The remote Oracle Linux host is missing a security update for the kernel package(s).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-7482: Several missing length checks ticket     decode allowing for information leak or potentially code     execution (bsc#1046107).

  - CVE-2016-10277: Potential privilege escalation due to a     missing bounds check in the lp driver. A kernel     command-line adversary can overflow the parport_nr array     to execute code (bsc#1039456).

  - CVE-2017-7542: The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel allowed local     users to cause a denial of service (integer overflow and     infinite loop) by leveraging the ability to open a raw     socket (bsc#1049882).

  - CVE-2017-7533: Bug in inotify code allowing privilege     escalation (bsc#1049483).

  - CVE-2017-11176: The mq_notify function in the Linux     kernel did not set the sock pointer to NULL upon entry     into the retry logic. During a user-space close of a     Netlink socket, it allowed attackers to cause a denial     of service (use-after-free) or possibly have unspecified     other impact (bsc#1048275).

  - CVE-2017-11473: Buffer overflow in the     mp_override_legacy_irq() function in     arch/x86/kernel/acpi/boot.c in the Linux kernel allowed     local users to gain privileges via a crafted ACPI table     (bnc#1049603).

  - CVE-2017-1000365: The Linux Kernel imposed a size     restriction on the arguments and environmental strings     passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the     size), but did not take the argument and environment     pointers into account, which allowed attackers to bypass     this limitation. (bnc#1039354)

  - CVE-2014-9922: The eCryptfs subsystem in the Linux     kernel allowed local users to gain privileges via a     large filesystem stack that includes an overlayfs layer,     related to fs/ecryptfs/main.c and fs/overlayfs/super.c     (bnc#1032340)

  - CVE-2017-8924: The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel allowed     local users to obtain sensitive information (in the     dmesg ringbuffer and syslog) from uninitialized kernel     memory by using a crafted USB device (posing as an io_ti     USB serial device) to trigger an integer underflow     (bnc#1038982).

  - CVE-2017-8925: The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel allowed     local users to cause a denial of service (tty     exhaustion) by leveraging reference count mishandling     (bnc#1038981).

  - CVE-2017-1000380: sound/core/timer.c was vulnerable to a     data race in the ALSA /dev/snd/timer driver resulting in     local users being able to read information belonging to     other users, i.e., uninitialized memory contents could     have bene disclosed when a read and an ioctl happen at     the same time (bnc#1044125)

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c was too late in checking whether     an overwrite of an skb data structure may occur, which     allowed local users to cause a denial of service (system     crash) via crafted system calls (bnc#1041431)

  - CVE-2017-1000363: A buffer overflow in kernel     commandline handling of the 'lp' parameter could be used     by local console attackers to bypass certain secure boot     settings. (bnc#1039456)

  - CVE-2017-9076: The dccp_v6_request_recv_sock function in     net/dccp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039885)

  - CVE-2017-9077: The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1040069)

  - CVE-2017-9075: The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039883)

  - CVE-2017-9074: The IPv6 fragmentation implementation in     the Linux kernel did not consider that the nexthdr field     may be associated with an invalid option, which allowed     local users to cause a denial of service (out-of-bounds     read and BUG) or possibly have unspecified other impact     via crafted socket and send system calls (bnc#1039882)

  - CVE-2017-7487: The ipxitf_ioctl function in     net/ipx/af_ipx.c in the Linux kernel mishandled     reference counts, which allowed local users to cause a     denial of service (use-after-free) or possibly have     unspecified other impact via a failed SIOCGIFADDR ioctl     call for an IPX interface (bnc#1038879)

  - CVE-2017-8890: The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allowed attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call (bnc#1038544)

  - CVE-2017-2647: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash)     via vectors involving a NULL value for a certain match     field, related to the keyring_search_iterator function     in keyring.c (bnc#1030593)

  - CVE-2017-6951: The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a request_key system call for     the 'dead' type (bnc#1029850)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3637 advisory.

  - The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not     properly validate certain block-size data, which allows local users to cause a denial of service (integer     signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via     crafted system calls. (CVE-2017-7308)

  - Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr     integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g.
    Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the     command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO)     'lp=none' arguments to the command line. (CVE-2017-1000363)

  - sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA     /dev/snd/timer driver resulting in local users being able to read information belonging to other users,     i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
    (CVE-2017-1000380)

  - The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890. (CVE-2017-9077)

  - The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the     nexthdr field may be associated with an invalid option, which allows local users to cause a denial of     service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send     system calls. (CVE-2017-9074)

  - The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890. (CVE-2017-9075)

  - The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows     local users to cause a denial of service (panic) by leveraging incorrect length validation.
    (CVE-2017-14489)

  - The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute     access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and     consequently gain privileges, via an io_setup system call. (CVE-2016-10044)

  - Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. (CVE-2017-11473)

  - The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5     allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified     other impact by changing a certain sequence-number value, aka a double fetch vulnerability.
    (CVE-2017-8831)

  - Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or     cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations     that leverage improper might_cancel queueing. (CVE-2017-10661)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 4.10.17 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandles     inheritance, which allows local users to cause a denial     of service or possibly have unspecified other impact     via crafted system calls, a related issue to     CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.

  - The IPv6 DCCP implementation in the Linux kernel     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.

  - The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel mishandles     inheritance, which allows local users to cause a denial     of service or possibly have unspecified other impact     via crafted system calls, a related issue to     CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.

  - The IPv6 fragmentation implementation in the Linux     kernel through 4.11.1 does not consider that the     nexthdr field may be associated with an invalid option,     which allows local users to cause a denial of service     (out-of-bounds read and BUG) or possibly have     unspecified other impact via crafted socket and send     system calls.

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.

  - Improved isolation for neighbor table settings. (The     fix added to the 042stab120.19 kernel was incomplete.)

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The regulator_ena_gpio_free function in     drivers/regulator/core.c in the Linux kernel allows     local users to gain privileges or cause a denial of     service (use-after-free) via a crafted     application.i1/4^CVE-2014-9940i1/4%0

  - Race condition in the sctp_wait_for_sndbuf function in     net/sctp/socket.c in the Linux kernel before 4.9.11     allows local users to cause a denial of service     (assertion failure and panic) via a multithreaded     application that peels off an association in a certain     buffer-full state.i1/4^CVE-2017-5986i1/4%0

  - net/sctp/socket.c in the Linux kernel through 4.10.1     does not properly restrict association peel-off     operations during certain wait states, which allows     local users to cause a denial of service (invalid     unlock and double free) via a multithreaded     application. NOTE: this vulnerability exists because of     an incorrect fix for CVE-2017-5986.i1/4^CVE-2017-6353i1/4%0

  - The ipxitf_ioctl function in net/ipx/af_ipx.c in the     Linux kernel through 4.11.1 mishandles reference     counts, which allows local users to cause a denial of     service (use-after-free) or possibly have unspecified     other impact via a failed SIOCGIFADDR ioctl call for an     IPX interface.i1/4^CVE-2017-7487i1/4%0

  - fs/ext4/inode.c in the Linux kernel before 4.6.2, when     ext4 data=ordered mode is used, mishandles a     needs-flushing-before-commit list, which allows local     users to obtain sensitive information from other users'     files in opportunistic circumstances by waiting for a     hardware reset, creating a new file, making write     system calls, and reading this file.i1/4^CVE-2017-7495i1/4%0

  - The NFSv2/NFSv3 server in the nfsd subsystem in the     Linux kernel through 4.10.11 allows remote attackers to     cause a denial of service (system crash) via a long RPC     reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c,     and fs/nfsd/nfsxdr.c.i1/4^CVE-2017-7645i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     through 4.10.15 allows attackers to cause a denial of     service (double free) or possibly have unspecified     other impact by leveraging use of the accept system     call.i1/4^CVE-2017-8890i1/4%0

  - The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel before     4.10.4 allows local users to obtain sensitive     information (in the dmesg ringbuffer and syslog) from     uninitialized kernel memory by using a crafted USB     device (posing as an io_ti USB serial device) to     trigger an integer underflow.i1/4^CVE-2017-8924i1/4%0

  - The IPv6 fragmentation implementation in the Linux     kernel through 4.11.1 does not consider that the     nexthdr field may be associated with an invalid option,     which allows local users to cause a denial of service     (out-of-bounds read and BUG) or possibly have     unspecified other impact via crafted socket and send     system calls.i1/4^CVE-2017-9074i1/4%0

  - The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel through 4.11.1     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890.i1/4^CVE-2017-9075i1/4%0

  - The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890.i1/4^CVE-2017-9077i1/4%0

  - The __ip6_append_data function in net/ipv6/ip6_output.c     in the Linux kernel through 4.11.3 is too late in     checking whether an overwrite of an skb data structure     may occur, which allows local users to cause a denial     of service (system crash) via crafted system     calls.i1/4^CVE-2017-9242i1/4%0

  - The ext4_fill_super function in fs/ext4/super.c in the     Linux kernel through 4.9.8 does not properly validate     meta block groups, which allows physically proximate     attackers to cause a denial of service (out-of-bounds     read and system crash) via a crafted ext4     image.i1/4^CVE-2016-10208i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1842 advisory.

  - The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the     CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which     allows local users to cause a denial of service (loss of writability) by making certain unshare system     calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call. (CVE-2014-7975)

  - The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU     Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout     data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading     the /proc/keys file. (CVE-2016-7042)

  - Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3     allows local users to cause a denial of service (double free) or possibly have unspecified other impact     via a crafted application that makes sendmsg system calls, leading to a free operation associated with a     new dump that started earlier than anticipated. (CVE-2016-9806)

  - The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly     restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory     locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
    (CVE-2016-9576)

  - The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in     situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary     kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg     device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-9576. (CVE-2016-10088)

  - The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr     call, which allows local users to gain group privileges by leveraging the existence of a setgid program     with restrictions on execute permissions. (CVE-2016-7097)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause     a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large     command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write     function. (CVE-2017-7187)

  - crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL     pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as     demonstrated by mcryptd(md5). (CVE-2016-10147)

  - arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows     guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by     an L2 guest. (CVE-2016-9588)

  - The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly     emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS     memory consumption) by leveraging the mishandling of page references. (CVE-2017-2596)

  - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. (CVE-2016-8645)

  - The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows     attackers to cause a denial of service (system crash) via (1) an application that makes crafted system     calls or possibly (2) IPv4 traffic with invalid IP options. (CVE-2017-5970)

  - Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain     privileges via a crafted application that makes concurrent perf_event_open system calls for moving a     software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2016-6786. (CVE-2017-6001)

  - The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain     match field, related to the keyring_search_iterator function in keyring.c. (CVE-2017-2647)

  - The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15     allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by     leveraging use of the accept system call. (CVE-2017-8890)

  - The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890. (CVE-2017-9077)

  - The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly     interact with certain locations of a chroot directory, which allows local users to cause a denial of     service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
    (CVE-2014-7970)

  - crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been     performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause     a denial of service (NULL pointer dereference and system crash) via a crafted application that does not     supply a key, related to the lrw_crypt function in crypto/lrw.c. (CVE-2015-8970)

  - Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users     to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls     without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c     and net/l2tp/l2tp_ip6.c. (CVE-2016-10200)

  - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount     namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via     MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of     mounts. (CVE-2016-6213)

  - It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal     keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its     session keyring. This allows root to bypass module signature verification by adding a new public key of     its own devising to the keyring. (CVE-2016-9604)

  - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a     certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local     users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a     socket system call. (CVE-2017-2671)

  - The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows     local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call     for the dead type. (CVE-2017-6951)

  - Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux     kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by     triggering failure of a certain bitmap operation. (CVE-2017-7616)

  - The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file,     related to arch/x86/mm/init.c and drivers/char/mem.c. (CVE-2017-7889)

  - The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the     nexthdr field may be associated with an invalid option, which allows local users to cause a denial of     service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send     system calls. (CVE-2017-9074)

  - The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890. (CVE-2017-9076)

  - The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in     checking whether an overwrite of an skb data structure may occur, which allows local users to cause a     denial of service (system crash) via crafted system calls. (CVE-2017-9242)

  - Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local     users to cause a denial of service (disk corruption) by writing to a page that is associated with a     different user's file after unsynchronized hole punching and page-fault handling. (CVE-2015-8839)

  - Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow     local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations.
    (CVE-2016-9685)

  - The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when     processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This     type value is uninitialized upon encountering certain error conditions. This value is used as an array     index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the     whole system. (CVE-2017-8797)

  - The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles     inheritance, which allows local users to cause a denial of service or possibly have unspecified other     impact via crafted system calls, a related issue to CVE-2017-8890. (CVE-2017-9075)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - nvme: Drop nvmeq->q_lock before dma_pool_alloc, so as to     prevent hard lockups (Aruna Ramakrishna) [Orabug:
    25409587]

  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)     [Orabug: 26277600] 

  - char: lp: fix possible integer overflow in lp_setup     (Willy Tarreau) [Orabug: 26403940] (CVE-2017-1000363)

  - ALSA: timer: Fix missing queue indices reset at     SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai) [Orabug:
    26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race between read and ioctl (Takashi     Iwai) [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: fix NULL pointer dereference in read/ioctl     race (Vegard Nossum) [Orabug: 26403956]     (CVE-2017-1000380)

  - ALSA: timer: Fix negative queue usage by racy accesses     (Takashi Iwai) [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)     [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)     [Orabug: 26403956] (CVE-2017-1000380)

  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG     Cong) [Orabug: 26404005] (CVE-2017-9077)

  - ocfs2: fix deadlock issue when taking inode lock at vfs     entry points (Eric Ren) [Orabug: 26427126] -     ocfs2/dlmglue: prepare tracking logic to avoid recursive     cluster lock (Eric Ren) [Orabug: 26427126] - ping:
    implement proper locking (Eric Dumazet) [Orabug:
    26540286] (CVE-2017-2671)

  - aio: mark AIO pseudo-fs noexec (Jann Horn) [Orabug:
    26643598] (CVE-2016-10044)

  - vfs: Commit to never having exectuables on proc and     sysfs. (Eric W. Biederman) [Orabug: 26643598]     (CVE-2016-10044)

  - vfs, writeback: replace FS_CGROUP_WRITEBACK with     SB_I_CGROUPWB (Tejun Heo) [Orabug: 26643598]     (CVE-2016-10044)

  - x86/acpi: Prevent out of bound access caused by broken     ACPI tables (Seunghun Han) [Orabug: 26643645]     (CVE-2017-11473)

  - sctp: do not inherit ipv6_[mc|ac|fl]_list from parent     (Eric Dumazet) [Orabug: 26650883] (CVE-2017-9075)

  - [media] saa7164: fix double fetch PCIe access condition     (Steven Toth) [Orabug: 26675142] (CVE-2017-8831)

  - [media] saa7164: fix sparse warnings (Hans Verkuil)     [Orabug: 26675142] (CVE-2017-8831)

  - fs: __generic_file_splice_read retry lookup on     AOP_TRUNCATED_PAGE (Abhi Das) [Orabug: 26797306] -     timerfd: Protect the might cancel mechanism proper     (Thomas Gleixner) [Orabug: 26899787] (CVE-2017-10661)

  - scsi: scsi_transport_iscsi: fix the issue that     iscsi_if_rx doesn't parse nlmsg properly (Xin Long)     [Orabug: 26988627] (CVE-2017-14489)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0015 for details.

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities:

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2017-8890)

  - The sctp_v6_create_accept_sk function in net/sctp/ipv6.c     in the Linux kernel mishandles inheritance, which allows     local users to cause a denial of service or possibly     have unspecified other impact via crafted system calls,     a related issue to CVE-2017-8890. An unprivileged local     user could use this flaw to induce kernel memory     corruption on the system, leading to a crash. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although we believe it is unlikely.
    (CVE-2017-9075)

  - The IPv6 DCCP implementation in the Linux kernel     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely. (CVE-2017-9076)

  - The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c     in the Linux kernel mishandles inheritance, which allows     local users to cause a denial of service or possibly     have unspecified other impact via crafted system calls,     a related issue to CVE-2017-8890. An unprivileged local     user could use this flaw to induce kernel memory     corruption on the system, leading to a crash. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although we believe it is unlikely.
    (CVE-2017-9077)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
102511	Oracle Linux 7 : kernel (ELSA-2017-1842-1) (Stack Clash)	Nessus	Oracle Linux Local Security Checks	8/16/2017	6/3/2021	critical
103110	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:2389-1) (Stack Clash)	Nessus	SuSE Local Security Checks	9/11/2017	1/19/2021	high
104371	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2017-3637)	Nessus	Oracle Linux Local Security Checks	11/3/2017	9/8/2021	high
100435	Fedora 25 : kernel (2017-273b67d5ee)	Nessus	Fedora Local Security Checks	5/26/2017	1/11/2021	high
100769	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-047)	Nessus	Virtuozzo Local Security Checks	6/14/2017	1/4/2021	high
101852	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1122)	Nessus	Huawei Local Security Checks	7/21/2017	1/6/2021	high
102281	Oracle Linux 7 : kernel (ELSA-2017-1842)	Nessus	Oracle Linux Local Security Checks	8/9/2017	9/8/2021	high
104454	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0168)	Nessus	OracleVM Local Security Checks	11/8/2017	1/4/2021	high
106469	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0015) (BlueBorne) (Meltdown) (Spectre) (Stack Clash)	Nessus	OracleVM Local Security Checks	1/30/2018	9/27/2019	critical
127323	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0098)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

high

critical

high