Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system. (CVE-2014-7841, Important)

* A race condition flaw was found in the way the Linux kernel's mmap(2), madvise(2), and fallocate(2) system calls interacted with each other while operating on virtual memory file system files. A local user could use this flaw to cause a denial of service.
(CVE-2014-4171, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's Common Internet File System (CIFS) implementation handled mounting of file system shares. A remote attacker could use this flaw to crash a client system that would mount a file system share from a malicious server. (CVE-2014-7145, Moderate)

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

* It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags.
An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-5471, CVE-2014-5472, Low)

Red Hat would like to thank Akira Fujita of NEC for reporting the CVE-2014-7822 issue. The CVE-2014-7841 issue was discovered by Liu Wei of Red Hat.

This update also fixes the following bugs :

* Previously, a kernel panic could occur if a process reading from a locked NFS file was killed and the lock was not released properly before the read operations finished. Consequently, the system crashed.
The code handling file locks has been fixed, and instead of halting, the system now emits a warning about the unreleased lock. (BZ#1172266)

* A race condition in the command abort handling logic of the ipr device driver could cause the kernel to panic when the driver received a response to an abort command prior to receiving other responses to the aborted command due to the support for multiple interrupts. With this update, the abort handler waits for the aborted command's responses first before completing an abort operation. (BZ#1162734)

* Previously, a race condition could occur when changing a Page Table Entry (PTE) or a Page Middle Directory (PMD) to 'pte_numa' or 'pmd_numa', respectively, causing the kernel to crash. This update removes the BUG_ON() macro from the __handle_mm_fault() function, preventing the kernel panic in the aforementioned scenario.
(BZ#1170662)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not     enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of     service (system crash) or possibly have unspecified other impact via a crafted splice system call, as     demonstrated by use of a file descriptor associated with an ext4 filesystem. (CVE-2014-7822)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a 'negative groups' issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c. (CVE-2014-8989)

A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-106:03 advisory.

    Description:
    The kernel package contains the Linux kernel (vmlinuz), the core of any     Linux operating system. The kernel handles the basic functions     of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2014-7822
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    CVE-2014-8159
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    CVE-2014-8160     net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack     entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,     which allows remote attackers to bypass intended access restrictions via packets with disallowed port     numbers.
    CVE-2014-8369     The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the     number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of     service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS     privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.
    Fixed bugs:
    * The maximum amount of entries in the IPv6 route table (net.ipv6.route.max_size) was 4096, and every     route towards this maximum size limit was counted. Communication to more systems was impossible when the     limit was exceeded. Now, only cached routes are counted, which guarantees that the kernel does not run out     of memory, but the user can now install as many routes as the memory allows until the kernel indicates it     can no longer handle the amount of memory and returns an error message.
    In addition, the default net.ipv6.route.max_size value has been increased to 16384 for performance     improvement reasons.
    * When the user attempted to scan for an FCOE-served Logical Unit Number (LUN), after an initial LUN scan,     a kernel panic occurred in bnx2fc_init_task. With this update, fixed it.
    * Under certain conditions, such as when attempting to scan the network for LUNs, a race condition in the     bnx2fc driver could trigger a kernel panic in bnx2fc_init_task. With this update, fixed it.
    * Previously, it was not possible to boot the kernel on Xen hypervisor in PVHVM mode if more than 32 vCPUs     were specified in the guest configuration. Support for more than 32 vCPUs has been added, and fixed it.
    * When the NVMe driver allocated a namespace queue, it indicated that it was a request-based driver when     it was actually a block I/O-based driver. So, when NVMe driver was loaded along with a request-based dm     device, the system could terminate unexpectedly or become unresponsive when attempting to access data.
    With this update, fixed it.
    * If a user attempted to apply an NVRAM firmware update when running the tg3 module provided with Asianux     Server 4 SP4 kernels, the update could fail. So, the Network Interface Card (NIC) could stay in an     unusable state and this could prevent the entire system from booting. With this update, fixed it.
    * Support for key sizes of 256 and 192 bits has been added to AES-NI.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

Red Hat would like to thank Akira Fujita of NEC for reporting this issue.

This update also fixes the following bugs :

* Previously, hot-unplugging of a virtio-blk device could in some cases lead to a kernel panic, for example during in-flight I/O requests. This update fixes race condition in the hot-unplug code in the virtio_blk.ko module. As a result, hot unplugging of the virtio-blk device no longer causes the guest kernel oops when there are in-flight I/O requests. (BZ#1006536)

* Before this update, due to a bug in the error-handling path, a corrupted metadata block could be used as a valid block. With this update, the error handling path has been fixed and more checks have been added to verify the metadata block. Now, when a corrupted metadata block is encountered, it is properly marked as corrupted and handled accordingly. (BZ#1034403)

* Previously, an incorrectly initialized variable resulted in a random value being stored in the variable that holds the number of default ACLs, and is sent in the SET_PATH_INFO data structure. Consequently, the setfacl command could, under certain circumstances, fail with an 'Invalid argument' error. With this update, the variable is correctly initialized to zero, thus fixing the bug. (BZ#1105625)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Eric Windisch discovered flaw in how the Linux kernel's XFS file system replaces remote attributes. A local access with access to an XFS file system could exploit this flaw to escalate their privileges.
(CVE-2015-0274)

A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges.
(CVE-2013-7421)

The Linux kernel's splice system call did not correctly validate its parameters. A local, unprivileged user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-7822)

A flaw was discovered in the crypto subsystem when screening module names for automatic module loading if the name contained a valid crypto module name, eg. vfat(aes). A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges.
(CVE-2014-9644).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- A flaw was found in the way the Linux kernel's splice()     system call validated its parameters. On certain file     systems, a local, unprivileged user could use this flaw     to write past the maximum file size, and thus crash the     system. (CVE-2014-7822, Moderate)

This update also fixes the following bugs :

  - Previously, hot-unplugging of a virtio-blk device could     in some cases lead to a kernel panic, for example during     in-flight I/O requests. This update fixes race condition     in the hot-unplug code in the virtio_blk.ko module. As a     result, hot unplugging of the virtio-blk device no     longer causes the guest kernel oops when there are     in-flight I/O requests.

  - Before this update, due to a bug in the error-handling     path, a corrupted metadata block could be used as a     valid block. With this update, the error handling path     has been fixed and more checks have been added to verify     the metadata block. Now, when a corrupted metadata block     is encountered, it is properly marked as corrupted and     handled accordingly.

  - Previously, an incorrectly initialized variable resulted     in a random value being stored in the variable that     holds the number of default ACLs, and is sent in the     SET_PATH_INFO data structure. Consequently, the setfacl     command could, under certain circumstances, fail with an     'Invalid argument' error. With this update, the variable     is correctly initialized to zero, thus fixing the bug.

The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system.
(CVE-2014-8159, Important)

* A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system. (CVE-2014-7822, Moderate)

* A flaw was found in the way the Linux kernel's netfilter subsystem handled generic protocol tracking. As demonstrated in the Stream Control Transmission Protocol (SCTP) case, a remote attacker could use this flaw to bypass intended iptables rule restrictions when the associated connection tracking module was not loaded on the system.
(CVE-2014-8160, Moderate)

* It was found that the fix for CVE-2014-3601 was incomplete: the Linux kernel's kvm_iommu_map_pages() function still handled IOMMU mapping failures incorrectly. A privileged user in a guest with an assigned host device could use this flaw to crash the host.
(CVE-2014-8369, Moderate)

Red Hat would like to thank Mellanox for reporting CVE-2014-8159, and Akira Fujita of NEC for reporting CVE-2014-7822.

Bug fixes :

* The maximum amount of entries in the IPv6 route table (net.ipv6.route.max_size) was 4096, and every route towards this maximum size limit was counted. Communication to more systems was impossible when the limit was exceeded. Now, only cached routes are counted, which guarantees that the kernel does not run out of memory, but the user can now install as many routes as the memory allows until the kernel indicates it can no longer handle the amount of memory and returns an error message.

In addition, the default 'net.ipv6.route.max_size' value has been increased to 16384 for performance improvement reasons. (BZ#1177581)

* When the user attempted to scan for an FCOE-served Logical Unit Number (LUN), after an initial LUN scan, a kernel panic occurred in bnx2fc_init_task. System scanning for LUNs is now stable after LUNs have been added. (BZ#1179098)

* Under certain conditions, such as when attempting to scan the network for LUNs, a race condition in the bnx2fc driver could trigger a kernel panic in bnx2fc_init_task. A patch fixing a locking issue that caused the race condition has been applied, and scanning the network for LUNs no longer leads to a kernel panic. (BZ#1179098)

* Previously, it was not possible to boot the kernel on Xen hypervisor in PVHVM mode if more than 32 vCPUs were specified in the guest configuration. Support for more than 32 vCPUs has been added, and the kernel now boots successfully in the described situation. (BZ#1179343)

* When the NVMe driver allocated a namespace queue, it indicated that it was a request-based driver when it was actually a block I/O-based driver. Consequently, when NVMe driver was loaded along with a request-based dm device, the system could terminate unexpectedly or become unresponsive when attempting to access data. The NVMe driver no longer sets the QUEUE_FLAG_STACKABLE bit when allocating a namespace queue and device-mapper no longer perceives NVMe driver as request-based; system hangs or crashes no longer occur. (BZ#1180555)

* If a user attempted to apply an NVRAM firmware update when running the tg3 module provided with Red Hat Enterprise Linux 6.6 kernels, the update could fail. As a consequence, the Network Interface Card (NIC) could stay in an unusable state and this could prevent the entire system from booting. The tg3 module has been updated to correctly apply firmware updates. (BZ#1182903)

* Support for key sizes of 256 and 192 bits has been added to AES-NI.
(BZ#1184332)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation.

  - CVE-2013-7421 / CVE-2014-9644     It was discovered that the Crypto API allowed     unprivileged users to load arbitrary kernel modules. A     local user can use this flaw to exploit vulnerabilities     in modules that would not normally be loaded.

  - CVE-2014-7822     Akira Fujita found that the splice() system call did not     validate the given file offset and length. A local     unprivileged user can use this flaw to cause filesystem     corruption on ext4 filesystems, or possibly other     effects.

  - CVE-2014-8160     Florian Westphal discovered that a netfilter     (iptables/ip6tables) rule accepting packets to a     specific SCTP, DCCP, GRE or UDPlite port/endpoint could     result in incorrect connection tracking state. If only     the generic connection tracking module (nf_conntrack)     was loaded, and not the protocol-specific connection     tracking module, this would allow access to any     port/endpoint of the specified protocol.

  - CVE-2014-8559     It was found that kernel functions that iterate over a     directory tree can dead-lock or live-lock in case some     of the directory entries were recently deleted or     dropped from the cache. A local unprivileged user can     use this flaw for denial of service.

  - CVE-2014-9585     Andy Lutomirski discovered that address randomisation     for the vDSO in 64-bit processes is extremely biased. A     local unprivileged user could potentially use this flaw     to bypass the ASLR protection mechanism.

  - CVE-2014-9683     Dmitry Chernenkov discovered that eCryptfs writes past     the end of the allocated buffer during encrypted     filename decoding, resulting in local denial of service.

  - CVE-2015-0239     It was found that KVM did not correctly emulate the x86     SYSENTER instruction. An unprivileged user within a     guest system that has not enabled SYSENTER, for example     because the emulated CPU vendor is AMD, could     potentially use this flaw to cause a denial of service     or privilege escalation in that guest.

  - CVE-2015-1420     It was discovered that the open_by_handle_at() system     call reads the handle size from user memory a second     time after validating it. A local user with the     CAP_DAC_READ_SEARCH capability could use this flaw for     privilege escalation.

  - CVE-2015-1421     It was found that the SCTP implementation could free an     authentication state while it was still in use,     resulting in heap corruption. This could allow remote     users to cause a denial of service or privilege     escalation.

  - CVE-2015-1593     It was found that address randomisation for the initial     stack in 64-bit processes was limited to 20 rather than     22 bits of entropy. A local unprivileged user could     potentially use this flaw to bypass the ASLR protection     mechanism.

This update fixes the CVEs described below.

A further issue, CVE-2014-9419, was considered, but appears to require extensive changes with a consequent high risk of regression. It is now unlikely to be fixed in squeeze-lts.

CVE-2013-6885

It was discovered that under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang on AMD 16h 00h through 0Fh processors. A local user can use this flaw to mount a denial of service (system hang) via a crafted application.

For more information please refer to the AMD CPU erratum 793 in http://support.amd.com/TechDocs/51810_16h_00h-0Fh_Rev_Guide.
pdf

CVE-2014-7822

It was found that the splice() system call did not validate the given file offset and length. A local unprivileged user can use this flaw to cause filesystem corruption on ext4 filesystems, or possibly other effects.

CVE-2014-8133

It was found that the espfix functionality can be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks for) and using it for stack. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8134

It was found that the espfix functionality is wrongly disabled in a 32-bit KVM guest. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8160

It was found that a netfilter (iptables or ip6tables) rule accepting packets to a specific SCTP, DCCP, GRE or UDPlite port/endpoint could result in incorrect connection tracking state. If only the generic connection tracking module (nf_conntrack) was loaded, and not the protocol-specific connection tracking module, this would allow access to any port/endpoint of the specified protocol.

CVE-2014-9420

It was found that the ISO-9660 filesystem implementation (isofs) follows arbitrarily long chains, including loops, of Continuation Entries (CEs). This allows local users to mount a denial of service via a crafted disc image.

CVE-2014-9584

It was found that the ISO-9660 filesystem implementation (isofs) does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted disc image.

CVE-2014-9585

It was discovered that address randomisation for the vDSO in 64-bit processes is extremely biassed. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

CVE-2015-1421

It was found that the SCTP implementation could free authentication state while it was still in use, resulting in heap corruption. This could allow remote users to cause a denial of service or privilege escalation.

CVE-2015-1593

It was found that address randomisation for the initial stack in 64-bit processes was limited to 20 rather than 22 bits of entropy. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001031 advisory.

    The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not     enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of     service (system crash) or possibly have unspecified other impact via a crafted splice system call, as     demonstrated by use of a file descriptor associated with an ext4 filesystem.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
81089	CentOS 7 : kernel (CESA-2015:0102)	Nessus	CentOS Local Security Checks	2015/1/30	2021/1/4	high
251999	Linux Distros Unpatched Vulnerability : CVE-2014-7822	Nessus	Misc.	2025/8/19	2026/7/17	high
81322	Amazon Linux AMI : kernel (ALAS-2015-476)	Nessus	Amazon Linux Local Security Checks	2015/2/13	2018/4/18	high
289957	MiracleLinux 4 : kernel-2.6.32-504.12.2.el6 (AXSA:2015-106:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/19	high
81291	RHEL 5 : kernel (RHSA-2015:0164)	Nessus	Red Hat Local Security Checks	2015/2/11	2019/10/24	high
82070	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2543-1)	Nessus	Ubuntu Local Security Checks	2015/3/25	2021/1/19	high
81308	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20150210)	Nessus	Scientific Linux Local Security Checks	2015/2/12	2021/1/14	high
81769	RHEL 6 : kernel (RHSA-2015:0674)	Nessus	Red Hat Local Security Checks	2015/3/12	2021/2/5	high
81449	Debian DSA-3170-1 : linux - security update	Nessus	Debian Local Security Checks	2015/2/24	2021/1/11	critical
82138	Debian DLA-155-1 : linux-2.6 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	critical
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/4/3	2025/12/26	critical
290358	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001031)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

critical

critical

critical

high