The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3067 advisory.

    - md: use kzalloc() when bitmap is disabled (Benjamin Randazzo)  [Orabug: 21563042]  {CVE-2015-5697}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1534 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    * An integer overflow flaw was found in the way the Linux kernel's     netfilter connection tracking implementation loaded extensions. An attacker     on a local network could potentially send a sequence of specially crafted     packets that would initiate the loading of a large number of extensions,     causing the targeted system in that network to crash. (CVE-2014-9715,     Moderate)

    * A stack-based buffer overflow flaw was found in the Linux kernel's early     load microcode functionality. On a system with UEFI Secure Boot enabled, a     local, privileged user could use this flaw to increase their privileges to     the kernel (ring0) level, bypassing intended restrictions in place.
    (CVE-2015-2666, Moderate)

    * It was found that the Linux kernel's ping socket implementation did not     properly handle socket unhashing during spurious disconnects, which could     lead to a use-after-free flaw. On x86-64 architecture systems, a local user     able to create ping sockets could use this flaw to crash the system.
    On non-x86-64 architecture systems, a local user able to create ping     sockets could use this flaw to escalate their privileges on the system.
    (CVE-2015-3636, Moderate)

    * It was found that the Linux kernel's TCP/IP protocol suite implementation     for IPv6 allowed the Hop Limit value to be set to a smaller value than the     default one. An attacker on a local network could use this flaw to prevent     systems on that network from sending or receiving network packets.
    (CVE-2015-2922, Low)

    Red Hat would like to thank Nathan Hoad for reporting the CVE-2014-9715     issue.

    This update also fixes several bugs. Refer to the following Knowledgebase     article for further information:

    https://access.redhat.com/articles/1474193

    All kernel users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The system must be     rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Vincent Tondellier discovered an integer overflow in the Linux kernel's netfilter connection tracking accounting of loaded extensions. An attacker on the local area network (LAN) could potential exploit this flaw to cause a denial of service (system crash of targeted system). (CVE-2014-9715)

Jan Beulich discovered the Xen virtual machine subsystem of the Linux kernel did not properly restrict access to PCI command registers. A local guest user could exploit this flaw to cause a denial of service (host crash). (CVE-2015-2150)

A privilege escalation was discovered in the fork syscal vi the int80 entry on 64 bit kernels with 32 bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges on the system. (CVE-2015-2830)

A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code path. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate privileges on Intel base machines with AEC-GCM mode IPSec security association. (CVE-2015-3331).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2014-9644)

  - The Btrfs implementation in the Linux kernel before     3.19 does not ensure that the visible xattr state is     consistent with a requested replacement, which allows     local users to bypass intended ACL settings and gain     privileges via standard filesystem operations (1)     during an xattr-replacement time window, related to a     race condition, or (2) after an xattr-replacement     attempt that fails because the data does not     fit.(CVE-2014-9710)

  - An integer overflow flaw was found in the way the Linux     kernel's netfilter connection tracking implementation     loaded extensions. An attacker on a local network could     potentially send a sequence of specially crafted     packets that would initiate the loading of a large     number of extensions, causing the targeted system in     that network to crash.(CVE-2014-9715)

  - A symlink size validation was missing in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support,     allowing the corruption of kernel memory. An attacker     able to mount a corrupted/malicious UDF file system     image could cause the kernel to crash.(CVE-2014-9728)

  - A symlink size validation was missing in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support,     allowing the corruption of kernel memory. An attacker     able to mount a corrupted/malicious UDF file system     image could cause the kernel to crash.(CVE-2014-9729)

  - A symlink size validation was missing in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support,     allowing the corruption of kernel memory. An attacker     able to mount a corrupted/malicious UDF file system     image could cause the kernel to crash.(CVE-2014-9730)

  - A path length checking flaw was found in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support. An     attacker able to mount a corrupted/malicious UDF file     system image could use this flaw to leak kernel memory     to user-space.(CVE-2014-9731)

  - The snd_compr_tstamp function in     sound/core/compress_offload.c in the Linux kernel     through 4.7, as used in Android before 2016-08-05 on     Nexus 5 and 7 (2013) devices, does not properly     initialize a timestamp data structure, which allows     attackers to obtain sensitive information via a crafted     application, aka Android internal bug 28770164 and     Qualcomm internal bug CR568717.(CVE-2014-9892)

  - drivers/media/media-device.c in the Linux kernel before     3.11, as used in Android before 2016-08-05 on Nexus 5     and 7 (2013) devices, does not properly initialize     certain data structures, which allows local users to     obtain sensitive information via a crafted application,     aka Android internal bug 28750150 and Qualcomm internal     bug CR570757, a different vulnerability than     CVE-2014-1739.(CVE-2014-9895)

  - The ethtool_get_wol function in net/core/ethtool.c in     the Linux kernel through 4.7, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     initialize a certain data structure, which allows local     users to obtain sensitive information via a crafted     application, aka Android internal bug 28803952 and     Qualcomm internal bug CR570754.(CVE-2014-9900)

  - The snd_compress_check_input function in     sound/core/compress_offload.c in the ALSA subsystem in     the Linux kernel before 3.17 does not properly check     for an integer overflow, which allows local users to     cause a denial of service (insufficient memory     allocation) or possibly have unspecified other impact     via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl     call.(CVE-2014-9904)

  - A race condition in the ip4_datagram_release_cb     function in net/ipv4/datagram.c in the Linux kernel     allows local users to gain privileges or cause a denial     of service (use-after-free) by leveraging incorrect     expectations about locking during multithreaded access     to internal data structures for IPv4 UDP     sockets.(CVE-2014-9914)

  - A flaw was discovered in the way the kernel allows     stackable filesystems to overlay. A local attacker who     is able to mount filesystems can abuse this flaw to     escalate privileges.(CVE-2014-9922)

  - The regulator_ena_gpio_free function in     drivers/regulator/core.c in the Linux kernel allows     local users to gain privileges or cause a denial of     service (use-after-free) via a crafted     application.(CVE-2014-9940)

  - It was found that the Linux kernel KVM subsystem's     sysenter instruction emulation was not sufficient. An     unprivileged guest user could use this flaw to escalate     their privileges by tricking the hypervisor to emulate     a SYSENTER instruction in 16-bit mode, if the guest OS     did not initialize the SYSENTER model-specific     registers (MSRs). Note: Certified guest operating     systems for Red Hat Enterprise Linux with KVM do     initialize the SYSENTER MSRs and are thus not     vulnerable to this issue when running on a KVM     hypervisor.(CVE-2015-0239)

  - A flaw was found in the way the Linux kernel's XFS file     system handled replacing of remote attributes under     certain conditions. A local user with access to XFS     file system mount could potentially use this flaw to     escalate their privileges on the system.(CVE-2015-0274)

  - A flaw was found in the way the Linux kernel's ext4     file system handled the 'page size i1/4z block size'     condition when the fallocate zero range functionality     was used. A local attacker could use this flaw to crash     the system.(CVE-2015-0275)

  - It was found that the Linux kernel's keyring     implementation would leak memory when adding a key to a     keyring via the add_key() function. A local attacker     could use this flaw to exhaust all available memory on     the system.(CVE-2015-1333)

  - Race condition in the handle_to_path function in     fs/fhandle.c in the Linux kernel through 3.19.1 allows     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function.(CVE-2015-1420)

  - A use-after-free flaw was found in the way the Linux     kernel's SCTP implementation handled authentication key     reference counting during INIT collisions. A remote     attacker could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2015-1421)

  - The IPv4 implementation in the Linux kernel before     3.18.8 does not properly consider the length of the     Read-Copy Update (RCU) grace period for redirecting     lookups in the absence of caching, which allows remote     attackers to cause a denial of service (memory     consumption or system crash) via a flood of     packets.(CVE-2015-1465)

  - A flaw was found in the way the nft_flush_table()     function of the Linux kernel's netfilter tables     implementation flushed rules that were referencing     deleted chains. A local user who has the CAP_NET_ADMIN     capability could use this flaw to crash the     system.(CVE-2015-1573)

  - An integer overflow flaw was found in the way the Linux     kernel randomized the stack for processes on certain     64-bit architecture systems, such as x86-64, causing     the stack entropy to be reduced by four.(CVE-2015-1593)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vincent Tondellier 發現，在 Linux 核心之已載入延伸模組的 netfilter 連線追蹤計數中有一個整數溢位。區域網路 (LAN) 上的攻擊者可能惡意利用此瑕疵，從而導致拒絕服務 (目標系統的系統當機)。

遠端 Redhat Enterprise Linux 7 主機上安裝的套件受到 RHSA-2015:1534 公告中提及的多個弱點影響。

    核心套件中包含 Linux 核心，後者是任何 Linux 作業系統的核心。

    * 在 Linux 核心的 netfilter 連線追蹤實作載入延伸模組的方式中發現一個整數溢位瑕疵。區域網路上的攻擊者可能傳送會起始大量延伸模組載入的特製封包序列，造成該網路中的目標系統當機。 (CVE-2014-9715，中等)

    * 在 Linux 核心的早期載入 microcode 功能中發現堆疊型緩衝區溢位瑕疵。在已啟用 UEFI 安全開機的系統上，有權限的本機使用者可利用此瑕疵，將其特權提升至核心 (ring0) 層級，以繞過現有的預定限制。
    (CVE-2015-2666，中等)

    * 據發現，Linux 核心的 ping 通訊端實作在假性中斷連線期間並未正確處理通訊端未雜湊，這可能導致釋放後使用瑕疵。在 x86-64 架構系統中，能建立 Ping 通訊端的本機使用者就可以利用此缺陷使系統當機。
    在非 x86-64 架構系統中，能建立 Ping 通訊端的本機使用者就可以利用此瑕疵，提升自己在系統上的權限。
    (CVE-2015-3636，中等)

    * 據發現，Linux 核心針對 IPv6 的 TCP/IP 通訊協定套件實作會允許躍點限制值設定為比預設值更小的值。區域網路上的攻擊者可利用此瑕疵，阻止該網路上的系統傳送或接收網路封包。
    (CVE-2015-2922，低)

    Red Hat 要感謝 Nathan Hoad 報告 CVE-2014-9715 問題。

    此更新還可修正數個錯誤。如需詳細資訊，請參閱下列知識庫文章：

    https://access.redhat.com/articles/1474193

    建議所有核心使用者皆升級至這些更新版套件，其中包含可更正這些問題的反向移植修補程式。必須重新啟動系統，此更新才會生效。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 5/6 主機中安裝的套件受到 ELSA-2015-3067 公告中提及的多個弱點影響。

    - md點陣圖停用時使用 kzalloc() (Benjamin Randazzo) [Orabug: 21563042] {CVE-2015-5697}

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Vincent Tondellier 發現，在 Linux 核心之已載入延伸模組的 netfilter 連線追蹤計數中有一個整數溢位。區域網路 (LAN) 上的攻擊者可能惡意利用此瑕疵，從而導致拒絕服務 (目標系統的系統當機)。(CVE-2014-9715)

Jan Beulich 發現，Linux 核心的 Xen 虛擬機器子系統並未正確限制 PCI 命令暫存器的存取權。本機來賓使用者可利用此瑕疵造成拒絕服務 (主機當機)。(CVE-2015-2150)

在具有 32 位元模擬支援的 64 位元核心中，發現 fork syscal vi the int80 項目有一個權限提升瑕疵。無權限的本機攻擊者可利用此瑕疵提升自己在系統上的權限。(CVE-2015-2830)

當使用 Intel AES-NI 加速程式碼路徑時，在 AES 解密中發現一個記憶體損毀問題。遠端攻擊者可惡意利用此瑕疵，從而導致拒絕服務 (系統當機)，或可能在具有 AEC-GCM 模式 IPSec 安全性關連性的 Intel 基礎機器上提升權限。(CVE-2015-3331)。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
85262	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3067)	Nessus	Oracle Linux Local Security Checks	2015/8/7	2025/4/29	medium
85248	RHEL 7 : kernel (RHSA-2015:1534)	Nessus	Red Hat Local Security Checks	2015/8/6	2025/4/15	medium
83759	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2613-1)	Nessus	Ubuntu Local Security Checks	2015/5/21	2021/1/19	high
124809	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1485)	Nessus	Huawei Local Security Checks	2019/5/13	2024/5/23	high
83758	Ubuntu 12.04 LTS：linux 弱點 (USN-2611-1)	Nessus	Ubuntu Local Security Checks	2015/5/21	2021/1/19	medium
85248	RHEL 7：核心 (RHSA-2015:1534)	Nessus	Red Hat Local Security Checks	2015/8/6	2025/4/15	medium
85262	Oracle Linux 5 / 6：Unbreakable Enterprise 核心 (ELSA-2015-3067)	Nessus	Oracle Linux Local Security Checks	2015/8/7	2025/4/29	medium
83759	Ubuntu 12.04 LTS：linux-lts-trusty 弱點 (USN-2613-1)	Nessus	Ubuntu Local Security Checks	2015/5/21	2021/1/19	high

検出

プラグインの検索

medium

medium

high

high

medium

medium

medium

high