The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an     OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service     (system crash) via a rename system call, related to fs/namei.c and fs/open.c. (CVE-2016-6198)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2574 advisory.

    - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Larry Woodman) [1385124] {CVE-2016-5195}
    - [net] add recursion limit to GRO (Sabrina Dubroca) [1374191] {CVE-2016-7039}
    - [kernel] audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore) [1359306]     {CVE-2016-6136}
    - [scsi] aacraid: Check size values after double-fetch from user (Maurizio Lombardi) [1369771]     {CVE-2016-6480}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. (CVE-2016-3841, Important)

* Several Moderate and Low impact security issues were found in the Linux kernel. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-4312, CVE-2015-8374, CVE-2015-8543, CVE-2015-8812, CVE-2015-8844, CVE-2015-8845, CVE-2016-2053, CVE-2016-2069, CVE-2016-2847, CVE-2016-3156, CVE-2016-4581, CVE-2016-4794, CVE-2016-5412, CVE-2016-5828, CVE-2016-5829, CVE-2016-6136, CVE-2016-6198, CVE-2016-6327, CVE-2016-6480, CVE-2015-8746, CVE-2015-8956, CVE-2016-2117, CVE-2016-2384, CVE-2016-3070, CVE-2016-3699, CVE-2016-4569, CVE-2016-4578)

Red Hat would like to thank Philip Pettersson (Samsung) for reporting CVE-2016-2053; Tetsuo Handa for reporting CVE-2016-2847; the Virtuozzo kernel team and Solar Designer (Openwall) for reporting CVE-2016-3156;
Justin Yackoski (Cryptonite) for reporting CVE-2016-2117; and Linn Crosetto (HP) for reporting CVE-2016-3699. The CVE-2015-8812 issue was discovered by Venkatesh Pottem (Red Hat Engineering); the CVE-2015-8844 and CVE-2015-8845 issues were discovered by Miroslav Vadkerti (Red Hat Engineering); the CVE-2016-4581 issue was discovered by Eric W. Biederman (Red Hat); the CVE-2016-6198 issue was discovered by CAI Qian (Red Hat); and the CVE-2016-3070 issue was discovered by Jan Stancek (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3587 advisory.

    - vfs: rename: check backing inode being equal (Miklos Szeredi)  [Orabug: 24010060]  {CVE-2016-6198}     {CVE-2016-6197}
    - vfs: add vfs_select_inode() helper (Miklos Szeredi)  [Orabug: 24010060]  {CVE-2016-6198} {CVE-2016-6197}
    - ovl: verify upper dentry before unlink and rename (Miklos Szeredi)  [Orabug: 24010060]  {CVE-2016-6198}     {CVE-2016-6197}
    - ovl: fix getcwd() failure after unsuccessful rmdir (Rui Wang)  [Orabug: 24010060]  {CVE-2016-6198}     {CVE-2016-6197}
    - atl2: Disable unimplemented scatter/gather feature (Ben Hutchings)  [Orabug: 23704078]  {CVE-2016-2117}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - vfs: rename: check backing inode being equal (Miklos     Szeredi) [Orabug: 24010060] (CVE-2016-6198)     (CVE-2016-6197)

  - vfs: add vfs_select_inode helper (Miklos Szeredi)     [Orabug: 24010060] (CVE-2016-6198) (CVE-2016-6197)

  - ovl: verify upper dentry before unlink and rename     (Miklos Szeredi) [Orabug: 24010060] (CVE-2016-6198)     (CVE-2016-6197)

  - ovl: fix getcwd failure after unsuccessful rmdir (Rui     Wang) [Orabug: 24010060] (CVE-2016-6198) (CVE-2016-6197)

  - xen: use same main loop for counting and remapping pages     (Juergen Gross) [Orabug: 24012238]

  - Revert 'ocfs2: bump up o2cb network protocol version'     (Junxiao Bi) 

  - atl2: Disable unimplemented scatter/gather feature (Ben     Hutchings) [Orabug: 23704078] (CVE-2016-2117)

  - Revert 'perf tools: Bump default sample freq to 4 kHz'     (ashok.vairavan) [Orabug: 23634802]

  - block: Initialize max_dev_sectors to 0 (Keith Busch)     [Orabug: 23333444]

  - sd: Fix rw_max for devices that report an optimal xfer     size (Martin K. Petersen) [Orabug: 23333444]

  - sd: Fix excessive capacity printing on devices with     blocks bigger than 512 bytes (Martin K. Petersen)     [Orabug: 23333444]

  - sd: Optimal I/O size is in bytes, not sectors (Martin K.
    Petersen) 

  - sd: Reject optimal transfer length smaller than page     size (Martin K. Petersen) [Orabug: 23333444]

  - Fix kabi issue for upstream commit ca369d51 (Joe Jin)     [Orabug: 23333444]

  - block/sd: Fix device-imposed transfer length limits (Joe     Jin)

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A security flaw was found in the Linux kernel in the mark_source_chains() function in 'net/ipv4/netfilter/ip_tables.c'. It is possible for a user-supplied 'ipt_entry' structure to have a large 'next_offset' field. This field is not bounds checked prior to writing to a counter value at the supplied offset. (CVE-2016-3134, Important)

* A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitrary kernel memory when unloading a kernel module. This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS and the user is granted elevated privileges. (CVE-2016-4997, Important)

* An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments. (CVE-2016-4998, Moderate)

Bug Fix(es) :

* In some cases, running the ipmitool command caused a kernel panic due to a race condition in the ipmi message handler. This update fixes the race condition, and the kernel panic no longer occurs in the described scenario. (BZ#1353947)

* Previously, running I/O-intensive operations in some cases caused the system to terminate unexpectedly after a NULL pointer dereference in the kernel. With this update, a set of patches has been applied to the 3w-9xxx and 3w-sas drivers that fix this bug. As a result, the system no longer crashes in the described scenario. (BZ#1362040)

* Previously, the Stream Control Transmission Protocol (SCTP) sockets did not inherit the SELinux labels properly. As a consequence, the sockets were labeled with the unlabeled_t SELinux type which caused SCTP connections to fail. The underlying source code has been modified, and SCTP connections now works as expected. (BZ#1354302)

* Previously, the bnx2x driver waited for transmission completions when recovering from a parity event, which substantially increased the recovery time. With this update, bnx2x does not wait for transmission completion in the described circumstances. As a result, the recovery of bnx2x after a parity event now takes less time. (BZ#1351972)

Enhancement(s) :

* With this update, the audit subsystem enables filtering of processes by name besides filtering by PID. Users can now audit by executable name (with the '-F exe=' option), which allows expression of many new audit rules. This functionality can be used to create events when specific applications perform a syscall. (BZ#1345774)

* With this update, the Nonvolatile Memory Express (NVMe) and the multi-queue block layer (blk_mq) have been upgraded to the Linux 4.5 upstream version. Previously, a race condition between timeout and freeing request in blk_mq occurred, which could affect the blk_mq_tag_to_rq() function and consequently a kernel oops could occur. The provided patch fixes this race condition by updating the tags with the active request. The patch simplifies blk_mq_tag_to_rq() and ensures that the two requests are not active at the same time.
(BZ#1350352)

* The Hyper-V storage driver (storvsc) has been upgraded from upstream. This update provides moderate performance improvement of I/O operations when using storvscr for certain workloads. (BZ#1360161)

Additional Changes :

Space precludes documenting all of the bug fixes and enhancements included in this advisory. To see the complete list of bug fixes and enhancements, refer to the following KnowledgeBase article:
https://access.redhat.com/articles/2592321

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1135:09 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any     Linux operating system.  The kernel handles the basic functions     of the operating system: memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2013-4312     The Linux kernel before 4.4.1 allows local users to bypass     file-descriptor limits and cause a denial of service (memory     consumption) by sending each descriptor over a UNIX socket before     closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
    CVE-2015-8374     fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles     compressed inline extents, which allows local users to obtain     sensitive pre-truncation information from a file via a clone action.
    CVE-2015-8543     The networking implementation in the Linux kernel through 4.3.3, as     used in Android and other products, does not validate protocol     identifiers for certain protocol families, which allows local users to     cause a denial of service (NULL function pointer dereference and     system crash) or possibly gain privileges by leveraging CLONE_NEWUSER     support to execute a crafted SOCK_RAW application.
    CVE-2015-8746     fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2     does not properly initialize memory for migration recovery operations,     which allows remote NFS servers to cause a denial of service (NULL     pointer dereference and panic) via crafted network traffic.
    CVE-2015-8812     drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5     does not properly identify error conditions, which allows remote     attackers to execute arbitrary code or cause a denial of service     (use-after-free) via crafted packets.
    CVE-2015-8844     The signal implementation in the Linux kernel before 4.3.5 on powerpc     platforms does not check for an MSR with both the S and T bits set,     which allows local users to cause a denial of service (TM Bad Thing     exception and panic) via a crafted application.
    CVE-2015-8845     The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the     Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM     suspend mode exists before proceeding with a tm_reclaim call, which     allows local users to cause a denial of service (TM Bad Thing     exception and panic) via a crafted application.
    CVE-2015-8956     The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the     Linux kernel before 4.2 allows local users to obtain sensitive     information or cause a denial of service (NULL pointer dereference)     via vectors involving a bind system call on a Bluetooth RFCOMM socket.
    CVE-2016-2053     The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux     kernel before 4.3 allows attackers to cause a denial of service     (panic) via an ASN.1 BER file that lacks a public key, leading to     mishandling by the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c.
    CVE-2016-2069     Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1     allows local users to gain privileges by triggering access to a paging     structure by a different CPU.
    CVE-2016-2117     The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in     the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O,     which allows remote attackers to obtain sensitive information from     kernel memory by reading packet data.
    CVE-2016-2384     Double free vulnerability in the snd_usbmidi_create function in     sound/usb/midi.c in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (panic) or possibly     have unspecified other impact via vectors involving an invalid USB     descriptor.
    CVE-2016-2847     fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of     unread data in pipes, which allows local users to cause a denial of     service (memory consumption) by creating many pipes with non-default     sizes.
    CVE-2016-3070     The trace_writeback_dirty_page implementation in     include/trace/events/writeback.h in the Linux kernel before 4.4     improperly interacts with mm/migrate.c, which allows local users to     cause a denial of service (NULL pointer dereference and system crash)     or possibly have unspecified other impact by triggering a certain page     move.
    CVE-2016-3156     The IPv4 implementation in the Linux kernel before 4.5.2 mishandles     destruction of device objects, which allows guest OS users to cause a     denial of service (host OS networking outage) by arranging for a large     number of IP addresses.
    CVE-2016-3699     The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat     Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows     local users to bypass intended Secure Boot restrictions and execute     untrusted code by appending ACPI tables to the initrd.
    CVE-2016-3841     The IPv6 stack in the Linux kernel before 4.3.3 mishandles options     data, which allows local users to gain privileges or cause a denial of     service (use-after-free and system crash) via a crafted sendmsg system     call.
    CVE-2016-4569     The snd_timer_user_params function in sound/core/timer.c in the Linux     kernel through 4.6 does not initialize a certain data structure, which     allows local users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface.
    CVE-2016-4578     sound/core/timer.c in the Linux kernel through 4.6 does not initialize     certain r1 data structures, which allows local users to obtain     sensitive information from kernel stack memory via crafted use of the     ALSA timer interface, related to the (1) snd_timer_user_ccallback and     (2) snd_timer_user_tinterrupt functions.
    CVE-2016-4581     fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse     a mount propagation tree in a certain case involving a slave mount,     which allows local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted series of mount system calls.
    CVE-2016-4794     Use-after-free vulnerability in mm/percpu.c in the Linux kernel     through 4.6 allows local users to cause a denial of service (BUG) or     possibly have unspecified other impact via crafted use of the mmap and     bpf system calls.
    CVE-2016-5412     arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through     4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled,     allows guest OS users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence of a suspended     transaction.
    CVE-2016-5828     The start_thread function in arch/powerpc/kernel/process.c in the     Linux kernel through 4.6.3 on powerpc platforms mishandles     transactional state, which allows local users to cause a denial of     service (invalid process state or TM Bad Thing exception, and system     crash) or possibly have unspecified other impact by starting and     suspending a transaction before an exec system call.
    CVE-2016-5829     Multiple heap-based buffer overflows in the hiddev_ioctl_usage     function in drivers/hid/usbhid/hiddev.c in the Linux kernel through     4.6.3 allow local users to cause a denial of service or possibly have     unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2)     HIDIOCSUSAGES ioctl call.
    CVE-2016-6136     Race condition in the audit_log_single_execve_arg function in     kernel/auditsc.c in the Linux kernel through 4.7 allows local users to     bypass intended character-set restrictions or disrupt system-call     auditing by changing a certain string, aka a double fetch     vulnerability.
    CVE-2016-6198     The filesystem layer in the Linux kernel before 4.5.5 proceeds with     post-rename operations after an OverlayFS file is renamed to a     self-hardlink, which allows local users to cause a denial of service     (system crash) via a rename system call, related to fs/namei.c and     fs/open.c.
    CVE-2016-6327     drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1     allows local users to cause a denial of service (NULL pointer     dereference and system crash) by using an ABORT_TASK command to abort     a device write operation.
    CVE-2016-6480     Race condition in the ioctl_send_fib function in     drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows     local users to cause a denial of service (out-of-bounds access or     system crash) by changing a certain size value, aka a double fetch     vulnerability.
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
246037	Linux Distros Unpatched Vulnerability : CVE-2016-6198	Nessus	Misc.	2025/8/8	2026/7/17	medium
94697	Oracle Linux 7 : kernel (ELSA-2016-2574)	Nessus	Oracle Linux Local Security Checks	2016/11/11	2026/2/9	critical
95321	CentOS 7 : kernel (CESA-2016:2574)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	critical
92656	Oracle Linux 6 / 7 : kernel-uek (ELSA-2016-3587)	Nessus	Oracle Linux Local Security Checks	2016/8/1	2026/2/9	high
92658	OracleVM 3.4 : kernel-uek (OVMSA-2016-0091)	Nessus	OracleVM Local Security Checks	2016/8/1	2026/1/29	high
93555	RHEL 7 : kernel (RHSA-2016:1847)	Nessus	Red Hat Local Security Checks	2016/9/16	2026/1/23	high
289409	MiracleLinux 7 : kernel-3.10.0-514.el7 (AXSA:2016-1135:09)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/9	critical

偵測

搜尋 Plugin

medium

critical

critical

high

high

high

critical