The remote OracleVM system is missing necessary patches to address critical security updates :

  - HID: hiddev: validate num_values for HIDIOCGUSAGES,     HIDIOCSUSAGES commands (Scott Bauer) [Orabug: 24803597]     (CVE-2016-5829)

  - ocfs2: Fix start offset to ocfs2_zero_range_for_truncate     (Ashish Samant) [Orabug: 24790230]

  - ocfs2: Fix double put of recount tree in     ocfs2_lock_refcount_tree (Ashish Samant) [Orabug:
    24691860]

  - megaraid_sas: Don't issue kill adapter for MFI     controllers in case of PD list DCMD failure (Sumit     Saxena) [Orabug: 24506797]

  - netfilter: x_tables: speed up jump target validation     (Florian Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: enforce nul-terminated table name     from getsockopt GET_ENTRIES (Pablo Neira Ayuso) [Orabug:
    24691226] (CVE-2016-3134)

  - netfilter: remove unused comefrom hookmask argument     (Florian Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: introduce and use     xt_copy_counters_from_user (Florian Westphal) [Orabug:
    24691226] (CVE-2016-3134)

  - netfilter: x_tables: do compat validation via     translate_table (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: x_tables: xt_compat_match_from_user doesn't     need a retval (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: ip6_tables: simplify translate_compat_table     args (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: ip_tables: simplify translate_compat_table     args (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: arp_tables: simplify translate_compat_table     args (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: x_tables: don't reject valid target size on     some architectures (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: x_tables: validate all offsets and sizes in a     rule (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: x_tables: check for bogus target offset     (Florian Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: check standard target size too     (Florian Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: add compat version of     xt_check_entry_offsets (Florian Westphal) [Orabug:
    24691226] (CVE-2016-3134)

  - netfilter: x_tables: assert minimum target size (Florian     Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: kill check_entry helper (Florian     Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: add and use xt_check_entry_offsets     (Florian Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: validate targets of jumps (Florian     Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: fix unconditional helper (Florian     Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: validate targets of jumps (Florian     Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: don't move to non-existent next     rule (Florian Westphal) [Orabug: 24691226]     (CVE-2016-3134)

  - netfilter: x_tables: fix unconditional helper (Florian     Westphal) [Orabug: 24691226] (CVE-2016-3134)

  - netfilter: x_tables: check for size overflow (Florian     Westphal) [Orabug: 24691226] (CVE-2016-3134)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2014-9904     It was discovered that the snd_compress_check_input     function used in the ALSA subsystem does not properly     check for an integer overflow, allowing a local user to     cause a denial of service.

  - CVE-2016-5728     Pengfei Wang discovered a race condition in the MIC VOP     driver that could allow a local user to obtain sensitive     information from kernel memory or cause a denial of     service.

  - CVE-2016-5828     Cyril Bur and Michael Ellerman discovered a flaw in the     handling of Transactional Memory on powerpc systems     allowing a local user to cause a denial of service     (kernel crash) or possibly have unspecified other     impact, by starting a transaction, suspending it, and     then calling any of the exec() class system calls.

  - CVE-2016-5829     A heap-based buffer overflow vulnerability was found in     the hiddev driver, allowing a local user to cause a     denial of service or, potentially escalate their     privileges.

  - CVE-2016-6130     Pengfei Wang discovered a flaw in the S/390 character     device drivers potentially leading to information leak     with /dev/sclp.

Additionally this update fixes a regression in the ebtables facility (#828914) that was introduced in DSA-3607-1.

The openSUSE Leap 42.1 was updated to 4.1.27 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2016-4997: A buffer overflow in 32bit     compat_setsockopt iptables handling could lead to a     local privilege escalation. (bsc#986362)

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allow     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755).

  - CVE-2016-4794: Use-after-free vulnerability in     mm/percpu.c in the Linux kernel allowed local users to     cause a denial of service (BUG) or possibly have     unspecified other impact via crafted use of the mmap and     bpf system calls (bnc#980265).

The following non-security bugs were fixed :

  - Refresh patches.xen/xen-netback-coalesce: Restore     copying of SKBs with head exceeding page size     (bsc#978469).

  - Refresh patches.xen/xen3-patch-2.6.26 (fix PAT     initialization).

  - Refresh patches.xen/xen3-patch-2.6.39 (fix ia32_compat     inheritance).

  - Refresh patches.xen/xen3-patch-3.14: Suppress atomic     file position updates for /proc/xen/xenbus (bsc#970275).

  - Refresh patches.xen/xen3-patch-3.16 (drop redundant     addition of a comment).

  - Refresh patches.xen/xen3-patch-4.1.7-8.

  - base: make module_create_drivers_dir race-free     (bnc#983977).

  - ipvs: count pre-established TCP states as active     (bsc#970114).

  - net: thunderx: Fix TL4 configuration for secondary Qsets     (bsc#986530).

  - net: thunderx: Fix link status reporting (bsc#986530).

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.62 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2014-9904: The snd_compress_check_input function in     sound/core/compress_offload.c in the ALSA subsystem in     the Linux kernel did not properly check for an integer     overflow, which allowed local users to cause a denial of     service (insufficient memory allocation) or possibly     have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl call (bnc#986811).

  - CVE-2015-7833: The usbvision driver in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (panic) via a nonzero bInterfaceNumber value     in a USB device descriptor (bnc#950998).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8845: The tm_reclaim_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms did not ensure that TM suspend mode     exists before proceeding with a tm_reclaim call, which     allowed local users to cause a denial of service (TM Bad     Thing exception and panic) via a crafted application     (bnc#975533).

  - CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in     the Linux kernel allowed local users to gain privileges     via crafted ASN.1 data (bnc#979867).

  - CVE-2016-1583: The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (stack memory consumption) via vectors involving crafted     mmap calls for /proc pathnames, leading to recursive     pagefault handling (bsc#983143).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-3672: The arch_pick_mmap_layout function in     arch/x86/mm/mmap.c in the Linux kernel did not properly     randomize the legacy base address, which made it easier     for local users to defeat the intended restrictions on     the ADDR_NO_RANDOMIZE flag, and bypass the ASLR     protection mechanism for a setuid or setgid program, by     disabling stack-consumption resource limits     (bnc#974308).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bsc#978401).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relied on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bsc#979213).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (memory corruption) by leveraging     in-container root access to provide a crafted offset     value that triggers an unintended decrement     (bsc#986362).

  - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging     in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary     (bsc#986365).

  - CVE-2016-5244: The rds_inc_info_copy function in     net/rds/recv.c in the Linux kernel did not initialize a     certain structure member, which allowed remote attackers     to obtain sensitive information from kernel stack memory     by reading an RDS message (bnc#983213).

  - CVE-2016-5828: The start_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms mishandled transactional state, which     allowed local users to cause a denial of service     (invalid process state or TM Bad Thing exception, and     system crash) or possibly have unspecified other impact     by starting and suspending a transaction an exec system     call (bsc#986569).

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allowed     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

USN-3071-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS.

Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel memory. (CVE-2016-5244)

Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content into an TCP stream. (CVE-2016-5696)

Pengfei Wang discovered a race condition in the MIC VOP driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or obtain potentially sensitive information from kernel memory. (CVE-2016-5728)

Cyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled transactional memory state on exec(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-5828)

It was discovered that a heap based buffer overflow existed in the USB HID driver in the Linux kernel. A local attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2016-5829).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3070-3 advisory.

    A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw     to gain access to any file by setting an ACL. (CVE-2016-1237)

    Kangjie Lu discovered an information leak in the Reliable Datagram Sockets (RDS) implementation in the     Linux kernel. A local attacker could use this to obtain potentially sensitive information from kernel     memory. (CVE-2016-5244)

    James Patrick-Evans discovered that the airspy USB device driver in the Linux kernel did not properly     handle certain error conditions. An attacker with physical access could use this to cause a denial of     service (memory consumption). (CVE-2016-5400)

    Yue Cao et al discovered a flaw in the TCP implementation's handling of challenge acks in the Linux     kernel. A remote attacker could use this to cause a denial of service (reset connection) or inject content     into an TCP stream. (CVE-2016-5696)

    Pengfei Wang discovered a race condition in the MIC VOP driver in the Linux kernel. A local attacker could     use this to cause a denial of service (system crash) or obtain potentially sensitive information from     kernel memory. (CVE-2016-5728)

    Cyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled transactional memory state on     exec(). A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2016-5828)

    It was discovered that a heap based buffer overflow existed in the USB HID driver in the Linux kernel. A     local attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2016-5829)

    It was discovered that the OverlayFS implementation in the Linux kernel did not properly verify dentry     state before proceeding with unlink and rename operations. A local attacker could use this to cause a     denial of service (system crash). (CVE-2016-6197)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
93907	OracleVM 3.4 : Unbreakable / etc (OVMSA-2016-0138)	Nessus	OracleVM Local Security Checks	2016/10/7	2026/1/22	high
91927	Debian DSA-3616-1 : linux - security update	Nessus	Debian Local Security Checks	2016/7/5	2021/1/11	high
92308	openSUSE Security Update : the Linux Kernel (openSUSE-2016-869)	Nessus	SuSE Local Security Checks	2016/7/15	2026/2/2	high
93299	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2105-1)	Nessus	SuSE Local Security Checks	2016/9/2	2026/1/27	high
95321	CentOS 7 : kernel (CESA-2016:2574)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	critical
93219	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3071-2)	Nessus	Ubuntu Local Security Checks	2016/8/30	2026/1/27	high
93242	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3070-3)	Nessus	Ubuntu Local Security Checks	2016/8/31	2024/8/27	high

検出

プラグインの検索

high

high

high

high

critical

high

high