The 3.13.7 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol (PPP) when used with the Layer Two Tunneling Protocol (L2TP).
A local user could exploit this flaw to gain administrative privileges. (CVE-2014-4943)

Michael S. Tsirkin discovered an information leak in the Linux kernel's segmentation of skbs when using the zerocopy feature of vhost-net. A local attacker could exploit this flaw to gain potentially sensitive information from kernel memory. (CVE-2014-0131)

Don Bailey discovered a flaw in the LZO decompress algorithm used by the Linux kernel. An attacker could exploit this flaw to cause a denial of service (memory corruption or OOPS). (CVE-2014-4608).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions (CVE-2013-4514).

Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation (CVE-2014-0131).

The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator (CVE-2014-4027).

Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run (CVE-2014-4608).

Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (CVE-2014-4652).

sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (CVE-2014-4653).

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call (CVE-2014-4654).

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls (CVE-2014-4655).

Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function (CVE-2014-4656).

The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (CVE-2014-4667).

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls (CVE-2014-4699).

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket (CVE-2014-4943).

The updated packages provides a solution for these security issues.

The SUSE Linux Enterprise 11 Service Pack 2 LTSS kernel has been updated to fix security issues on kernels on the x86_64 architecture.

The following security bugs have been fixed :

  - CVE-2012-4398: The __request_module function in     kernel/kmod.c in the Linux kernel before 3.4 did not set     a certain killable attribute, which allowed local users     to cause a denial of service (memory consumption) via a     crafted application (bnc#779488).

  - CVE-2013-2893: The Human Interface Device (HID)     subsystem in the Linux kernel through 3.11, when     CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or     CONFIG_LOGIWHEELS_FF is enabled, allowed physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device,     related to (1) drivers/hid/hid-lgff.c, (2)     drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c     (bnc#835839).

  - CVE-2013-2897: Multiple array index errors in     drivers/hid/hid-multitouch.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_MULTITOUCH is enabled, allowed     physically proximate attackers to cause a denial of     service (heap memory corruption, or NULL pointer     dereference and OOPS) via a crafted device (bnc#835839).

  - CVE-2013-2899: drivers/hid/hid-picolcd_core.c in the     Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_HID_PICOLCD is enabled,     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and OOPS) via a     crafted device (bnc#835839).

  - CVE-2013-2929: The Linux kernel before 3.12.2 did not     properly use the get_dumpable function, which allowed     local users to bypass intended ptrace restrictions or     obtain sensitive information from IA64 scratch registers     via a crafted application, related to kernel/ptrace.c     and arch/ia64/include/asm/processor.h (bnc#847652).

  - CVE-2013-7263: The Linux kernel before 3.12.4 updates     certain length values before ensuring that associated     data structures have been initialized, which allowed     local users to obtain sensitive information from kernel     stack memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call, related to net/ipv4/ping.c,     net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and     net/ipv6/udp.c (bnc#857643).

  - CVE-2014-0131: Use-after-free vulnerability in the     skb_segment function in net/core/skbuff.c in the Linux     kernel through 3.13.6 allowed attackers to obtain     sensitive information from kernel memory by leveraging     the absence of a certain orphaning operation     (bnc#867723).

  - CVE-2014-0181: The Netlink implementation in the Linux     kernel through 3.14.1 did not provide a mechanism for     authorizing socket operations based on the opener of a     socket, which allowed local users to bypass intended     access restrictions and modify network configurations by     using a Netlink socket for the (1) stdout or (2) stderr     of a setuid program (bnc#875051).

  - CVE-2014-2309: The ip6_route_add function in     net/ipv6/route.c in the Linux kernel through 3.13.6 did     not properly count the addition of routes, which allowed     remote attackers to cause a denial of service (memory     consumption) via a flood of ICMPv6 Router Advertisement     packets (bnc#867531).

  - CVE-2014-3181: Multiple stack-based buffer overflows in     the magicmouse_raw_event function in     drivers/hid/hid-magicmouse.c in the Magic Mouse HID     driver in the Linux kernel through 3.16.3 allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that provides a large amount     of (1) EHCI or (2) XHCI data associated with an event     (bnc#896382).

  - CVE-2014-3184: The report_fixup functions in the HID     subsystem in the Linux kernel before 3.16.2 might have     allowed physically proximate attackers to cause a denial     of service (out-of-bounds write) via a crafted device     that provides a small report descriptor, related to (1)     drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3)     drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c,     (5) drivers/hid/hid-petalynx.c, and (6)     drivers/hid/hid-sunplus.c (bnc#896390).

  - CVE-2014-3185: Multiple buffer overflows in the     command_port_read_callback function in     drivers/usb/serial/whiteheat.c in the Whiteheat USB     Serial Driver in the Linux kernel before 3.16.2 allowed     physically proximate attackers to execute arbitrary code     or cause a denial of service (memory corruption and     system crash) via a crafted device that provides a large     amount of (1) EHCI or (2) XHCI data associated with a     bulk response (bnc#896391).

  - CVE-2014-3186: Buffer overflow in the picolcd_raw_event     function in devices/hid/hid-picolcd_core.c in the     PicoLCD HID device driver in the Linux kernel through     3.16.3, as used in Android on Nexus 7 devices, allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that sends a large report     (bnc#896392).

  - CVE-2014-3601: The kvm_iommu_map_pages function in     virt/kvm/iommu.c in the Linux kernel through 3.16.1     miscalculates the number of pages during the handling of     a mapping failure, which allowed guest OS users to (1)     cause a denial of service (host OS memory corruption) or     possibly have unspecified other impact by triggering a     large gfn value or (2) cause a denial of service (host     OS memory consumption) by triggering a small gfn value     that leads to permanently pinned pages (bnc#892782).

  - CVE-2014-3610: The WRMSR processing functionality in the     KVM subsystem in the Linux kernel through 3.17.2 did not     properly handle the writing of a non-canonical address     to a model-specific register, which allowed guest OS     users to cause a denial of service (host OS crash) by     leveraging guest OS privileges, related to the     wrmsr_interception function in arch/x86/kvm/svm.c and     the handle_wrmsr function in arch/x86/kvm/vmx.c     (bnc#899192).

  - CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem     in the Linux kernel through 3.17.2 did not have an exit     handler for the INVVPID instruction, which allowed guest     OS users to cause a denial of service (guest OS crash)     via a crafted application (bnc#899192).

  - CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM     subsystem in the Linux kernel through 3.17.2 did not     properly perform RIP changes, which allowed guest OS     users to cause a denial of service (guest OS crash) via     a crafted application (bnc#899192).

  - CVE-2014-3673: The SCTP implementation in the Linux     kernel through 3.17.2 allowed remote attackers to cause     a denial of service (system crash) via a malformed     ASCONF chunk, related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c (bnc#902346).

  - CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function     in net/sctp/associola.c in the SCTP implementation in     the Linux kernel through 3.17.2 allowed remote attackers     to cause a denial of service (panic) via duplicate     ASCONF chunks that trigger an incorrect uncork within     the side-effect interpreter (bnc#902349).

  - CVE-2014-3688: The SCTP implementation in the Linux     kernel before 3.17.4 allowed remote attackers to cause a     denial of service (memory consumption) by triggering a     large number of chunks in an associations output queue,     as demonstrated by ASCONF probes, related to     net/sctp/inqueue.c and net/sctp/sm_statefuns.c     (bnc#902351).

  - CVE-2014-3690: arch/x86/kvm/vmx.c in the KVM subsystem     in the Linux kernel before 3.17.2 on Intel processors     did not ensure that the value in the CR4 control     register remains the same after a VM entry, which     allowed host OS users to kill arbitrary processes or     cause a denial of service (system disruption) by     leveraging /dev/kvm access, as demonstrated by     PR_SET_TSC prctl calls within a modified copy of QEMU     (bnc#902232).

  - CVE-2014-4608: Multiple integer overflows in the     lzo1x_decompress_safe function in     lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor     in the Linux kernel before 3.15.2 allowed     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Literal Run     (bnc#883948).

  - CVE-2014-4943: The PPPoL2TP feature in     net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6     allowed local users to gain privileges by leveraging     data-structure differences between an l2tp socket and an     inet socket (bnc#887082).

  - CVE-2014-5471: Stack consumption vulnerability in the     parse_rock_ridge_inode_internal function in     fs/isofs/rock.c in the Linux kernel through 3.16.1     allowed local users to cause a denial of service     (uncontrolled recursion, and system crash or reboot) via     a crafted iso9660 image with a CL entry referring to a     directory entry that has a CL entry (bnc#892490).

  - CVE-2014-5472: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel through     3.16.1 allowed local users to cause a denial of service     (unkillable mount process) via a crafted iso9660 image     with a self-referential CL entry (bnc#892490).

  - CVE-2014-7826: kernel/trace/trace_syscalls.c in the     Linux kernel through 3.17.2 did not properly handle     private syscall numbers during use of the ftrace     subsystem, which allowed local users to gain privileges     or cause a denial of service (invalid pointer     dereference) via a crafted application (bnc#904013).

  - CVE-2014-7841: The sctp_process_param function in     net/sctp/sm_make_chunk.c in the SCTP implementation in     the Linux kernel before 3.17.4, when ASCONF is used,     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) via a     malformed INIT chunk (bnc#905100).

  - CVE-2014-7842: Race condition in arch/x86/kvm/x86.c in     the Linux kernel before 3.17.4 allowed guest OS users to     cause a denial of service (guest OS crash) via a crafted     application that performs an MMIO transaction or a PIO     transaction to trigger a guest userspace emulation error     report, a similar issue to CVE-2010-5313 (bnc#905312).

  - CVE-2014-8134: The paravirt_ops_setup function in     arch/x86/kernel/kvm.c in the Linux kernel through 3.18     uses an improper paravirt_enabled setting for KVM guest     kernels, which made it easier for guest OS users to     bypass the ASLR protection mechanism via a crafted     application that reads a 16-bit value (bnc#909078).

  - CVE-2014-8369: The kvm_iommu_map_pages function in     virt/kvm/iommu.c in the Linux kernel through 3.17.2     miscalculates the number of pages during the handling of     a mapping failure, which allowed guest OS users to cause     a denial of service (host OS page unpinning) or possibly     have unspecified other impact by leveraging guest OS     privileges. NOTE: this vulnerability exists because of     an incorrect fix for CVE-2014-3601 (bnc#902675).

  - CVE-2014-8559: The d_walk function in fs/dcache.c in the     Linux kernel through 3.17.2 did not properly maintain     the semantics of rename_lock, which allowed local users     to cause a denial of service (deadlock and system hang)     via a crafted application (bnc#903640).

  - CVE-2014-8709: The ieee80211_fragment function in     net/mac80211/tx.c in the Linux kernel before 3.13.5 did     not properly maintain a certain tail pointer, which     allowed remote attackers to obtain sensitive cleartext     information by reading packets (bnc#904700).

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel before     3.18.2 did not validate a length value in the Extensions     Reference (ER) System Use Field, which allowed local     users to obtain sensitive information from kernel memory     via a crafted iso9660 image (bnc#912654).

  - CVE-2014-9585: The vdso_addr function in     arch/x86/vdso/vma.c in the Linux kernel through 3.18.2     did not properly choose memory locations for the vDSO     area, which made it easier for local users to bypass the     ASLR protection mechanism by guessing a location at the     end of a PMD (bnc#912705).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The pn_recvmsg function in net/phonet/datagram.c in the     Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7265)

  - The mISDN_sock_recvmsg function in     drivers/isdn/mISDN/socket.c in the Linux kernel before     3.12.4 does not ensure that a certain length value is     consistent with the size of an associated data     structure, which allows local users to obtain sensitive     information from kernel memory via a (1) recvfrom, (2)     recvmmsg, or (3) recvmsg system call.(CVE-2013-7266)

  - The atalk_recvmsg function in net/appletalk/ddp.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7267)

  - The ipx_recvmsg function in net/ipx/af_ipx.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7268)

  - The nr_recvmsg function in net/netrom/af_netrom.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7269)

  - The packet_recvmsg function in net/packet/af_packet.c     in the Linux kernel before 3.12.4 updates a certain     length value before ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7270)

  - The x25_recvmsg function in net/x25/af_x25.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7271)

  - The dgram_recvmsg function in net/ieee802154/dgram.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel stack     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7281)

  - A NULL pointer dereference flaw was found in the     rds_ib_laddr_check() function in the Linux kernel's     implementation of Reliable Datagram Sockets (RDS). A     local, unprivileged user could use this flaw to crash     the system.(CVE-2013-7339)

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2013-7421)

  - A flaw was found in the Linux kernel's implementation     of Unix sockets. A server polling for client-socket     data could put the peer socket on a wait list the peer     socket could then close the connection, making the     reference on the wait list no longer valid. This could     lead to bypassing the permissions on a Unix socket and     packets being injected into the stream, and could also     panic the machine (denial of service).(CVE-2013-7446)

  - The compat_sys_recvmmsg function in net/compat.c in the     Linux kernel before 3.13.2, when CONFIG_X86_X32 is     enabled, allows local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter.(CVE-2014-0038)

  - Buffer overflow in the complete_emulated_mmio function     in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6     allows guest OS users to execute arbitrary code on the     host OS by leveraging a loop that triggers an invalid     memory copy affecting certain cancel_work_item     data.(CVE-2014-0049)

  - The cifs_iovec_write function in fs/cifs/file.c in the     Linux kernel through 3.13.5 does not properly handle     uncached write operations that copy fewer than the     requested number of bytes, which allows local users to     obtain sensitive information from kernel memory, cause     a denial of service (memory corruption and system     crash), or possibly gain privileges via a writev system     call with a crafted pointer.(CVE-2014-0069)

  - drivers/vhost/net.c in the Linux kernel before 3.13.10,     when mergeable buffers are disabled, does not properly     validate packet lengths, which allows guest OS users to     cause a denial of service (memory corruption and host     OS crash) or possibly gain privileges on the host OS     via crafted packets, related to the handle_rx and     get_rx_bufs functions.(CVE-2014-0077)

  - Race condition in the inet_frag_intern function in     net/ipv4/inet_fragment.c in the Linux kernel through     3.13.6 allows remote attackers to cause a denial of     service (use-after-free error) or possibly have     unspecified other impact via a large series of     fragmented ICMP Echo Request packets to a system with a     heavy CPU load.(CVE-2014-0100)

  - A flaw was found in the way the Linux kernel processed     an authenticated COOKIE_ECHO chunk during the     initialization of an SCTP connection. A remote attacker     could use this flaw to crash the system by initiating a     specially crafted SCTP handshake in order to trigger a     NULL pointer dereference on the system.(CVE-2014-0101)

  - The keyring_detect_cycle_iterator function in     security/keys/keyring.c in the Linux kernel through     3.13.6 does not properly determine whether keyrings are     identical, which allows local users to cause a denial     of service (OOPS) via crafted keyctl     commands.(CVE-2014-0102)

  - Use-after-free vulnerability in the skb_segment     function in net/core/skbuff.c in the Linux kernel     through 3.13.6 allows attackers to obtain sensitive     information from kernel memory by leveraging the     absence of a certain orphaning     operation.(CVE-2014-0131)

  - The ioapic_deliver function in virt/kvm/ioapic.c in the     Linux kernel through 3.14.1 does not properly validate     the kvm_irq_delivery_to_apic return value, which allows     guest OS users to cause a denial of service (host OS     crash) via a crafted entry in the redirection table of     an I/O APIC. NOTE: the affected code was moved to the     ioapic_service function before the vulnerability was     announced.(CVE-2014-0155)

  - It was found that the permission checks performed by     the Linux kernel when a netlink message was received     were not sufficient. A local, unprivileged user could     potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged     process and altering the output of this     process.(CVE-2014-0181)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

在 3.13.6 之前的 Linux 核心中，net/core/skbuff.c 的 skb_segment 函式有釋放後使用弱點，攻擊者因而得以利用缺乏特定遺棄作業的情形，從核心記憶體取得敏感資訊。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 3.13.6 之前版本的 Linux 核心中，net/core/skbuff.c 的 skb_segment 函式有釋放後使用弱點，允許攻擊者利用特定孤立作業遺漏的情況，從核心記憶體取得敏感資訊。 (CVE-2014-0131)

請注意，Nessus 依賴供應商報告的套件存在。

穩定版 3.13.7 更新含有多個有關樹狀結構的重要修正。

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Linux 核心已更新，可修正多種錯誤和安全性問題。

CVE-2014-4699：在 Intel 處理器上，執行不使用 IRET 的系統呼叫時，Linux 核心未針對已儲存的 RIP 位址正確限制非正式值的使用，進而允許本機使用者透過特製的應用程式發出 ptrace 和 fork 系統呼叫，進而利用爭用情形並取得權限，或是造成拒絕服務 (雙重錯誤)。

CVE-2014-4667：Linux 核心的 net/sctp/associola.c 中的 sctp_association_free 函式並未正確管理某些積存值，而允許遠端攻擊者透過特製的 SCTP 封包造成拒絕服務 (通訊端中斷)。

CVE-2014-4171：Linux 核心中的 mm/shmem.c 並未正確實作範圍通知與打洞之間的互動，這允許本機使用者使用 mmap 系統呼叫存取漏洞造成拒絕服務 (i_mutex hold)，透過封鎖完成 (1) MADV_REMOVE madvise 呼叫或 (2) FALLOC_FL_PUNCH_HOLE fallocate 呼叫干擾預定 shmem 活動即為一例。

CVE-2014-4508：當啟用系統呼叫稽核並設定 sep CPU 功能旗標時，32 位元 x86 平台上 Linux 核心中的 arch/x86/kernel/entry_32.S 會允許本機使用者透過無效的系統呼叫數造成拒絕服務 (OOPS 與系統當機)，數字 1000 即為一例。

CVE-2014-4656：Linux 核心的 ALSA 控制實作中之 sound/core/control.c 中存在多個整數溢位，可允許本機使用者利用 /dev/snd/controlCX 存取權造成拒絕服務，此問題與 (1) snd_ctl_add 函式中的索引值和 (2) snd_ctl_remove_numid_conflict 函式中的 numid 值相關。

CVE-2014-4655：Linux 核心的 ALSA 控制實例中之 sound/core/control.c 中的 snd_ctl_elem_add 函式並未正確維護 user_ctl_count 值，而允許本機使用者利用大量 SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl 呼叫的 /dev/snd/controlCX 存取權，造成拒絕服務 (整數溢位與限制繞過)。

CVE-2014-4654：Linux 核心的 ALSA 控制實例中之 sound/core/control.c 中的 snd_ctl_elem_add 函式並未檢查 SNDRV_CTL_IOCTL_ELEM_REPLACE 命令的授權，而允許本機使用者利用 ioctl 呼叫的 /dev/snd/controlCX 存取權，移除核心控制並造成拒絕服務 (釋放後使用及系統當機)。

CVE-2014-4653：Linux kernel 中 ALSA 控制實作中的 sound/core/control.c 並未確保擁有讀取/寫入鎖定，進而允許本機使用者利用 /dev/snd/controlCX 存取權造成拒絕服務(釋放後使用)，並從核心記憶體取得敏感資訊。

CVE-2014-4652：Linux 核心的 ALSA 控制實作之 sound/core/control.c 中的 snd_ctl_elem_user_tlv 函式中 tlv 處置程式功能有爭用情形，會允許本機使用者利用 /dev/snd/controlCX 存取權，從核心記憶體取得敏感資訊。

CVE-2014-4014：Linux 核心中的功能實作並未正確考慮命名空間不適用於 inode 的問題，進而允許本機使用者透過先建立使用者命名空間來繞過預定的 chmod 限制，對具有 root 群組擁有權的檔案設定 setgid 位元即為一例。

CVE-2014-2309：Linux 核心的 net/ipv6/route.c 中的 ip6_route_add 函式並未正確計算路由的增加，而允許遠端攻擊者透過 ICMPv6 路由器廣告封包溢流造成拒絕服務 (記憶體消耗)。

CVE-2014-3917：以特定系統呼叫規則啟用 CONFIG_AUDITSYSCALL 時，Linux 核心中的 kernel/auditsc.c 會允許本機使用者透過大值的系統呼叫數，從核心記憶體取得敏感單一位元值，或是引發拒絕服務 (OOPS)。

CVE-2014-0131：Linux 核心的 net/core/skbuff.c 中 skb_segment 函式的釋放後使用弱點允許攻擊者利用某些孤立操作的遺漏從核心記憶體取得敏感資訊。

CVE-2014-3144：在 Linux 核心之 net/core/filter.c 的 sk_run_filter 函式中，(1) BPF_S_ANC_NLATTR 和 (2) BPF_S_ANC_NLATTR_NEST 延伸模組實作並未檢查特定長度值是否夠大，進而允許本機使用者透過特製的 BPF 指令引發拒絕服務 (整數反向溢位和系統當機)。

CVE-2014-3145：在 Linux 核心之 net/core/filter.c 的 sk_run_filter 函式中，BPF_S_ANC_NLATTR_NEST 延伸模組實作在特定減法中使用了相反順序，進而允許本機使用者透過特製的 BPF 指令引發拒絕服務 (過度讀取和系統當機)。請注意：該弱點公告前，受影響的程式碼已移至
__skb_get_nlattr_nest 函式。

已修正的其他錯誤：

- HID：logitech-dj：修正 USB 3.0 問題 (bnc#788080)。

Sasha Levin 報告，在與第二層通道通訊協定 (L2TP) 一起使用時，Linux 核心的點對點通訊協定 (PPP) 中出現一個瑕疵。
本機使用者可惡意利用此瑕疵取得系統管理員權限。(CVE-2014-4943)

Michael S. Tsirkin 發現，在使用 vhost-net 的 zerocopy 功能時，Linux 核心的 skbs 分割中有一個資訊洩漏。本機攻擊者可惡意利用此瑕疵，取得核心記憶體中的敏感資訊。(CVE-2014-0131)

Salva Peiró發現 Linux 核心的 media- device 驅動程式有一個資訊洩漏瑕疵。本機攻擊者可利用此瑕疵，取得核心記憶體中的敏感資訊。(CVE-2014-1739)

在 Linux 核心的通訊端篩選器子系統中發現邊界檢查錯誤。本機使用者可利用此瑕疵，透過特製的 BPF 指令引發拒絕服務 (系統當機)。
(CVE-2014-3144)

在 Linux 核心的通訊端篩選器子系統中發現其餘部分計算錯誤。本機使用者可利用此瑕疵，透過特製的 BPF 指令引發拒絕服務 (系統當機)。
(CVE-2014-3145)

當稽核某些系統呼叫時，在 Linux 核心的稽核子系統中發現一個瑕疵。本機攻擊者可惡意利用此瑕疵，藉此從核心記憶體取得敏感單一位元值，或引發拒絕服務 (OOPS)。(CVE-2014-3917)

在 Linux 核心的 inode 權限相關使用者命名空間之實作中發現瑕疵。本機使用者可惡意利用此瑕疵，藉由建立使用者命名空間來取得系統管理員權限。(CVE-2014-4014)

Don Bailey 在 Linux 核心所使用的 LZO 解壓縮演算法中發現瑕疵。攻擊者可惡意利用此瑕疵，以造成拒絕服務 (記憶體損毀或 OOPS)。(CVE-2014-4608)。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
73242	Fedora 19 : kernel-3.13.7-100.fc19 (2014-4360)	Nessus	Fedora Local Security Checks	2014/3/28	2021/1/11	critical
76563	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2283-1)	Nessus	Ubuntu Local Security Checks	2014/7/17	2021/1/19	high
77074	Mandriva Linux Security Advisory : kernel (MDVSA-2014:155)	Nessus	Mandriva Local Security Checks	2014/8/8	2021/1/6	medium
76557	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9488 / 9491 / 9493)	Nessus	SuSE Local Security Checks	2014/7/17	2021/1/19	critical
83696	SUSE SLES11 Security Update : kernel (SUSE-SU-2015:0481-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
124801	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1477)	Nessus	Huawei Local Security Checks	2019/5/13	2025/11/20	medium
86006	F5 Networks BIG-IP：Linux 核心弱點 (SOL15699)	Nessus	F5 Networks Local Security Checks	2015/9/18	2019/1/4	low
218277	Linux Distros 未修補弱點：CVE-2014-0131	Nessus	Misc.	2025/3/4	2025/9/4	low
73241	Fedora 20：kernel-3.13.7-200.fc20 (2014-4317)	Nessus	Fedora Local Security Checks	2014/3/28	2021/1/11	critical
76988	openSUSE 安全性更新：核心 (openSUSE-SU-2014:0957-1)	Nessus	SuSE Local Security Checks	2014/8/4	2021/1/19	medium
76565	Ubuntu 12.04 LTS：linux-lts-raring 弱點 (USN-2286-1)	Nessus	Ubuntu Local Security Checks	2014/7/17	2021/1/19	high

検出

プラグインの検索

critical

high

medium

critical

high

medium

low

low

critical

medium

high