According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Mounting a crafted EXT4 image read-only leads to an     attacker controlled memory corruption and     SLAB-Out-of-Bounds reads.(CVE-2016-10208i1/4%0

  - An issue was discovered in the hwpoison implementation     in mm/memory-failure.c in the Linux kernel before     5.0.4. When soft_offline_in_use_page() runs on a thp     tail page after pmd is split, an attacker can cause a     denial of service (BUG).(CVE-2019-10124i1/4%0

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666i1/4%0

  - A flaw was found in the way the Linux kernel's     networking subsystem handled offloaded packets with     multiple layers of encapsulation in the GRO (Generic     Receive Offload) code path. A remote attacker could use     this flaw to trigger unbounded recursion in the kernel     that could lead to stack corruption, resulting in a     system crash.(CVE-2016-8666i1/4%0

  - The ethtool_get_wol function in net/core/ethtool.c in     the Linux kernel through 4.7, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     initialize a certain data structure, which allows local     users to obtain sensitive information via a crafted     application, aka Android internal bug 28803952 and     Qualcomm internal bug CR570754.(CVE-2014-9900i1/4%0

  - A vulnerability was found in crypto/ahash.c in the     Linux kernel which allows attackers to cause a denial     of service (API operation calling its own callback, and     infinite recursion) by triggering EBUSY on a full     queue.(CVE-2017-7618i1/4%0

  - drivers/misc/qseecom.c in the QSEECOM driver for the     Linux kernel 3.x, as used in Qualcomm Innovation Center     (QuIC) Android contributions for MSM devices and other     products, does not validate certain offset, length, and     base values within an ioctl call, which allows     attackers to gain privileges or cause a denial of     service (memory corruption) via a crafted     application.(CVE-2014-4322i1/4%0

  - An integer overflow vulnerability was found in the     Linux kernel in xt_alloc_table_info, which on 32-bit     systems can lead to small structure allocation and a     copy_from_user based heap corruption.(CVE-2016-3135i1/4%0

  - Stack-based buffer overflow in the     supply_lm_input_write function in     drivers/thermal/supply_lm_core.c in the MSM Thermal     driver for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted application that sends a large     amount of data through the debugfs     interface.(CVE-2016-2063i1/4%0

  - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in     the Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7264i1/4%0

  - A bypass was found for the Spectre v1 hardening in the     eBPF engine of the Linux kernel. The code in the     kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic in     various cases, including cases of different branches     with different state or limits to sanitize, leading to     side-channel attacks.(CVE-2019-7308i1/4%0

  - The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandles     inheritance, which allows local users to cause a denial     of service or possibly have unspecified other impact     via crafted system calls, a related issue to     CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9077i1/4%0

  - The cgroup offline implementation in the Linux kernel     through 4.8.11 mishandles certain drain operations,     which allows local users to cause a denial of service     (system hang) by leveraging access to a container     environment for executing a crafted application, as     demonstrated by trinity.(CVE-2016-9191i1/4%0

  - The KVM implementation in the Linux kernel through     4.20.5 has a Use-after-Free.(CVE-2019-7221i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's network subsystem handled socket     creation with an invalid protocol identifier. A local     user could use this flaw to crash the     system.(CVE-2015-8543i1/4%0

  - The drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel, through 4.13.11, allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4653i1/4%0

  - A vulnerability leading to a local privilege escalation     was found in apparmor in the Linux kernel. When     proc_pid_attr_write() was changed to use memdup_user     apparmor's (interface violating) assumption that the     setprocattr buffer was always a single page was     violated.(CVE-2016-6187i1/4%0

  - A vulnerability was found in the Linux kernel in     'tmpfs' file system. When file permissions are modified     via 'chmod' and the user is not in the owning group or     capable of CAP_FSETID, the setgid bit is cleared in     inode_change_ok(). Setting a POSIX ACL via 'setxattr'     sets the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way this     allows to bypass the check in 'chmod'.(CVE-2017-5551i1/4%0

  - A flaw was found in the Linux Kernel in the     ucma_leave_multicast() function in     drivers/infiniband/core/ucma.c which allows access to a     certain data structure after freeing it in     ucma_process_join(). This allows an attacker to cause a     use-after-free bug and to induce kernel memory     corruption, leading to a system crash or other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-14734i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that the Linux kernel's implementation of     vectored pipe read and write functionality did not take     into account the I/O vectors that were already     processed when retrying after a failed atomic access     operation, potentially resulting in memory corruption     due to an I/O vector array overrun. A local,     unprivileged user could use this flaw to crash the     system or, potentially, escalate their privileges on     the system.(CVE-2015-1805)

  - net/llc/sysctl_net_llc.c in the Linux kernel before     3.19 uses an incorrect data type in a sysctl table,     which allows local users to obtain potentially     sensitive information from kernel memory or possibly     have unspecified other impact by accessing a sysctl     entry.(CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042)

  - Xen 3.3.x through 4.5.x and the Linux kernel through     3.19.1 do not properly restrict access to PCI command     registers, which might allow local guest OS users to     cause a denial of service (non-maskable interrupt and     host crash) by disabling the (1) memory or (2) I/O     decoding for a PCI Express device and then accessing     the device, which triggers an Unsupported Request (UR)     response.(CVE-2015-2150)

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666)

  - The xsave/xrstor implementation in     arch/x86/include/asm/xsave.h in the Linux kernel before     3.19.2 creates certain .altinstr_replacement pointers     and consequently does not provide any protection     against instruction faulting, which allows local users     to cause a denial of service (panic) by triggering a     fault, as demonstrated by an unaligned memory operand     or a non-canonical address memory     operand.(CVE-2015-2672)

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830)

  - It was found that the Linux kernel's TCP/IP protocol     suite implementation for IPv6 allowed the Hop Limit     value to be set to a smaller value than the default     one. An attacker on a local network could use this flaw     to prevent systems on that network from sending or     receiving network packets.(CVE-2015-2922)

  - A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in     which the source was inside and the destination was     outside of a bind mount. A privileged user inside a     container could use this flaw to escape the bind mount     and, potentially, escalate their privileges on the     system.(CVE-2015-2925)

  - A race condition flaw was found in the way the Linux     kernel's SCTP implementation handled Address     Configuration lists when performing Address     Configuration Change (ASCONF). A local attacker could     use this flaw to crash the system via a race condition     triggered by setting certain ASCONF options on a     socket.(CVE-2015-3212)

  - mm/memory.c in the Linux kernel before 4.1.4 mishandles     anonymous pages, which allows local users to gain     privileges or cause a denial of service (page tainting)     via a crafted application that triggers writing to page     zero.(CVE-2015-3288)

  - A flaw was found in the way the Linux kernel's nested     NMI handler and espfix64 functionalities interacted     during NMI processing. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the system.(CVE-2015-3290)

  - It was found that if a Non-Maskable Interrupt (NMI)     occurred immediately after a SYSCALL call or before a     SYSRET call with the user RSP pointing to the NMI IST     stack, the kernel could skip that NMI.(CVE-2015-3291)

  - A buffer overflow flaw was found in the way the Linux     kernel's Intel AES-NI instructions optimized version of     the RFC4106 GCM mode decryption functionality handled     fragmented packets. A remote attacker could use this     flaw to crash, or potentially escalate their privileges     on, a system over a connection with an active AES-GCM     mode IPSec security association.(CVE-2015-3331)

  - A race condition flaw was found between the chown and     execve system calls. When changing the owner of a     setuid user binary to root, the race condition could     momentarily make the binary setuid root. A local,     unprivileged user could potentially use this flaw to     escalate their privileges on the system.(CVE-2015-3339)

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636)

  - An inode data validation error was found in Linux     kernels built with UDF file system (CONFIG_UDF_FS)     support. An attacker able to mount a     corrupted/malicious UDF file system image could cause     the kernel to crash.(CVE-2015-4167)

  - A flaw was discovered in the way the Linux kernel's TTY     subsystem handled the tty shutdown phase. A local,     unprivileged user could use this flaw to cause denial     of service on the system by holding a reference to the     ldisc lock during tty shutdown, causing a     deadlock.(CVE-2015-4170)

  - A flaw was discovered in the kernel's collect_mounts     function. If the kernel's audit subsystem called     collect_mounts to audit an unmounted path, it could     panic the system. With this flaw, an unprivileged user     could call umount(MNT_DETACH) to launch a     denial-of-service attack.(CVE-2015-4177)

  - A DoS flaw was found for a Linux kernel built for the     x86 architecture which had the KVM virtualization     support(CONFIG_KVM) enabled. The kernel would be     vulnerable to a NULL pointer dereference flaw in Linux     kernel's kvm_apic_has_events() function while doing an     ioctl. An unprivileged user able to access the     '/dev/kvm' device could use this flaw to crash the     system kernel.(CVE-2015-4692)

  - A flaw was found in the kernel's implementation of the     Berkeley Packet Filter (BPF). A local attacker could     craft BPF code to crash the system by creating a     situation in which the JIT compiler would fail to     correctly optimize the JIT image on the last pass. This     would lead to the CPU executing instructions that were     not part of the JIT code.(CVE-2015-4700)

  - A buffer overflow flaw was found in the way the Linux     kernel's virtio-net subsystem handled certain fraglists     when the GRO (Generic Receive Offload) functionality     was enabled in a bridged network configuration. An     attacker on the local network could potentially use     this flaw to crash the system, or, although unlikely,     elevate their privileges on the system.(CVE-2015-5156)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel was updated to fix bugs and security issues :

Following security issues were fixed: CVE-2015-2830: A flaw was found in the way the Linux kernels 32-bit emulation implementation handled forking or closing of a task with an int80 entry. A local user could have potentially used this flaw to escalate their privileges on the system.

CVE-2015-2042: A kernel information leak in rds sysctl files was fixed.

CVE-2014-9683: Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel allowed local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

CVE-2015-0275: A BUG_ON in ext4 was fixed which could be triggered by local users.

CVE-2015-2666: A buffer overflow when loading microcode files into the kernel could be used by the administrator to execute code in the kernel, bypassing secure boot measures.

  - CVE-2015-1421: Use-after-free vulnerability in the     sctp_assoc_update function in net/sctp/associola.c in     the Linux kernel allowed remote attackers to cause a     denial of service (slab corruption and panic) or     possibly have unspecified other impact by triggering an     INIT collision that leads to improper handling of     shared-key data.

  - CVE-2015-2150: XSA-120: Guests were permitted to modify     all bits of the PCI command register of passed through     cards, which could lead to Host system crashes.

  - CVE-2015-0777: The XEN usb backend could leak     information to the guest system due to copying     uninitialized memory.

  - CVE-2015-1593: A integer overflow reduced the     effectiveness of the stack randomization on 64-bit     systems.

  - CVE-2014-9419: The __switch_to function in     arch/x86/kernel/process_64.c in the Linux kernel did not     ensure that Thread Local Storage (TLS) descriptors are     loaded before proceeding with other steps, which made it     easier for local users to bypass the ASLR protection     mechanism via a crafted application that reads a TLS     base address.

  - CVE-2014-9428: The batadv_frag_merge_packets function in     net/batman-adv/fragmentation.c in the B.A.T.M.A.N.
    implementation in the Linux kernel used an incorrect     length field during a calculation of an amount of     memory, which allowed remote attackers to cause a denial     of service (mesh-node system crash) via fragmented     packets.

  - CVE-2014-8160:
    net/netfilter/nf_conntrack_proto_generic.c in the Linux     kernel generated incorrect conntrack entries during     handling of certain iptables rule sets for the SCTP,     DCCP, GRE, and UDP-Lite protocols, which allowed remote     attackers to bypass intended access restrictions via     packets with disallowed port numbers.

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key.

  - CVE-2014-9420: The rock_continue function in     fs/isofs/rock.c in the Linux kernel did not restrict the     number of Rock Ridge continuation entries, which allowed     local users to cause a denial of service (infinite loop,     and system crash or hang) via a crafted iso9660 image.

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel did not     validate a length value in the Extensions Reference (ER)     System Use Field, which allowed local users to obtain     sensitive information from kernel memory via a crafted     iso9660 image.

  - CVE-2014-9585: The vdso_addr function in     arch/x86/vdso/vma.c in the Linux kernel did not properly     choose memory locations for the vDSO area, which made it     easier for local users to bypass the ASLR protection     mechanism by guessing a location at the end of a PMD.

  - CVE-2014-8559: The d_walk function in fs/dcache.c in the     Linux kernel through did not properly maintain the     semantics of rename_lock, which allowed local users to     cause a denial of service (deadlock and system hang) via     a crafted application.

  - CVE-2014-8134: The paravirt_ops_setup function in     arch/x86/kernel/kvm.c in the Linux kernel used an     improper paravirt_enabled setting for KVM guest kernels,     which made it easier for guest OS users to bypass the     ASLR protection mechanism via a crafted application that     reads a 16-bit value.

Following bugs were fixed :

  - powerpc/pci: Fix IO space breakage after     of_pci_range_to_resource() change (bnc#922542).

  - cifs: fix use-after-free bug in find_writable_file     (bnc#909477).

  - usb: Do not allow usb_alloc_streams on unconfigured     devices (bsc#920581).

  - fuse: honour max_read and max_write in direct_io mode     (bnc#918954).

  - switch iov_iter_get_pages() to passing maximal number of     pages (bnc#918954).

  - bcache: fix a livelock in btree lock v2 (bnc#910440)     (bnc#910440). Updated because another version went     upstream

  - drm/i915: Initialise userptr mmu_notifier serial to 1     (bnc#918970).

  - NFS: Don't try to reclaim delegation open state if     recovery failed (boo#909634).

  - NFSv4: Ensure that we call FREE_STATEID when NFSv4.x     stateids are revoked (boo#909634).

  - NFSv4: Fix races between nfs_remove_bad_delegation() and     delegation return (boo#909634).

  - NFSv4: Ensure that we remove NFSv4.0 delegations when     state has expired (boo#909634).

  - Fixing lease renewal (boo#909634).

  - bcache: Fix a bug when detaching (bsc#908582).

  - fix a leak in bch_cached_dev_run() (bnc#910440).

  - bcache: unregister reboot notifier when bcache fails to     register a block device (bnc#910440).

  - bcache: fix a livelock in btree lock (bnc#910440).

  - bcache: [BUG] clear BCACHE_DEV_UNLINK_DONE flag when     attaching a backing device (bnc#910440).

  - bcache: Add a cond_resched() call to gc (bnc#910440).

  - storvsc: ring buffer failures may result in I/O freeze     (bnc#914175).

  - ALSA: seq-dummy: remove deadlock-causing events on close     (boo#916608).

  - ALSA: pcm: Zero-clear reserved fields of PCM status     ioctl in compat mode (boo#916608).

  - ALSA: bebob: Uninitialized id returned by     saffirepro_both_clk_src_get (boo#916608).

  - ALSA: hda - Fix built-in mic on Compaq Presario CQ60     (bnc#920604).

  - ALSA: hda - Fix regression of HD-audio controller     fallback modes (bsc#921313).

  - [media] sound: Update au0828 quirks table (boo#916608).

  - [media] sound: simplify au0828 quirk table (boo#916608).

  - ALSA: usb-audio: Add mic volume fix quirk for Logitech     Webcam C210 (boo#916608).

  - ALSA: usb-audio: extend KEF X300A FU 10 tweak to Arcam     rPAC (boo#916608).

  - ALSA: usb-audio: Add ctrl message delay quirk for     Marantz/Denon devices (boo#916608).

  - ALSA: usb-audio: Fix memory leak in FTU quirk     (boo#916608).

  - ALSA: usb-audio: Fix device_del() sysfs warnings at     disconnect (boo#916608).

  - ALSA: hda - Add new GPU codec ID 0x10de0072 to snd-hda     (boo#916608).

  - ALSA: hda - Fix wrong gpio_dir & gpio_mask hint setups     for IDT/STAC codecs (boo#916608).

  - ALSA: hda/realtek - New codec support for ALC298     (boo#916608).

  - ALSA: hda/realtek - New codec support for ALC256     (boo#916608).

  - ALSA: hda/realtek - Add new Dell desktop for ALC3234     headset mode (boo#916608).

  - ALSA: hda - Add EAPD fixup for ASUS Z99He laptop     (boo#916608).

  - ALSA: hda - Fix built-in mic at resume on Lenovo Ideapad     S210 (boo#916608).

  - ALSA: hda/realtek - Add headset Mic support for new Dell     machine (boo#916608).

  - ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP     (boo#916608).

  - ALSA: hda_intel: Add Device IDs for Intel Sunrise Point     PCH (boo#916608).

  - ALSA: hda - add codec ID for Braswell display audio     codec (boo#916608).

  - ALSA: hda - add PCI IDs for Intel Braswell (boo#916608).

  - ALSA: hda - Add dock support for Thinkpad T440     (17aa:2212) (boo#916608).

  - ALSA: hda - Set up GPIO for Toshiba Satellite S50D     (bnc#915858).

  - rpm/kernel-binary.spec.in: Fix build if there is no
    *.crt file

  - mm, vmscan: prevent kswapd livelock due to     pfmemalloc-throttled process being killed (VM     Functionality bnc#910150).

  - Input: evdev - fix EVIOCG(type) ioctl (bnc#904899).

  - mnt: Implicitly add MNT_NODEV on remount when it was     implicitly added by mount (bsc#907988).

  - Btrfs: fix scrub race leading to use-after-free     (bnc#915456).

  - Btrfs: fix setup_leaf_for_split() to avoid leaf     corruption (bnc#915454).

  - Btrfs: fix fsync log replay for inodes with a mix of     regular refs and extrefs (bnc#915425).

  - Btrfs: fix fsync when extend references are added to an     inode (bnc#915425).

  - Btrfs: fix directory inconsistency after fsync log     replay (bnc#915425).

  - Btrfs: make xattr replace operations atomic     (bnc#913466).

  - Btrfs: fix directory recovery from fsync log     (bnc#895797).

  - Btrfs: simplify insert_orphan_item (boo#926385).

  - Btrfs: set proper message level for skinny metadata.

  - Btrfs: make sure we wait on logged extents when fsycning     two subvols.

  - Btrfs: fix lost return value due to variable shadowing.

  - Btrfs: fix leak of path in btrfs_find_item.

  - Btrfs: fix fsync data loss after adding hard link to     inode.

  - Btrfs: fix fs corruption on transaction abort if device     supports discard.

  - Btrfs: fix data loss in the fast fsync path.

  - Btrfs: don't delay inode ref updates during log replay.

  - Btrfs: do not move em to modified list when unpinning.

  - Btrfs:__add_inode_ref: out of bounds memory read when     looking for extended ref.

  - Btrfs: fix inode eviction infinite loop after cloning     into it (boo#905088).

  - bcache: add mutex lock for bch_is_open (bnc#908612).

  - bcache: Correct printing of btree_gc_max_duration_ms     (bnc#908610).

  - bcache: fix crash with incomplete cache set     (bnc#908608).

  - bcache: fix memory corruption in init error path     (bnc#908606).

  - bcache: Fix more early shutdown bugs (bnc#908605).

  - bcache: fix use-after-free in btree_gc_coalesce()     (bnc#908604).

  - bcache: Fix an infinite loop in journal replay     (bnc#908603).

  - bcache: fix typo in bch_bkey_equal_header (bnc#908598).

  - bcache: Make sure to pass GFP_WAIT to mempool_alloc()     (bnc#908596).

  - bcache: fix crash on shutdown in passthrough mode     (bnc#908594).

  - bcache: fix lockdep warnings on shutdown (bnc#908593).

  - bcache allocator: send discards with correct size     (bnc#908592).

  - bcache: Fix to remove the rcu_sched stalls (bnc#908589).

  - bcache: Fix a journal replay bug (bnc#908588).

  - Update x86_64 config files: CONFIG_SENSORS_NCT6683=m The     nct6683 driver is already enabled on i386 and history     suggests that it not being enabled on x86_64 is by     mistake.

  - rpm/kernel-binary.spec.in: Own the modules directory in     the devel package (bnc#910322)

  - Revert 'iwlwifi: mvm: treat EAPOLs like mgmt frames wrt     rate' (bnc#900811).

  - mm: free compound page with correct order (bnc#913695).

  - drm/i915: More cautious with pch fifo underruns     (boo#907039).

  - Refresh patches.arch/arm64-0039-generic-pci.patch (fix     PCI bridge support)

  - x86/microcode/intel: Fish out the stashed microcode for     the BSP (bsc#903589).

  - x86, microcode: Reload microcode on resume (bsc#903589).

  - x86, microcode: Don't initialize microcode code on     paravirt (bsc#903589).

  - x86, microcode, intel: Drop unused parameter     (bsc#903589).

  - x86, microcode, AMD: Do not use smp_processor_id() in     preemtible context (bsc#903589).

  - x86, microcode: Update BSPs microcode on resume     (bsc#903589).

  - x86, microcode, AMD: Fix ucode patch stashing on 32-bit     (bsc#903589).

  - x86, microcode: Fix accessing dis_ucode_ldr on 32-bit     (bsc#903589).

  - x86, microcode, AMD: Fix early ucode loading on 32-bit     (bsc#903589).

  - Bluetooth: Add support for Broadcom BCM20702A0 variants     firmware download (bnc#911311).

  - drm/radeon: fix sad_count check for dce3 (bnc#911356).

  - drm/i915: Don't call intel_prepare_page_flip() multiple     times on gen2-4 (bnc#911835).

  - udf: Check component length before reading it.

  - udf: Check path length when reading symlink.

  - udf: Verify symlink size before loading it.

  - udf: Verify i_size when loading inode.

  - arm64: Enable DRM

  - arm64: Enable generic PHB driver (bnc#912061).

  - ACPI / video: Add some Samsung models to     disable_native_backlight list (boo#905681).

  - asus-nb-wmi: Add another wapf=4 quirk (boo#911438).

  - asus-nb-wmi: Add wapf4 quirk for the X550VB     (boo#911438).

  - asus-nb-wmi: Add wapf4 quirk for the U32U (boo#911438).

  - asus-nb-wmi: Add wapf4 quirk for the X550CC     (boo#911438).

  - asus-nb-wmi: Constify asus_quirks DMI table     (boo#911438).

  - asus-nb-wmi: Add wapf4 quirk for the X550CL     (boo#911438).

  - asus-nb-wmi.c: Rename x401u quirk to wapf4 (boo#911438).

  - asus-nb-wmi: Add ASUSTeK COMPUTER INC. X200CA     (boo#911438).

  - WAPF 4 for ASUSTeK COMPUTER INC. X75VBP WLAN ON     (boo#911438).

  - Input: synaptics - gate forcepad support by DMI check     (bnc#911578).

  - ext4: introduce aging to extent status tree     (bnc#893428).

  - ext4: cleanup flag definitions for extent status tree     (bnc#893428).

  - ext4: limit number of scanned extents in status tree     shrinker (bnc#893428).

  - ext4: move handling of list of shrinkable inodes into     extent status code (bnc#893428).

  - ext4: change LRU to round-robin in extent status tree     shrinker (bnc#893428).

  - ext4: cache extent hole in extent status tree for     ext4_da_map_blocks() (bnc#893428).

  - ext4: fix block reservation for bigalloc filesystems     (bnc#893428).

  - ext4: track extent status tree shrinker delay statictics     (bnc#893428).

  - ext4: improve extents status tree trace point     (bnc#893428).

  - rpm/kernel-binary.spec.in: Provide name-version-release     for kgraft packages (bnc#901925)

  - rpm/kernel-binary.spec.in: Fix including the secure boot     cert in /etc/uefi/certs

  - doc/README.SUSE: update Solid Driver team contacts

  - rpm/kernel-binary.spec.in: Do not sign firmware files     (bnc#867199)

  - Port module signing changes from SLE11-SP3 (fate#314508)

  - doc/README.PATCH-POLICY.SUSE: add patch policy / best     practices document after installation.

  - Update config files. (boo#925479) Do not set     CONFIG_SYSTEM_TRUSTED_KEYRING until we need it in future     openSUSE version: e.g. MODULE_SIG, IMA, PKCS7(new),     KEXEC_BZIMAGE_VERIFY_SIG(new)

  - Input: xpad - use proper endpoint type (bnc#926397).

  - md: don't require sync_min to be a multiple of     chunk_size (bnc#910500).

The openSUSE 13.1 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2014-8989: The Linux kernel did not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allowed local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c (bnc#906545).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandles IRET faults in     processing NMIs that occurred during userspace     execution, which might allow local users to gain     privileges by triggering an NMI (bnc#937969).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel through     4.2.3 did not ensure that certain slot numbers are     valid, which allowed local users to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #DB (aka Debug)     exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #AC (aka Alignment     Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key     (bnc#912202).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2015-6937 (bnc#952384     953052).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-7885: The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 did not initialize a certain structure     member, which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951627).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Disable 64bit address for Creative HDA     controllers (bnc#814440).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y     (boo#956934).

  - KVM: x86: update masterclock values on TSC writes     (bsc#961739).

  - NFS: Fix a NULL pointer dereference of migration     recovery ops for v4.2 client (bsc#960839).

  - apparmor: allow SYS_CAP_RESOURCE to be sufficient to     prlimit another task (bsc#921949).

  - blktap: also call blkif_disconnect() when frontend     switched to closed (bsc#952976).

  - blktap: refine mm tracking (bsc#952976).

  - cdrom: Random writing support for BD-RE media     (bnc#959568).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - ipv4: Do not increase PMTU with Datagram Too Big message     (bsc#955224).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - ipv6: fix tunnel error handling (bsc#952579).

  - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224).

  - uas: Add response iu handling (bnc#954138).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/evtchn: make use of PHYSDEVOP_map_pirq.

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

远程 Ubuntu 14.04 LTS 主机上安装的一个程序包受到 USN-2588-1 公告中提及的多个漏洞影响。

  - 在 4.0 之前的 Linux 内核中，arch/x86/kernel/cpu/microcode/intel_early.c 的 get_matching_model_microcode 函数中存在基于堆栈的缓冲区溢出，允许上下文有关的攻击者通过构建的微代码标头获取权限，并利用 Root 权限对 initrd 进行写入访问。(CVE-2015-2666)

  - 在 3.19.6 之前的 Linux 内核的 IPv6 堆栈的邻居发现 (ND) 协议实现中，net/ipv6/ndisc.c 的 ndisc_router_discovery 函数允许远程攻击者通过路由器公告 (RA) 消息中的较小 hop_limit 值重新配置 hop-limit 设置。(CVE-2015-2922)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

SUSE Linux Enterprise 12 内核已更新到版本 3.12.43，可接收各种安全补丁和缺陷补丁。

已修复下列安全缺陷：

- CVE-2014-3647：3.17.2 及更早版本的 Linux 内核中 KVM 子系统中的 arch/x86/kvm/emulate.c 未正确执行 RIP 更改，这允许客户机操作系统用户通过构建的应用程序造成拒绝服务（客户机操作系统崩溃）(bsc#899192)。

- CVE-2014-8086：3.17 及更早版本的 Linux 内核中 fs/ext4/file.c 中的 ext4_file_write_iter 函数内存在争用条件，允许本地用户通过组合写入操作和 O_DIRECT 标记的 F_SETFL fcntl 操作来造成拒绝服务（文件不可用）(bsc#900881)。

- CVE-2014-8159：InfiniBand (IB) 实现未正确限制内存区域注册的用户动词，这允许本地用户利用 /dev/infiniband/ 下的 uverbs 设备的权限访问任意物理内存位置，并因此造成拒绝服务（系统崩溃）或获得权限 (bsc#914742)。

- CVE-2015-1465：3.18.8 及更早版本的 Linux 内核中的 IPv4 实现在缺少缓存的情况下重定向查找时，未正确考虑读-拷贝-更新 (RCU) 宽限期的长度，这允许远程攻击者通过数据包洪流造成拒绝服务（内存消耗或系统崩溃）(bsc#916225)。

- CVE-2015-2041：3.19 及之前版本的 Linux 内核中的 net/llc/sysctl_net_llc.c 在 sysctl 表中使用错误的数据类型，这可能允许本地用户通过访问 sysctl 条目从内核内存中获取敏感信息或造成其他不明影响 (bsc#919007)。

- CVE-2015-2042：3.19 及之前版本的 Linux 内核中的 net/rds/sysctl.c 在 sysctl 表中使用错误的数据类型，这可能允许本地用户通过访问 sysctl 条目从内核内存中获取敏感信息或造成其他不明影响 (bsc#919018)。

- CVE-2015-2666：修复了允许构建的微代码溢出内核堆栈的缺陷 (bsc#922944)。

- CVE-2015-2830：修复了因 64 位任务处理不当而导致的 int80 fork (bsc#926240)。

- CVE-2015-2922：修复了由于未正确处理路由器公告而可能存在的针对 IPv6 网络堆栈的拒绝服务 (DoS) 攻击 (bsc#922583)。

- CVE-2015-3331：修复了使用 AESNI 的 RFC4106 实现中的缓冲区溢出 (bsc#927257)。

- CVE-2015-3332：修复了 TCP Fast Open 本地 DoS (bsc#928135)。

- CVE-2015-3339：修复了 chown() 和 execve() 系统调用之间的争用条件缺陷，该争用条件可能导致本地权限升级 (bsc#928130)。

- CVE-2015-3636：修复了可能导致本地权限升级的 ping 套接字中的释放后使用 (bsc#929525)。

修复了以下非安全缺陷：

- /proc/stat：转换为 single_open_size() (bsc#928122)。

- ACPI / sysfs：将 counter_show() 的计数字段视为无符号 (bsc#909312)。

- 自动提供/废弃所有旧风格的子程序包 (bsc#925567)

- Btrfs：btrfs_release_extent_buffer_page 未释放虚拟范围的页面 (bsc#930226)。

- Btrfs：修复在克隆到 inode 中之后的 inode 逐出无限循环 (bsc#930224)。

- Btrfs：修复在 extent_same ioctl 之后的 inode 逐出无限循环 (bsc#930224)。

- Btrfs：修复使用 -o discard 选项挂载 fs 时的日志树损坏 (bsc#927116)。

- Btrfs：修复 Iseek 中的边界检查 (bsc#927115)。

- 修复 rtworkqueues 崩溃。禁止在中断上下文中调用 __sched_setscheduler()，而之前 destroy_worker() 在配置有 nohz_full 的定时器中断中执行此操作。
 同时为两个引导选项排除该可能性。

- Input：psmouse - 添加 psmouse_matches_pnp_id 帮助程序函数 (bsc#929092)。

- Input：synaptics - 修复 Lenovo 2015 产品上的触摸板中键 (bsc#929092)。

- Input：synaptics - 处理虚假的松开指点杆按钮动作 (bsc#929092)。

- Input：synaptics - 重新编制了 Lenovo 2015 系列产品上指点杆按钮的路由 (bsc#929092)。

- Input：synaptics - 删除 Lenovos 2015 的 TOPBUTTONPAD 属性 (bsc#929092)。

- Input：synaptics - 检索查询 $10 中的扩展功能 (bsc#929092)。

- NFS：为 nfs_setattr_update_inode() 添加属性更新屏障 (bsc#920262)。

- NFS：在对 nfs_setattr_update_inode 进行更改后还原 kabi (bsc#920262)。

- af_iucv：修复 AF_IUCV sendmsg() errno （bsc#927308，LTC#123304）。

- audit：不拒绝所有 AUDIT_INODE 过滤器类型 (bsc#927455)。

- bnx2x：修复 iommu=on 时的 kdump (bsc#921769)。

- cpufreq：修复 __cpufreq_governor() 中的空指针取消引用 (bsc#924664)。

- dasd：修复在暂停/恢复后没有路径的设备（bsc#927308，LTC#123896）。

- dasd：修复无法将 DASD 设备设为离线的问题（bsc#927308，LTC#123905）。

- dasd：修复在暂停/恢复后未恢复的设备（bsc#927308，LTC#123892）。

- dasd：在线处理后缺少分区（bsc#917125，LTC#120565）。

- drm/radeon/cik：添加 Macrotile 模式数组查询 (bsc#927285)。

- drm/radeon：修复 SI 上的显示图块设置 (bsc#927285)。

- drm/radeon：为 DCE 中的 CIK 芯片设置正确的 BANK 数 (bsc#927285)。

- iommu/amd：在 iommu 页表中正确编码大页面 (bsc#931014)。

- iommu/amd：优化新 fetch_pte 接口的 alloc_new_range (bsc#931014)。

- iommu/amd：优化新 fetch_pte 接口的 amd_iommu_iova_to_phys (bsc#931014)。

- iommu/amd：优化新 fetch_pte 接口的 iommu_unmap_page (bsc#931014)。

- iommu/amd：返回 fetch_pte 中的 pte 页面大小 (bsc#931014)。

- ipc/shm.c：修复当调用跨越多个段时，过分激进的 shmdt()（ipc 补丁）。

- ipmi：关闭空闲 ipmi 接口上的所有活动 (bsc#915540)。

- ixgbe：修复启用 SFP+ 功能的接口的检测 (bsc#922734)。

- kgr：向 kgr_revert_replaced_funs 中的消息添加错误代码。

- kgr：向 kthread wait_event_freezable() API 调用添加 kgraft 批注。

- kgr：修正第一个修补阶段中的错误处理。

- kgr：处理模块的延迟修补。

- kgr：处理最终阶段的失败。

- kgr：如果通知器注册失败，则在 kgr_init 中返回错误。

- kgr：取出 kgr_patch_code 中的 fops 开关并添加到新的函数中。

- kgr：使用 for_each_process_thread (bsc#929883)。

- kgr：对所有线程使用 kgr_in_progress (bnc#929883)。

- libata：在 Samsung SSD 850 Pro 中排列 TRIM 的黑名单 (bsc#926156)。

- mlx4：调用 dev_kfree_skby_any，而不是 dev_kfree_skb (bsc#928708)。

- mm、numa：在单节点计算机上真正默认禁用 NUMA 平衡（自动 NUMA 平衡）。

- mm：vmscan：如果节点没有可回收的页面，则不根据 pfmemalloc 预留进行节流（bsc#924803，VM 功能）。

- net/mlx4：缓存行 CQE/EQE 步幅补丁 (bsc#927084)。

- net/mlx4_core：缓存行 EQE 大小支持 (bsc#927084)。

- net/mlx4_core：启用 CQE/EQE 步幅支持 (bsc#927084)。

- net/mlx4_en：添加 mlx4_en_get_cqe 帮助程序 (bsc#927084)。

- perf/x86/amd/ibs：更新 IBS MSR 和功能定义。

- powerpc/mm：修复当设置了 MAP_FIXED 并且映射超出允许的地址空间时出现的 mmap errno (bsc#930669)。

- powerpc/numa：添加禁用和调试拓扑结构更新的功能 (bsc#924809)。

- powerpc/numa：启用 CONFIG_HAVE_MEMORYLESS_NODES (bsc#924809)。

- powerpc/numa：启用 USE_PERCPU_NUMA_NODE_ID (bsc#924809)。

- powerpc/numa：检查来自 proc_create 的错误返回 (bsc#924809)。

- powerpc/numa：确保在拓扑结构更新时每个 cpu 的 NUMA 映射正确 (bsc#924809)。

- powerpc/numa：使用 update_cpu_topology 中 update->cpu 的缓存值 (bsc#924809)。

- powerpc/perf：Cap 64 位用户空间回溯至 PERF_MAX_STACK_DEPTH (bsc#928141)。

- powerpc/pseries：将 api_version 引入到迁移 sysfs 接口 (bsc#926314)。

- powerpc/pseries：移动设备树更新后的小端补丁 (bsc#926314)。

- powerpc/pseries：简化在暂停/迁移期间对可暂停性的检查 (bsc#926314)。

- powerpc：修复 sys_call_table 声明以启用 syscall 跟踪。

- powerpc：修复 verify_cpu_node_mapping() 报告的警告 (bsc#924809)。

- powerpc：仅为在引导时存在的 cpu 设置 numa 节点信息 (bsc#924809)。

- powerpc：重新排序每个 cpu 的 NUMA 信息初始化 (bsc#924809)。

- powerpc：numa_setup_cpu() 中的某些变更 (bsc#924809)。

- quota：修复配额获取/设置接口中单位的使用 (bsc#913232)。

- rpm/kernel-binary.spec.in：如果没有 *.crt 文件，则修复版本

- rpm/kernel-obs-qa.spec.in：内核版本不匹配时不会失败

- s390/bpf：修复 ALU_NEG (A = -A)（bsc#917125，LTC#121759）。

- s390/bpf：修复 JMP_JGE_K (A >= K) 和 JMP_JGT_K (A > K)（bsc#917125，LTC#121759）。

- s390/bpf：修复 JMP_JGE_X (A > X) 和 JMP_JGT_X (A >= X)（bsc#917125，LTC#121759）。

- s390/bpf：修复 skb_copy_bits() 的偏移参数（bsc#917125，LTC#121759）。

- s390/bpf：修复 sk_load_byte_msh()（bsc#917125，LTC#121759）。

- s390/bpf：修复 skb_copy_bits() 参数传递（bsc#917125，LTC#121759）。

- s390/bpf：调用 C 函数之前的零扩展参数（bsc#917125，LTC#121759）。

- s390/sclp：将之前的 sclp init 调用合并到 sclp_early_detect() 中（bsc#917125，LTC#122429）。

- s390/sclp：动态确定 zfcpdump 的 HSA 大小（bsc#917125，LTC#122429）。

- s390/sclp：将 sclp_sdias 的声明移动到单独的标头文件中（bsc#917125，LTC#122429）。

- s390/sclp：将之前的代码从 sclp_cmd.c 移动到 sclp_early.c（bsc#917125，LTC#122429）。

- s390/sclp：用 sccb_early 替换未初始化的 early_event_mask_sccb 变量（bsc#917125，LTC#122429）。

- s390/sclp：恢复 smp-detect-possible-cpus.patch（bsc#917125，LTC#122429）。

- s390/sclp_early：添加函数来检测 sclp 控制台功能（bsc#917125，LTC#122429）。

- s390/sclp_early：去掉 sclp_early_read_info_sccb_valid（bsc#917125，LTC#122429）。

- s390/sclp_early：将 sccb 指针传递到每个 *_detect() 函数（bsc#917125，LTC#122429）。

- s390/sclp_early：用 sccb_early 替换 early_read_info_sccb（bsc#917125，LTC#122429）。

- s390/sclp_early：也能为零值返回正确的 HSA 区块计数（bsc#917125，LTC#122429）。

- s390/smp：限制可能的 cpu 掩码中的 cpu 数量（bsc#917125，LTC#122429）。

- s390：kgr，仅当启用时更改 kgraft 状态。

- sched、time：修复 thread_group_cputime() 中的锁定反转

- sched：修复潜在的、接近无限的 distribute_cfs_runtime() 循环 (bsc#930786)

- sched：加强拓扑结构设置 (bsc#924809)。

- seqlock：添加 read_seqbegin_or_lock() 的 irqsave 变体（时间可扩展性）。

- storvsc：当不需要传输数据时正确设置 SRB 标记 (bsc#931130)。

- x86/apic/uv：更新 APIC UV OEM 检查 (bsc#929145)。

- x86/apic/uv：更新 UV APIC HUB 检查 (bsc#929145)。

- x86/apic/uv：更新 UV APIC 驱动程序检查 (bsc#929145)。

- x86/microcode/intel：针对加载程序中的堆栈溢出进行保护 (bsc#922944)。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程 Oracle Linux 7 主机上安装的程序包受到 ELSA-2015-1534 公告中提及的多个漏洞的影响。

  - 在 3.19.6 之前的 Linux 内核的 IPv6 堆栈的邻居发现 (ND) 协议实现中，net/ipv6/ndisc.c 的 ndisc_router_discovery 函数允许远程攻击者通过路由器公告 (RA) 消息中的较小 hop_limit 值重新配置 hop-limit 设置。(CVE-2015-2922)

  在 4.0.3 之前的 Linux 内核中，net/ipv4/ping.c 中的 ping_unhash 函数在反哈希操作期间未初始化特定列表数据结构，这允许本地用户利用为 IPPROTO_ICMP 或 IPPROTO_ICMPV6 协议执行 SOCK_DGRAM 套接字系统调用然后在断开连接后执行连接系统调用的能力，来获取特权或造成拒绝服务（释放后使用和系统崩溃）。(CVE-2015-3636)

  - 在 3.14.5 之前的 Linux 内核中，netfilter 子系统的 include/net/netfilter/nf_conntrack_extend.h 对某些扩展数据使用不够大的数据类型，本地用户可利用可触发扩展加载的出站网络流量造成拒绝服务（空指针取消引用和 OOPS），这一点已由在 NAT 环境中配置 PPTP 隧道证实。(CVE-2014-9715)

  - 在 4.0 之前的 Linux 内核中，arch/x86/kernel/cpu/microcode/intel_early.c 的 get_matching_model_microcode 函数中存在基于堆栈的缓冲区溢出，允许上下文有关的攻击者通过构建的微代码标头获取权限，并利用 Root 权限对 initrd 进行写入访问。(CVE-2015-2666)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

* 发现 Linux 内核的 netfilter 链接跟踪实现载入扩展的方式中存在整数溢出缺陷。本地网络上的攻击者可以发送一系列特别构建的数据包，将会启动加载大量扩展，从而导致此网络中的目标系统崩溃。（CVE-2014-9715，中危）

* 发现 Linux 内核的早期加载微代码功能中存在基于堆栈的缓冲区溢出缺陷。在启用 UEFI Secure Boot 的系统中，本地特权用户可以利用此缺陷将其权限升级至内核 (ring0) 级别，从而绕过已存在的预期限制。（CVE-2015-2666，中危）

* 发现在虚假断开过程中，Linux 内核的 ping 套接字实现未能正确处理套接字反哈希，这可能导致释放后使用缺陷。在 x86-64 架构系统上，有权创建 ping 套接字的本地用户可利用此缺陷造成系统崩溃。在非 x86-64 架构系统上，有权创建 ping 套接字的本地用户可利用此缺陷升级其在系统上的权限。（CVE-2015-3636，中危）

* 已发现 Linux 内核中适用于 IPv6 的 TCP/IP 协议套件实现允许将 Hop Limit 设置为一个低于默认的值。本地网络上的攻击者可利用此缺陷，阻碍该网络上的系统发送或接收网络程序包。（CVE-2015-2922，低危）

此更新还修复多个缺陷。

必须重新启动系统才能使此更新生效。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
124978	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1525)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	high
124811	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1487)	Nessus	Huawei Local Security Checks	2019/5/13	2024/5/23	high
82756	openSUSE Security Update : Linux Kernel (openSUSE-2015-302)	Nessus	SuSE Local Security Checks	2015/4/14	2021/1/19	critical
88545	openSUSE Security Update : the Linux Kernel (openSUSE-2016-124)	Nessus	SuSE Local Security Checks	2016/2/3	2021/1/19	high
83179	Ubuntu 14.04 LTS：Linux 内核漏洞 (USN-2588-1)	Nessus	Ubuntu Local Security Checks	2015/5/1	2024/8/28	high
84227	SUSE SLED12 / SLES12 安全更新：kernel (SUSE-SU-2015:1071-1)	Nessus	SuSE Local Security Checks	2015/6/17	2021/1/6	medium
85247	Oracle Linux 7：内核 (ELSA-2015-1534)	Nessus	Oracle Linux Local Security Checks	2015/8/6	2024/10/23	high
85264	Scientific Linux 安全更新：SL7.x x86_64 中的 kernel	Nessus	Scientific Linux Local Security Checks	2015/8/7	2021/1/14	medium

検出

プラグインの検索

high

high

critical

high

high

medium

high

medium