The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3103 advisory.

    - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen)  [Orabug: 20192540]     {CVE-2014-4652}
    - target/rd: Refactor rd_build_device_space + rd_release_device_space (Nicholas Bellinger)  [Orabug:
    20192516]  {CVE-2014-4027}
    - HID: logitech: perform bounds checking on device_id early enough (Jiri Kosina)  [Orabug: 20192477]     {CVE-2014-3182}
    - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara)  [Orabug: 20192448]  {CVE-2014-6410}
    - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen)  [Orabug: 20192416]     {CVE-2014-4656}
    - ALSA: control: Handle numid overflow (Lars-Peter Clausen)  [Orabug: 20192367]  {CVE-2014-4656}
    - HID: picolcd: sanity check report size in raw_event() callback (Jiri Kosina)  [Orabug: 20192208]     {CVE-2014-3186}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350i1/4%0

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel allows local users to cause a denial of service     (stack-based buffer overflow) or possibly have     unspecified other impacts via a large command size in     an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds     write access in the sg_write function.(CVE-2017-7187i1/4%0

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection     fault).(CVE-2019-3701i1/4%0

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-8890i1/4%0

  - The overlayfs implementation in the linux (aka Linux     kernel) package before 3.19.0-21.21 in Ubuntu through     15.04 does not properly check permissions for file     creation in the upper filesystem directory, which     allows local users to obtain root access by leveraging     a configuration in which overlayfs is permitted in an     arbitrary mount namespace.(CVE-2015-1328i1/4%0

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.16.3 allows local users to cause a denial of     service (xfs_ilock_attr_map_shared invalid pointer     dereference) via a crafted xfs image.(CVE-2018-10322i1/4%0

  - In the flush_tmregs_to_thread function in     arch/powerpc/kernel/ptrace.c in the Linux kernel before     4.13.5, a guest kernel crash can be triggered from     unprivileged userspace during a core dump on a POWER     host due to a missing processor feature check and an     erroneous use of transactional memory (TM) instructions     in the core dump path, leading to a denial of     service.(CVE-2018-1091i1/4%0

  - ** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in     the Linux kernel before 4.16 allows local users to     cause a denial of service (ata qc leak) by triggering     certain failure conditions. NOTE: a third party     disputes the relevance of this report because the     failure can only occur for physically proximate     attackers who unplug SAS Host Bus Adapter     cables.(CVE-2018-10021i1/4%0

  - A use-after-free flaw was discovered in the Linux     kernel's tty subsystem, which allows for the disclosure     of uncontrolled memory location and possible kernel     panic. The information leak is caused by a race     condition when attempting to set and read the tty line     discipline. A local attacker could use the TIOCSETD     (via tty_set_ldisc ) to switch to a new line discipline     a concurrent call to a TIOCGETD ioctl performing a read     on a given tty could then access previously allocated     memory. Up to 4 bytes could be leaked when querying the     line discipline or the kernel could panic with a     NULL-pointer dereference.(CVE-2016-0723i1/4%0

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182i1/4%0

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584i1/4%0

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the     system.(CVE-2015-5157i1/4%0

  - drivers/media/media-device.c in the Linux kernel before     3.11, as used in Android before 2016-08-05 on Nexus 5     and 7 (2013) devices, does not properly initialize     certain data structures, which allows local users to     obtain sensitive information via a crafted application,     aka Android internal bug 28750150 and Qualcomm internal     bug CR570757, a different vulnerability than     CVE-2014-1739.(CVE-2014-9895i1/4%0

  - A use-after-free vulnerability in sys_ioprio_get() was     found due to get_task_ioprio() accessing the     task-i1/4zio_context without holding the task lock and     could potentially race with exit_io_context(), leading     to a use-after-free.(CVE-2016-7911i1/4%0

  - A flaw was found in the Linux kernel which is related     to the user namespace lazily unmounting file systems.
    The fs_pin struct has two members (m_list and s_list)     which are usually initialized on use in the     pin_insert_group function. However, these members might     go unmodified in this case, the system panics when it     attempts to destroy or free them. This flaw could be     used to launch a denial-of-service     attack.(CVE-2015-4178i1/4%0

  - A flaw was found in the Linux kernel's implementation     of raw_sendmsg allowing a local attacker to panic the     kernel or possibly leak kernel addresses. A local     attacker, with the privilege of creating raw sockets,     can abuse a possible race condition when setting the     socket option to allow the kernel to automatically     create ip header values and thus potentially escalate     their privileges.(CVE-2017-17712i1/4%0

  - A flaw was discovered in the F2FS filesystem code in     fs/f2fs/super.c in the Linux kernel. A denial of     service, due to an out-of-bounds memory access, can     occur upon encountering an abnormal bitmap size when     mounting a crafted f2fs image.(CVE-2018-13096i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's madvise MADV_WILLNEED functionality     handled page table locking. A local, unprivileged user     could use this flaw to crash the     system.(CVE-2014-8173i1/4%0

  - An out-of-bounds heap memory access leading to a Denial     of Service, heap disclosure, or further impact was     found in setsockopt(). The function call is normally     restricted to root, however some processes with     cap_sys_admin may also be able to trigger this flaw in     privileged container environments.(CVE-2016-4998i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1971 advisory.

    - [alsa] control: Make sure that id->index does not overflow (Jaroslav Kysela) [1117313 1117314]     {CVE-2014-4656}
    - [alsa] control: Handle numid overflow (Jaroslav Kysela) [1117313 1117314] {CVE-2014-4656}
    - [alsa] control: Protect user controls against concurrent access (Jaroslav Kysela) [1117338 1117339]     {CVE-2014-4652}
    - [alsa] control: Fix replacing user controls (Jaroslav Kysela) [1117323 1117324] {CVE-2014-4654     CVE-2014-4655}
    - [net] sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann) [1155750 1152755]     {CVE-2014-3688}
    - [net] sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [1155737 1152755] {CVE-2014-3687}
    - [net] sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [1147856     1152755] {CVE-2014-3673}
    - [lib] assoc_array: Fix termination condition in assoc array garbage collection (David Howells) [1155136     1139431] {CVE-2014-3631}
    - [fs] udf: Avoid infinite loop when processing indirect ICBs (Jacob Tanenbaum) [1142321 1142322]     {CVE-2014-6410}
    - [hid] picolcd: fix memory corruption via OOB write (Jacob Tanenbaum) [1141408 1141409] {CVE-2014-3186}
    - [usb] serial/whiteheat: fix memory corruption flaw (Jacob Tanenbaum) [1141403 1141404] {CVE-2014-3185}
    - [hid] fix off by one error in various _report_fixup routines (Jacob Tanenbaum) [1141393 1141394]     {CVE-2014-3184}
    - [hid] logitech-dj: fix OOB array access (Jacob Tanenbaum) [1141211 1141212] {CVE-2014-3182}
    - [hid] fix OOB write in magicmouse driver (Jacob Tanenbaum) [1141176 1141177] {CVE-2014-3181}
    - [fs] vfs: fix ref count leak in path_mountpoint() (Ian Kent) [1122481 1122376] {CVE-2014-5045}
    - [kernel] ptrace: get_dumpable() incorrect tests (Jacob Tanenbaum) [1111605 1111606] {CVE-2013-2929}
    - [media] media-device: fix an information leakage (Jacob Tanenbaum) [1109776 1109777] {CVE-2014-1739}
    - [target] rd: Refactor rd_build_device_space + rd_release_device_space (Denys Vlasenko) [1108754 1108755]     {CVE-2014-4027}
    - [virt] kvm: fix PIT timer race condition (Petr  Matousek) [1144879 1144880] {CVE-2014-3611}
    - [virt] kvm/vmx: handle invept and invvpid vm exits gracefully (Petr  Matousek) [1145449 1116936]     [1144828 1144829] {CVE-2014-3645 CVE-2014-3646}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important)

* A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service.
(CVE-2014-3688, Important)

* Two flaws were found in the way the Apple Magic Mouse/Trackpad multi-touch driver and the Minibox PicoLCD driver handled invalid HID reports. An attacker with physical access to the system could use these flaws to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3181, CVE-2014-3186, Moderate)

* A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate)

* A flaw was found in the way the Linux kernel's keys subsystem handled the termination condition in the associative array garbage collection functionality. A local, unprivileged user could use this flaw to crash the system. (CVE-2014-3631, Moderate)

* Multiple flaws were found in the way the Linux kernel's ALSA implementation handled user controls. A local, privileged user could use either of these flaws to crash the system. (CVE-2014-4654, CVE-2014-4655, CVE-2014-4656, Moderate)

* A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. (CVE-2014-5045, Moderate)

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low)

* A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-6410, Low)

* An information leak flaw in the way the Linux kernel handled media device enumerate entities IOCTL requests could allow a local user able to access the /dev/media0 device file to leak kernel memory bytes.
(CVE-2014-1739, Low)

* An out-of-bounds read flaw in the Logitech Unifying receiver driver could allow an attacker with physical access to the system to crash the system or, potentially, escalate their privileges on the system.
(CVE-2014-3182, Low)

* Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled invalid HID reports. An attacker with physical access to the system could use either of these flaws to write data past an allocated memory buffer.
(CVE-2014-3184, Low)

* An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) back end driver of the iSCSI Target subsystem could allow a privileged user to leak the contents of kernel memory to an iSCSI initiator remote client. (CVE-2014-4027, Low)

* An information leak flaw in the Linux kernel's ALSA implementation could allow a local, privileged user to leak kernel memory to user space. (CVE-2014-4652, Low)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel     before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service     (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.
    (CVE-2014-3182)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's futex     subsystem handled the requeuing of certain Priority     Inheritance (PI) futexes. A local, unprivileged user     could use this flaw to escalate their privileges on the     system.(CVE-2014-3153)

  - An out-of-bounds write flaw was found in the way the     Apple Magic Mouse/Trackpad multi-touch driver handled     Human Interface Device (HID) reports with an invalid     size. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3181)

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182)

  - Multiple out-of-bounds write flaws were found in the     way the Cherry Cymotion keyboard driver, KYE/Genius     device drivers, Logitech device drivers, Monterey     Genius KB29E keyboard driver, Petalynx Maxter remote     control driver, and Sunplus wireless desktop driver     handled HID reports with an invalid report descriptor     size. An attacker with physical access to the system     could use either of these flaws to write data past an     allocated memory buffer.(CVE-2014-3184)

  - A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed     completion commands sent via USB Request Blocks     buffers. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3185)

  - It was found that Linux kernel's ptrace subsystem did     not properly sanitize the address-space-control bits     when the program-status word (PSW) was being set. On     IBM S/390 systems, a local, unprivileged user could use     this flaw to set address-space-control bits to the     kernel space, and thus gain read and write access to     kernel memory.(CVE-2014-3534)

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601)

  - It was found that KVM's Write to Model Specific     Register (WRMSR) instruction emulation would write     non-canonical values passed in by the guest to certain     MSRs in the host's context. A privileged guest user     could use this flaw to crash the host.(CVE-2014-3610)

  - A race condition flaw was found in the way the Linux     kernel's KVM subsystem handled PIT (Programmable     Interval Timer) emulation. A guest user who has access     to the PIT I/O ports could use this flaw to crash the     host.(CVE-2014-3611)

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT)     instructions. On hosts with an Intel processor and     invept VM exit support, an unprivileged guest user     could use these instructions to crash the     guest.(CVE-2014-3645)

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invvpid     (Invalidate Translations Based on VPID) instructions.
    On hosts with an Intel processor and invppid VM exit     support, an unprivileged guest user could use these     instructions to crash the guest.(CVE-2014-3646)

  - A flaw was found in the way the Linux kernel's KVM     subsystem handled non-canonical addresses when     emulating instructions that change the RIP (for     example, branches or calls). A guest user with access     to an I/O or MMIO region could use this flaw to crash     the guest.(CVE-2014-3647)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled malformed Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3673)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled duplicate Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3687)

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled the association's output queue. A remote     attacker could send specially crafted packets that     would cause the system to use an excessive amount of     memory, leading to a denial of service.(CVE-2014-3688)

  - It was found that the Linux kernel's KVM implementation     did not ensure that the host CR4 control register value     remained unchanged across VM entries on the same     virtual CPU. A local, unprivileged user could use this     flaw to cause a denial of service on the     system.(CVE-2014-3690)

  - An out-of-bounds memory access flaw was found in the     Linux kernel's system call auditing implementation. On     a system with existing audit rules defined, a local,     unprivileged user could use this flaw to leak kernel     memory to user space or, potentially, crash the     system.(CVE-2014-3917)

  - A flaw was found in the way Linux kernel's Transparent     Huge Pages (THP) implementation handled non-huge page     migration. A local, unprivileged user could use this     flaw to crash the kernel by migrating transparent     hugepages.(CVE-2014-3940)

  - The capabilities implementation in the Linux kernel     before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows     local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by     setting the setgid bit on a file with group ownership     of root.(CVE-2014-4014)

  - An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) backend driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client.(CVE-2014-4027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
80004	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2014-3103)	Nessus	Oracle Linux Local Security Checks	2014/12/15	2026/2/9	medium
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/4/3	2025/12/26	critical
124972	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1519)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high
79845	Oracle Linux 7 : kernel (ELSA-2014-1971)	Nessus	Oracle Linux Local Security Checks	2014/12/10	2026/2/9	high
79848	RHEL 7 : kernel (RHSA-2014:1971)	Nessus	Red Hat Local Security Checks	2014/12/10	2021/1/14	high
252007	Linux Distros Unpatched Vulnerability : CVE-2014-3182	Nessus	Misc.	2025/8/19	2026/7/17	medium
124804	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1480)	Nessus	Huawei Local Security Checks	2019/5/13	2024/7/4	high

検出

プラグインの検索

medium

critical

high

high

high

medium

high