ID CVE-2014-9322
Summary arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
References
Vulnerable Configurations
  • Linux Kernel 3.0 release candidate 1
    cpe:2.3:o:linux:linux_kernel:3.0:rc1
  • Linux Kernel 3.0 release candidate 2
    cpe:2.3:o:linux:linux_kernel:3.0:rc2
  • Linux Kernel 3.0 release candidate 3
    cpe:2.3:o:linux:linux_kernel:3.0:rc3
  • Linux Kernel 3.0 release candidate 4
    cpe:2.3:o:linux:linux_kernel:3.0:rc4
  • Linux Kernel 3.0 release candidate 5
    cpe:2.3:o:linux:linux_kernel:3.0:rc5
  • Linux Kernel 3.0 release candidate 6
    cpe:2.3:o:linux:linux_kernel:3.0:rc6
  • Linux Kernel 3.0 release candidate 7
    cpe:2.3:o:linux:linux_kernel:3.0:rc7
  • Linux Kernel 3.0.1
    cpe:2.3:o:linux:linux_kernel:3.0.1
  • Linux Kernel 3.0.2
    cpe:2.3:o:linux:linux_kernel:3.0.2
  • Linux Kernel 3.0.3
    cpe:2.3:o:linux:linux_kernel:3.0.3
  • Linux Kernel 3.0.4
    cpe:2.3:o:linux:linux_kernel:3.0.4
  • Linux Kernel 3.0.5
    cpe:2.3:o:linux:linux_kernel:3.0.5
  • Linux Kernel 3.0.6
    cpe:2.3:o:linux:linux_kernel:3.0.6
  • Linux Kernel 3.0.7
    cpe:2.3:o:linux:linux_kernel:3.0.7
  • Linux Kernel 3.0.8
    cpe:2.3:o:linux:linux_kernel:3.0.8
  • Linux Kernel 3.0.9
    cpe:2.3:o:linux:linux_kernel:3.0.9
  • Linux Kernel 3.0.10
    cpe:2.3:o:linux:linux_kernel:3.0.10
  • Linux Kernel 3.0.11
    cpe:2.3:o:linux:linux_kernel:3.0.11
  • Linux Kernel 3.0.12
    cpe:2.3:o:linux:linux_kernel:3.0.12
  • Linux Kernel 3.0.13
    cpe:2.3:o:linux:linux_kernel:3.0.13
  • Linux Kernel 3.0.14
    cpe:2.3:o:linux:linux_kernel:3.0.14
  • Linux Kernel 3.0.15
    cpe:2.3:o:linux:linux_kernel:3.0.15
  • Linux Kernel 3.0.16
    cpe:2.3:o:linux:linux_kernel:3.0.16
  • Linux Kernel 3.0.17
    cpe:2.3:o:linux:linux_kernel:3.0.17
  • Linux Kernel 3.0.18
    cpe:2.3:o:linux:linux_kernel:3.0.18
  • Linux Kernel 3.0.19
    cpe:2.3:o:linux:linux_kernel:3.0.19
  • Linux Kernel 3.0.20
    cpe:2.3:o:linux:linux_kernel:3.0.20
  • Linux Kernel 3.0.21
    cpe:2.3:o:linux:linux_kernel:3.0.21
  • Linux Kernel 3.0.22
    cpe:2.3:o:linux:linux_kernel:3.0.22
  • Linux Kernel 3.0.23
    cpe:2.3:o:linux:linux_kernel:3.0.23
  • Linux Kernel 3.0.24
    cpe:2.3:o:linux:linux_kernel:3.0.24
  • Linux Kernel 3.0.25
    cpe:2.3:o:linux:linux_kernel:3.0.25
  • Linux Kernel 3.0.26
    cpe:2.3:o:linux:linux_kernel:3.0.26
  • Linux Kernel 3.0.27
    cpe:2.3:o:linux:linux_kernel:3.0.27
  • Linux Kernel 3.0.28
    cpe:2.3:o:linux:linux_kernel:3.0.28
  • Linux Kernel 3.0.29
    cpe:2.3:o:linux:linux_kernel:3.0.29
  • Linux Kernel 3.0.30
    cpe:2.3:o:linux:linux_kernel:3.0.30
  • Linux Kernel 3.0.31
    cpe:2.3:o:linux:linux_kernel:3.0.31
  • Linux Kernel 3.0.32
    cpe:2.3:o:linux:linux_kernel:3.0.32
  • Linux Kernel 3.0.33
    cpe:2.3:o:linux:linux_kernel:3.0.33
  • Linux Kernel 3.0.34
    cpe:2.3:o:linux:linux_kernel:3.0.34
  • Linux Kernel 3.0.35
    cpe:2.3:o:linux:linux_kernel:3.0.35
  • Linux Kernel 3.0.36
    cpe:2.3:o:linux:linux_kernel:3.0.36
  • Linux Kernel 3.0.37
    cpe:2.3:o:linux:linux_kernel:3.0.37
  • Linux Kernel 3.0.38
    cpe:2.3:o:linux:linux_kernel:3.0.38
  • Linux Kernel 3.0.39
    cpe:2.3:o:linux:linux_kernel:3.0.39
  • Linux Kernel 3.0.40
    cpe:2.3:o:linux:linux_kernel:3.0.40
  • Linux Kernel 3.0.41
    cpe:2.3:o:linux:linux_kernel:3.0.41
  • Linux Kernel 3.0.42
    cpe:2.3:o:linux:linux_kernel:3.0.42
  • Linux Kernel 3.0.43
    cpe:2.3:o:linux:linux_kernel:3.0.43
  • Linux Kernel 3.0.44
    cpe:2.3:o:linux:linux_kernel:3.0.44
  • Linux Kernel 3.0.45
    cpe:2.3:o:linux:linux_kernel:3.0.45
  • Linux Kernel 3.0.46
    cpe:2.3:o:linux:linux_kernel:3.0.46
  • Linux Kernel 3.0.47
    cpe:2.3:o:linux:linux_kernel:3.0.47
  • Linux Kernel 3.0.48
    cpe:2.3:o:linux:linux_kernel:3.0.48
  • Linux Kernel 3.0.49
    cpe:2.3:o:linux:linux_kernel:3.0.49
  • Linux Kernel 3.0.50
    cpe:2.3:o:linux:linux_kernel:3.0.50
  • Linux Kernel 3.0.51
    cpe:2.3:o:linux:linux_kernel:3.0.51
  • Linux Kernel 3.0.52
    cpe:2.3:o:linux:linux_kernel:3.0.52
  • Linux Kernel 3.0.53
    cpe:2.3:o:linux:linux_kernel:3.0.53
  • Linux Kernel 3.0.54
    cpe:2.3:o:linux:linux_kernel:3.0.54
  • Linux Kernel 3.0.55
    cpe:2.3:o:linux:linux_kernel:3.0.55
  • Linux Kernel 3.0.56
    cpe:2.3:o:linux:linux_kernel:3.0.56
  • Linux Kernel 3.0.57
    cpe:2.3:o:linux:linux_kernel:3.0.57
  • Linux Kernel 3.0.58
    cpe:2.3:o:linux:linux_kernel:3.0.58
  • Linux Kernel 3.0.59
    cpe:2.3:o:linux:linux_kernel:3.0.59
  • Linux Kernel 3.0.60
    cpe:2.3:o:linux:linux_kernel:3.0.60
  • Linux Kernel 3.0.61
    cpe:2.3:o:linux:linux_kernel:3.0.61
  • Linux Kernel 3.0.62
    cpe:2.3:o:linux:linux_kernel:3.0.62
  • Linux Kernel 3.0.63
    cpe:2.3:o:linux:linux_kernel:3.0.63
  • Linux Kernel 3.0.64
    cpe:2.3:o:linux:linux_kernel:3.0.64
  • Linux Kernel 3.0.65
    cpe:2.3:o:linux:linux_kernel:3.0.65
  • Linux Kernel 3.0.66
    cpe:2.3:o:linux:linux_kernel:3.0.66
  • Linux Kernel 3.0.67
    cpe:2.3:o:linux:linux_kernel:3.0.67
  • Linux Kernel 3.0.68
    cpe:2.3:o:linux:linux_kernel:3.0.68
  • Linux Kernel 3.1
    cpe:2.3:o:linux:linux_kernel:3.1
  • Linux Kernel 3.1 release candidate 1
    cpe:2.3:o:linux:linux_kernel:3.1:rc1
  • Linux Kernel 3.1 release candidate 2
    cpe:2.3:o:linux:linux_kernel:3.1:rc2
  • Linux Kernel 3.1 release candidate 3
    cpe:2.3:o:linux:linux_kernel:3.1:rc3
  • Linux Kernel 3.1 release candidate 4
    cpe:2.3:o:linux:linux_kernel:3.1:rc4
  • Linux Kernel 3.1.1
    cpe:2.3:o:linux:linux_kernel:3.1.1
  • Linux Kernel 3.1.2
    cpe:2.3:o:linux:linux_kernel:3.1.2
  • Linux Kernel 3.1.3
    cpe:2.3:o:linux:linux_kernel:3.1.3
  • Linux Kernel 3.1.4
    cpe:2.3:o:linux:linux_kernel:3.1.4
  • Linux Kernel 3.1.5
    cpe:2.3:o:linux:linux_kernel:3.1.5
  • Linux Kernel 3.1.6
    cpe:2.3:o:linux:linux_kernel:3.1.6
  • Linux Kernel 3.1.7
    cpe:2.3:o:linux:linux_kernel:3.1.7
  • Linux Kernel 3.1.8
    cpe:2.3:o:linux:linux_kernel:3.1.8
  • Linux Kernel 3.1.9
    cpe:2.3:o:linux:linux_kernel:3.1.9
  • Linux Kernel 3.1.10
    cpe:2.3:o:linux:linux_kernel:3.1.10
  • Linux Kernel 3.2
    cpe:2.3:o:linux:linux_kernel:3.2
  • Linux Kernel 3.2 (x86)
    cpe:2.3:o:linux:linux_kernel:3.2:-:-:-:-:-:x86
  • Linux Kernel 3.2 release candidate 2
    cpe:2.3:o:linux:linux_kernel:3.2:rc2
  • Linux Kernel 3.2 release candidate 3
    cpe:2.3:o:linux:linux_kernel:3.2:rc3
  • Linux Kernel 3.2 release candidate 4
    cpe:2.3:o:linux:linux_kernel:3.2:rc4
  • Linux Kernel 3.2 release candidate 5
    cpe:2.3:o:linux:linux_kernel:3.2:rc5
  • Linux Kernel 3.2 release candidate 6
    cpe:2.3:o:linux:linux_kernel:3.2:rc6
  • Linux Kernel 3.2 release candidate 7
    cpe:2.3:o:linux:linux_kernel:3.2:rc7
  • Linux Kernel 3.2.1
    cpe:2.3:o:linux:linux_kernel:3.2.1
  • Linux Kernel 3.2.1 (x86)
    cpe:2.3:o:linux:linux_kernel:3.2.1:-:-:-:-:-:x86
  • Linux Kernel 3.2.2
    cpe:2.3:o:linux:linux_kernel:3.2.2
  • Linux Kernel 3.2.3
    cpe:2.3:o:linux:linux_kernel:3.2.3
  • Linux Kernel 3.2.4
    cpe:2.3:o:linux:linux_kernel:3.2.4
  • Linux Kernel 3.2.5
    cpe:2.3:o:linux:linux_kernel:3.2.5
  • Linux Kernel 3.2.6
    cpe:2.3:o:linux:linux_kernel:3.2.6
  • Linux Kernel 3.2.7
    cpe:2.3:o:linux:linux_kernel:3.2.7
  • Linux Kernel 3.2.8
    cpe:2.3:o:linux:linux_kernel:3.2.8
  • Linux Kernel 3.2.9
    cpe:2.3:o:linux:linux_kernel:3.2.9
  • Linux Kernel 3.2.10
    cpe:2.3:o:linux:linux_kernel:3.2.10
  • Linux Kernel 3.2.11
    cpe:2.3:o:linux:linux_kernel:3.2.11
  • Linux Kernel 3.2.12
    cpe:2.3:o:linux:linux_kernel:3.2.12
  • Linux Kernel 3.2.13
    cpe:2.3:o:linux:linux_kernel:3.2.13
  • Linux Kernel 3.2.14
    cpe:2.3:o:linux:linux_kernel:3.2.14
  • Linux Kernel 3.2.15
    cpe:2.3:o:linux:linux_kernel:3.2.15
  • Linux Kernel 3.2.16
    cpe:2.3:o:linux:linux_kernel:3.2.16
  • Linux Kernel 3.2.17
    cpe:2.3:o:linux:linux_kernel:3.2.17
  • Linux Kernel 3.2.18
    cpe:2.3:o:linux:linux_kernel:3.2.18
  • Linux Kernel 3.2.19
    cpe:2.3:o:linux:linux_kernel:3.2.19
  • Linux Kernel 3.2.20
    cpe:2.3:o:linux:linux_kernel:3.2.20
  • Linux Kernel 3.2.21
    cpe:2.3:o:linux:linux_kernel:3.2.21
  • Linux Kernel 3.2.22
    cpe:2.3:o:linux:linux_kernel:3.2.22
  • Linux Kernel 3.2.23
    cpe:2.3:o:linux:linux_kernel:3.2.23
  • Linux Kernel 3.2.24
    cpe:2.3:o:linux:linux_kernel:3.2.24
  • Linux Kernel 3.2.25
    cpe:2.3:o:linux:linux_kernel:3.2.25
  • Linux Kernel 3.2.26
    cpe:2.3:o:linux:linux_kernel:3.2.26
  • Linux Kernel 3.2.27
    cpe:2.3:o:linux:linux_kernel:3.2.27
  • Linux Kernel 3.2.28
    cpe:2.3:o:linux:linux_kernel:3.2.28
  • Linux Kernel 3.2.29
    cpe:2.3:o:linux:linux_kernel:3.2.29
  • Linux Kernel 3.2.30
    cpe:2.3:o:linux:linux_kernel:3.2.30
  • Linux Kernel 3.3
    cpe:2.3:o:linux:linux_kernel:3.3
  • Linux Kernel 3.3 release candidate 1
    cpe:2.3:o:linux:linux_kernel:3.3:rc1
  • Linux Kernel 3.3 release candidate 2
    cpe:2.3:o:linux:linux_kernel:3.3:rc2
  • Linux Kernel 3.3 release candidate 3
    cpe:2.3:o:linux:linux_kernel:3.3:rc3
  • Linux Kernel 3.3 release candidate 4
    cpe:2.3:o:linux:linux_kernel:3.3:rc4
  • Linux Kernel 3.3 release candidate 5
    cpe:2.3:o:linux:linux_kernel:3.3:rc5
  • Linux Kernel 3.3 release candidate 6
    cpe:2.3:o:linux:linux_kernel:3.3:rc6
  • Linux Kernel 3.3 release candidate 7
    cpe:2.3:o:linux:linux_kernel:3.3:rc7
  • Linux Kernel 3.3.1
    cpe:2.3:o:linux:linux_kernel:3.3.1
  • Linux Kernel 3.3.2
    cpe:2.3:o:linux:linux_kernel:3.3.2
  • Linux Kernel 3.3.3
    cpe:2.3:o:linux:linux_kernel:3.3.3
  • Linux Kernel 3.3.4
    cpe:2.3:o:linux:linux_kernel:3.3.4
  • Linux Kernel 3.3.5
    cpe:2.3:o:linux:linux_kernel:3.3.5
  • Linux Kernel 3.3.6
    cpe:2.3:o:linux:linux_kernel:3.3.6
  • Linux Kernel 3.3.7
    cpe:2.3:o:linux:linux_kernel:3.3.7
  • Linux Kernel 3.3.8
    cpe:2.3:o:linux:linux_kernel:3.3.8
  • Linux Kernel 3.4
    cpe:2.3:o:linux:linux_kernel:3.4
  • Linux Kernel 3.4 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:-:-:-:-:-:x86
  • Linux Kernel 3.4 release candidate 1
    cpe:2.3:o:linux:linux_kernel:3.4:rc1
  • Linux Kernel 3.4 release candidate 1 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:rc1:-:-:-:-:x86
  • Linux Kernel 3.4 release candidate 2
    cpe:2.3:o:linux:linux_kernel:3.4:rc2
  • Linux Kernel 3.4 release candidate 2 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:rc2:-:-:-:-:x86
  • Linux Kernel 3.4 release candidate 3
    cpe:2.3:o:linux:linux_kernel:3.4:rc3
  • Linux Kernel 3.4 release candidate 3 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:rc3:-:-:-:-:x86
  • Linux Kernel 3.4 release candidate 4
    cpe:2.3:o:linux:linux_kernel:3.4:rc4
  • Linux Kernel 3.4 release candidate 4 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:rc4:-:-:-:-:x86
  • Linux Kernel 3.4 release candidate 5
    cpe:2.3:o:linux:linux_kernel:3.4:rc5
  • Linux Kernel 3.4 release candidate 5 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:rc5:-:-:-:-:x86
  • Linux Kernel 3.4 release candidate 6
    cpe:2.3:o:linux:linux_kernel:3.4:rc6
  • Linux Kernel 3.4 release candidate 6 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:rc6:-:-:-:-:x86
  • Linux Kernel 3.4 release candidate 7
    cpe:2.3:o:linux:linux_kernel:3.4:rc7
  • Linux Kernel 3.4 release candidate 7 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4:rc7:-:-:-:-:x86
  • Linux Kernel 3.4.1
    cpe:2.3:o:linux:linux_kernel:3.4.1
  • Linux Kernel 3.4.1 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4.1:-:-:-:-:-:x86
  • Linux Kernel 3.4.2
    cpe:2.3:o:linux:linux_kernel:3.4.2
  • Linux Kernel 3.4.2 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4.2:-:-:-:-:-:x86
  • Linux Kernel 3.4.3
    cpe:2.3:o:linux:linux_kernel:3.4.3
  • Linux Kernel 3.4.3 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4.3:-:-:-:-:-:x86
  • Linux Kernel 3.4.4
    cpe:2.3:o:linux:linux_kernel:3.4.4
  • Linux Kernel 3.4.4 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4.4:-:-:-:-:-:x86
  • Linux Kernel 3.4.5
    cpe:2.3:o:linux:linux_kernel:3.4.5
  • Linux Kernel 3.4.5 (x86)
    cpe:2.3:o:linux:linux_kernel:3.4.5:-:-:-:-:-:x86
  • Linux Kernel 3.4.6
    cpe:2.3:o:linux:linux_kernel:3.4.6
  • Linux Kernel 3.4.7
    cpe:2.3:o:linux:linux_kernel:3.4.7
  • Linux Kernel 3.4.8
    cpe:2.3:o:linux:linux_kernel:3.4.8
  • Linux Kernel 3.4.9
    cpe:2.3:o:linux:linux_kernel:3.4.9
  • Linux Kernel 3.4.10
    cpe:2.3:o:linux:linux_kernel:3.4.10
  • Linux Kernel 3.4.11
    cpe:2.3:o:linux:linux_kernel:3.4.11
  • Linux Kernel 3.4.12
    cpe:2.3:o:linux:linux_kernel:3.4.12
  • Linux Kernel 3.4.13
    cpe:2.3:o:linux:linux_kernel:3.4.13
  • Linux Kernel 3.4.14
    cpe:2.3:o:linux:linux_kernel:3.4.14
  • Linux Kernel 3.4.15
    cpe:2.3:o:linux:linux_kernel:3.4.15
  • Linux Kernel 3.4.16
    cpe:2.3:o:linux:linux_kernel:3.4.16
  • Linux Kernel 3.4.17
    cpe:2.3:o:linux:linux_kernel:3.4.17
  • Linux Kernel 3.4.18
    cpe:2.3:o:linux:linux_kernel:3.4.18
  • Linux Kernel 3.4.19
    cpe:2.3:o:linux:linux_kernel:3.4.19
  • Linux Kernel 3.4.20
    cpe:2.3:o:linux:linux_kernel:3.4.20
  • Linux Kernel 3.4.21
    cpe:2.3:o:linux:linux_kernel:3.4.21
  • Linux Kernel 3.4.22
    cpe:2.3:o:linux:linux_kernel:3.4.22
  • Linux Kernel 3.4.23
    cpe:2.3:o:linux:linux_kernel:3.4.23
  • Linux Kernel 3.4.24
    cpe:2.3:o:linux:linux_kernel:3.4.24
  • Linux Kernel 3.4.25
    cpe:2.3:o:linux:linux_kernel:3.4.25
  • Linux Kernel 3.4.26
    cpe:2.3:o:linux:linux_kernel:3.4.26
  • Linux Kernel 3.4.27
    cpe:2.3:o:linux:linux_kernel:3.4.27
  • Linux Kernel 3.4.28
    cpe:2.3:o:linux:linux_kernel:3.4.28
  • Linux Kernel 3.4.29
    cpe:2.3:o:linux:linux_kernel:3.4.29
  • Linux Kernel 3.4.30
    cpe:2.3:o:linux:linux_kernel:3.4.30
  • Linux Kernel 3.4.31
    cpe:2.3:o:linux:linux_kernel:3.4.31
  • Linux Kernel 3.4.32
    cpe:2.3:o:linux:linux_kernel:3.4.32
  • Linux Kernel 3.4.33
    cpe:2.3:o:linux:linux_kernel:3.4.33
  • Linux Kernel 3.4.34
    cpe:2.3:o:linux:linux_kernel:3.4.34
  • Linux Kernel 3.4.35
    cpe:2.3:o:linux:linux_kernel:3.4.35
  • Linux Kernel 3.4.36
    cpe:2.3:o:linux:linux_kernel:3.4.36
  • Linux Kernel 3.4.37
    cpe:2.3:o:linux:linux_kernel:3.4.37
  • Linux Kernel 3.4.38
    cpe:2.3:o:linux:linux_kernel:3.4.38
  • Linux Kernel 3.4.39
    cpe:2.3:o:linux:linux_kernel:3.4.39
  • Linux Kernel 3.4.40
    cpe:2.3:o:linux:linux_kernel:3.4.40
  • Linux Kernel 3.4.41
    cpe:2.3:o:linux:linux_kernel:3.4.41
  • Linux Kernel 3.4.42
    cpe:2.3:o:linux:linux_kernel:3.4.42
  • Linux Kernel 3.4.43
    cpe:2.3:o:linux:linux_kernel:3.4.43
  • Linux Kernel 3.4.44
    cpe:2.3:o:linux:linux_kernel:3.4.44
  • Linux Kernel 3.4.45
    cpe:2.3:o:linux:linux_kernel:3.4.45
  • Linux Kernel 3.4.46
    cpe:2.3:o:linux:linux_kernel:3.4.46
  • Linux Kernel 3.4.47
    cpe:2.3:o:linux:linux_kernel:3.4.47
  • Linux Kernel 3.4.48
    cpe:2.3:o:linux:linux_kernel:3.4.48
  • Linux Kernel 3.4.49
    cpe:2.3:o:linux:linux_kernel:3.4.49
  • Linux Kernel 3.4.50
    cpe:2.3:o:linux:linux_kernel:3.4.50
  • Linux Kernel 3.4.51
    cpe:2.3:o:linux:linux_kernel:3.4.51
  • Linux Kernel 3.4.52
    cpe:2.3:o:linux:linux_kernel:3.4.52
  • Linux Kernel 3.4.53
    cpe:2.3:o:linux:linux_kernel:3.4.53
  • Linux Kernel 3.4.54
    cpe:2.3:o:linux:linux_kernel:3.4.54
  • Linux Kernel 3.4.55
    cpe:2.3:o:linux:linux_kernel:3.4.55
  • Linux Kernel 3.4.56
    cpe:2.3:o:linux:linux_kernel:3.4.56
  • Linux Kernel 3.4.57
    cpe:2.3:o:linux:linux_kernel:3.4.57
  • Linux Kernel 3.4.58
    cpe:2.3:o:linux:linux_kernel:3.4.58
  • Linux Kernel 3.4.59
    cpe:2.3:o:linux:linux_kernel:3.4.59
  • Linux Kernel 3.4.60
    cpe:2.3:o:linux:linux_kernel:3.4.60
  • Linux Kernel 3.4.61
    cpe:2.3:o:linux:linux_kernel:3.4.61
  • Linux Kernel 3.4.62
    cpe:2.3:o:linux:linux_kernel:3.4.62
  • Linux Kernel 3.4.63
    cpe:2.3:o:linux:linux_kernel:3.4.63
  • Linux Kernel 3.4.64
    cpe:2.3:o:linux:linux_kernel:3.4.64
  • Linux Kernel 3.4.65
    cpe:2.3:o:linux:linux_kernel:3.4.65
  • Linux Kernel 3.4.66
    cpe:2.3:o:linux:linux_kernel:3.4.66
  • Linux Kernel 3.4.67
    cpe:2.3:o:linux:linux_kernel:3.4.67
  • Linux Kernel 3.4.68
    cpe:2.3:o:linux:linux_kernel:3.4.68
  • Linux Kernel 3.4.69
    cpe:2.3:o:linux:linux_kernel:3.4.69
  • Linux Kernel 3.4.70
    cpe:2.3:o:linux:linux_kernel:3.4.70
  • Linux Kernel 3.4.71
    cpe:2.3:o:linux:linux_kernel:3.4.71
  • Linux Kernel 3.4.72
    cpe:2.3:o:linux:linux_kernel:3.4.72
  • Linux Kernel 3.4.73
    cpe:2.3:o:linux:linux_kernel:3.4.73
  • Linux Kernel 3.4.74
    cpe:2.3:o:linux:linux_kernel:3.4.74
  • Linux Kernel 3.4.75
    cpe:2.3:o:linux:linux_kernel:3.4.75
  • Linux Kernel 3.4.76
    cpe:2.3:o:linux:linux_kernel:3.4.76
  • Linux Kernel 3.4.77
    cpe:2.3:o:linux:linux_kernel:3.4.77
  • Linux Kernel 3.4.78
    cpe:2.3:o:linux:linux_kernel:3.4.78
  • Linux Kernel 3.4.79
    cpe:2.3:o:linux:linux_kernel:3.4.79
  • Linux Kernel 3.5.1
    cpe:2.3:o:linux:linux_kernel:3.5.1
  • Linux Kernel 3.5.2
    cpe:2.3:o:linux:linux_kernel:3.5.2
  • Linux Kernel 3.5.3
    cpe:2.3:o:linux:linux_kernel:3.5.3
  • Linux Kernel 3.5.4
    cpe:2.3:o:linux:linux_kernel:3.5.4
  • Linux Kernel 3.5.5
    cpe:2.3:o:linux:linux_kernel:3.5.5
  • Linux Kernel 3.5.6
    cpe:2.3:o:linux:linux_kernel:3.5.6
  • Linux Kernel 3.5.7
    cpe:2.3:o:linux:linux_kernel:3.5.7
  • Linux Kernel 3.6
    cpe:2.3:o:linux:linux_kernel:3.6
  • Linux Kernel 3.6.1
    cpe:2.3:o:linux:linux_kernel:3.6.1
  • Linux Kernel 3.6.2
    cpe:2.3:o:linux:linux_kernel:3.6.2
  • Linux Kernel 3.6.3
    cpe:2.3:o:linux:linux_kernel:3.6.3
  • Linux Kernel 3.6.4
    cpe:2.3:o:linux:linux_kernel:3.6.4
  • Linux Kernel 3.6.5
    cpe:2.3:o:linux:linux_kernel:3.6.5
  • Linux Kernel 3.6.6
    cpe:2.3:o:linux:linux_kernel:3.6.6
  • Linux Kernel 3.6.7
    cpe:2.3:o:linux:linux_kernel:3.6.7
  • Linux Kernel 3.6.8
    cpe:2.3:o:linux:linux_kernel:3.6.8
  • Linux Kernel 3.6.9
    cpe:2.3:o:linux:linux_kernel:3.6.9
  • Linux Kernel 3.6.10
    cpe:2.3:o:linux:linux_kernel:3.6.10
  • Linux Kernel 3.6.11
    cpe:2.3:o:linux:linux_kernel:3.6.11
  • Linux Kernel 3.7
    cpe:2.3:o:linux:linux_kernel:3.7
  • Linux Kernel 3.7.1
    cpe:2.3:o:linux:linux_kernel:3.7.1
  • Linux Kernel 3.7.2
    cpe:2.3:o:linux:linux_kernel:3.7.2
  • Linux Kernel 3.7.3
    cpe:2.3:o:linux:linux_kernel:3.7.3
  • Linux Kernel 3.7.4
    cpe:2.3:o:linux:linux_kernel:3.7.4
  • Linux Kernel 3.7.5
    cpe:2.3:o:linux:linux_kernel:3.7.5
  • Linux Kernel 3.7.6
    cpe:2.3:o:linux:linux_kernel:3.7.6
  • Linux Kernel 3.7.7
    cpe:2.3:o:linux:linux_kernel:3.7.7
  • Linux Kernel 3.7.8
    cpe:2.3:o:linux:linux_kernel:3.7.8
  • Linux Kernel 3.7.9
    cpe:2.3:o:linux:linux_kernel:3.7.9
  • Linux Kernel 3.7.10
    cpe:2.3:o:linux:linux_kernel:3.7.10
  • Linux Kernel 3.8.0
    cpe:2.3:o:linux:linux_kernel:3.8.0
  • Linux Kernel 3.8.1
    cpe:2.3:o:linux:linux_kernel:3.8.1
  • Linux Kernel 3.8.2
    cpe:2.3:o:linux:linux_kernel:3.8.2
  • Linux Kernel 3.8.3
    cpe:2.3:o:linux:linux_kernel:3.8.3
  • Linux Kernel 3.8.4
    cpe:2.3:o:linux:linux_kernel:3.8.4
  • Linux Kernel 3.8.5
    cpe:2.3:o:linux:linux_kernel:3.8.5
  • Linux Kernel 3.8.6
    cpe:2.3:o:linux:linux_kernel:3.8.6
  • Linux Kernel 3.8.7
    cpe:2.3:o:linux:linux_kernel:3.8.7
  • Linux Kernel 3.8.8
    cpe:2.3:o:linux:linux_kernel:3.8.8
  • Linux Kernel 3.8.9
    cpe:2.3:o:linux:linux_kernel:3.8.9
  • Linux Kernel 3.8.10
    cpe:2.3:o:linux:linux_kernel:3.8.10
  • Linux Kernel 3.8.11
    cpe:2.3:o:linux:linux_kernel:3.8.11
  • Linux Kernel 3.8.12
    cpe:2.3:o:linux:linux_kernel:3.8.12
  • Linux Kernel 3.8.13
    cpe:2.3:o:linux:linux_kernel:3.8.13
  • Linux Kernel 3.9 release candidate 1
    cpe:2.3:o:linux:linux_kernel:3.9:rc1
  • Linux Kernel 3.9 release candidate 2
    cpe:2.3:o:linux:linux_kernel:3.9:rc2
  • Linux Kernel 3.9 release candidate 3
    cpe:2.3:o:linux:linux_kernel:3.9:rc3
  • Linux Kernel 3.9 release candidate 4
    cpe:2.3:o:linux:linux_kernel:3.9:rc4
  • Linux Kernel 3.9 release candidate 5
    cpe:2.3:o:linux:linux_kernel:3.9:rc5
  • Linux Kernel 3.9 release candidate 6
    cpe:2.3:o:linux:linux_kernel:3.9:rc6
  • Linux Kernel 3.9 release candidate 7
    cpe:2.3:o:linux:linux_kernel:3.9:rc7
  • Linux Kernel 3.9.0
    cpe:2.3:o:linux:linux_kernel:3.9.0
  • Linux Kernel 3.9.0 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.0:-:-:-:-:-:arm64
  • Linux Kernel 3.9.1
    cpe:2.3:o:linux:linux_kernel:3.9.1
  • Linux Kernel 3.9.1 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.1:-:-:-:-:-:arm64
  • Linux Kernel 3.9.2
    cpe:2.3:o:linux:linux_kernel:3.9.2
  • Linux Kernel 3.9.2 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.2:-:-:-:-:-:arm64
  • Linux Kernel 3.9.3
    cpe:2.3:o:linux:linux_kernel:3.9.3
  • Linux Kernel 3.9.3 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.3:-:-:-:-:-:arm64
  • Linux Kernel 3.9.4
    cpe:2.3:o:linux:linux_kernel:3.9.4
  • Linux Kernel 3.9.4 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.4:-:-:-:-:-:arm64
  • Linux Kernel 3.9.5
    cpe:2.3:o:linux:linux_kernel:3.9.5
  • Linux Kernel 3.9.5 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.5:-:-:-:-:-:arm64
  • Linux Kernel 3.9.6
    cpe:2.3:o:linux:linux_kernel:3.9.6
  • Linux Kernel 3.9.6 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.6:-:-:-:-:-:arm64
  • Linux Kernel 3.9.7
    cpe:2.3:o:linux:linux_kernel:3.9.7
  • Linux Kernel 3.9.7 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.7:-:-:-:-:-:arm64
  • Linux Kernel 3.9.8
    cpe:2.3:o:linux:linux_kernel:3.9.8
  • Linux Kernel 3.9.8 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.8:-:-:-:-:-:arm64
  • Linux Kernel 3.9.9
    cpe:2.3:o:linux:linux_kernel:3.9.9
  • Linux Kernel 3.9.9 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.9:-:-:-:-:-:arm64
  • Linux Kernel 3.9.10
    cpe:2.3:o:linux:linux_kernel:3.9.10
  • Linux Kernel 3.9.10 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.10:-:-:-:-:-:arm64
  • Linux Kernel 3.9.11
    cpe:2.3:o:linux:linux_kernel:3.9.11
  • Linux Kernel 3.9.11 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.9.11:-:-:-:-:-:arm64
  • Linux Kernel 3.10
    cpe:2.3:o:linux:linux_kernel:3.10
  • Linux Kernel 3.10.0 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.0:-:-:-:-:-:arm64
  • Linux Kernel 3.10.1
    cpe:2.3:o:linux:linux_kernel:3.10.1
  • Linux Kernel 3.10.1 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.1:-:-:-:-:-:arm64
  • Linux Kernel 3.10.2
    cpe:2.3:o:linux:linux_kernel:3.10.2
  • Linux Kernel 3.10.2 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.2:-:-:-:-:-:arm64
  • Linux Kernel 3.10.3
    cpe:2.3:o:linux:linux_kernel:3.10.3
  • Linux Kernel 3.10.3 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.3:-:-:-:-:-:arm64
  • Linux Kernel 3.10.4
    cpe:2.3:o:linux:linux_kernel:3.10.4
  • Linux Kernel 3.10.4 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.4:-:-:-:-:-:arm64
  • Linux Kernel 3.10.5
    cpe:2.3:o:linux:linux_kernel:3.10.5
  • Linux Kernel 3.10.5 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.5:-:-:-:-:-:arm64
  • Linux Kernel 3.10.6
    cpe:2.3:o:linux:linux_kernel:3.10.6
  • Linux Kernel 3.10.6 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.6:-:-:-:-:-:arm64
  • Linux Kernel 3.10.7
    cpe:2.3:o:linux:linux_kernel:3.10.7
  • Linux Kernel 3.10.7 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.7:-:-:-:-:-:arm64
  • Linux Kernel 3.10.8
    cpe:2.3:o:linux:linux_kernel:3.10.8
  • Linux Kernel 3.10.8 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.8:-:-:-:-:-:arm64
  • Linux Kernel 3.10.9
    cpe:2.3:o:linux:linux_kernel:3.10.9
  • Linux Kernel 3.10.9 on ARM64 architecture
    cpe:2.3:o:linux:linux_kernel:3.10.9:-:-:-:-:-:arm64
  • Linux Kernel 3.10.10
    cpe:2.3:o:linux:linux_kernel:3.10.10
  • Linux Kernel 3.10.11
    cpe:2.3:o:linux:linux_kernel:3.10.11
  • Linux Kernel 3.10.2
    cpe:2.3:o:linux:linux_kernel:3.10.12
  • Linux Kernel 3.10.13
    cpe:2.3:o:linux:linux_kernel:3.10.13
  • Linux Kernel 3.10.14
    cpe:2.3:o:linux:linux_kernel:3.10.14
  • Linux Kernel 3.10.15
    cpe:2.3:o:linux:linux_kernel:3.10.15
  • Linux Kernel 3.10.16
    cpe:2.3:o:linux:linux_kernel:3.10.16
  • Linux Kernel 3.10.17
    cpe:2.3:o:linux:linux_kernel:3.10.17
  • Linux Kernel 3.10.18
    cpe:2.3:o:linux:linux_kernel:3.10.18
  • Linux Kernel 3.10.19
    cpe:2.3:o:linux:linux_kernel:3.10.19
  • Linux Kernel 3.10.20
    cpe:2.3:o:linux:linux_kernel:3.10.20
  • Linux Kernel 3.10.21
    cpe:2.3:o:linux:linux_kernel:3.10.21
  • Linux Kernel 3.10.22
    cpe:2.3:o:linux:linux_kernel:3.10.22
  • Linux Kernel 3.10.23
    cpe:2.3:o:linux:linux_kernel:3.10.23
  • Linux Kernel 3.10.24
    cpe:2.3:o:linux:linux_kernel:3.10.24
  • Linux Kernel 3.10.25
    cpe:2.3:o:linux:linux_kernel:3.10.25
  • Linux Kernel 3.10.26
    cpe:2.3:o:linux:linux_kernel:3.10.26
  • Linux Kernel 3.10.27
    cpe:2.3:o:linux:linux_kernel:3.10.27
  • Linux Kernel 3.10.28
    cpe:2.3:o:linux:linux_kernel:3.10.28
  • Linux Kernel 3.10.29
    cpe:2.3:o:linux:linux_kernel:3.10.29
  • Linux Kernel 3.11
    cpe:2.3:o:linux:linux_kernel:3.11
  • Linux Kernel 3.11.1
    cpe:2.3:o:linux:linux_kernel:3.11.1
  • Linux Kernel 3.11.2
    cpe:2.3:o:linux:linux_kernel:3.11.2
  • Linux Kernel 3.11.3
    cpe:2.3:o:linux:linux_kernel:3.11.3
  • Linux Kernel 3.11.4
    cpe:2.3:o:linux:linux_kernel:3.11.4
  • Linux Kernel 3.11.5
    cpe:2.3:o:linux:linux_kernel:3.11.5
  • Linux Kernel 3.11.6
    cpe:2.3:o:linux:linux_kernel:3.11.6
  • Linux Kernel 3.11.7
    cpe:2.3:o:linux:linux_kernel:3.11.7
  • Linux Kernel 3.11.8
    cpe:2.3:o:linux:linux_kernel:3.11.8
  • Linux Kernel 3.11.9
    cpe:2.3:o:linux:linux_kernel:3.11.9
  • Linux Kernel 3.11.10
    cpe:2.3:o:linux:linux_kernel:3.11.10
  • Linux Kernel 3.12
    cpe:2.3:o:linux:linux_kernel:3.12
  • Linux Kernel 3.12.1
    cpe:2.3:o:linux:linux_kernel:3.12.1
  • Linux Kernel 3.12.2
    cpe:2.3:o:linux:linux_kernel:3.12.2
  • Linux Kernel 3.12.3
    cpe:2.3:o:linux:linux_kernel:3.12.3
  • Linux Kernel 3.12.4
    cpe:2.3:o:linux:linux_kernel:3.12.4
  • Linux Kernel 3.12.5
    cpe:2.3:o:linux:linux_kernel:3.12.5
  • Linux Kernel 3.12.6
    cpe:2.3:o:linux:linux_kernel:3.12.6
  • Linux Kernel 3.12.7
    cpe:2.3:o:linux:linux_kernel:3.12.7
  • Linux Kernel 3.12.8
    cpe:2.3:o:linux:linux_kernel:3.12.8
  • Linux Kernel 3.12.9
    cpe:2.3:o:linux:linux_kernel:3.12.9
  • Linux Kernel 3.12.10
    cpe:2.3:o:linux:linux_kernel:3.12.10
  • Linux Kernel 3.12.11
    cpe:2.3:o:linux:linux_kernel:3.12.11
  • Linux Kernel 3.12.12
    cpe:2.3:o:linux:linux_kernel:3.12.12
  • Linux Kernel 3.12.13
    cpe:2.3:o:linux:linux_kernel:3.12.13
  • Linux Kernel 3.12.14
    cpe:2.3:o:linux:linux_kernel:3.12.14
  • Linux Kernel 3.12.15
    cpe:2.3:o:linux:linux_kernel:3.12.15
  • Linux Kernel 3.12.16
    cpe:2.3:o:linux:linux_kernel:3.12.16
  • Linux Kernel 3.12.17
    cpe:2.3:o:linux:linux_kernel:3.12.17
  • Linux Kernel 3.13
    cpe:2.3:o:linux:linux_kernel:3.13
  • Linux Kernel 3.13.1
    cpe:2.3:o:linux:linux_kernel:3.13.1
  • Linux Kernel 3.13.2
    cpe:2.3:o:linux:linux_kernel:3.13.2
  • Linux Kernel 3.13.3
    cpe:2.3:o:linux:linux_kernel:3.13.3
  • Linux Kernel 3.13.4
    cpe:2.3:o:linux:linux_kernel:3.13.4
  • Linux Kernel 3.13.5
    cpe:2.3:o:linux:linux_kernel:3.13.5
  • Linux Kernel 3.13.6
    cpe:2.3:o:linux:linux_kernel:3.13.6
  • Linux Kernel 3.13.7
    cpe:2.3:o:linux:linux_kernel:3.13.7
  • Linux Kernel 3.13.8
    cpe:2.3:o:linux:linux_kernel:3.13.8
  • Linux Kernel 3.13.9
    cpe:2.3:o:linux:linux_kernel:3.13.9
  • Linux Kernel 3.13.10
    cpe:2.3:o:linux:linux_kernel:3.13.10
  • Linux Kernel 3.13.11
    cpe:2.3:o:linux:linux_kernel:3.13.11
  • Linux Kernel 3.14
    cpe:2.3:o:linux:linux_kernel:3.14
  • Linux Kernel 3.14 release candidate 1
    cpe:2.3:o:linux:linux_kernel:3.14:rc1
  • Linux Kernel 3.14 release candidate 2
    cpe:2.3:o:linux:linux_kernel:3.14:rc2
  • Linux Kernel 3.14 release candidate 3
    cpe:2.3:o:linux:linux_kernel:3.14:rc3
  • Linux Kernel 3.14 release candidate 4
    cpe:2.3:o:linux:linux_kernel:3.14:rc4
  • Linux Kernel 3.14 release candidate 5
    cpe:2.3:o:linux:linux_kernel:3.14:rc5
  • Linux Kernel 3.14 release candidate 6
    cpe:2.3:o:linux:linux_kernel:3.14:rc6
  • Linux Kernel 3.14 release candidate 7
    cpe:2.3:o:linux:linux_kernel:3.14:rc7
  • Linux Kernel 3.14 release candidate 8
    cpe:2.3:o:linux:linux_kernel:3.14:rc8
  • Linux Kernel 3.14.1
    cpe:2.3:o:linux:linux_kernel:3.14.1
  • Linux Kernel 3.14.2
    cpe:2.3:o:linux:linux_kernel:3.14.2
  • Linux Kernel 3.14.3
    cpe:2.3:o:linux:linux_kernel:3.14.3
  • Linux Kernel 3.14.4
    cpe:2.3:o:linux:linux_kernel:3.14.4
  • Linux Kernel 3.14.5
    cpe:2.3:o:linux:linux_kernel:3.14.5
  • Linux Kernel 3.15
    cpe:2.3:o:linux:linux_kernel:3.15
  • Linux Kernel 3.15.1
    cpe:2.3:o:linux:linux_kernel:3.15.1
  • Linux Kernel 3.15.2
    cpe:2.3:o:linux:linux_kernel:3.15.2
  • Linux Kernel 3.15.3
    cpe:2.3:o:linux:linux_kernel:3.15.3
  • Linux Kernel 3.15.4
    cpe:2.3:o:linux:linux_kernel:3.15.4
  • Linux Kernel 3.15.5
    cpe:2.3:o:linux:linux_kernel:3.15.5
  • Linux Kernel 3.15.6
    cpe:2.3:o:linux:linux_kernel:3.15.6
  • Linux Kernel 3.15.7
    cpe:2.3:o:linux:linux_kernel:3.15.7
  • Linux Kernel 3.15.8
    cpe:2.3:o:linux:linux_kernel:3.15.8
  • Linux Kernel 3.16.0
    cpe:2.3:o:linux:linux_kernel:3.16.0
  • Linux Kernel 3.16.1
    cpe:2.3:o:linux:linux_kernel:3.16.1
  • Linux Kernel 3.17
    cpe:2.3:o:linux:linux_kernel:3.17
  • cpe:2.3:o:linux:linux_kernel:3.17.1
    cpe:2.3:o:linux:linux_kernel:3.17.1
  • cpe:2.3:o:linux:linux_kernel:3.17.2
    cpe:2.3:o:linux:linux_kernel:3.17.2
  • cpe:2.3:o:linux:linux_kernel:3.17.3
    cpe:2.3:o:linux:linux_kernel:3.17.3
  • cpe:2.3:o:linux:linux_kernel:3.17.4
    cpe:2.3:o:linux:linux_kernel:3.17.4
  • Google Android 5.1.1
    cpe:2.3:o:google:android:5.1.1
  • Google Android 6.0
    cpe:2.3:o:google:android:6.0
CVSS
Base: 7.2 (as of 22-06-2016 - 12:56)
Impact:
Exploitability:
CWE CWE-264
CAPEC
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
exploit-db via4
  • description Linux Kernel IRET Instruction #SS Fault Handling - Crash PoC. CVE-2014-9322. Dos exploit for lin_amd64 platform
    file exploits/linux_x86-64/dos/36266.c
    id EDB-ID:36266
    last seen 2016-02-04
    modified 2015-03-04
    platform linux_x86-64
    port
    published 2015-03-04
    reporter Emeric Nasi
    source https://www.exploit-db.com/download/36266/
    title Linux Kernel IRET Instruction #SS Fault Handling - Crash PoC
    type dos
  • description Linux Kernel - 'BadIRET' Local Privilege Escalation. CVE-2014-9322. Local exploit for Linux platform
    id EDB-ID:44205
    last seen 2018-02-28
    modified 2017-07-24
    published 2017-07-24
    reporter Exploit-DB
    source https://www.exploit-db.com/download/44205/
    title Linux Kernel - 'BadIRET' Local Privilege Escalation
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2014-1698-1.NASL
    description The SUSE Linux Enterprise 11 Service Pack 2 LTSS kernel has been updated to fix security issues on kernels on the x86_64 architecture. The following security bugs have been fixed : CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could have been used by local attackers to crash the machine or execute code. CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the 1-clock-tests test suite. CVE-2014-8133: Insufficient validation of TLS register usage could have leaked information from the kernel stack to userspace. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-01
    modified 2018-07-31
    plugin id 83653
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83653
    title SUSE SLES11 Security Update : kernel (SUSE-SU-2014:1698-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-2008.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-02
    plugin id 80105
    published 2014-12-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80105
    title CentOS 5 : kernel (CESA-2014:2008)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-3107.NASL
    description Description of changes: [2.6.39-400.215.15.el6uek] - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara) [Orabug: 20224060] {CVE-2014-5471} {CVE-2014-5472} - x86_64, traps: Stop using IST for #SS (Andy Lutomirski) [Orabug: 20224028] {CVE-2014-9090} {CVE-2014-9322}
    last seen 2018-09-01
    modified 2015-12-01
    plugin id 80157
    published 2014-12-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80157
    title Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3107)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-027.NASL
    description Multiple vulnerabilities has been found and corrected in the Linux kernel : The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c (CVE-2014-3688=. Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a long unencrypted auth ticket (CVE-2014-6416). net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket (CVE-2014-6417). net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly validate auth replies, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via crafted data from the IP address of a Ceph Monitor (CVE-2014-6418). The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk (CVE-2014-7841). Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313 (CVE-2014-7842). arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value (CVE-2014-8133). Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call (CVE-2014-8884). The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite (CVE-2014-9090). arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (CVE-2014-9322). The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address (CVE-2014-9419). The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image (CVE-2014-9420). Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key (CVE-2014-9529). The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image (CVE-2014-9584). The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD (CVE-2014-9585). The updated packages provides a solution for these security issues.
    last seen 2018-09-01
    modified 2018-07-19
    plugin id 80578
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80578
    title Mandriva Linux Security Advisory : kernel (MDVSA-2015:027)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-1997.NASL
    description Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) * A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important) * A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service. (CVE-2014-3688, Important) * A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low) * It was found that the Linux kernel's networking implementation did not correctly handle the setting of the keepalive socket option on raw sockets. A local user able to create a raw socket could use this flaw to crash the system. (CVE-2012-6657, Low) * It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low) Red Hat would like to thank Andy Lutomirski for reporting CVE-2014-9322. The CVE-2014-3673 issue was discovered by Liu Wei of Red Hat. Bug fixes : * This update fixes a race condition issue between the sock_queue_err_skb function and sk_forward_alloc handling in the socket error queue (MSG_ERRQUEUE), which could occasionally cause the kernel, for example when using PTP, to incorrectly track allocated memory for the error queue, in which case a traceback would occur in the system log. (BZ#1155427) * The zcrypt device driver did not detect certain crypto cards and the related domains for crypto adapters on System z and s390x architectures. Consequently, it was not possible to run the system on new crypto hardware. This update enables toleration mode for such devices so that the system can make use of newer crypto hardware. (BZ#1158311) * After mounting and unmounting an XFS file system several times consecutively, the umount command occasionally became unresponsive. This was caused by the xlog_cil_force_lsn() function that was not waiting for completion as expected. With this update, xlog_cil_force_lsn() has been modified to correctly wait for completion, thus fixing this bug. (BZ#1158325) * When using the ixgbe adapter with disabled LRO and the tx-usec or rs-usec variables set to 0, transmit interrupts could not be set lower than the default of 8 buffered tx frames. Consequently, a delay of TCP transfer occurred. The restriction of a minimum of 8 buffered frames has been removed, and the TCP delay no longer occurs. (BZ#1158326) * The offb driver has been updated for the QEMU standard VGA adapter, fixing an incorrect displaying of colors issue. (BZ#1158328) * Under certain circumstances, when a discovered MTU expired, the IPv6 connection became unavailable for a short period of time. This bug has been fixed, and the connection now works as expected. (BZ#1161418) * A low throughput occurred when using the dm-thin driver to write to unprovisioned or shared chunks for a thin pool with the chunk size bigger than the max_sectors_kb variable. (BZ#1161420) * Large write workloads on thin LVs could cause the iozone and smallfile utilities to terminate unexpectedly. (BZ#1161421)
    last seen 2018-09-01
    modified 2018-07-02
    plugin id 80088
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80088
    title CentOS 6 : kernel (CESA-2014:1997)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20141217_KERNEL_ON_SL5_X.NASL
    description * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) The system must be rebooted for this update to take effect.
    last seen 2018-09-01
    modified 2014-12-18
    plugin id 80100
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80100
    title Scientific Linux Security Update : kernel on SL5.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-3106.NASL
    description Description of changes: kernel-uek [3.8.13-55.1.2.el7uek] - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara) [Orabug: 20224059] {CVE-2014-5471} {CVE-2014-5472} - x86_64, traps: Stop using IST for #SS (Andy Lutomirski) [Orabug: 20224027] {CVE-2014-9090} {CVE-2014-9322}
    last seen 2018-09-01
    modified 2015-12-01
    plugin id 80156
    published 2014-12-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80156
    title Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2014-3106)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-2010.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-02
    modified 2014-12-19
    plugin id 80098
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80098
    title RHEL 7 : kernel (RHSA-2014:2010)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2015-0040.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0040 for details.
    last seen 2018-09-01
    modified 2018-07-24
    plugin id 82691
    published 2015-04-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82691
    title OracleVM 3.3 : kernel-uek (OVMSA-2015-0040)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-791.NASL
    description The openSUSE 12.3 kernel was updated to fix security issues : This will be the final kernel update for openSUSE 13.2 during its lifetime, which ends January 4th 2015. CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code. CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite. CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace. CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-8884: Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel allowed local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call. CVE-2014-3186: Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel, as used in Android on Nexus 7 devices, allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report. CVE-2014-7841: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel, when ASCONF is used, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk. CVE-2014-4608: Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel allowed context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. CVE-2014-8709: The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel did not properly maintain a certain tail pointer, which allowed remote attackers to obtain sensitive cleartext information by reading packets. CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response. CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c. CVE-2014-3182: Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value. CVE-2014-3181: Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2013-7263: The Linux kernel updated certain length values before ensuring that associated data structures have been initialized, which allowed local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. This update fixes the leak of the port number when using ipv6 sockets. (bsc#853040). CVE-2014-6410: The __udf_read_inode function in fs/udf/inode.c in the Linux kernel did not restrict the amount of ICB indirection, which allowed physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode. CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel allowed local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel, when SCTP authentication is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction. CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call. CVE-2013-2888, CVE-2013-2889, CVE-2013-2890, CVE-2013-2891, CVE-2013-2892, CVE-2013-2893, CVE-2013-2894, CVE-2013-2895, CVE-2013-2896, CVE-2013-2897, CVE-2013-2898, CVE-2013-2899: Multiple issues in the Human Interface Device (HID) subsystem in the Linux kernel allowed physically proximate attackers to cause a denial of service or system crash via (heap-based out-of-bounds write) via a crafted device. (Not separately listed.) Other bugfixes : - xfs: mark all internal workqueues as freezable (bnc#899785). - target/rd: Refactor rd_build_device_space + rd_release_device_space (bnc#882639) - Enable CONFIG_ATH9K_HTC for armv7hl/omap2plus config (bnc#890624) - swiotlb: don't assume PA 0 is invalid (bnc#865882). - drm/i915: Apply alignment restrictions on scanout surfaces for VT-d (bnc#818561). - tg3: Change nvram command timeout value to 50ms (bnc#768714). - tg3: Override clock, link aware and link idle mode during NVRAM dump (bnc#768714). - tg3: Set the MAC clock to the fastest speed during boot code load (bnc#768714).
    last seen 2018-09-01
    modified 2015-11-16
    plugin id 80150
    published 2014-12-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80150
    title openSUSE Security Update : the Linux Kernel (openSUSE-SU-2014:1669-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-794.NASL
    description The openSUSE 13.2 kernel was updated to version 3.16.7. These security issues were fixed : - CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code. (bnc#910251) - CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite. (bnc#907818) - CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace. (bnc#909077) - CVE-2014-3673: The SCTP implementation in the Linux kernel through 3.17.2 allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c (bnc#902346, bnc#902349). - CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allowed remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that triggered an incorrect uncork within the side-effect interpreter (bnc#902349). - CVE-2014-3688: The SCTP implementation in the Linux kernel before 3.17.4 allowed remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c (bnc#902351). - CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application (bnc#904013). - CVE-2014-7841: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk (bnc#905100). These non-security issues were fixed : - ahci: Check and set 64-bit DMA mask for platform AHCI driver (bnc#902632). - ahci/xgene: Remove logic to set 64-bit DMA mask (bnc#902632). - ahci_xgene: Skip the PHY and clock initialization if already configured by the firmware (bnc#902632). - ALSA: hda - Add mute LED control for Lenovo Ideapad Z560 (bnc#665315). - ALSA: hda/realtek - Add alc_update_coef*_idx() helper (bnc#905068). - ALSA: hda/realtek - Change EAPD to verb control (bnc#905068). - ALSA: hda/realtek - Optimize alc888_coef_init() (bnc#905068). - ALSA: hda/realtek - Restore default value for ALC668 (bnc#905068). - ALSA: hda/realtek - Update Initial AMP for EAPD control (bnc#905068). - ALSA: hda/realtek - Update restore default value for ALC282 (bnc#905068). - ALSA: hda/realtek - Update restore default value for ALC283 (bnc#905068). - ALSA: hda/realtek - Use alc_write_coef_idx() in alc269_quanta_automake() (bnc#905068). - ALSA: hda/realtek - Use tables for batch COEF writes/updtes (bnc#905068). - ALSA: usb-audio: Do not resubmit pending URBs at MIDI error recovery. - arm64: Add architectural support for PCI (bnc#902632). - arm64: adjust el0_sync so that a function can be called (bnc#902632). - arm64: Do not call enable PCI resources when specify PCI_PROBE_ONLY (bnc#902632). - arm64: dts: Add X-Gene reboot driver dts node (bnc#902632). - arm64/efi: efistub: cover entire static mem footprint in PE/COFF .text (bnc#902632). - arm64/efi: efistub: do not abort if base of DRAM is occupied (bnc#902632). - arm64: fix bug for reloading FPSIMD state after cpu power off (bnc#902632). - arm64: fix VTTBR_BADDR_MASK (bnc#902632). - arm64: fpsimd: fix a typo in fpsimd_save_partial_state ENDPROC (bnc#902632). - arm64/mustang: Disable sgenet and xgenet (bnc#902632). - arm64: Select reboot driver for X-Gene platform (bnc#902632). - arm: Add APM Mustang network driver (bnc#902632). - arm/arm64: KVM: Fix and refactor unmap_range (bnc#902632). - arm: Define PCI_IOBASE as the base of virtual PCI IO space (bnc#902632). - asm-generic/io.h: Fix ioport_map() for !CONFIG_GENERIC_IOMAP (bnc#902632). - ax88179_178a: fix bonding failure (bsc#908253). - btrfs: Fix and enhance merge_extent_mapping() to insert best fitted extent map. - btrfs: fix crash of btrfs_release_extent_buffer_page. - btrfs: fix invalid leaf slot access in btrfs_lookup_extent(). - btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup. - btrfs: fix lockups from btrfs_clear_path_blocking. - btrfs: fix race that makes btrfs_lookup_extent_info miss skinny extent items. - btrfs: Fix the wrong condition judgment about subset extent map. - btrfs: fix wrong accounting of raid1 data profile in statfs. - btrfs: send, do not delay dir move if there is a new parent inode. - config: armv7hl: Disable CONFIG_USB_MUSB_TUSB6010 (bnc#906914). - cpufreq: arm_big_little: fix module license spec (bnc#902632). - Delete patches.rpmify/chipidea-clean-up-dependencies (bnc#903986). - Disable Exynos cpufreq modules. - drivers/net/fddi/skfp/h/skfbi.h: Remove useless PCI_BASE_2ND macros (bnc#902632). - drm/i915: Keep vblank interrupts enabled while enabling/disabling planes (bnc#904097). - drm: Implement O_NONBLOCK support on /dev/dri/cardN (bnc#904097). - drm/nv50/disp: fix dpms regression on certain boards (bnc#902728). - drm/radeon: add locking around atombios scratch space usage (bnc#904932). - drm/radeon: add missing crtc unlock when setting up the MC (bnc#904932). - drm/radeon/dpm: disable ulv support on SI (bnc#904932). - drm/radeon: fix endian swapping in vbios fetch for tdp table (bnc#904932). - drm/radeon: fix speaker allocation setup (bnc#904932). - drm/radeon: initialize sadb to NULL in the audio code (bnc#904932). - drm/radeon: make sure mode init is complete in bandwidth_update (bnc#904932). - drm/radeon: report disconnected for LVDS/eDP with PX if ddc fails (bnc#904417). - drm/radeon: set correct CE ram size for CIK (bnc#904932). - drm/radeon: Use drm_malloc_ab instead of kmalloc_array (bnc#904932). - drm/radeon: use gart for DMA IB tests (bnc#904932). - drm/radeon: use gart memory for DMA ring tests (bnc#904932). - drm/tilcdc: Fix the error path in tilcdc_load() (bko#86071). - hp_accel: Add support for HP ZBook 15 (bnc#905329). - ideapad-laptop: Change Lenovo Yoga 2 series rfkill handling (bnc#904289). - Input: i8042 - also set the firmware id for MUXed ports (bnc#897112). - Input: psmouse - add psmouse_matches_pnp_id helper function (bnc#897112). - Input: psmouse - add support for detecting FocalTech PS/2 touchpads (bnc#897112). - Input: synaptics - add min/max quirk for Lenovo T440s (bnc#903748). - irqchip: gic: preserve gic V2 bypass bits in cpu ctrl register (bnc#902632). - iwlwifi: dvm: drop non VO frames when flushing (bnc#900786). - KEYS: Allow special keys (eg. DNS results) to be invalidated by CAP_SYS_ADMIN (bnc#904717). - KEYS: Fix stale key registration at error path (bnc#908163). - KEYS: Fix the size of the key description passed to/from userspace (bnc#904717). - KEYS: Increase root_maxkeys and root_maxbytes sizes (bnc#904717). - KEYS: request_key() should reget expired keys rather than give EKEYEXPIRED (bnc#904717). - KEYS: Simplify KEYRING_SEARCH_{NO,DO}_STATE_CHECK flags (bnc#904717). - KVM: ARM: Add arm,gic-400 compatible support (bnc#902632). - KVM: ARM: Hack to enable VGIC mapping on 64k PAGE_SIZE kernels (bnc#902633). - Limit xgbe a0 driver to arm64 - net/xgbe: Add A0 silicon support (bnc#902632). - of/pci: Add pci_get_new_domain_nr() and of_get_pci_domain_nr() (bnc#902632). - of/pci: Add pci_register_io_range() and pci_pio_to_address() (bnc#902632). - of/pci: Add support for parsing PCI host bridge resources from DT (bnc#902632). - of/pci: Fix the conversion of IO ranges into IO resources (bnc#902632). - of/pci: Move of_pci_range_to_resource() to of/address.c (bnc#902632). - parport: parport_pc, do not remove parent devices early (bnc#856659). - PCI: Add generic domain handling (bnc#902632). - PCI: Add pci_remap_iospace() to map bus I/O resources (bnc#902632). - PCI: xgene: Add APM X-Gene PCIe driver (bnc#902632). - power: reset: Add generic SYSCON register mapped reset (bnc#902632). - power: reset: Remove X-Gene reboot driver (bnc#902632). - quirk for Lenovo Yoga 3: no rfkill switch (bnc#904289). - reiserfs: destroy allocated commit workqueue. - rtc: ia64: allow other architectures to use EFI RTC (bnc#902632). - scripts/tags.sh: Do not specify kind-spec for emacs ctags/etags. - scripts/tags.sh: fix DEFINE_HASHTABLE in emacs case. - tags.sh: Fixup regex definition for etags. - ttusb-dec: buffer overflow in ioctl (bnc#905739). - usb: Add support for Synopsis H20AHB EHCI host controller (bnc#902632). - usb: fix hcd h20ahb driver depends (bnc#902632). - usb: uvc: add a quirk for Dell XPS M1330 webcam (bnc#904539). - usb: uvc: Fix destruction order in uvc_delete() (bnc#897736).
    last seen 2018-09-01
    modified 2014-12-22
    plugin id 80153
    published 2014-12-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80153
    title openSUSE Security Update : Linux Kernel (openSUSE-SU-2014:1678-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-0812-1.NASL
    description The SUSE Linux Enterprise 10 SP4 LTSS kernel was updated to receive various security and bugfixes. The following security bugs have been fixed : CVE-2015-2041: A information leak in the llc2_timeout_table was fixed (bnc#919007). CVE-2014-9322: arch/x86/kernel/entry_64.S in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (bnc#910251). CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the 1-clock-tests test suite (bnc#907818). CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel did not properly manage a certain backlog value, which allowed remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (bnc#885422). CVE-2014-3673: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c (bnc#902346). CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response (bnc#896391). CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c (bnc#896390). CVE-2014-1874: The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel allowed local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context (bnc#863335). CVE-2014-0181: The Netlink implementation in the Linux kernel did not provide a mechanism for authorizing socket operations based on the opener of a socket, which allowed local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program (bnc#875051). CVE-2013-4299: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel allowed remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device (bnc#846404). CVE-2013-2147: The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel did not initialize certain data structures, which allowed local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c (bnc#823260). CVE-2012-6657: The sock_setsockopt function in net/core/sock.c in the Linux kernel did not ensure that a keepalive action is associated with a stream socket, which allowed local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket (bnc#896779). CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem (bnc#769784). CVE-2012-2319: Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel allowed local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020 (bnc#760902). CVE-2012-2313: The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel did not restrict access to the SIOCSMIIREG command, which allowed local users to write data to an Ethernet adapter via an ioctl call (bnc#758813). CVE-2011-4132: The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allowed local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an 'invalid log first block value' (bnc#730118). CVE-2011-4127: The Linux kernel did not properly restrict SG_IO ioctl calls, which allowed local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume (bnc#738400). CVE-2011-1585: The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel did not properly determine the associations between users and sessions, which allowed local users to bypass CIFS share authentication by leveraging a mount of a share by a different user (bnc#687812). CVE-2011-1494: Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel might have allowed local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow (bnc#685402). CVE-2011-1495: drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel did not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions (bnc#685402). CVE-2011-1493: Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel allowed remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket (bnc#681175). CVE-2011-4913: The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel did not validate the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, which allowed remote attackers to (1) cause a denial of service (integer underflow, heap memory corruption, and panic) via a small length value in data sent to a ROSE socket, or (2) conduct stack-based buffer overflow attacks via a large length value in data sent to a ROSE socket (bnc#681175). CVE-2011-4914: The ROSE protocol implementation in the Linux kernel did not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket (bnc#681175). CVE-2011-1476: Integer underflow in the Open Sound System (OSS) subsystem in the Linux kernel on unspecified non-x86 platforms allowed local users to cause a denial of service (memory corruption) by leveraging write access to /dev/sequencer (bnc#681999). CVE-2011-1477: Multiple array index errors in sound/oss/opl3.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer (bnc#681999). CVE-2011-1163: The osf_partition function in fs/partitions/osf.c in the Linux kernel did not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing (bnc#679812). CVE-2011-1090: The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel stored NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allowed local users to cause a denial of service (panic) via a crafted attempt to set an ACL (bnc#677286). CVE-2014-9584: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel did not validate a length value in the Extensions Reference (ER) System Use Field, which allowed local users to obtain sensitive information from kernel memory via a crafted iso9660 image (bnc#912654). CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the Linux kernel did not restrict the number of Rock Ridge continuation entries, which allowed local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image (bnc#911325). CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry (bnc#892490). CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry (bnc#892490). CVE-2014-3917: kernel/auditsc.c in the Linux kernel, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allowed local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number (bnc#880484). CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (bnc#883795). CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allowed local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call (bnc#883795). CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not properly maintain the user_ctl_count value, which allowed local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls (bnc#883795). CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel did not ensure possession of a read/write lock, which allowed local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (bnc#883795). CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function (bnc#883795). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-02
    modified 2018-07-31
    plugin id 83723
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83723
    title SUSE SLES10 Security Update : kernel (SUSE-SU-2015:0812-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20141216_KERNEL_ON_SL6_X.NASL
    description - A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important) - A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service. (CVE-2014-3688, Important) - A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low) - It was found that the Linux kernel's networking implementation did not correctly handle the setting of the keepalive socket option on raw sockets. A local user able to create a raw socket could use this flaw to crash the system. (CVE-2012-6657, Low) - It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low) Bug fixes : - This update fixes a race condition issue between the sock_queue_err_skb function and sk_forward_alloc handling in the socket error queue (MSG_ERRQUEUE), which could occasionally cause the kernel, for example when using PTP, to incorrectly track allocated memory for the error queue, in which case a traceback would occur in the system log. - The zcrypt device driver did not detect certain crypto cards and the related domains for crypto adapters on System z and s390x architectures. Consequently, it was not possible to run the system on new crypto hardware. This update enables toleration mode for such devices so that the system can make use of newer crypto hardware. - After mounting and unmounting an XFS file system several times consecutively, the umount command occasionally became unresponsive. This was caused by the xlog_cil_force_lsn() function that was not waiting for completion as expected. With this update, xlog_cil_force_lsn() has been modified to correctly wait for completion, thus fixing this bug. - When using the ixgbe adapter with disabled LRO and the tx-usec or rs- usec variables set to 0, transmit interrupts could not be set lower than the default of 8 buffered tx frames. Consequently, a delay of TCP transfer occurred. The restriction of a minimum of 8 buffered frames has been removed, and the TCP delay no longer occurs. - The offb driver has been updated for the QEMU standard VGA adapter, fixing an incorrect displaying of colors issue. - Under certain circumstances, when a discovered MTU expired, the IPv6 connection became unavailable for a short period of time. This bug has been fixed, and the connection now works as expected. - A low throughput occurred when using the dm-thin driver to write to unprovisioned or shared chunks for a thin pool with the chunk size bigger than the max_sectors_kb variable. - Large write workloads on thin LVs could cause the iozone and smallfile utilities to terminate unexpectedly.
    last seen 2018-09-01
    modified 2014-12-18
    plugin id 80099
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80099
    title Scientific Linux Security Update : kernel on SL6.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_KERNEL-150306.NASL
    description The SUSE Linux Enterprise 11 SP3 kernel has been updated to receive various security and bugfixes. New features enabled : - The Ceph and rbd remote network block device drivers are now enabled and supported, to serve as client for SUSE Enterprise Storage 1.0. (FATE#318328) - Support to selected Bay Trail CPUs used in Point of Service Hardware was enabled. (FATE#317933) - Broadwell Legacy Audio, HDMI Audio and DisplayPort Audio support (Audio Driver: HD-A HDMI/DP Audio/HDA Analog/DSP) was enabled. (FATE#317347) The following security bugs have been fixed : - An integer overflow in the stack randomization on 64-bit systems lead to less effective stack ASLR on those systems. (bsc#917839). (CVE-2015-1593) - iptables rules could be bypassed if the specific network protocol module was not loaded, allowing e.g. SCTP to bypass the firewall if the sctp protocol was not enabled. (bsc#913059). (CVE-2014-8160) - A flaw was found in the way the Linux kernels splice() system call validated its parameters. On certain file systems, a local, unprivileged user could have used this flaw to write past the maximum file size, and thus crash the system. (bnc#915322). (CVE-2014-7822) - The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel did not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which made it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. (bnc#911326). (CVE-2014-9419) - The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel did not validate a length value in the Extensions Reference (ER) System Use Field, which allowed local users to obtain sensitive information from kernel memory via a crafted iso9660 image. (bnc#912654). (CVE-2014-9584) - The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel did not properly choose memory locations for the vDSO area, which made it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. (bnc#912705). (CVE-2014-9585) - The d_walk function in fs/dcache.c in the Linux kernel did not properly maintain the semantics of rename_lock, which allowed local users to cause a denial of service (deadlock and system hang) via a crafted application. (bnc#903640). (CVE-2014-8559) - The rock_continue function in fs/isofs/rock.c in the Linux kernel did not restrict the number of Rock Ridge continuation entries, which allowed local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image (bsc#911325). (CVE-2014-9420) - The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel used an improper paravirt_enabled setting for KVM guest kernels, which made it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value (bnc#907818 909077 909078). (CVE-2014-8134) - The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel miscalculated the number of pages during the handling of a mapping failure, which allowed guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601 (bsc#902675). (CVE-2014-8369) - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel on Intel processors did not ensure that the value in the CR4 control register remains the same after a VM entry, which allowed host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU. (bnc#902232). (CVE-2014-3690) - Race condition in arch/x86/kvm/x86.c in the Linux kernel allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313. (bnc#905312). (CVE-2014-7842) - The Netlink implementation in the Linux kernel did not provide a mechanism for authorizing socket operations based on the opener of a socket, which allowed local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. (bnc#875051). (CVE-2014-0181) - The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an associations output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c. (bnc#902351). (CVE-2014-3688) - The pivot_root implementation in fs/namespace.c in the Linux kernel did not properly interact with certain locations of a chroot directory, which allowed local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call. (bnc#900644). (CVE-2014-7970) - The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. (bnc#902349, bnc#904899). (CVE-2014-3687) The following non-security bugs have been fixed : - ACPI idle: permit sparse C-state sub-state numbers (bnc#908550,FATE#317933). - ALSA : hda - not use assigned converters for all unused pins (FATE#317933). - ALSA: hda - Add Device IDs for Intel Wildcat Point-LP PCH (FATE#317347). - ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets (FATE#317347). - ALSA: hda - add PCI IDs for Intel BayTrail (FATE#317347). - ALSA: hda - add PCI IDs for Intel Braswell (FATE#317347). - ALSA: hda - add codec ID for Braswell display audio codec (FATE#317933). - ALSA: hda - add codec ID for Broadwell display audio codec (FATE#317933). - ALSA: hda - add codec ID for Valleyview2 display codec (FATE#317933). - ALSA: hda - define is_haswell() to check if a display audio codec is Haswell (FATE#317933). - ALSA: hda - hdmi: Re-setup pin and infoframe on plug-in on all codecs (FATE#317933). - ALSA: hda - not choose assigned converters for unused pins of Valleyview (FATE#317933). - ALSA: hda - rename function not_share_unassigned_cvt() (FATE#317933). - ALSA: hda - unmute pin amplifier in infoframe setup for Haswell (FATE#317933). - ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV (FATE#317933). - ALSA: hda - verify pin:cvt connection on preparing a stream for Intel HDMI codec (FATE#317933). - ALSA: hda/hdmi - apply Valleyview fix-ups to Cherryview display codec (FATE#317933). - ALSA: hda/hdmi - apply all Haswell fix-ups to Broadwell display codec (FATE#317933). - ALSA: hda_intel: Add Device IDs for Intel Sunrise Point PCH (FATE#317347). - ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP (FATE#317347). - Add support for AdvancedSilicon HID multitouch screen (2149:36b1) (FATE#317933). - Disable switching to bootsplash at oops/panic. (bnc#877593) - Do not trigger congestion wait on dirty-but-not-writeout pages (VM Performance, bnc#909093, bnc#910517). - Fix HDIO_DRIVE_* ioctl() regression. (bnc#833588, bnc#905799) - Fix Module.supported handling for external modules. (bnc#905304) - Fix zero freq if frequency is requested too quickly in a row. (bnc#908572) - Fix zero freq if frequency is requested too quickly in a row. (bnc#908572) - Fixup kABI after patches.fixes/writeback-do-not-sync-data-dirtied-after-s ync-start.patch. (bnc#833820) - Force native backlight for HP POS machines (bnc#908551,FATE#317933). - HID: use multi input quirk for 22b9:2968 (FATE#317933). - IPoIB: Use a private hash table for path lookup in xmit path (bsc#907196). - Import kabi files from kernel 3.0.101-0.40 - KEYS: Fix stale key registration at error path. (bnc#908163) - NFS: Add sequence_priviliged_ops for nfs4_proc_sequence(). (bnc#864401) - NFS: do not use STABLE writes during writeback. (bnc#816099) - NFSv4.1 handle DS stateid errors. (bnc#864401) - NFSv4.1: Do not decode skipped layoutgets. (bnc#864411) - NFSv4.1: Fix a race in the pNFS return-on-close code. (bnc#864409) - NFSv4.1: Fix an ABBA locking issue with session and state serialisation. (bnc#864409) - NFSv4.1: We must release the sequence id when we fail to get a session slot. (bnc#864401) - NFSv4: Do not accept delegated opens when a delegation recall is in effect. (bnc#864409) - NFSv4: Ensure correct locking when accessing the '^a' list. (bnc#864401) - NFSv4: Fix another reboot recovery race. (bnc#916982) - Preserve kabi checksum of path_is_under(). - Refresh patches.drivers/HID-multitouch-add-support-for-Atmel-212 c. Fix the non-working touchsreen. (bnc#909740) - Revert 'drm/i915: Calculate correct stolen size for GEN7+' (bnc#908550,FATE#317933). - SUNRPC: Do not allow low priority tasks to pre-empt higher priority ones. (bnc#864401) - SUNRPC: When changing the queue priority, ensure that we change the owner. (bnc#864401) - Setting rbd and libceph as supported drivers (bsc#917884) - audit: efficiency fix 1: only wake up if queue shorter than backlog limit. (bnc#908393) - audit: efficiency fix 2: request exclusive wait since all need same resource. (bnc#908393) - audit: fix endless wait in audit_log_start(). (bnc#908393) - audit: make use of remaining sleep time from wait_for_auditd. (bnc#908393) - audit: refactor hold queue flush. (bnc#908393) - audit: reset audit backlog wait time after error recovery. (bnc#908393) - audit: wait_for_auditd() should use TASK_UNINTERRUPTIBLE. (bnc#908393) - block: rbd: use NULL instead of 0 (FATE#318328 bsc#917884). - block: replace strict_strtoul() with kstrtoul() (FATE#318328 bsc#917884). - bonding: propagate LRO disabling down to slaves. (bnc#829110 / bnc#891277 / bnc#904053) - cciss: fix broken mutex usage in ioctl. (bnc#910013) - ceph: Add necessary clean up if invalid reply received in handle_reply() (FATE#318328 bsc#917884). - ceph: remove bogus extern (FATE#318328 bsc#917884). - config: Disable CONFIG_RCU_FAST_NO_HZ (bnc#884817) This option has been verified to be racy vs hotplug, and is irrelevant to SLE in any case. - coredump: ensure the fpu state is flushed for proper multi-threaded core dump. (bnc#904671) - crush: CHOOSE_LEAF -> CHOOSELEAF throughout (FATE#318328 bsc#917884). - crush: add SET_CHOOSE_TRIES rule step (FATE#318328 bsc#917884). - crush: add note about r in recursive choose (FATE#318328 bsc#917884). - crush: add set_choose_local_[fallback_]tries steps (FATE#318328 bsc#917884). - crush: apply chooseleaf_tries to firstn mode too (FATE#318328 bsc#917884). - crush: attempts -> tries (FATE#318328 bsc#917884). - crush: clarify numrep vs endpos (FATE#318328 bsc#917884). - crush: eliminate CRUSH_MAX_SET result size limitation (FATE#318328 bsc#917884). - crush: factor out (trivial) crush_destroy_rule() (FATE#318328 bsc#917884). - crush: fix crush_choose_firstn comment (FATE#318328 bsc#917884). - crush: fix some comments (FATE#318328 bsc#917884). - crush: generalize descend_once (FATE#318328 bsc#917884). - crush: new SET_CHOOSE_LEAF_TRIES command (FATE#318328 bsc#917884). - crush: pass parent r value for indep call (FATE#318328 bsc#917884). - crush: pass weight vector size to map function (FATE#318328 bsc#917884). - crush: reduce scope of some local variables (FATE#318328 bsc#917884). - crush: return CRUSH_ITEM_UNDEF for failed placements with indep (FATE#318328 bsc#917884). - crush: strip firstn conditionals out of crush_choose, rename (FATE#318328 bsc#917884). - crush: use breadth-first search for indep mode (FATE#318328 bsc#917884). - crypto: add missing crypto module aliases (bsc#914423). - crypto: include crypto- module prefix in template (bsc#914423). - crypto: kernel oops at insmod of the z90crypt device driver (bnc#909088, LTC#119591). - crypto: prefix module autoloading with 'crypto-' (bsc#914423). - dm raid: add region_size parameter. (bnc#895841) - do not do blind d_drop() in nfs_prime_dcache(). (bnc#908069 / bnc#896484) - drm/cirrus: Fix cirrus drm driver for fbdev + qemu (bsc#909846,bnc#856760). - drm/i915: split PCI IDs out into i915_drm.h v4 (bnc#908550,FATE#317933). - fix dcache exit scaling. (bnc#876594) - infiniband: ipoib: Sanitize neighbour handling in ipoib_main.c (bsc#907196). - iommu/vt-d: Fix an off-by-one bug in __domain_mapping() (bsc#908825). - ipoib: Convert over to dev_lookup_neigh_skb() (bsc#907196). - ipoib: Need to do dst_neigh_lookup_skb() outside of priv->lock (bsc#907196). - ipv6: fix net reference leak in IPv6 conntrack reassembly. (bnc#865419) - isofs: Fix unchecked printing of ER records. - kABI: protect console include in consolemap. - kabi fix. (bnc#864404) - kabi, mm: prevent endless growth of anon_vma hierarchy. (bnc#904242) - kernel/audit.c: avoid negative sleep durations. (bnc#908393) - kernel: 3215 tty close crash (bnc#915209, LTC#120873). - kernel: incorrect clock_gettime result (bnc#915209, LTC#121184). - kvm: Do not expose MONITOR cpuid as available. (bnc#887597) - kvm: iommu: Add cond_resched to legacy device assignment code. (bnc#910159) - libceph: CEPH_OSD_FLAG_* enum update (FATE#318328 bsc#917884). - libceph: add ceph_kv{malloc,free}() and switch to them (FATE#318328 bsc#917884). - libceph: add ceph_pg_pool_by_id() (FATE#318328 bsc#917884). - libceph: add function to ensure notifies are complete (FATE#318328 bsc#917884). - libceph: add process_one_ticket() helper (FATE#318328 bsc#917884). - libceph: all features fields must be u64 (FATE#318328 bsc#917884). - libceph: block I/O when PAUSE or FULL osd map flags are set (FATE#318328 bsc#917884). - libceph: call r_unsafe_callback when unsafe reply is received (FATE#318328 bsc#917884). - libceph: create_singlethread_workqueue() does not return ERR_PTRs (FATE#318328 bsc#917884). - libceph: do not hard code max auth ticket len (FATE#318328 bsc#917884). - libceph: dout() is missing a newline (FATE#318328 bsc#917884). - libceph: factor out logic from ceph_osdc_start_request() (FATE#318328 bsc#917884). - libceph: fix error handling in ceph_osdc_init() (FATE#318328 bsc#917884). - libceph: fix preallocation check in get_reply() (FATE#318328 bsc#917884). - libceph: fix safe completion (FATE#318328 bsc#917884). - libceph: follow redirect replies from osds (FATE#318328 bsc#917884). - libceph: follow {read,write}_tier fields on osd request submission (FATE#318328 bsc#917884). - libceph: gracefully handle large reply messages from the mon (FATE#318328 bsc#917884). - libceph: introduce and start using oid abstraction (FATE#318328 bsc#917884). - libceph: rename MAX_OBJ_NAME_SIZE to CEPH_MAX_OID_NAME_LEN (FATE#318328 bsc#917884). - libceph: rename ceph_msg::front_max to front_alloc_len (FATE#318328 bsc#917884). - libceph: rename ceph_osd_request::r_{oloc,oid} to r_base_{oloc,oid} (FATE#318328 bsc#917884). - libceph: rename front to front_len in get_reply() (FATE#318328 bsc#917884). - libceph: replace ceph_calc_ceph_pg() with ceph_oloc_oid_to_pg() (FATE#318328 bsc#917884). - libceph: resend all writes after the osdmap loses the full flag (FATE#318328 bsc#917884). - libceph: start using oloc abstraction (FATE#318328 bsc#917884). - libceph: take map_sem for read in handle_reply() (FATE#318328 bsc#917884). - libceph: update ceph_features.h (FATE#318328 bsc#917884). - libceph: use CEPH_MON_PORT when the specified port is 0 (FATE#318328 bsc#917884). - libiscsi: Added new boot entries in the session sysfs (FATE#316723 bsc#914355) - mei: ME hardware reset needs to be synchronized. (bnc#876086) - mei: add 9 series PCH mei device ids. (bnc#876086) - mei: add hw start callback. (bnc#876086) - mei: cancel stall timers in mei_reset. (bnc#876086) - mei: do not have to clean the state on power up. (bnc#876086) - mei: limit the number of consecutive resets. (bnc#876086) - mei: me: add Lynx Point Wellsburg work station device id. (bnc#876086) - mei: me: clear interrupts on the resume path. (bnc#876086) - mei: me: do not load the driver if the FW does not support MEI interface. (bnc#876086) - mei: me: fix hardware reset flow. (bnc#876086) - mei: me: read H_CSR after asserting reset. (bnc#876086) - mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process being killed (VM Functionality bnc#910150). - mm: fix BUG in __split_huge_page_pmd. (bnc#906586) - mm: fix corner case in anon_vma endless growing prevention. (bnc#904242) - mm: prevent endless growth of anon_vma hierarchy. (bnc#904242) - mm: vmscan: count only dirty pages as congested (VM Performance, bnc#910517). - net, sunrpc: suppress allocation warning in rpc_malloc(). (bnc#904659) - net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes (FATE#318328 bsc#917884). - net: handle more general stacking in dev_disable_lro(). (bnc#829110 / bnc#891277 / bnc#904053) - netfilter: do not drop packet on insert collision. (bnc#907611) - nf_conntrack: avoid reference leak in __ipv6_conntrack_in(). (bnc#865419) - nfs_prime_dcache needs fh to be set. (bnc#908069 / bnc#896484) - nfsd: fix EXDEV checking in rename. (bnc#915791) - pnfs: defer release of pages in layoutget. (bnc#864411) - proc_sys_revalidate: fix Oops on NULL nameidata. (bnc#907551) - qlge: fix an '&&' vs '||' bug (bsc#912171). - rbd: Fix error recovery in rbd_obj_read_sync() (FATE#318328 bsc#917884). - rbd: Use min_t() to fix comparison of distinct pointer types warning (FATE#318328 bsc#917884). - rbd: add 'minor' sysfs rbd device attribute (FATE#318328 bsc#917884). - rbd: add support for single-major device number allocation scheme (FATE#318328 bsc#917884). - rbd: clean up a few things in the refresh path (FATE#318328 bsc#917884). - rbd: complete notifies before cleaning up osd_client and rbd_dev (FATE#318328 bsc#917884). - rbd: do not destroy ceph_opts in rbd_add() (FATE#318328 bsc#917884). - rbd: do not hold ctl_mutex to get/put device (FATE#318328 bsc#917884). - rbd: drop an unsafe assertion (FATE#318328 bsc#917884). - rbd: drop original request earlier for existence check (FATE#318328 bsc#917884). - rbd: enable extended devt in single-major mode (FATE#318328 bsc#917884). - rbd: fetch object order before using it (FATE#318328 bsc#917884). - rbd: fix I/O error propagation for reads (FATE#318328 bsc#917884). - rbd: fix a couple warnings (FATE#318328 bsc#917884). - rbd: fix buffer size for writes to images with snapshots (FATE#318328 bsc#917884). - rbd: fix cleanup in rbd_add() (FATE#318328 bsc#917884). - rbd: fix error handling from rbd_snap_name() (FATE#318328 bsc#917884). - rbd: fix error paths in rbd_img_request_fill() (FATE#318328 bsc#917884). - rbd: fix null dereference in dout (FATE#318328 bsc#917884). - rbd: fix use-after free of rbd_dev->disk (FATE#318328 bsc#917884). - rbd: flush dcache after zeroing page data (FATE#318328 bsc#917884). - rbd: ignore unmapped snapshots that no longer exist (FATE#318328 bsc#917884). - rbd: introduce rbd_dev_header_unwatch_sync() and switch to it (FATE#318328 bsc#917884). - rbd: make rbd_obj_notify_ack() synchronous (FATE#318328 bsc#917884). - rbd: protect against concurrent unmaps (FATE#318328 bsc#917884). - rbd: protect against duplicate client creation (FATE#318328 bsc#917884). - rbd: rbd_device::dev_id is an int, format it as such (FATE#318328 bsc#917884). - rbd: refactor rbd_init() a bit (FATE#318328 bsc#917884). - rbd: send snapshot context with writes (FATE#318328 bsc#917884). - rbd: set removing flag while holding list lock (FATE#318328 bsc#917884). - rbd: switch to ida for rbd id assignments (FATE#318328 bsc#917884). - rbd: take a little credit (FATE#318328 bsc#917884). - rbd: tear down watch request if rbd_dev_device_setup() fails (FATE#318328 bsc#917884). - rbd: tweak 'loaded' message and module description (FATE#318328 bsc#917884). - rbd: use reference counts for image requests (FATE#318328 bsc#917884). - rbd: use rwsem to protect header updates (FATE#318328 bsc#917884). - rbd: use the correct length for format 2 object names (FATE#318328 bsc#917884). - rpm/kernel-binary.spec.in: Own the modules directory in the devel package. (bnc#910322) - scsi_dh_alua: add missing hunk in alua_set_params(). (bnc#846656) - scsifront: avoid acquiring same lock twice if ring is full. - sd: medium access timeout counter fails to reset. (bnc#894213) - storvsc: ring buffer failures may result in I/O freeze - swap: fix shmem swapping when more than 8 areas. (bnc#903096) - timekeeping: Avoid possible deadlock from clock_was_set_delayed (bsc#771619). - tty: Fix memory leak in virtual console when enable unicode translation. (bnc#916515) - udf: Check component length before reading it. - udf: Check path length when reading symlink. - udf: Verify i_size when loading inode. - udf: Verify symlink size before loading it. - udp: Add MIB counters for rcvbuferrors. (bnc#909565) - usb: xhci: rework root port wake bits if controller is not allowed to wakeup (bsc#909264). - virtio_net: drop dst reference before transmitting a packet. (bnc#882470) - vt: push the tty_lock down into the map handling. (bnc#915826) - workqueue: Make rescuer thread process more works. (bnc#900279) - x86, xsave: remove thread_has_fpu() bug check in __sanitize_i387_state(). (bnc#904671) - x86-64/MCE: flip CPU and bank numbers in log message. - x86/UV: Fix NULL pointer dereference in uv_flush_tlb_others() if the '^a' boot option is used (bsc#909092). - x86/UV: Fix conditional in gru_exit() (bsc#909095). - x86/early quirk: use gen6 stolen detection for VLV (bnc#908550,FATE#317933). - x86/gpu: Print the Intel graphics stolen memory range. (bnc#908550) - x86/hpet: Make boot_hpet_disable extern (bnc#908550,FATE#317933). - x86/intel: Add quirk to disable HPET for the Baytrail platform (bnc#908550,FATE#317933). - x86/uv: Fix UV2 BAU legacy mode (bsc#909092). - x86/uv: Fix the UV BAU destination timeout period (bsc#909092). - x86/uv: Implement UV BAU runtime enable and disable control via /proc/sgi_uv/ (bsc#909092). - x86/uv: Update the UV3 TLB shootdown logic (bsc#909092). - x86/uv: Work around UV2 BAU hangs (bsc#909092). - x86: UV BAU: Avoid NULL pointer reference in ptc_seq_show (bsc#911181). - x86: UV BAU: Increase maximum CPUs per socket/hub (bsc#911181). - x86: add early quirk for reserving Intel graphics stolen memory v5 (bnc#908550,FATE#317933). - x86: irq: Check for valid irq descriptor in check_irq_vectors_for_cpu_disable. (bnc#914726) - xen-privcmd-hcall-preemption: Fix EFLAGS.IF access. - xfs: re-enable non-blocking behaviour in xfs_map_blocks. (bnc#900279) - xfs: recheck buffer pinned status after push trylock failure. (bnc#907338) - xfs: remove log force from xfs_buf_trylock(). (bnc#907338) - xhci: fix incorrect type in assignment in handle_device_notification() (bsc#910321). - zcrypt: Number of supported ap domains is not retrievable (bnc#915209, LTC#120788).
    last seen 2018-09-01
    modified 2015-03-24
    plugin id 82020
    published 2015-03-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82020
    title SuSE 11.3 Security Update : Linux Kernel (SAT Patch Numbers 10412 / 10415 / 10416)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-2008.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-14
    modified 2018-09-12
    plugin id 80096
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80096
    title RHEL 5 : kernel (RHSA-2014:2008)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-2008-1.NASL
    description From Red Hat Security Advisory 2014:2008 : Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-18
    plugin id 80110
    published 2014-12-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80110
    title Oracle Linux 5 : kernel (ELSA-2014-2008-1)
  • NASL family F5 Networks Local Security Checks
    NASL id F5_BIGIP_SOL16122.NASL
    description arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
    last seen 2018-09-01
    modified 2018-07-10
    plugin id 85947
    published 2015-09-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85947
    title F5 Networks BIG-IP : Linux kernel vulnerability (SOL16122)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-2029.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5.9 Extended Update Support. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-14
    modified 2018-09-12
    plugin id 80214
    published 2014-12-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80214
    title RHEL 5 : kernel (RHSA-2014:2029)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-2028.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 6.2 Advanced Update Support. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-14
    modified 2018-09-12
    plugin id 80213
    published 2014-12-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80213
    title RHEL 6 : kernel (RHSA-2014:2028)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0057.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.
    last seen 2018-09-01
    modified 2018-07-24
    plugin id 99163
    published 2017-04-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99163
    title OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-0068-1.NASL
    description The SUSE Linux Enterprise 12 kernel was updated to 3.12.31 to receive various security and bugfixes. Security issues fixed: CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code. - CVE-2014-9090: Various issues in LDT handling in 32bit compatibility mode on the x86_64 platform were fixed, where local attackers could crash the machine. - CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace. - CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. - CVE-2014-3647: Nadav Amit reported that the KVM (Kernel Virtual Machine) mishandled noncanonical addresses when emulating instructions that change the rip (Instruction Pointer). A guest user with access to I/O or the MMIO could use this flaw to cause a denial of service (system crash) of the guest. - CVE-2014-3611: A race condition flaw was found in the way the Linux kernel's KVM subsystem handled PIT (Programmable Interval Timer) emulation. A guest user who has access to the PIT I/O ports could use this flaw to crash the host. - CVE-2014-3610: If the guest writes a noncanonical value to certain MSR registers, KVM will write that value to the MSR in the host context and a #GP will be raised leading to kernel panic. A privileged guest user could have used this flaw to crash the host. - CVE-2014-7841: A remote attacker could have used a flaw in SCTP to crash the system by sending a maliciously prepared SCTP packet in order to trigger a NULL pointer dereference on the server. - CVE-2014-3673: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. - CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response. Bugs fixed: BTRFS : - btrfs: fix race that makes btrfs_lookup_extent_info miss skinny extent items (bnc#904077). - btrfs: fix invalid leaf slot access in btrfs_lookup_extent() (bnc#904077). - btrfs: avoid returning -ENOMEM in convert_extent_bit() too early (bnc#902016). - btrfs: make find_first_extent_bit be able to cache any state (bnc#902016). - btrfs: deal with convert_extent_bit errors to avoid fs corruption (bnc#902016). - btrfs: be aware of btree inode write errors to avoid fs corruption (bnc#899551). - btrfs: add missing end_page_writeback on submit_extent_page failure (bnc#899551). - btrfs: fix crash of btrfs_release_extent_buffer_page (bnc#899551). - btrfs: ensure readers see new data after a clone operation (bnc#898234). - btrfs: avoid visiting all extent items when cloning a range (bnc#898234). - btrfs: fix clone to deal with holes when NO_HOLES feature is enabled (bnc#898234). - btrfs: make fsync work after cloning into a file (bnc#898234). - btrfs: fix use-after-free when cloning a trailing file hole (bnc#898234). - btrfs: clone, don't create invalid hole extent map (bnc#898234). - btrfs: limit the path size in send to PATH_MAX (bnc#897770). - btrfs: send, fix more issues related to directory renames (bnc#897770). - btrfs: send, remove dead code from __get_cur_name_and_parent (bnc#897770). - btrfs: send, account for orphan directories when building path strings (bnc#897770). - btrfs: send, avoid unnecessary inode item lookup in the btree (bnc#897770). - btrfs: send, fix incorrect ref access when using extrefs (bnc#897770). - btrfs: send, build path string only once in send_hole (bnc#897770). - btrfs: part 2, fix incremental send's decision to delay a dir move/rename (bnc#897770). - btrfs: fix incremental send's decision to delay a dir move/rename (bnc#897770). - btrfs: remove unnecessary inode generation lookup in send (bnc#897770). - btrfs: avoid unnecessary utimes update in incremental send (bnc#897770). - btrfs: fix send issuing outdated paths for utimes, chown and chmod (bnc#897770). - btrfs: fix send attempting to rmdir non-empty directories (bnc#897770). - btrfs: send, don't send rmdir for same target multiple times (bnc#897770). - btrfs: incremental send, fix invalid path after dir rename (bnc#897770). - btrfs: fix assert screwup for the pending move stuff (bnc#897770). - btrfs: make some tree searches in send.c more efficient (bnc#897770). - btrfs: use right extent item position in send when finding extent clones (bnc#897770). - btrfs: more send support for parent/child dir relationship inversion (bnc#897770). - btrfs: fix send dealing with file renames and directory moves (bnc#897770). - btrfs: add missing error check in incremental send (bnc#897770). - btrfs: make send's file extent item search more efficient (bnc#897770). - btrfs: fix infinite path build loops in incremental send (bnc#897770). - btrfs: send, don't delay dir move if there's a new parent inode (bnc#897770). - btrfs: add helper btrfs_fdatawrite_range (bnc#902010). - btrfs: correctly flush compressed data before/after direct IO (bnc#902010). - btrfs: make inode.c:compress_file_range() return void (bnc#902010). - btrfs: report error after failure inlining extent in compressed write path (bnc#902010). - btrfs: don't ignore compressed bio write errors (bnc#902010). - btrfs: make inode.c:submit_compressed_extents() return void (bnc#902010). - btrfs: process all async extents on compressed write failure (bnc#902010). - btrfs: don't leak pages and memory on compressed write error (bnc#902010). - btrfs: fix hang on compressed write error (bnc#902010). - btrfs: set page and mapping error on compressed write failure (bnc#902010). - btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup (bnc#904115). Hyper-V : - hyperv: Fix a bug in netvsc_send(). - hyperv: Fix a bug in netvsc_start_xmit(). - drivers: hv: vmbus: Enable interrupt driven flow control. - drivers: hv: vmbus: Properly protect calls to smp_processor_id(). - drivers: hv: vmbus: Cleanup hv_post_message(). - drivers: hv: vmbus: Cleanup vmbus_close_internal(). - drivers: hv: vmbus: Fix a bug in vmbus_open(). - drivers: hv: vmbus: Cleanup vmbus_establish_gpadl(). - drivers: hv: vmbus: Cleanup vmbus_teardown_gpadl(). - drivers: hv: vmbus: Cleanup vmbus_post_msg(). - storvsc: get rid of overly verbose warning messages. - hyperv: NULL dereference on error. - hyperv: Increase the buffer length for netvsc_channel_cb(). zSeries / S390 : - s390: pass march flag to assembly files as well (bnc#903279, LTC#118177). - kernel: reduce function tracer overhead (bnc#903279, LTC#118177). - SUNRPC: Handle EPIPE in xprt_connect_status (bnc#901090). - SUNRPC: Ensure that we handle ENOBUFS errors correctly (bnc#901090). - SUNRPC: Ensure call_connect_status() deals correctly with SOFTCONN tasks (bnc#901090). - SUNRPC: Ensure that call_connect times out correctly (bnc#901090). - SUNRPC: Handle connect errors ECONNABORTED and EHOSTUNREACH (bnc#901090). - SUNRPC: Ensure xprt_connect_status handles all potential connection errors (bnc#901090). - SUNRPC: call_connect_status should recheck bind and connect status on error (bnc#901090). kGraft : - kgr: force patching process to succeed (fate#313296). - kgr: usb-storage, mark kthread safe (fate#313296 bnc#899908). - Refresh patches.suse/kgr-0039-kgr-fix-ugly-race.patch. Fix few bugs, and also races (immutable vs mark_processes vs other threads). - kgr: always use locked bit ops for thread_info->flags (fate#313296). - kgr: lower the workqueue scheduling timeout (fate#313296 bnc#905087). - kgr: mark even more kthreads (fate#313296 bnc#904871). - rpm/kernel-binary.spec.in: Provide name-version-release for kgraft packages (bnc#901925) Other : - NFSv4: test SECINFO RPC_AUTH_GSS pseudoflavors for support (bnc#905758). - Enable cmac(aes) and cmac(3des_ede) for FIPS mode (bnc#905296 bnc#905772). - scsi_dh_alua: disable ALUA handling for non-disk devices (bnc#876633). - powerpc/vphn: NUMA node code expects big-endian (bsc#900126). - net: fix checksum features handling in netif_skb_features() (bnc#891259). - be2net: Fix invocation of be_close() after be_clear() (bnc#895468). - PCI: pciehp: Clear Data Link Layer State Changed during init (bnc#898297). - PCI: pciehp: Use symbolic constants, not hard-coded bitmask (bnc#898297). - PCI: pciehp: Use link change notifications for hot-plug and removal (bnc#898297). - PCI: pciehp: Make check_link_active() non-static (bnc#898297). - PCI: pciehp: Enable link state change notifications (bnc#898297). - ALSA: hda - Treat zero connection as non-error (bnc#902898). - bcache: add mutex lock for bch_is_open (bnc#902893). - futex: Fix a race condition between REQUEUE_PI and task death (bcn #851603 (futex scalability series)). - Linux 3.12.31 (bnc#895983 bnc#897912). - futex: Ensure get_futex_key_refs() always implies a barrier (bcn #851603 (futex scalability series)). - usbback: don't access request fields in shared ring more than once. - Update Xen patches to 3.12.30. - locking/rwsem: Avoid double checking before try acquiring write lock (Locking scalability.). - zcrypt: toleration of new crypto adapter hardware (bnc#894057, LTC#117041). - zcrypt: support for extended number of ap domains (bnc#894057, LTC#117041). - kABI: protect linux/fs.h include in mm/internal.h. - Linux 3.12.30 (FATE#315482 bnc#862957 bnc#863526 bnc#870498). - Update patches.fixes/xfs-mark-all-internal-workqueues-as-freeza ble.patch (bnc#899785). - xfs: mark all internal workqueues as freezable. - drm/i915: Move DP port disable to post_disable for pch platforms (bnc#899787). - pagecachelimit: reduce lru_lock congestion for heavy parallel reclaim fix (bnc#895680). - Linux 3.12.29 (bnc#879255 bnc#880892 bnc#887046 bnc#887418 bnc#891619 bnc#892612 bnc#892650 bnc#897101). - iommu/vt-d: Work around broken RMRR firmware entries (bnc#892860). - iommu/vt-d: Store bus information in RMRR PCI device path (bnc#892860). - iommu/vt-d: Only remove domain when device is removed (bnc#883139). - driver core: Add BUS_NOTIFY_REMOVED_DEVICE event (bnc#883139). - Update config files: Re-enable CONFIG_FUNCTION_PROFILER (bnc#899489) Option FUNCTION_PROFILER was enabled in debug and trace kernels so far, but it was accidentally disabled before tracing features were merged into the default kernel and the trace flavor was discarded. So all kernels are missing the feature now. Re-enable it. - xfs: xlog_cil_force_lsn doesn't always wait correctly. - scsi: clear 'host_scribble' upon successful abort (bnc#894863). - module: warn if module init + probe takes long (bnc#889297 bnc#877622 bnc#889295 bnc#893454). - mm, THP: don't hold mmap_sem in khugepaged when allocating THP (bnc#880767, VM Performance). - pagecache_limit: batch large nr_to_scan targets (bnc#895221). - iommu/vt-d: Check return value of acpi_bus_get_device() (bnc#903307). - rpm/kernel-binary.spec.in: Fix including the secure boot cert in /etc/uefi/certs - sched: Reduce contention in update_cfs_rq_blocked_load() (Scheduler/core performance). - x86: use optimized ioresource lookup in ioremap function (Boot time optimisations (bnc#895387)). - x86: optimize resource lookups for ioremap (Boot time optimisations (bnc#895387)). - usb: Do not re-read descriptors for wired devices in usb_authorize_device() (bnc#904354). - netxen: Fix link event handling (bnc#873228). - x86, cpu: Detect more TLB configuration -xen (TLB Performance). - x86/mm: Fix RCU splat from new TLB tracepoints (TLB Performance). - x86/mm: Set TLB flush tunable to sane value (33) (TLB Performance). - x86/mm: New tunable for single vs full TLB flush (TLB Performance). - x86/mm: Add tracepoints for TLB flushes (TLB Performance). - x86/mm: Unify remote INVLPG code (TLB Performance). - x86/mm: Fix missed global TLB flush stat (TLB Performance). - x86/mm: Rip out complicated, out-of-date, buggy TLB flushing (TLB Performance). - x86, cpu: Detect more TLB configuration (TLB Performance). - mm, x86: Revisit tlb_flushall_shift tuning for page flushes except on IvyBridge (TLB Performance). - x86/mm: Clean up the TLB flushing code (TLB Performance). - mm: free compound page with correct order (VM Functionality). - bnx2x: Utilize FW 7.10.51 (bnc#887382). - bnx2x: Remove unnecessary internal mem config (bnc#887382). - rtnetlink: fix oops in rtnl_link_get_slave_info_data_size (bnc#901774). - dm: do not call dm_sync_table() when creating new devices (bnc#901809). - [media] uvc: Fix destruction order in uvc_delete() (bnc#897736). - uas: replace WARN_ON_ONCE() with lockdep_assert_held() (FATE#315595). - cxgb4/cxgb4vf: Add Devicde ID for two more adapter (bsc#903999). - cxgb4/cxgb4vf: Add device ID for new adapter and remove for dbg adapter (bsc#903999). - cxgb4: Adds device ID for few more Chelsio T4 Adapters (bsc#903999). - cxgb4: Check if rx checksum offload is enabled, while reading hardware calculated checksum (bsc#903999). - xen-pciback: drop SR-IOV VFs when PF driver unloads (bsc#901839). This update also includes fixes contained in the Linux 3.12.stable release series, not separately listed here. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-01
    modified 2018-07-31
    plugin id 83665
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83665
    title SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0068-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-2031.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5.6 Long Life. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-14
    modified 2018-09-12
    plugin id 80216
    published 2014-12-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80216
    title RHEL 5 : kernel (RHSA-2014:2031)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0290.NASL
    description The remote Oracle Linux host is missing a security update for one or more kernel-related packages.
    last seen 2018-09-19
    modified 2018-09-17
    plugin id 81800
    published 2015-03-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81800
    title Oracle Linux 7 : kernel (ELSA-2015-0290)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-3012.NASL
    description The remote Oracle Linux host is missing a security update for the Unbreakable Enterprise kernel package(s).
    last seen 2018-09-01
    modified 2015-12-01
    plugin id 81966
    published 2015-03-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81966
    title Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3012)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-2008.NASL
    description From Red Hat Security Advisory 2014:2008 : Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-18
    plugin id 80111
    published 2014-12-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80111
    title Oracle Linux 5 : kernel (ELSA-2014-2008)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1998.NASL
    description Updated kernel-rt packages that fix one security issue are now available for Red Hat Enterprise MRG 2.5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Users are advised to upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.10.58-rt62.60 and correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-26
    plugin id 80073
    published 2014-12-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80073
    title RHEL 6 : kernel-rt (RHSA-2014:1998)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-3108.NASL
    description Description of changes: kernel-uek [2.6.32-400.36.13.el6uek] - net: guard tcp_set_keepalive() to tcp sockets (Eric Dumazet) [Orabug: 20224099] {CVE-2012-6657} - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara) [Orabug: 20224061] {CVE-2014-5471} {CVE-2014-5472} - x86_64, traps: Stop using IST for #SS (Andy Lutomirski) [Orabug: 20224029] {CVE-2014-9090} {CVE-2014-9322}
    last seen 2018-09-01
    modified 2015-12-01
    plugin id 80158
    published 2014-12-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80158
    title Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3108)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-2009.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 6.5 Extended Update Support. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-14
    modified 2018-09-12
    plugin id 80097
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80097
    title RHEL 6 : kernel (RHSA-2014:2009)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-793.NASL
    description The openSUSE 13.1 kernel was updated to fix security issues and bugs : Security issues fixed: CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code. CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite. CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace. CVE-2014-0181: The Netlink implementation in the Linux kernel through 3.14.1 did not provide a mechanism for authorizing socket operations based on the opener of a socket, which allowed local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. (bsc#875051) CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-3688: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c. CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. CVE-2014-7975: The do_umount function in fs/namespace.c in the Linux kernel did not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allowed local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call. CVE-2014-8884: Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel allowed local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call. CVE-2014-3673: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. CVE-2014-3186: Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel, as used in Android on Nexus 7 devices, allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report. CVE-2014-7841: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel, when ASCONF is used, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk. CVE-2014-4611: Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715. CVE-2014-4608: Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel allowed context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. CVE-2014-8709: The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel did not properly maintain a certain tail pointer, which allowed remote attackers to obtain sensitive cleartext information by reading packets. CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response. CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c. CVE-2014-3182: Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value. CVE-2014-3181: Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2013-7263: The Linux kernel updated certain length values before ensuring that associated data structures have been initialized, which allowed local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. This update fixes the leak of the port number when using ipv6 sockets. (bsc#853040). CVE-2013-2898: Fixed potential kernel caller confusion via past-end-of-heap-allocation read in sensor-hub HID driver. CVE-2013-2891: Fixed 16 byte past-end-of-heap-alloc zeroing in steelseries HID driver. VE-2014-6410: The __udf_read_inode function in fs/udf/inode.c in the Linux kernel did not restrict the amount of ICB indirection, which allowed physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode. CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. CVE-2014-0206: Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory via a large head value. CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-5206: The do_remount function in fs/namespace.c in the Linux kernel did not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allowed local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a 'mount -o remount' command within a user namespace. CVE-2014-5207: fs/namespace.c in the Linux kernel did not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allowed local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a 'mount -o remount' command within a user namespace. CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call. CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel allowed local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel, when SCTP authentication is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction. CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call. Also the following bugs were fixed : - KEYS: Fix stale key registration at error path (bnc#908163). - parport: parport_pc, do not remove parent devices early (bnc#856659). - xfs: fix directory hash ordering bug. - xfs: mark all internal workqueues as freezable (bnc#899785). - [media] uvc: Fix destruction order in uvc_delete() (bnc#897736). - cfq-iosched: Fix wrong children_weight calculation (bnc#893429). - target/rd: Refactor rd_build_device_space + rd_release_device_space (bnc#882639). - Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch (bnc#887046). - usb: pci-quirks: Prevent Sony VAIO t-series from switching usb ports (bnc#864375). - xhci: Switch only Intel Lynx Point-LP ports to EHCI on shutdown (bnc#864375). - xhci: Switch Intel Lynx Point ports to EHCI on shutdown (bnc#864375). - ALSA: hda - Fix broken PM due to incomplete i915 initialization (bnc#890114). - netbk: Don't destroy the netdev until the vif is shut down (bnc#881008). - swiotlb: don't assume PA 0 is invalid (bnc#865882). - PM / sleep: Fix request_firmware() error at resume (bnc#873790). - usbcore: don't log on consecutive debounce failures of the same port (bnc#818966).
    last seen 2018-09-01
    modified 2015-11-16
    plugin id 80152
    published 2014-12-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80152
    title openSUSE Security Update : the Linux Kernel (openSUSE-SU-2014:1677-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-2010.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-02
    plugin id 80106
    published 2014-12-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80106
    title CentOS 7 : kernel (CESA-2014:2010)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2014-455.NASL
    description The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk. (CVE-2014-7841) The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call. (CVE-2014-7970) The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite. (CVE-2014-9090) A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322)
    last seen 2018-09-01
    modified 2018-04-18
    plugin id 79725
    published 2014-12-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79725
    title Amazon Linux AMI : kernel (ALAS-2014-455)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-2030.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 6.4 Extended Update Support. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-14
    modified 2018-09-12
    plugin id 80215
    published 2014-12-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80215
    title RHEL 6 : kernel (RHSA-2014:2030)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1997.NASL
    description Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) * A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important) * A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service. (CVE-2014-3688, Important) * A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low) * It was found that the Linux kernel's networking implementation did not correctly handle the setting of the keepalive socket option on raw sockets. A local user able to create a raw socket could use this flaw to crash the system. (CVE-2012-6657, Low) * It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low) Red Hat would like to thank Andy Lutomirski for reporting CVE-2014-9322. The CVE-2014-3673 issue was discovered by Liu Wei of Red Hat. Bug fixes : * This update fixes a race condition issue between the sock_queue_err_skb function and sk_forward_alloc handling in the socket error queue (MSG_ERRQUEUE), which could occasionally cause the kernel, for example when using PTP, to incorrectly track allocated memory for the error queue, in which case a traceback would occur in the system log. (BZ#1155427) * The zcrypt device driver did not detect certain crypto cards and the related domains for crypto adapters on System z and s390x architectures. Consequently, it was not possible to run the system on new crypto hardware. This update enables toleration mode for such devices so that the system can make use of newer crypto hardware. (BZ#1158311) * After mounting and unmounting an XFS file system several times consecutively, the umount command occasionally became unresponsive. This was caused by the xlog_cil_force_lsn() function that was not waiting for completion as expected. With this update, xlog_cil_force_lsn() has been modified to correctly wait for completion, thus fixing this bug. (BZ#1158325) * When using the ixgbe adapter with disabled LRO and the tx-usec or rs-usec variables set to 0, transmit interrupts could not be set lower than the default of 8 buffered tx frames. Consequently, a delay of TCP transfer occurred. The restriction of a minimum of 8 buffered frames has been removed, and the TCP delay no longer occurs. (BZ#1158326) * The offb driver has been updated for the QEMU standard VGA adapter, fixing an incorrect displaying of colors issue. (BZ#1158328) * Under certain circumstances, when a discovered MTU expired, the IPv6 connection became unavailable for a short period of time. This bug has been fixed, and the connection now works as expected. (BZ#1161418) * A low throughput occurred when using the dm-thin driver to write to unprovisioned or shared chunks for a thin pool with the chunk size bigger than the max_sectors_kb variable. (BZ#1161420) * Large write workloads on thin LVs could cause the iozone and smallfile utilities to terminate unexpectedly. (BZ#1161421)
    last seen 2018-09-14
    modified 2018-09-12
    plugin id 80072
    published 2014-12-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80072
    title RHEL 6 : kernel (RHSA-2014:1997)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0009.NASL
    description Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 4 Extended Life Cycle Support. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-09
    modified 2018-09-07
    plugin id 80396
    published 2015-01-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80396
    title RHEL 4 : kernel (RHSA-2015:0009)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_KERNEL-141217.NASL
    description The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues. The following security bugs have been fixed : - The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 did not set a certain killable attribute, which allowed local users to cause a denial of service (memory consumption) via a crafted application. (bnc#779488). (CVE-2012-4398) - drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allowed physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device. (bnc#835839). (CVE-2013-2889) - The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allowed physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c. (bnc#835839). (CVE-2013-2893) - Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allowed physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device. (bnc#835839). (CVE-2013-2897) - drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device. (bnc#835839). (CVE-2013-2899) - The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allowed local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. (bnc#853040, bnc#857643). (CVE-2013-7263) - Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event. (bnc#896382). (CVE-2014-3181) - The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c. (bnc#896390). (CVE-2014-3184) - Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response. (bnc#896391). (CVE-2014-3185) - Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report. (bnc#896392). (CVE-2014-3186) - The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculated the number of pages during the handling of a mapping failure, which allowed guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages. (bnc#892782). (CVE-2014-3601) - The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 did not properly handle the writing of a non-canonical address to a model-specific register, which allowed guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. (bnc#899192). (CVE-2014-3610) - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 did not have an exit handler for the INVVPID instruction, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application. (bnc#899192). (CVE-2014-3646) - arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 did not properly perform RIP changes, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application. (bnc#899192). (CVE-2014-3647) - The SCTP implementation in the Linux kernel through 3.17.2 allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. (bnc#902346, bnc#902349). (CVE-2014-3673) - arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (bnc#883724). (CVE-2014-4508) - * DISPUTED * Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allowed context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says: The Linux kernel is not affected; media hype. (bnc#883948). (CVE-2014-4608) - kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. (bnc#904013). (CVE-2014-7826) - An SCTP server doing ASCONF would panic on malformed INIT ping-of-death. (bnc#905100). (CVE-2014-7841) - The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 did not properly maintain a certain tail pointer, which allowed remote attackers to obtain sensitive cleartext information by reading packets. (bnc#904700). (CVE-2014-8709) - A local user with write access could have used this flaw to crash the kernel or elevate privileges (bnc#905522). The following non-security bugs have been fixed:. (CVE-2014-8884) - Build the KOTD against the SP3 Update project - HID: fix kabi breakage. - NFS: Provide stub nfs_fscache_wait_on_invalidate() for when CONFIG_NFS_FSCACHE=n. - NFS: fix inverted test for delegation in nfs4_reclaim_open_state. (bnc#903331) - NFS: remove incorrect Lock reclaim failed! warning. (bnc#903331) - NFSv4: nfs4_open_done first must check that GETATTR decoded a file type. (bnc#899574) - PCI: pciehp: Clear Data Link Layer State Changed during init. (bnc#898295) - PCI: pciehp: Enable link state change notifications. (bnc#898295) - PCI: pciehp: Handle push button event asynchronously. (bnc#898295) - PCI: pciehp: Make check_link_active() non-static. (bnc#898295) - PCI: pciehp: Use link change notifications for hot-plug and removal. (bnc#898295) - PCI: pciehp: Use per-slot workqueues to avoid deadlock. (bnc#898295) - PCI: pciehp: Use symbolic constants, not hard-coded bitmask. (bnc#898295) - PM / hibernate: Iterate over set bits instead of PFNs in swsusp_free(). (bnc#860441) - be2net: Fix invocation of be_close() after be_clear(). (bnc#895468) - block: Fix bogus partition statistics reports. (bnc#885077 / bnc#891211) - block: Fix computation of merged request priority. - btrfs: Fix wrong device size when we are resizing the device. - btrfs: Return right extent when fiemap gives unaligned offset and len. - btrfs: abtract out range locking in clone ioctl(). - btrfs: always choose work from prio_head first. - btrfs: balance delayed inode updates. - btrfs: cache extent states in defrag code path. - btrfs: check file extent type before anything else. (bnc#897694) - btrfs: clone, do not create invalid hole extent map. - btrfs: correctly determine if blocks are shared in btrfs_compare_trees. - btrfs: do not bug_on if we try to cow a free space cache inode. - btrfs: ensure btrfs_prev_leaf does not miss 1 item. - btrfs: ensure readers see new data after a clone operation. - btrfs: fill_holes: Fix slot number passed to hole_mergeable() call. - btrfs: filter invalid arg for btrfs resize. - btrfs: fix EINVAL checks in btrfs_clone. - btrfs: fix EIO on reading file after ioctl clone works on it. - btrfs: fix a crash of clone with inline extents split. - btrfs: fix crash of compressed writes. (bnc#898375) - btrfs: fix crash when starting transaction. - btrfs: fix deadlock with nested trans handles. - btrfs: fix hang on error (such as ENOSPC) when writing extent pages. - btrfs: fix leaf corruption after __btrfs_drop_extents. - btrfs: fix race between balance recovery and root deletion. - btrfs: fix wrong extent mapping for DirectIO. - btrfs: handle a missing extent for the first file extent. - btrfs: limit delalloc pages outside of find_delalloc_range. (bnc#898375) - btrfs: read lock extent buffer while walking backrefs. - btrfs: remove unused wait queue in struct extent_buffer. - btrfs: replace EINVAL with ERANGE for resize when ULLONG_MAX. - btrfs: replace error code from btrfs_drop_extents. - btrfs: unlock extent and pages on error in cow_file_range. - btrfs: unlock inodes in correct order in clone ioctl. - btrfs_ioctl_clone: Move clone code into its own function. - cifs: delay super block destruction until all cifsFileInfo objects are gone. (bnc#903653) - drm/i915: Flush the PTEs after updating them before suspend. (bnc#901638) - drm/i915: Undo gtt scratch pte unmapping again. (bnc#901638) - ext3: return 32/64-bit dir name hash according to usage type. (bnc#898554) - ext4: return 32/64-bit dir name hash according to usage type. (bnc#898554) - fix: use after free of xfs workqueues. (bnc#894895) - fs: add new FMODE flags: FMODE_32bithash and FMODE_64bithash. (bnc#898554) - futex: Ensure get_futex_key_refs() always implies a barrier (bnc#851603 (futex scalability series)). - futex: Fix a race condition between REQUEUE_PI and task death (bnc#851603 (futex scalability series)). - ipv6: add support of peer address. (bnc#896415) - ipv6: fix a refcnt leak with peer addr. (bnc#896415) - megaraid_sas: Disable fastpath writes for non-RAID0. (bnc#897502) - mm: change __remove_pages() to call release_mem_region_adjustable(). (bnc#891790) - netxen: Fix link event handling. (bnc#873228) - netxen: fix link notification order. (bnc#873228) - nfsd: rename int access to int may_flags in nfsd_open(). (bnc#898554) - nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes). (bnc#898554) - ocfs2: fix NULL pointer dereference in ocfs2_duplicate_clusters_by_page. (bnc#899843) - powerpc: Add smp_mb() to arch_spin_is_locked() (bsc#893758). - powerpc: Add smp_mb()s to arch_spin_unlock_wait() (bsc#893758). - powerpc: Add support for the optimised lockref implementation (bsc#893758). - powerpc: Implement arch_spin_is_locked() using arch_spin_value_unlocked() (bsc#893758). - refresh patches.xen/xen-blkback-multi-page-ring (bnc#897708)). - remove filesize checks for sync I/O journal commit. (bnc#800255) - resource: add __adjust_resource() for internal use. (bnc#891790) - resource: add release_mem_region_adjustable(). (bnc#891790) - revert PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free(). (bnc#860441) - rpm/mkspec: Generate specfiles according to Factory requirements. - rpm/mkspec: Generate a per-architecture per-package _constraints file - sched: Fix unreleased llc_shared_mask bit during CPU hotplug. (bnc#891368) - scsi_dh_alua: disable ALUA handling for non-disk devices. (bnc#876633) - usb: Do not re-read descriptors for wired devices in usb_authorize_device(). (bnc#904358) - usbback: Do not access request fields in shared ring more than once. - usbhid: add another mouse that needs QUIRK_ALWAYS_POLL. (bnc#888607) - vfs,proc: guarantee unique inodes in /proc. (bnc#868049) - x86, cpu hotplug: Fix stack frame warning incheck_irq_vectors_for_cpu_disable(). (bnc#887418) - x86, ioremap: Speed up check for RAM pages (Boot time optimisations (bnc#895387)). - x86: Add check for number of available vectors before CPU down. (bnc#887418) - x86: optimize resource lookups for ioremap (Boot time optimisations (bnc#895387)). - x86: use optimized ioresource lookup in ioremap function (Boot time optimisations (bnc#895387)). - xfs: Do not free EFIs before the EFDs are committed (bsc#755743). - xfs: Do not reference the EFI after it is freed (bsc#755743). - xfs: fix cil push sequence after log recovery (bsc#755743). - zcrypt: support for extended number of ap domains (bnc#894058, LTC#117041). - zcrypt: toleration of new crypto adapter hardware (bnc#894058, LTC#117041).
    last seen 2018-09-02
    modified 2014-12-26
    plugin id 80250
    published 2014-12-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80250
    title SuSE 11.3 Security Update : Linux kernel (SAT Patch Number 10103)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2491-1.NASL
    description Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack Segment (SS) register in the x86 architecture. A local attacker could exploit this flaw to gain administrative privileges. (CVE-2014-9322) Lars Bull reported a race condition in the PIT (programmable interrupt timer) emulation in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel. A local guest user with access to PIT i/o ports could exploit this flaw to cause a denial of service (crash) on the host. (CVE-2014-3611) Lars Bull and Nadav Amit reported a flaw in how KVM (the Kernel Virtual Machine) handles noncanonical writes to certain MSR registers. A privileged guest user can exploit this flaw to cause a denial of service (kernel panic) on the host. (CVE-2014-3610) Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS) implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-8133) Prasad J Pandit reported a flaw in the rock_continue function of the Linux kernel's ISO 9660 CDROM file system. A local user could exploit this flaw to cause a denial of service (system crash or hang). (CVE-2014-9420). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-01
    modified 2018-08-03
    plugin id 81164
    published 2015-02-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81164
    title Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2491-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-1997.NASL
    description From Red Hat Security Advisory 2014:1997 : Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) * A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important) * A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service. (CVE-2014-3688, Important) * A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low) * It was found that the Linux kernel's networking implementation did not correctly handle the setting of the keepalive socket option on raw sockets. A local user able to create a raw socket could use this flaw to crash the system. (CVE-2012-6657, Low) * It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low) Red Hat would like to thank Andy Lutomirski for reporting CVE-2014-9322. The CVE-2014-3673 issue was discovered by Liu Wei of Red Hat. Bug fixes : * This update fixes a race condition issue between the sock_queue_err_skb function and sk_forward_alloc handling in the socket error queue (MSG_ERRQUEUE), which could occasionally cause the kernel, for example when using PTP, to incorrectly track allocated memory for the error queue, in which case a traceback would occur in the system log. (BZ#1155427) * The zcrypt device driver did not detect certain crypto cards and the related domains for crypto adapters on System z and s390x architectures. Consequently, it was not possible to run the system on new crypto hardware. This update enables toleration mode for such devices so that the system can make use of newer crypto hardware. (BZ#1158311) * After mounting and unmounting an XFS file system several times consecutively, the umount command occasionally became unresponsive. This was caused by the xlog_cil_force_lsn() function that was not waiting for completion as expected. With this update, xlog_cil_force_lsn() has been modified to correctly wait for completion, thus fixing this bug. (BZ#1158325) * When using the ixgbe adapter with disabled LRO and the tx-usec or rs-usec variables set to 0, transmit interrupts could not be set lower than the default of 8 buffered tx frames. Consequently, a delay of TCP transfer occurred. The restriction of a minimum of 8 buffered frames has been removed, and the TCP delay no longer occurs. (BZ#1158326) * The offb driver has been updated for the QEMU standard VGA adapter, fixing an incorrect displaying of colors issue. (BZ#1158328) * Under certain circumstances, when a discovered MTU expired, the IPv6 connection became unavailable for a short period of time. This bug has been fixed, and the connection now works as expected. (BZ#1161418) * A low throughput occurred when using the dm-thin driver to write to unprovisioned or shared chunks for a thin pool with the chunk size bigger than the max_sectors_kb variable. (BZ#1161420) * Large write workloads on thin LVs could cause the iozone and smallfile utilities to terminate unexpectedly. (BZ#1161421)
    last seen 2018-09-01
    modified 2018-07-18
    plugin id 80070
    published 2014-12-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80070
    title Oracle Linux 6 : kernel (ELSA-2014-1997)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-2010.NASL
    description From Red Hat Security Advisory 2014:2010 : Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel handled GS segment register base switching when recovering from a #SS (stack segment) fault on an erroneous return to user space. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-9322, Important) Red Hat would like to thank Andy Lutomirski for reporting this issue. All kernel users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.
    last seen 2018-09-01
    modified 2018-07-18
    plugin id 80112
    published 2014-12-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80112
    title Oracle Linux 7 : kernel (ELSA-2014-2010)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-1272.NASL
    description The remote Oracle Linux host is missing a security update for one or more kernel-related packages.
    last seen 2018-09-19
    modified 2018-09-17
    plugin id 85097
    published 2015-07-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85097
    title Oracle Linux 6 : kernel (ELSA-2015-1272)
redhat via4
advisories
  • bugzilla
    id 1172806
    title CVE-2014-9322 kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment kernel is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997005
        • comment kernel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842006
      • AND
        • comment kernel-abi-whitelists is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997029
        • comment kernel-abi-whitelists is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20131645028
      • AND
        • comment kernel-bootwrapper is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997009
        • comment kernel-bootwrapper is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842010
      • AND
        • comment kernel-debug is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997013
        • comment kernel-debug is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842012
      • AND
        • comment kernel-debug-devel is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997017
        • comment kernel-debug-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842014
      • AND
        • comment kernel-devel is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997015
        • comment kernel-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842016
      • AND
        • comment kernel-doc is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997025
        • comment kernel-doc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842024
      • AND
        • comment kernel-firmware is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997027
        • comment kernel-firmware is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842026
      • AND
        • comment kernel-headers is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997007
        • comment kernel-headers is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842008
      • AND
        • comment kernel-kdump is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997021
        • comment kernel-kdump is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842018
      • AND
        • comment kernel-kdump-devel is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997023
        • comment kernel-kdump-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842020
      • AND
        • comment perf is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997011
        • comment perf is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842022
      • AND
        • comment python-perf is earlier than 0:2.6.32-504.3.3.el6
          oval oval:com.redhat.rhsa:tst:20141997019
        • comment python-perf is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111849018
    rhsa
    id RHSA-2014:1997
    released 2014-12-16
    severity Important
    title RHSA-2014:1997: kernel security and bug fix update (Important)
  • bugzilla
    id 1172806
    title CVE-2014-9322 kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment kernel is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008002
        • comment kernel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099003
      • AND
        • comment kernel-PAE is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008022
        • comment kernel-PAE is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099019
      • AND
        • comment kernel-PAE-devel is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008020
        • comment kernel-PAE-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099017
      • AND
        • comment kernel-debug is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008010
        • comment kernel-debug is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070993007
      • AND
        • comment kernel-debug-devel is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008008
        • comment kernel-debug-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070993013
      • AND
        • comment kernel-devel is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008006
        • comment kernel-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099011
      • AND
        • comment kernel-doc is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008024
        • comment kernel-doc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099021
      • AND
        • comment kernel-headers is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008004
        • comment kernel-headers is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099005
      • AND
        • comment kernel-kdump is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008016
        • comment kernel-kdump is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099015
      • AND
        • comment kernel-kdump-devel is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008018
        • comment kernel-kdump-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099013
      • AND
        • comment kernel-xen is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008014
        • comment kernel-xen is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099007
      • AND
        • comment kernel-xen-devel is earlier than 0:2.6.18-400.1.1.el5
          oval oval:com.redhat.rhsa:tst:20142008012
        • comment kernel-xen-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070099009
    rhsa
    id RHSA-2014:2008
    released 2014-12-17
    severity Important
    title RHSA-2014:2008: kernel security update (Important)
  • bugzilla
    id 1172806
    title CVE-2014-9322 kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhsa:tst:20140675001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhsa:tst:20140675002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20140675003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20140675004
    • OR
      • AND
        • comment kernel is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010005
        • comment kernel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842006
      • AND
        • comment kernel-abi-whitelists is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010031
        • comment kernel-abi-whitelists is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20131645028
      • AND
        • comment kernel-bootwrapper is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010025
        • comment kernel-bootwrapper is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842010
      • AND
        • comment kernel-debug is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010021
        • comment kernel-debug is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842012
      • AND
        • comment kernel-debug-devel is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010017
        • comment kernel-debug-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842014
      • AND
        • comment kernel-devel is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010015
        • comment kernel-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842016
      • AND
        • comment kernel-doc is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010033
        • comment kernel-doc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842024
      • AND
        • comment kernel-headers is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010007
        • comment kernel-headers is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842008
      • AND
        • comment kernel-kdump is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010029
        • comment kernel-kdump is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842018
      • AND
        • comment kernel-kdump-devel is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010027
        • comment kernel-kdump-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842020
      • AND
        • comment kernel-tools is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010019
        • comment kernel-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140678010
      • AND
        • comment kernel-tools-libs is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010011
        • comment kernel-tools-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140678012
      • AND
        • comment kernel-tools-libs-devel is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010023
        • comment kernel-tools-libs-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140678020
      • AND
        • comment perf is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010013
        • comment perf is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842022
      • AND
        • comment python-perf is earlier than 0:3.10.0-123.13.2.el7
          oval oval:com.redhat.rhsa:tst:20142010009
        • comment python-perf is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111849018
    rhsa
    id RHSA-2014:2010
    released 2014-12-18
    severity Important
    title RHSA-2014:2010: kernel security update (Important)
  • rhsa
    id RHSA-2014:1998
  • rhsa
    id RHSA-2014:2028
  • rhsa
    id RHSA-2014:2031
  • rhsa
    id RHSA-2015:0009
rpms
  • kernel-0:2.6.32-504.3.3.el6
  • kernel-abi-whitelists-0:2.6.32-504.3.3.el6
  • kernel-bootwrapper-0:2.6.32-504.3.3.el6
  • kernel-debug-0:2.6.32-504.3.3.el6
  • kernel-debug-devel-0:2.6.32-504.3.3.el6
  • kernel-devel-0:2.6.32-504.3.3.el6
  • kernel-doc-0:2.6.32-504.3.3.el6
  • kernel-firmware-0:2.6.32-504.3.3.el6
  • kernel-headers-0:2.6.32-504.3.3.el6
  • kernel-kdump-0:2.6.32-504.3.3.el6
  • kernel-kdump-devel-0:2.6.32-504.3.3.el6
  • perf-0:2.6.32-504.3.3.el6
  • python-perf-0:2.6.32-504.3.3.el6
  • kernel-0:2.6.18-400.1.1.el5
  • kernel-PAE-0:2.6.18-400.1.1.el5
  • kernel-PAE-devel-0:2.6.18-400.1.1.el5
  • kernel-debug-0:2.6.18-400.1.1.el5
  • kernel-debug-devel-0:2.6.18-400.1.1.el5
  • kernel-devel-0:2.6.18-400.1.1.el5
  • kernel-doc-0:2.6.18-400.1.1.el5
  • kernel-headers-0:2.6.18-400.1.1.el5
  • kernel-kdump-0:2.6.18-400.1.1.el5
  • kernel-kdump-devel-0:2.6.18-400.1.1.el5
  • kernel-xen-0:2.6.18-400.1.1.el5
  • kernel-xen-devel-0:2.6.18-400.1.1.el5
  • kernel-0:3.10.0-123.13.2.el7
  • kernel-abi-whitelists-0:3.10.0-123.13.2.el7
  • kernel-bootwrapper-0:3.10.0-123.13.2.el7
  • kernel-debug-0:3.10.0-123.13.2.el7
  • kernel-debug-devel-0:3.10.0-123.13.2.el7
  • kernel-devel-0:3.10.0-123.13.2.el7
  • kernel-doc-0:3.10.0-123.13.2.el7
  • kernel-headers-0:3.10.0-123.13.2.el7
  • kernel-kdump-0:3.10.0-123.13.2.el7
  • kernel-kdump-devel-0:3.10.0-123.13.2.el7
  • kernel-tools-0:3.10.0-123.13.2.el7
  • kernel-tools-libs-0:3.10.0-123.13.2.el7
  • kernel-tools-libs-devel-0:3.10.0-123.13.2.el7
  • perf-0:3.10.0-123.13.2.el7
  • python-perf-0:3.10.0-123.13.2.el7
refmap via4
confirm
hp
  • HPSBGN03282
  • HPSBGN03285
misc http://www.zerodayinitiative.com/advisories/ZDI-16-170
mlist [oss-security] 20141215 Linux kernel: multiple x86_64 vulnerabilities
osvdb 115919
secunia 62336
suse
  • SUSE-SU-2015:0736
  • SUSE-SU-2015:0812
  • openSUSE-SU-2015:0566
ubuntu USN-2491-1
Last major update 22-08-2016 - 22:08
Published 17-12-2014 - 06:59
Last modified 09-11-2017 - 21:29
Back to Top