Multiple vulnerabilities has been found and corrected in the Linux kernel :

The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application (CVE-2013-4483).

The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with IPIP encapsulation (CVE-2013-4348).

The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c (CVE-2013-4470).

The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test (CVE-2013-2015).

net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet (CVE-2013-4387).

The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network (CVE-2013-4350).

The updated packages provides a solution for these security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3046 advisory.

    - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin)  [Orabug: 19229497]     {CVE-2014-4943} {CVE-2014-4943}
    - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo)  [Orabug: 19230689]  {CVE-2014-4699}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3049 advisory.

    - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin)  [Orabug: 19229497]     {CVE-2014-4943} {CVE-2014-4943}
    - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo)  [Orabug: 19230689]  {CVE-2014-4699}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000734 advisory.

    The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote     attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with     IPIP encapsulation.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 3.11.7 stable update contains a number of important fixes across the tree Various bug and CVE fixes The 3.11.6 stable update contains a number of fixes across the tree. The 3.11.5 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2929)

Dave Jones and Vince Weaver reported a flaw in the Linux kernel's per event subsystem that allows normal users to enable function tracing.
An unprivileged local user could exploit this flaw to obtain potentially sensitive information from the kernel. (CVE-2013-2930)

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. (CVE-2013-4345)

Jason Wang discovered a bug in the network flow dissector in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (infinite loop). (CVE-2013-4348)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a buffer overflow in the Ozmo Devices USB over WiFi devices. A local user could exploit this flaw to cause a denial of service or possibly unspecified impact.
(CVE-2013-4513)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for the SystemBase Multi-2/PCI serial card. An unprivileged user could obtain sensitive information from kernel memory.
(CVE-2013-4516)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

Nico Golde and Fabian Yamaguchi reported a flaw in the driver for Adaptec AACRAID scsi raid devices in the Linux kernel. A local user could use this flaw to cause a denial of service or possibly other unspecified impact. (CVE-2013-6380)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

A race condition flaw was discovered in the Linux kernel's ipc shared memory implementation. A local user could exploit this flaw to cause a denial of service (system crash) or possibly have unspecied other impacts. (CVE-2013-7026).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The NFSv2 and NFSv3 server implementations in the Linux     kernel through 4.10.13 lacked certain checks for the     end of a buffer. A remote attacker could trigger a     pointer-arithmetic error or possibly cause other     unspecified impacts using crafted requests related to     fs/nfsd/nfs3xdr.c and     fs/nfsd/nfsxdr.c.(CVE-2017-7895i1/4%0

  - A flaw was found in the Linux kernel's ACPI subsystem     where a function does not flush the operand cache and     causes a kernel stack dump. This allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism when using a     specially crafted ACPI table.(CVE-2017-13695i1/4%0

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649i1/4%0

  - Race condition in kernel/ucount.c in the Linux kernel     through 4.10.2 allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via crafted system calls     that leverage certain decrement behavior that causes     incorrect interaction between put_ucounts and     get_ucounts.(CVE-2017-6874i1/4%0

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7825i1/4%0

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial     of service (uninitialized-memory free and kernel crash)     or have an unspecified other impact by executing a     crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable.(CVE-2017-17805i1/4%0

  - The msm_ipc_router_bind_control_port function in     net/ipc_router/ipc_router_core.c in the IPC router     kernel module for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, does not verify     that a port is a client port, which allows attackers to     gain privileges or cause a denial of service (race     condition and list corruption) by making many     BIND_CONTROL_PORT ioctl calls.(CVE-2016-2059i1/4%0

  - The do_remount function in fs/namespace.c in the Linux     kernel through 3.16.1 does not maintain the     MNT_LOCK_READONLY bit across a remount of a bind mount,     which allows local users to bypass an intended     read-only restriction and defeat certain sandbox     protection mechanisms via a 'mount -o remount' command     within a user namespace.(CVE-2014-5206i1/4%0

  - The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2185i1/4%0

  - It was found that the fix for CVE-2014-3601 was     incomplete: the Linux kernel's kvm_iommu_map_pages()     function still handled IOMMU mapping failures     incorrectly. A privileged user in a guest with an     assigned host device could use this flaw to crash the     host.(CVE-2014-8369i1/4%0

  - A NULL pointer dereference was found in     net/rds/rdma.c:__rds_rdma_map() function in the Linux     kernel allowing local attackers to cause a system panic     and a denial-of-service.(CVE-2018-7492i1/4%0

  - An issue was discovered in the XFS filesystem in     fs/xfs/xfs_icache.c in the Linux kernel. There is a     NULL pointer dereference leading to a system panic in     lookup_slow() on a NULL inode-i1/4zi_ops pointer when     doing pathwalks on a corrupted xfs image. This occurs     because of a lack of proper validation that cached     inodes are free during an allocation.(CVE-2018-13093i1/4%0

  - The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device     descriptor.(CVE-2016-2188i1/4%0

  - Linux kernel built with the 802.1Q/802.1ad     VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local     Area Network(CONFIG_VXLAN) with Transparent Ethernet     Bridging(TEB) GRO support, is vulnerable to a stack     overflow issue. It could occur while receiving large     packets via GRO path, as an unlimited recursion could     unfold in both VLAN and TEB modules, leading to a stack     corruption in the kernel.(CVE-2016-7039i1/4%0

  - The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in     the Linux kernel before 4.6.1 supports MSR 0x2f8, which     allows guest OS users to read or write to the     kvm_arch_vcpu data structure, and consequently obtain     sensitive information or cause a denial of service     (system crash), via a crafted ioctl     call.(CVE-2016-3713i1/4%0

  - A flaw was found in the way the Linux kernel's VFS     subsystem handled reference counting when performing     unmount operations on symbolic links. A local,     unprivileged user could use this flaw to exhaust all     available memory on the system or, potentially, trigger     a use-after-free error, resulting in a system crash or     privilege escalation.(CVE-2014-5045i1/4%0

  - The KEYS subsystem in the Linux kernel before 4.13.10     does not correctly synchronize the actions of updating     versus finding a key in the 'negative' state to avoid a     race condition, which allows local users to cause a     denial of service or possibly have unspecified other     impact via crafted system calls.(CVE-2017-15951i1/4%0

  - The skb_flow_dissect function in     net/core/flow_dissector.c in the Linux kernel through     3.12 allows remote attackers to cause a denial of     service (infinite loop) via a small value in the IHL     field of a packet with IPIP     encapsulation.(CVE-2013-4348i1/4%0

  - The Linux kernel through 3.17.4 does not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allows local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c.(CVE-2014-8989i1/4%0

  - An infinite-loop flaw was found in the kernel. When a     local user calls the sys_writev syscall with a     specially crafted sequence of iov structs, the     fuse_fill_write_pages kernel function might never     terminate, instead continuing in a tight loop. This     process cannot be terminated and requires a     reboot.(CVE-2015-8785i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel was updated to fix various bugs and security issues :

  - mm/page-writeback.c: do not count anon pages as     dirtyable memory (reclaim stalls).

  - mm/page-writeback.c: fix dirty_balance_reserve     subtraction from dirtyable memory (reclaim stalls).

  - compat_sys_recvmmsg X32 fix (bnc#860993 CVE-2014-0038).

  - hwmon: (coretemp) Fix truncated name of alarm attributes

  - net: fib: fib6_add: fix potential NULL pointer     dereference (bnc#854173 CVE-2013-6431).

  - keys: fix race with concurrent install_user_keyrings()     (bnc#808358)(CVE-2013-1792).

  - KVM: x86: Convert vapic synchronization to _cached     functions (CVE-2013-6368) (bnc#853052 CVE-2013-6368).

  - wireless: radiotap: fix parsing buffer overrun     (bnc#854634 CVE-2013-7027).

  - KVM: x86: fix guest-initiated crash with x2apic     (CVE-2013-6376) (bnc#853053 CVE-2013-6376).

  - KVM: x86: Fix potential divide by 0 in lapic     (CVE-2013-6367) (bnc#853051 CVE-2013-6367).

  - KVM: Improve create VCPU parameter (CVE-2013-4587)     (bnc#853050 CVE-2013-4587).

  - staging: ozwpan: prevent overflow in oz_cdev_write()     (bnc#849023 CVE-2013-4513).

  - perf/x86: Fix offcore_rsp valid mask for SNB/IVB     (bnc#825006).

  - perf/x86: Add Intel IvyBridge event scheduling     constraints (bnc#825006).

  - libertas: potential oops in debugfs (bnc#852559     CVE-2013-6378).

  - aacraid: prevent invalid pointer dereference (bnc#852373     CVE-2013-6380).

  - staging: wlags49_h2: buffer overflow setting station     name (bnc#849029 CVE-2013-4514).

  - net: flow_dissector: fail on evil iph->ihl (bnc#848079     CVE-2013-4348).

  - Staging: bcm: info leak in ioctl (bnc#849034     CVE-2013-4515).

  - Refresh     patches.fixes/net-rework-recvmsg-handler-msg_name-and-ms     g_namelen-logic.patch.

  - ipv6: remove max_addresses check from     ipv6_create_tempaddr (bnc#805226, CVE-2013-0343).

  - net: rework recvmsg handler msg_name and msg_namelen     logic (bnc#854722).

  - crypto: ansi_cprng - Fix off by one error in non-block     size request (bnc#840226).

  - x6: Fix reserve_initrd so that acpi_initrd_override is     reached (bnc#831836).

  - Refresh other Xen patches.

  - aacraid: missing capable() check in compat ioctl     (bnc#852558).

  -     patches.fixes/gpio-ich-fix-ichx_gpio_check_available-ret     urn.patch: Update upstream reference

  - perf/ftrace: Fix paranoid level for enabling function     tracer (bnc#849362).

  - xhci: fix NULL pointer dereference on     ring_doorbell_for_active_rings (bnc#848255).

  - xhci: Fix oops happening after address device timeout     (bnc#848255).

  - xhci: Ensure a command structure points to the correct     trb on the command ring (bnc#848255).

  -     patches.arch/iommu-vt-d-remove-stack-trace-from-broken-i     rq-remapping-warning.patch: Update upstream reference.

  - Allow NFSv4 username mapping to work properly     (bnc#838024).

  - Refresh btrfs attribute publishing patchset to match     openSUSE-13.1 No user-visible changes, but uses     kobj_sysfs_ops and better kobject lifetime management.

  - Fix a few incorrectly checked [io_]remap_pfn_range()     calls (bnc#849021, CVE-2013-4511).

  - drm/radeon: don't set hpd, afmt interrupts when     interrupts are disabled.

  -     patches.fixes/cifs-fill-TRANS2_QUERY_FILE_INFO-ByteCount
    -fields.patch: Fix TRANS2_QUERY_FILE_INFO ByteCount     fields (bnc#804950).

  - iommu: Remove stack trace from broken irq remapping     warning (bnc#844513).

  - Disable patches related to bnc#840656     patches.suse/btrfs-cleanup-don-t-check-the-same-thing-tw     ice     patches.suse/btrfs-0220-fix-for-patch-cleanup-don-t-chec     k-the-same-thi.patch

  - btrfs: use feature attribute names to print better error     messages.

  - btrfs: add ability to change features via sysfs.

  - btrfs: add publishing of unknown features in sysfs.

  - btrfs: publish per-super features to sysfs.

  - btrfs: add per-super attributes to sysfs.

  - btrfs: export supported featured to sysfs.

  - kobject: introduce kobj_completion.

  - btrfs: add ioctls to query/change feature bits online.

  - btrfs: use btrfs_commit_transaction when setting     fslabel.

  - x86/iommu/vt-d: Expand interrupt remapping quirk to     cover x58 chipset (bnc#844513).

  - NFSv4: Fix issues in nfs4_discover_server_trunking     (bnc#811746).

  - iommu/vt-d: add quirk for broken interrupt remapping on     55XX chipsets (bnc#844513).

ID	名稱	產品	系列	已發布	已更新	嚴重性
70837	Mandriva Linux Security Advisory : kernel (MDVSA-2013:265)	Nessus	Mandriva Local Security Checks	2013/11/11	2021/1/6	high
76601	Oracle Linux 6 : unbreakable enterprise kernel (ELSA-2014-3046)	Nessus	Oracle Linux Local Security Checks	2014/7/20	2026/2/9	high
76781	Oracle Linux 7 : unbreakable enterprise kernel (ELSA-2014-3049)	Nessus	Oracle Linux Local Security Checks	2014/7/25	2026/2/9	high
290610	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000734)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
70862	Fedora 18 : kernel-3.11.7-100.fc18 (2013-20748)	Nessus	Fedora Local Security Checks	2013/11/13	2021/1/11	high
71799	Ubuntu 13.10 : linux vulnerabilities (USN-2075-1)	Nessus	Ubuntu Local Security Checks	2014/1/5	2023/4/7	high
124974	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1521)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
75251	openSUSE Security Update : kernel (openSUSE-SU-2014:0204-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high

偵測

搜尋 Plugin

high

high

high

high

high

high

critical

high