The SUSE Linux Enterprise 11 SP4 kernel was updated to fix the following security bug :

  - CVE-2017-2636: A race condition in the n_hdlc tty Linux     kernel driver (drivers/tty/n_hdlc.c) could have been     exploited to gain a local privilege escalation     (bnc#1027565)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - Race condition in drivers/tty/n_hdlc.c in the Linux     kernel through 4.10.1 allows local users to gain     privileges or cause a denial of service (double free)     by setting the HDLC line discipline.

  - Kernel crash in cgroup_show_path() while running rkt in     a container.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.
(CVE-2017-2636, Important)

* A flaw was found in the Linux kernel's implementation of seq_file where a local attacker could manipulate memory in the put() function pointer. This could lead to memory corruption and possible privileged escalation. (CVE-2016-7910, Moderate)

Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636.

Bug Fix(es) :

* Previously, Chelsio firmware included an incorrectly-formatted firmware bin file. As a consequence, the firmware could not be flashed. This update provides a firmware bin file that is formatted correctly. As a result, Chelsio firmware can now be flashed successfully. (BZ#1433865)

* When multiple simultaneous processes attempted to read from the /proc/stat file, spinlock overhead was generated on Non-Uniform Memory Access (NUMA) systems. Consequently, a large amount of CPU was consumed. With this update, the underlying source code has been fixed to avoid taking spinlock when the interrupt line does not exist. As a result, the spinlock overhead is now generated less often, and multiple simultaneous processes can now read /proc/stat without consuming a large amount of CPU. (BZ#1428106)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0931 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that     can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device     could use this flaw to increase their privileges on the system. (CVE-2017-2636, Important)

    * A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the     kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA     key. This flaw panics the machine during the verification of the RSA key. (CVE-2016-8650, Moderate)

    * A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE     setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create     a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory     allocations and create situations where the system could crash or cause memory corruption. (CVE-2016-9793,     Moderate)

    * A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files.
    An empty (null) write to this file can crash the system by causing the system to attempt to access     unmapped kernel memory. (CVE-2017-2618, Moderate)

    Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636 and Ralf Spenneberg for reporting     CVE-2016-8650. The CVE-2017-2618 issue was discovered by Paul Moore (Red Hat Engineering).

    Bug Fix(es):

    * Previously, a cgroups data structure was sometimes corrupted due to a race condition in the kernel-rt     cgroups code. Consequently, several system tasks were blocked, and the operating system became     unresponsive. This update adds a lock that prevents the race condition. As a result, the cgroups data     structure no longer gets corrupted and the operating system no longer hangs under the described     circumstances. (BZ#1420784)

    * The kernel-rt packages have been upgraded to the 3.10.0-514.16.1 source tree, which provides a number of     bug fixes over the previous version. (BZ#1430749)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A race condition flaw was found in the N_HLDC Linux     kernel driver when accessing n_hdlc.tbuf list that can     lead to double free. A local, unprivileged user able to     set the HDLC line discipline on the tty device could use     this flaw to increase their privileges on the system.
    (CVE-2017-2636, Important)

  - A flaw was found in the Linux kernel key management     subsystem in which a local attacker could crash the     kernel or corrupt the stack and additional memory     (denial of service) by supplying a specially crafted RSA     key. This flaw panics the machine during the     verification of the RSA key. (CVE-2016-8650, Moderate)

  - A flaw was found in the Linux kernel's implementation of     setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt()     system call. Users with non- namespace CAP_NET_ADMIN are     able to trigger this call and create a situation in     which the sockets sendbuff data size could be negative.
    This could adversely affect memory allocations and     create situations where the system could crash or cause     memory corruption. (CVE-2016-9793, Moderate)

  - A flaw was found in the Linux kernel's handling of     clearing SELinux attributes on /proc/pid/attr files. An     empty (null) write to this file can crash the system by     causing the system to attempt to access unmapped kernel     memory. (CVE-2017-2618, Moderate)

An update for kernel is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.
(CVE-2017-2636, Important)

Red Hat would like to thank Alexander Popov for reporting this issue.

According to the version of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Race condition in drivers/tty/n_hdlc.c in the Linux     kernel through 4.10.1 allows local users to gain     privileges or cause a denial of service (double free)     by setting the HDLC line discipline.(CVE-2017-2636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3533 advisory.

    - Revert 'x86/mm: Expand the exception table logic to allow new handling options' (Brian Maly)  [Orabug:
    25790387]  {CVE-2016-9644}
    - Revert 'fix minor infoleak in get_user_ex()' (Brian Maly)  [Orabug: 25790387]  {CVE-2016-9644}
    - x86/mm: Expand the exception table logic to allow new handling options (Tony Luck)  [Orabug: 25790387]     {CVE-2016-9644}
    - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766898]  {CVE-2016-8399}     {CVE-2016-8399}
    - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765436]     {CVE-2016-10088}
    - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751984]  {CVE-2017-7187}
    - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696677]  {CVE-2017-2636}
    - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696677]  {CVE-2017-2636}
    - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451520]  {CVE-2016-8633}
    - usbnet: cleanup after bind() in probe() (Oliver Neukum)  [Orabug: 25463898]  {CVE-2016-3951}
    - cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind (Bjorn Mork)  [Orabug: 25463898]     {CVE-2016-3951}
    - cdc_ncm: Add support for moving NDP to end of NCM frame (Enrico Mioso)  [Orabug: 25463898]     {CVE-2016-3951}
    - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463918]     {CVE-2016-3672}
    - kvm: fix page struct leak in handle_vmon (Paolo Bonzini)  [Orabug: 25507133]  {CVE-2017-2596}
    - crypto: mcryptd - Check mcryptd algorithm compatibility (tim)  [Orabug: 25507153]  {CVE-2016-10147}
    - kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (Jim Mattson)  [Orabug: 25507188]     {CVE-2016-9588}
    - KVM: x86: drop error recovery in em_jmp_far and em_ret_far (Radim Krcmar)  [Orabug: 25507213]     {CVE-2016-9756}
    - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507226]  {CVE-2016-8645}
    - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507226]  {CVE-2016-8645}
    - tipc: check minimum bearer MTU (Michal Kubecek)  [Orabug: 25507239]  {CVE-2016-8632} {CVE-2016-8632}
    - fix minor infoleak in get_user_ex() (Al Viro)  [Orabug: 25507269]  {CVE-2016-9178}
    - scsi: arcmsr: Simplify user_len checking (Borislav Petkov)  [Orabug: 25507319]  {CVE-2016-7425}
    - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507319]     {CVE-2016-7425}
    - tmpfs: clear S_ISGID when setting posix ACLs (Gu Zheng)  [Orabug: 25507341]  {CVE-2016-7097}     {CVE-2016-7097}
    - posix_acl: Clear SGID bit when setting file permissions (Jan Kara)  [Orabug: 25507341]  {CVE-2016-7097}     {CVE-2016-7097}
    - ext2: convert to mbcache2 (Jan Kara)  [Orabug: 25512366]  {CVE-2015-8952}
    - ext4: convert to mbcache2 (Jan Kara)  [Orabug: 25512366]  {CVE-2015-8952}
    - mbcache2: reimplement mbcache (Jan Kara)  [Orabug: 25512366]  {CVE-2015-8952}
    - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512466]     {CVE-2016-3140}
    - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682419]  {CVE-2017-6345}
    - ipv4: keep skb->dst around in presence of IP options (Eric Dumazet)  [Orabug: 25698300]  {CVE-2017-5970}
    - perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race (Peter Zijlstra)  [Orabug:
    25698751]  {CVE-2017-6001}
    - ip6_gre: fix ip6gre_err() invalid reads (Eric Dumazet)  [Orabug: 25699015]  {CVE-2017-5897}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
99180	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:0912-1)	Nessus	SuSE Local Security Checks	2017/4/4	2025/12/26	high
99315	Virtuozzo 7 : readykernel-patch (VZA-2017-028)	Nessus	Virtuozzo Local Security Checks	2017/4/13	2025/12/26	high
99316	CentOS 6 : kernel (CESA-2017:0892)	Nessus	CentOS Local Security Checks	2017/4/13	2025/12/26	high
99338	RHEL 6 : kernel (RHSA-2017:0892)	Nessus	Red Hat Local Security Checks	2017/4/13	2025/12/25	high
99344	RHEL 7 : kernel-rt (RHSA-2017:0931)	Nessus	Red Hat Local Security Checks	2017/4/13	2024/11/4	high
99351	Scientific Linux Security Update : kernel on SL7.x x86_64 (20170412)	Nessus	Scientific Linux Local Security Checks	2017/4/13	2025/12/25	high
99453	RHEL 6 : kernel (RHSA-2017:0986)	Nessus	Red Hat Local Security Checks	2017/4/19	2025/12/25	high
99913	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1066)	Nessus	Huawei Local Security Checks	2017/5/2	2025/12/22	high
99159	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3533)	Nessus	Oracle Linux Local Security Checks	2017/4/3	2026/2/9	critical

検出

プラグインの検索

high

high

high

high

high

high

high

high

critical