The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0150 advisory.

    - [fs] jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen) [783284] {CVE-2011-4086}
    - [fs] epoll: workarounds to preserve kernel ABI (Jason Baron) [681692] {CVE-2011-1083}
    - [fs] epoll: limit paths (Jason Baron) [681692] {CVE-2011-1083}
    - [fs] epoll: prevent creating circular epoll structures (Jason Baron) [681692] {CVE-2011-1083}
    - [fs] epoll: add ep_call_nested() (Jason Baron) [681692] {CVE-2011-1083}
    - [misc] Move exit_robust_list to mm_release, null lists on cleanup (Laszlo Ersek) [750283]     {CVE-2012-0028}
    - [fs] nfs: Fix an O_DIRECT Oops (Jeff Layton) [754620] {CVE-2011-4325}
    - [scsi] sd: fix 32-on-64 block device ioctls (Paolo Bonzini) [752386] {CVE-2011-4127}
    - [md] dm: do not forward ioctls from LVs to the underlying devices (Paolo Bonzini) [752386]     {CVE-2011-4127}
    - [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752386] {CVE-2011-4127}
    - [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752386] {CVE-2011-4127}
    - [fs] ext4: fix BUG_ON() in ext4_ext_insert_extent() (Lukas Czerner) [747946] {CVE-2011-3638}
    - [fs] xfs: Fix memory corruption in xfs_readlink (Carlos Maiolino) [749160] {CVE-2011-4077}
    - [fs] hfs: add sanity check for file name length (Eric Sandeen) [755433] {CVE-2011-4330}
    - [security] keys: Fix NULL deref in user-defined key type (David Howells) [751301] {CVE-2011-4110}
    - [fs] proc: fix oops on invalid /proc/<pid>/maps access (Johannes Weiner) [747699] {CVE-2011-3637}
    - [misc] remove div_long_long_rem (Prarit Bhargava) [732614] {CVE-2011-3209}
    - [net] bridge: fix use after free in __br_deliver (Amerigo Wang) [703045] {CVE-2011-2942}
    - [fs] proc: close race with exec in mem_read() (Johannes Weiner) [692042] {CVE-2011-1020}
    - [mm] implement access_remote_vm (Johannes Weiner) [692042] {CVE-2011-1020}
    - [mm] factor out main logic of access_process_vm (Johannes Weiner) [692042] {CVE-2011-1020}
    - [mm] use mm_struct to resolve gate vma's in __get_user_pages (Johannes Weiner) [692042] {CVE-2011-1020}
    - [mm] make in_gate_area take mm_struct instead of a task_struct (Johannes Weiner) [692042]     {CVE-2011-1020}
    - [mm] make get_gate_vma take mm_struct instead of task_struct (Johannes Weiner) [692042] {CVE-2011-1020}
    - [x86_64] mark assoc mm when running task in 32 bit compat mode (Johannes Weiner) [692042]     {CVE-2011-1020}
    - [misc] sched: add ctx tag to mm running task in ia32 compat mode (Johannes Weiner) [692042]     {CVE-2011-1020}
    - [fs] proc: require the target to be tracable (or yourself) (Johannes Weiner) [692042] {CVE-2011-1020}
    - [fs] proc: close race in /proc/*/environ (Johannes Weiner) [692042] {CVE-2011-1020}
    - [fs] proc: report errors in /proc/*/*map* sanely (Johannes Weiner) [692042] {CVE-2011-1020}
    - [fs] proc: shift down_read(mmap_sem) to the caller (Johannes Weiner) [692042] {CVE-2011-1020}
    - [fs] detect exec transition phase with new mm but old creds (Johannes Weiner) [692042] {CVE-2011-1020}
    - [fs] cifs: always do is_path_accessible check in cifs_mount (Jeff Layton) [738300] {CVE-2011-3363}
    - [fs] cifs: add fallback in is_path_accessible for old servers (Jeff Layton) [738300] {CVE-2011-3363}
    - [char] tpm: Zero buffer after copying to userspace (Jiri Benc) [732631] {CVE-2011-1162}
    - [misc] kernel: plug taskstats io infoleak (Jerome Marchand) [716846] {CVE-2011-2494}
    - [mm] avoid wrapping vm_pgoff in mremap and stack expansion (Jerome Marchand) [716544] {CVE-2011-2496}
    - [fs] ecryptfs: Add mount option to check uid of mounting device (Eric Sandeen) [731174] {CVE-2011-1833}
    - [misc] taskstats: don't allow duplicate entries in listener mode (Jerome Marchand) [715450]     {CVE-2011-2484}
    - [net] gro: Only reset frag0 when skb can be pulled (Herbert Xu) [679682] {CVE-2011-2723}
    - [net] sctp: fix memory reclaim and panic in sctp_sock_rfree (Thomas Graf) [714870] {CVE-2011-2482}
    - [xen] iommu: disable bus-mastering on hw that causes IOMMU fault (Laszlo Ersek) [730343] {CVE-2011-3131}
    - [xen] x86_emulate: Fix SAHF emulation (Igor Mammedov) [718884] {CVE-2011-2519}
    - [xen] fix off-by-one shift in x86_64 __addr_ok (Laszlo Ersek) [719850] {CVE-2011-2901}
    - [usb] auerswald: fix buffer overflow (Don Zickus) [722396] {CVE-2009-4067}
    - [char] tpm: Fix uninitialized usage of data buffer (Stanislaw Gruszka) [684673] {CVE-2011-1160}
    - [fs] ext4: Fix max size and logical block counting of extent file (Lukas Czerner) [722563]     {CVE-2011-2695}
    - [wireless] nl80211: check for valid SSID size in scan operation (Stanislaw Gruszka) [718155]     {CVE-2011-2517}
    - [fs] proc: restrict access to /proc/PID/io (Oleg Nesterov) [716828] {CVE-2011-2495}
    - [net] sunrpc: Don't hang forever on NLM unlock requests (Jeff Layton) [709547] {CVE-2011-2491}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way the Linux kernel's Event Poll (epoll) subsystem handled large, nested epoll structures. A local, unprivileged user could use this flaw to cause a denial of service.

A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client.

The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0150 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issue:

    * A flaw was found in the way the Linux kernel's Event Poll (epoll)     subsystem handled large, nested epoll structures. A local, unprivileged     user could use this flaw to cause a denial of service. (CVE-2011-1083,     Moderate)

    Red Hat would like to thank Nelson Elhage for reporting this issue.

    These updated kernel packages include a number of bug fixes and     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 5.8 Technical     Notes, linked to in the References, for information on the most significant     of these changes.

    All Red Hat Enterprise Linux 5 users are advised to install these updated     packages, which correct these issues and add these enhancements. The system     must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Dan Rosenberg discovered that IRDA did not correctly check the size of buffers. On non-x86 systems, a local attacker could exploit this to read kernel heap memory, leading to a loss of privacy. (CVE-2010-4529)

Dan Rosenburg discovered that the CAN subsystem leaked kernel addresses into the /proc filesystem. A local attacker could use this to increase the chances of a successful memory corruption exploit.
(CVE-2010-4565)

Kees Cook discovered that the IOWarrior USB device driver did not correctly check certain size fields. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges. (CVE-2010-4656)

Goldwyn Rodrigues discovered that the OCFS2 filesystem did not correctly clear memory when writing certain file holes. A local attacker could exploit this to read uninitialized data from the disk, leading to a loss of privacy. (CVE-2011-0463)

Dan Carpenter discovered that the TTPCI DVB driver did not check certain values during an ioctl. If the dvb-ttpci module was loaded, a local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges. (CVE-2011-0521)

Jens Kuehnel discovered that the InfiniBand driver contained a race condition. On systems using InfiniBand, a local attacker could send specially crafted requests to crash the system, leading to a denial of service. (CVE-2011-0695)

Dan Rosenberg discovered that XFS did not correctly initialize memory.
A local attacker could make crafted ioctl calls to leak portions of kernel stack memory, leading to a loss of privacy. (CVE-2011-0711)

Rafael Dominguez Vega discovered that the caiaq Native Instruments USB driver did not correctly validate string lengths. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges. (CVE-2011-0712)

Kees Cook reported that /proc/pid/stat did not correctly filter certain memory locations. A local attacker could determine the memory layout of processes in an attempt to increase the chances of a successful memory corruption exploit. (CVE-2011-0726)

Timo Warns discovered that MAC partition parsing routines did not correctly calculate block counts. A local attacker with physical access could plug in a specially crafted block device to crash the system or potentially gain root privileges. (CVE-2011-1010)

Timo Warns discovered that LDM partition parsing routines did not correctly calculate block counts. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1012)

Matthiew Herrb discovered that the drm modeset interface did not correctly handle a signed comparison. A local attacker could exploit this to crash the system or possibly gain root privileges.
(CVE-2011-1013)

Marek Olsak discovered that the Radeon GPU drivers did not correctly validate certain registers. On systems with specific hardware, a local attacker could exploit this to write to arbitrary video memory.
(CVE-2011-1016)

Timo Warns discovered that the LDM disk partition handling code did not correctly handle certain values. By inserting a specially crafted disk device, a local attacker could exploit this to gain root privileges. (CVE-2011-1017)

Vasiliy Kulikov discovered that the CAP_SYS_MODULE capability was not needed to load kernel modules. A local attacker with the CAP_NET_ADMIN capability could load existing kernel modules, possibly increasing the attack surface available on the system. (CVE-2011-1019)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-1078)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check that device name strings were NULL terminated. A local attacker could exploit this to crash the system, leading to a denial of service, or leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1079)

Vasiliy Kulikov discovered that bridge network filtering did not check that name fields were NULL terminated. A local attacker could exploit this to leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1080)

Nelson Elhage discovered that the epoll subsystem did not correctly handle certain structures. A local attacker could create malicious requests that would hang the system, leading to a denial of service.
(CVE-2011-1082)

Johan Hovold discovered that the DCCP network stack did not correctly handle certain packet combinations. A remote attacker could send specially crafted network traffic that would crash the system, leading to a denial of service. (CVE-2011-1093)

Peter Huewe discovered that the TPM device did not correctly initialize memory. A local attacker could exploit this to read kernel heap memory contents, leading to a loss of privacy. (CVE-2011-1160)

Dan Rosenberg discovered that some ALSA drivers did not correctly check the adapter index during ioctl calls. If this driver was loaded, a local attacker could make a specially crafted ioctl call to gain root privileges. (CVE-2011-1169)

Vasiliy Kulikov discovered that the netfilter code did not check certain strings copied from userspace. A local attacker with netfilter access could exploit this to read kernel memory or crash the system, leading to a denial of service. (CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-2534)

Vasiliy Kulikov discovered that the Acorn Universal Networking driver did not correctly initialize memory. A remote attacker could send specially crafted traffic to read kernel stack memory, leading to a loss of privacy. (CVE-2011-1173)

Dan Rosenberg discovered that the IRDA subsystem did not correctly check certain field sizes. If a system was using IRDA, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-1180)

Julien Tinnes discovered that the kernel did not correctly validate the signal structure from tkill(). A local attacker could exploit this to send signals to arbitrary threads, possibly bypassing expected restrictions. (CVE-2011-1182)

Dan Rosenberg reported errors in the OSS (Open Sound System) MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. (CVE-2011-1476)

Dan Rosenberg reported errors in the kernel's OSS (Open Sound System) driver for Yamaha FM synthesizer chips. A local user can exploit this to cause memory corruption, causing a denial of service or privilege escalation. (CVE-2011-1477)

Ryan Sweat discovered that the GRO code did not correctly validate memory. In some configurations on systems using VLANs, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1478)

Dan Rosenberg discovered that MPT devices did not correctly validate certain values in ioctl calls. If these drivers were loaded, a local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy. (CVE-2011-1494, CVE-2011-1495)

Tavis Ormandy discovered that the pidmap function did not correctly handle large requests. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-1593)

Vasiliy Kulikov discovered that the AGP driver did not check certain ioctl values. A local attacker with access to the video subsystem could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges. (CVE-2011-1745, CVE-2011-2022)

Oliver Hartkopp and Dave Jones discovered that the CAN network driver did not correctly validate certain socket structures. If this driver was loaded, a local attacker could crash the system, leading to a denial of service. (CVE-2011-1748)

A flaw was found in the b43 driver in the Linux kernel. An attacker could use this flaw to cause a denial of service if the system has an active wireless interface using the b43 driver. (CVE-2011-3359)

Maynard Johnson discovered that on POWER7, certain speculative events may raise a performance monitor exception. A local attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-4611)

Dan Rosenberg discovered flaws in the linux Rose (X.25 PLP) layer used by amateur radio. A local user or a remote user on an X.25 network could exploit these flaws to execute arbitrary code as root.
(CVE-2011-4913).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
68468	Oracle Linux 5 : kernel (ELSA-2012-0150)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	medium
69590	Amazon Linux AMI : kernel (ALAS-2012-100)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
58052	RHEL 5 : Red Hat Enterprise Linux 5.8 kernel update (Moderate) (RHSA-2012:0150)	Nessus	Red Hat Local Security Checks	2012/2/21	2025/3/20	medium
55454	Ubuntu 10.10 : linux vulnerabilities (USN-1160-1)	Nessus	Ubuntu Local Security Checks	2011/6/29	2019/9/19	high

検出

プラグインの検索

medium

medium

medium

high