的更新版 kernel-rt 套件，可修正三個安全性問題、數個錯誤，並新增多個增強功能。

Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可針對每個弱點從〈參照〉一節的 CVE 連結中取得常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

kernel-rt 套件中包含 Linux 核心，這是任何 Linux 作業系統的核心。

在特定情形下，Linux 核心的 XFS 檔案系統實作排序目錄雜湊的方式有一個拒絕服務瑕疵。本機攻擊者可利用此瑕疵，建立雜湊值衝突的目錄，造成檔案系統損毀，進而可能導致系統當機。(CVE-2014-7283，中等)

在 Linux 核心之 perf 子系統的系統呼叫追蹤功能中發現一個超出邊界記憶體存取瑕疵。無權限的本機使用者可利用此瑕疵使系統當機。
(CVE-2014-7825，中等)

在 Linux 核心之 ftrace 子系統的系統呼叫追蹤功能中發現一個超出邊界記憶體存取瑕疵。在已啟用 ftrace 系統呼叫追蹤功能的系統中，無權限的本機使用者可利用此瑕疵造成系統當機，或提升自己的權限。
(CVE-2014-7826，中等)

Red Hat 要感謝 Robert Święcki 報告 CVE-2014-7825 和 CVE-2014-7826。

kernel-rt 套件已升級至上游版本 3.10.58，相較於先前的版本，此版本提供數個錯誤修正與增強功能。(BZ#1158105)

此更新也可修正下列錯誤：

* 對低優先順序執行緒自動進行 NUMA 平衡，可造成與在同個處理程序中執行的高優先順序執行緒發生記憶體爭用。
此爭用情形可在系統上觸發不良的即時效能。
為避免這種潛在的記憶體爭用，MRG Realtime 核心現已停用 NUMA_BALANCING_DEFAULT_ENABLED。(BZ#1158940)

* 追蹤錯誤時，WARN*() 函式可使環緩衝區溢流，造成追蹤沒有效用或甚至使環緩衝區溢位。為解決此問題，traceoff_on_warning 選項已新增至核心命令行，且已新增為 sysctl 選項。此選項會將對環緩衝區的警告訊息寫入停用，讓針對除錯的追蹤變得更加乾淨。(BZ#1155200)

此外，此更新還新增了下列增強功能：

* 在 MRG Realtime 核心中現已啟用 XHCI (USB 3) 的支援。
(BZ#1134095)

建議所有 kernel-rt 使用者皆升級至這些更新版套件，其可更正這些問題並新增這些增強功能。必須重新啟動系統，此更新才會生效。

遠端 Ubuntu 14.04 LTS 主機上安裝的一個套件受到 USN-2226-1 公告中所提及的多個弱點影響。

    Matthew Daley 報告，Linux 核心磁碟片驅動程式中存在資訊洩漏。無權限的本機使用者可惡意利用此瑕疵從核心記憶體取得可能的敏感資訊。
    (CVE-2014-1738)

    Matthew Daley 報告，Linux 核心磁碟片驅動程式處理 ioctl 命令時出現一個瑕疵。如果載入磁碟片模組，無權限的本機使用者則可惡意利用此瑕疵取得系統管理員權限。(CVE-2014-1737)

    當 Linux 核心之虛擬機器的可合併緩衝區停用時，在網路封包的處理中發現一個瑕疵。客體 OS 使用者可利用此缺陷來造成拒絕服務 (主機 OS 當機) 或可能取得主機 OS 中的特權。(CVE-2014-0077)

    Trk Edwin 發現，Xen netback 驅動程式與不允許在 softirq 環境中睡眠的 Linux 設定搭配使用時會產生瑕疵。客體管理員可利用此瑕疵，在主機上造成拒絕服務 (系統當機)。(CVE-2014-2580)

    在 Linux 核心的 ping 通訊端中發現一個瑕疵。無權限的本機使用者可惡意利用此瑕疵，透過特製應用程式引發拒絕服務 (系統當機) 或可能取得權限。
    (CVE-2014-2851)

    Hannes Frederic Sowa 報告，Linux 核心的 xfs 檔案系統中存在雜湊衝突排序問題。
    本機使用者可利用此缺陷造成檔案系統損毀和拒絕服務 (OOPS 或系統當機)。(CVE-2014-7283)

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Ubuntu 14.04 LTS 主机上安装的一个程序包受到 USN-2226-1 公告中提及的多个漏洞影响。

    Matthew Daley 报告，Linux 内核的软盘驱动程序存在信息泄露。本地非特权用户可利用此缺陷获取内核内存中的潜在敏感信息。
    (CVE-2014-1738)

    Matthew Daley 报告，Linux 内核的软盘驱动程序在处理 ioctl 命令时存在缺陷。如果加载软盘模块，本地非特权用户可利用此缺陷获得管理权限。(CVE-2014-1737)

    当针对 Linux 内核的虚拟机禁用可合并缓冲区时，在处理网络数据包的过程中发现一个缺陷。客户机操作系统用户可利用此缺陷造成拒绝服务（主机操作系统崩溃），或可能获得主机操作系统上的权限。(CVE-2014-0077)

    Trk Edwin 发现，当 Xen netback 驱动程序与不允许在 softirq 上下文中休眠的 Linux 配置一起使用时，存在缺陷。客户机管理员可利用此缺陷导致主机拒绝服务（系统崩溃）。(CVE-2014-2580)

    在 Linux 内核的 ping 套接字中发现一个缺陷。本地非非特权用户可利用此缺陷造成拒绝服务（系统崩溃）或可能通过构建的应用程序获取权限。
    (CVE-2014-2851)

    Hannes Frederic Sowa 报告了 Linux 内核中 xfs 文件系统的哈希冲突排序问题。
    本地用户可利用此缺陷造成文件系统崩溃和拒绝服务（oops 和错误）。(CVE-2014-7283)

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

3 つのセキュリティ問題と複数のバグを修正し、様々な強化を追加する更新済みの kernel-rt パッケージが、Red Hat Enterprise MRG 2.5 で現在利用可能です。

Red Hat 製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度中として評価しています。詳細な重要度の評価を提供する Common Vulnerability Scoring System （CVSS）のベーススコアが、「参照」セクションの CVE リンクの各脆弱性に対して利用可能です。

kernel-rt パッケージには Linux オペレーティングシステムのコアである Linux カーネルが含まれています。

Linux カーネルの XFS ファイルシステム実装が、特定の状況でディレクトリのハッシュを順番付けする方法で、サービス拒否の欠陥が見つかりました。ローカルの攻撃者が、この欠陥を利用して、相反するハッシュ値でディレクトリを作成することにより、ファイルシステムを破損し、システムクラッシュを引き起こす可能性があります。（CVE-2014-7283、重要度中）

Linux カーネルの perf サブシステムの syscall トレース機能に、領域外メモリアクセスの欠陥が見つかりました。ローカルの権限のないユーザーがこの欠陥を悪用して、システムをクラッシュさせることが可能でした。
（CVE-2014-7825、重要度中）

Linux カーネルの ftrace サブシステムの syscall トレース機能に、領域外メモリアクセスの欠陥が見つかりました。ftrace syscall トレースが有効なシステムで、ローカルの権限のないユーザーがこの欠陥を利用して、システムをクラッシュさせたり、権限を昇格する可能性があります。
（CVE-2014-7826、重要度中）

Red Hat は、CVE-2014-7825 および CVE-2014-7826 を報告してくれた Robert Święcki 氏に感謝の意を表します。

kernel-rt パッケージが、Upstream バージョン 3.10.58 にアップグレードされています。これにより、以前のバージョンに対する多数のバグ修正と拡張機能が提供されます。（BZ#1158105）

この更新は以下のバグも修正します：

* 優先度の低いスレッドで自動 NUMA バランシングを行うことにより、同じプロセスで実行されている優先度の高いスレッドでメモリコンテンションが引き起こされる可能性があります。
このコンテンションにより、システムで貧弱なリアルタイムパフォーマンスが発生する可能性があります。
この潜在的なメモリコンテンションを回避するために、MRG Realtime カーネルは現在、NUMA_BALANCING_DEFAULT_ENABLED を無効にしています。（BZ#1158940）

* バグを追跡するときに、WARN*() 関数が、リングバッファをフラッドし、トレースを役に立たないものにしたり、リングバッファをオーバーフローしたりする可能性があります。この問題に対処するために、カーネルコマンドラインに traceoff_on_warning オプションが sysctl オプションとして追加されました。このオプションは、警告メッセージのリングバッファへの書き込みを無効にし、デバッギングのトレースをクリーンにします。（BZ#1155200）

また、この更新は以下の拡張機能も追加します：

* XHCI（USB 3）のサポートが、MRG Realtime カーネルで現在有効にされています。
（BZ#1134095）

kernel-rt の全ユーザーは、これらの更新済みパッケージへアップグレードし、これらの問題を修正し、これらの拡張機能を追加することが推奨されます。この更新を有効にするには、システムを再起動する必要があります。

リモートの Ubuntu 14.04 LTS ホストには、USN-2226-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    Matthew Daley 氏は、Linux カーネルのフロッピーディスクドライバーにおける情報漏洩を報告しました。権限のないローカルユーザーは、この欠陥を悪用して、カーネルメモリから潜在的な機密情報を入手することがあります。
    (CVE-2014-1738)

    Matthew Daley 氏は、Linux カーネルのフロッピーディスクドライバーによる ioctl コマンドの処理における欠陥を報告しました。権限のないローカルユーザーはこの欠陥を悪用して、フロッピーディスクモジュールがロードされた場合に、管理者権限を入手する可能性があります。(CVE-2014-1737)

    Linux カーネルの仮想マシンでマージ可能なバッファが無効になっている時に、ネットワークパケットの処理に欠陥が発見されました。ゲスト OS ユーザーはこの欠陥を悪用して、サービス拒否 (ホスト OS クラッシュ) を引き起こしたり、ホスト OS の権限を入手したりする可能性があります。(CVE-2014-0077)

    Trk Edwin 氏は、softirq コンテキストでスリープ状態を許可しない Linux 設定で使用される場合に生じる Xen ネットバックドライバーの欠陥を発見しました。ゲスト管理者がこの欠陥を悪用し、ホスト上でサービス拒否 (システムクラッシュ) を引き起こす可能性があります。(CVE-2014-2580)

    Linux カーネルの ping ソケットに欠陥が発見されました。権限のないローカルユーザーはこの欠陥を悪用して、サービス拒否（システムクラッシュ）を引き起こしたり、細工されたアプリケーションを介して権限を取得したりする可能性があります。
    (CVE-2014-2851)

    Hannes Frederic Sowa 氏が、Linux カーネルの xfs ファイルシステムにおけるハッシュ衝突の順序付けの問題を報告しました。
    ローカルユーザーが、この欠陥を悪用して、ファイルシステムの破損とサービス拒否 (oops またはパニック) を引き起こす可能性がありました。(CVE-2014-7283)

Tenable は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free vulnerability was found in DCCP socket     code affecting the Linux kernel since 2.6.16. This     vulnerability could allow an attacker to their escalate     privileges.(CVE-2017-8824i1/4%0

  - The OZWPAN driver in the Linux kernel through 4.0.5     relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash)     via a crafted packet.(CVE-2015-4004i1/4%0

  - Integer signedness error in the MSM V4L2 video driver     for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to gain     privileges or cause a denial of service (array overflow     and memory corruption) via a crafted application that     triggers an msm_isp_axi_create_stream     call.(CVE-2016-2061i1/4%0

  - A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system     crash.(CVE-2014-7283i1/4%0

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636i1/4%0

  - Incorrect buffer length handling was found in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in     the Linux kernel, which could be exploited by malicious     NCPFS servers to crash the kernel or possibly execute     an arbitrary code.(CVE-2018-8822i1/4%0

  - ** DISPUTED ** Kernel Samepage Merging (KSM) in the     Linux kernel 2.6.32 through 4.x does not prevent use of     a write-timing side channel, which allows guest OS     users to defeat the ASLR protection mechanism on other     guest OS instances via a Cross-VM ASL INtrospection     (CAIN) attack. NOTE: the vendor states 'Basically if     you care about this attack vector, disable     deduplication.' Share-until-written approaches for     memory conservation among mutually untrusting tenants     are inherently detectable for information disclosure,     and can be classified as potentially misunderstood     behaviors rather than vulnerabilities.(CVE-2015-2877i1/4%0

  - The tty_set_termios_ldisc() function in     'drivers/tty/tty_ldisc.c' in the Linux kernel before     4.5 allows local users to obtain sensitive information     from kernel memory by reading a tty data     structure.(CVE-2015-8964i1/4%0

  - An issue was discovered in the Linux kernel through     4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same     user data twice with copy_from_user. The header part of     the user data is double-fetched, and a malicious user     thread can tamper with the critical variables     (hdr.size_in and hdr.size_out) in the header between     the two fetches because of a race condition, leading to     severe kernel errors, such as buffer over-accesses.
    This bug can cause a local denial of service and     information leakage.(CVE-2018-12633i1/4%0

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2018-1092i1/4%0

  - fs/f2fs/extent_cache.c in the Linux kernel, before     4.13, mishandles extent trees. This allows local users     to cause a denial of service via an application with     multiple threads.(CVE-2017-18193i1/4%0

  - A design flaw was found in the file extended attribute     handling of the Linux kernel's handling of cached     attributes. Too many entries in the cache cause a soft     lockup while attempting to iterate the cache and access     relevant locks.(CVE-2015-8952i1/4%0

  - Off-by-one error in the pipe_advance function in     lib/iov_iter.c in the Linux kernel before 4.9.5 allows     local users to obtain sensitive information from     uninitialized heap-memory locations in opportunistic     circumstances by reading from a pipe after an incorrect     buffer-release decision.(CVE-2017-5550i1/4%0

  - The HMAC implementation (crypto/hmac.c) in the Linux     kernel, before 4.14.8, does not validate that the     underlying cryptographic hash algorithm is unkeyed.
    This allows a local attacker, able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3), to cause a kernel stack     buffer overflow by executing a crafted sequence of     system calls that encounter a missing SHA-3     initialization.(CVE-2017-17806i1/4%0

  - The mp_get_count function in     drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel     before 3.12 does not initialize a certain data     structure, which allows local users to obtain sensitive     information from kernel stack memory via a TIOCGICOUNT     ioctl call.(CVE-2013-4516i1/4%0

  - The perf_cpu_time_max_percent_handler function in     kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service     (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an     incorrect sample-rate calculation.(CVE-2017-18255i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when     mounting a crafted btrfs image could lead to a system     crash and a denial of service.(CVE-2018-14609i1/4%0

  - The oz_usb_handle_ep_data function in     drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 allows remote     attackers to cause a denial of service (divide-by-zero     error and system crash) via a crafted     packet.(CVE-2015-4003i1/4%0

  - drivers/hid/hid-logitech-dj.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows     physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) or obtain     sensitive information from kernel memory via a crafted     device.(CVE-2013-2895i1/4%0

  - drivers/usb/serial/cypress_m8.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions.(CVE-2016-3137i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A race condition flaw was found in the way the Linux     kernel's mmap(2), madvise(2), and fallocate(2) system     calls interacted with each other while operating on     virtual memory file system files. A local user could     use this flaw to cause a denial of     service.(CVE-2014-4171)

  - An information leak flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled access of the user control's     state. A local, privileged user could use this flaw to     leak kernel memory to user space.(CVE-2014-4652)

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4653)

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4654)

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4655)

  - An integer overflow flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4656)

  - An integer underflow flaw was found in the way the     Linux kernel's Stream Control Transmission Protocol     (SCTP) implementation processed certain COOKIE_ECHO     packets. By sending a specially crafted SCTP packet, a     remote attacker could use this flaw to prevent     legitimate connections to a particular SCTP server     socket to be made.(CVE-2014-4667)

  - 'It was found that the Linux kernel's ptrace subsystem     allowed a traced process' instruction pointer to be set     to a non-canonical memory address without forcing the     non-sysret code path when returning to user space. A     local, unprivileged user could use this flaw to crash     the system or, potentially, escalate their privileges     on the system.

  - Note: The CVE-2014-4699 issue only affected systems     using an Intel CPU.(CVE-2014-4699)'

  - A flaw was found in the way the pppol2tp_setsockopt()     and pppol2tp_getsockopt() functions in the Linux     kernel's PPP over L2TP implementation handled requests     with a non-SOL_PPPOL2TP socket option level. A local,     unprivileged user could use this flaw to escalate their     privileges on the system.(CVE-2014-4943)

  - A flaw was found in the way the Linux kernel's VFS     subsystem handled reference counting when performing     unmount operations on symbolic links. A local,     unprivileged user could use this flaw to exhaust all     available memory on the system or, potentially, trigger     a use-after-free error, resulting in a system crash or     privilege escalation.(CVE-2014-5045)

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's Stream Control Transmission Protocol     (SCTP) implementation handled simultaneous connections     between the same hosts. A remote attacker could use     this flaw to crash the system.(CVE-2014-5077)

  - It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a     specially crafted ISO image to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-5471)

  - It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a     specially crafted ISO image to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-5472)

  - A stack overflow flaw caused by infinite recursion was     found in the way the Linux kernel's Universal Disk     Format (UDF) file system implementation processed     indirect Information Control Blocks (ICBs). An attacker     with physical access to the system could use a     specially crafted UDF image to crash the     system.(CVE-2014-6410)

  - Buffer overflow in net/ceph/auth_x.c in Ceph, as used     in the Linux kernel before 3.16.3, allows remote     attackers to cause a denial of service (memory     corruption and panic) or possibly have unspecified     other impact via a long unencrypted auth     ticket.(CVE-2014-6416)

  - net/ceph/auth_x.c in Ceph, as used in the Linux kernel     before 3.16.3, does not properly consider the     possibility of kmalloc failure, which allows remote     attackers to cause a denial of service (system crash)     or possibly have unspecified other impact via a long     unencrypted auth ticket.(CVE-2014-6417)

  - net/ceph/auth_x.c in Ceph, as used in the Linux kernel     before 3.16.3, does not properly validate auth replies,     which allows remote attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact via crafted data from the IP address of a     Ceph Monitor.(CVE-2014-6418)

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's Common Internet File System (CIFS)     implementation handled mounting of file system shares.
    A remote attacker could use this flaw to crash a client     system that would mount a file system share from a     malicious server.(CVE-2014-7145)

  - A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system crash.(CVE-2014-7283)

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7825)

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7826)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001829 advisory.

    The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel     before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of     service (filesystem corruption, and OOPS or panic) via operations on directories that have hash     collisions, as demonstrated by rmdir operations.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2226-1 advisory.

    Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged     local user could exploit this flaw to obtain potentially sensitive information from kernel memory.
    (CVE-2014-1738)

    Matthew Daley reported a flaw in the handling of ioctl commands by the floppy disk driver in the Linux     kernel. An unprivileged local user could exploit this flaw to gain administrative privileges if the floppy     disk module is loaded. (CVE-2014-1737)

    A flaw was discovered in the handling of network packets when mergeable buffers are disabled for virtual     machines in the Linux kernel. Guest OS users may exploit this flaw to cause a denial of service (host OS     crash) or possibly gain privilege on the host OS. (CVE-2014-0077)

    Trk Edwin discovered a flaw with Xen netback driver when used with Linux configurations that do not     allow sleeping in softirq context. A guest administrator could exploit this flaw to cause a denial of     service (system crash) on the host. (CVE-2014-2580)

    A flaw was discovered in the Linux kernel's ping sockets. An unprivileged local user could exploit this     flaw to cause a denial of service (system crash) or possibly gain privileges via a crafted application.
    (CVE-2014-2851)

    Hannes Frederic Sowa reported a hash collision ordering problem in the xfs filesystem in the Linux kernel.
    A local user could exploit this flaw to cause filesystem corruption and a denial of service (oops or     panic). (CVE-2014-7283)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel-rt packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

  * A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system crash. (CVE-2014-7283,     Moderate)

  * An out-of-bounds memory access flaw was found in the     syscall tracing functionality of the Linux kernel's perf     subsystem. A local, unprivileged user could use this     flaw to crash the system. (CVE-2014-7825, Moderate)

  * An out-of-bounds memory access flaw was found in the     syscall tracing functionality of the Linux kernel's     ftrace subsystem. On a system with ftrace syscall     tracing enabled, a local, unprivileged user could use     this flaw to crash the system, or escalate their     privileges. (CVE-2014-7826, Moderate)

The kernel-rt packages have been upgraded to upstream version 3.10.58, which provides a number of bug fixes and enhancements over the previous version. (BZ#1158105)

This update also fixes the following bugs :

  * Automatic NUMA balancing on a low priority thread could     cause memory contention with a high priority thread     running in the same process. This contention could     trigger poor real time performance on the system. In     order to avoid this potential memory contention, the MRG     Realtime kernel now disables     NUMA_BALANCING_DEFAULT_ENABLED. (BZ#1158940)

  * When tracing a bug, WARN*() functions could flood the     ring buffer making the trace useless or even overflowing     the ring buffer. To address this issue, a     traceoff_on_warning option was added to the kernel     command line and as a sysctl option. This option     disables the writing of the warning messages to the ring     buffer, which results in a cleaner trace for debugging.
    (BZ#1155200)

In addition, this update adds the following enhancement :

  * Support for XHCI (USB 3) is now enabled in the MRG     Realtime kernel. (BZ#1134095)

All kernel-rt users are advised to upgrade to these updated packages, which contain correct these issues and add these enhancements. The system must be rebooted for this update to take effect.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002290 advisory.

    The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel     before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of     service (filesystem corruption, and OOPS or panic) via operations on directories that have hash     collisions, as demonstrated by rmdir operations.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000905 advisory.

    The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel     before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of     service (filesystem corruption, and OOPS or panic) via operations on directories that have hash     collisions, as demonstrated by rmdir operations.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
79684	RHEL 6：kernel-rt (RHSA-2014:1943)	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium
79684	RHEL 6：kernel-rt (RHSA-2014:1943)	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium
74214	Ubuntu 14.04 LTS : Linux 核心弱點 (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/8/27	medium
74214	Ubuntu 14.04 LTS：Linux 内核漏洞 (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/8/27	medium
79684	RHEL 6：kernel-rt（RHSA-2014:1943）	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium
74214	Ubuntu 14.04 LTS : Linux カーネルの脆弱性 (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/8/27	medium
124800	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1476)	Nessus	Huawei Local Security Checks	2019/5/13	2022/5/20	high
124805	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1481)	Nessus	Huawei Local Security Checks	2019/5/13	2021/2/19	high
286412	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001829)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	medium
74214	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/8/27	medium
79684	RHEL 6 : kernel-rt (RHSA-2014:1943)	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium
286937	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002290)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	medium
290964	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000905)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium