The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2226-1 advisory.

  - drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not     properly validate packet lengths, which allows guest OS users to cause a denial of service (memory     corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to     the handle_rx and get_rx_bufs functions. (CVE-2014-0077)

  - The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly     handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger     kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

  - The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not     properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows     local users to obtain sensitive information from kernel heap memory by leveraging write access to a     /dev/fd device. (CVE-2014-1738)

  - The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq     context, allows local guest administrators to cause a denial of service (scheduling while atomic error     and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the     interface. (CVE-2014-2580)

  - Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1     allows local users to cause a denial of service (use-after-free and system crash) or possibly gain     privileges via a crafted application that leverages an improperly managed reference counter.
    (CVE-2014-2851)

  - The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel     before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of     service (filesystem corruption, and OOPS or panic) via operations on directories that have hash     collisions, as demonstrated by rmdir operations. (CVE-2014-7283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free vulnerability was found in DCCP socket     code affecting the Linux kernel since 2.6.16. This     vulnerability could allow an attacker to their escalate     privileges.(CVE-2017-8824i1/4%0

  - The OZWPAN driver in the Linux kernel through 4.0.5     relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash)     via a crafted packet.(CVE-2015-4004i1/4%0

  - Integer signedness error in the MSM V4L2 video driver     for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to gain     privileges or cause a denial of service (array overflow     and memory corruption) via a crafted application that     triggers an msm_isp_axi_create_stream     call.(CVE-2016-2061i1/4%0

  - A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system     crash.(CVE-2014-7283i1/4%0

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636i1/4%0

  - Incorrect buffer length handling was found in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in     the Linux kernel, which could be exploited by malicious     NCPFS servers to crash the kernel or possibly execute     an arbitrary code.(CVE-2018-8822i1/4%0

  - ** DISPUTED ** Kernel Samepage Merging (KSM) in the     Linux kernel 2.6.32 through 4.x does not prevent use of     a write-timing side channel, which allows guest OS     users to defeat the ASLR protection mechanism on other     guest OS instances via a Cross-VM ASL INtrospection     (CAIN) attack. NOTE: the vendor states 'Basically if     you care about this attack vector, disable     deduplication.' Share-until-written approaches for     memory conservation among mutually untrusting tenants     are inherently detectable for information disclosure,     and can be classified as potentially misunderstood     behaviors rather than vulnerabilities.(CVE-2015-2877i1/4%0

  - The tty_set_termios_ldisc() function in     'drivers/tty/tty_ldisc.c' in the Linux kernel before     4.5 allows local users to obtain sensitive information     from kernel memory by reading a tty data     structure.(CVE-2015-8964i1/4%0

  - An issue was discovered in the Linux kernel through     4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same     user data twice with copy_from_user. The header part of     the user data is double-fetched, and a malicious user     thread can tamper with the critical variables     (hdr.size_in and hdr.size_out) in the header between     the two fetches because of a race condition, leading to     severe kernel errors, such as buffer over-accesses.
    This bug can cause a local denial of service and     information leakage.(CVE-2018-12633i1/4%0

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2018-1092i1/4%0

  - fs/f2fs/extent_cache.c in the Linux kernel, before     4.13, mishandles extent trees. This allows local users     to cause a denial of service via an application with     multiple threads.(CVE-2017-18193i1/4%0

  - A design flaw was found in the file extended attribute     handling of the Linux kernel's handling of cached     attributes. Too many entries in the cache cause a soft     lockup while attempting to iterate the cache and access     relevant locks.(CVE-2015-8952i1/4%0

  - Off-by-one error in the pipe_advance function in     lib/iov_iter.c in the Linux kernel before 4.9.5 allows     local users to obtain sensitive information from     uninitialized heap-memory locations in opportunistic     circumstances by reading from a pipe after an incorrect     buffer-release decision.(CVE-2017-5550i1/4%0

  - The HMAC implementation (crypto/hmac.c) in the Linux     kernel, before 4.14.8, does not validate that the     underlying cryptographic hash algorithm is unkeyed.
    This allows a local attacker, able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3), to cause a kernel stack     buffer overflow by executing a crafted sequence of     system calls that encounter a missing SHA-3     initialization.(CVE-2017-17806i1/4%0

  - The mp_get_count function in     drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel     before 3.12 does not initialize a certain data     structure, which allows local users to obtain sensitive     information from kernel stack memory via a TIOCGICOUNT     ioctl call.(CVE-2013-4516i1/4%0

  - The perf_cpu_time_max_percent_handler function in     kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service     (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an     incorrect sample-rate calculation.(CVE-2017-18255i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when     mounting a crafted btrfs image could lead to a system     crash and a denial of service.(CVE-2018-14609i1/4%0

  - The oz_usb_handle_ep_data function in     drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 allows remote     attackers to cause a denial of service (divide-by-zero     error and system crash) via a crafted     packet.(CVE-2015-4003i1/4%0

  - drivers/hid/hid-logitech-dj.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows     physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) or obtain     sensitive information from kernel memory via a crafted     device.(CVE-2013-2895i1/4%0

  - drivers/usb/serial/cypress_m8.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions.(CVE-2016-3137i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

3 つのセキュリティ問題と複数のバグを修正し、様々な強化を追加する更新済みの kernel-rt パッケージが、Red Hat Enterprise MRG 2.5 で現在利用可能です。

Red Hat 製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度中として評価しています。詳細な重要度の評価を提供する Common Vulnerability Scoring System （CVSS）のベーススコアが、「参照」セクションの CVE リンクの各脆弱性に対して利用可能です。

kernel-rt パッケージには Linux オペレーティングシステムのコアである Linux カーネルが含まれています。

Linux カーネルの XFS ファイルシステム実装が、特定の状況でディレクトリのハッシュを順番付けする方法で、サービス拒否の欠陥が見つかりました。ローカルの攻撃者が、この欠陥を利用して、相反するハッシュ値でディレクトリを作成することにより、ファイルシステムを破損し、システムクラッシュを引き起こす可能性があります。（CVE-2014-7283、重要度中）

Linux カーネルの perf サブシステムの syscall トレース機能に、領域外メモリアクセスの欠陥が見つかりました。ローカルの権限のないユーザーがこの欠陥を悪用して、システムをクラッシュさせることが可能でした。
（CVE-2014-7825、重要度中）

Linux カーネルの ftrace サブシステムの syscall トレース機能に、領域外メモリアクセスの欠陥が見つかりました。ftrace syscall トレースが有効なシステムで、ローカルの権限のないユーザーがこの欠陥を利用して、システムをクラッシュさせたり、権限を昇格する可能性があります。
（CVE-2014-7826、重要度中）

Red Hat は、CVE-2014-7825 および CVE-2014-7826 を報告してくれた Robert Święcki 氏に感謝の意を表します。

kernel-rt パッケージが、Upstream バージョン 3.10.58 にアップグレードされています。これにより、以前のバージョンに対する多数のバグ修正と拡張機能が提供されます。（BZ#1158105）

この更新は以下のバグも修正します：

* 優先度の低いスレッドで自動 NUMA バランシングを行うことにより、同じプロセスで実行されている優先度の高いスレッドでメモリコンテンションが引き起こされる可能性があります。
このコンテンションにより、システムで貧弱なリアルタイムパフォーマンスが発生する可能性があります。
この潜在的なメモリコンテンションを回避するために、MRG Realtime カーネルは現在、NUMA_BALANCING_DEFAULT_ENABLED を無効にしています。（BZ#1158940）

* バグを追跡するときに、WARN*() 関数が、リングバッファをフラッドし、トレースを役に立たないものにしたり、リングバッファをオーバーフローしたりする可能性があります。この問題に対処するために、カーネルコマンドラインに traceoff_on_warning オプションが sysctl オプションとして追加されました。このオプションは、警告メッセージのリングバッファへの書き込みを無効にし、デバッギングのトレースをクリーンにします。（BZ#1155200）

また、この更新は以下の拡張機能も追加します：

* XHCI（USB 3）のサポートが、MRG Realtime カーネルで現在有効にされています。
（BZ#1134095）

kernel-rt の全ユーザーは、これらの更新済みパッケージへアップグレードし、これらの問題を修正し、これらの拡張機能を追加することが推奨されます。この更新を有効にするには、システムを再起動する必要があります。

リモートの Ubuntu 14.04 LTS ホストには、USN-2226-1のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  -3.13.10より前のLinuxカーネルで、drivers/vhost/net.cは、マージ可能なバッファが無効な場合、パケットの長さを適切に検証しません。これにより、ゲストOSのユーザーは、細工されたパケットを通じて、サービス拒否（メモリ破損およびホストOSのクラッシュ）を引き起こしたり、ホストOSで権限を取得したりすることができます。これは、handle_rx関数とget_rx_bufs関数に関連します。（CVE-2014-0077）

  -FDRAWCMD ioctl呼び出しの処理中、3.14.3までのLinuxカーネルでdrivers/block/floppy.c 内のraw_cmd_copyin関数が、エラー状態を適切に処理しません。これにより、ローカルユーザーが kfree操作をトリガーし、/dev/fdデバイスへの書き込みを利用して権限を取得することができます。（CVE-2014-1737）

  -FDRAWCMD ioctl呼び出しの処理中、3.14.3までのLinuxカーネルにおいて drivers/block/floppy.c 内のraw_cmd_copyout関数は特定のポインターへのアクセスを適切に制限しません。これにより、ローカルユーザーが /dev/fdデバイスへの書き込みアクセスを利用して、カーネルヒープメモリから機密情報を取得する可能性があります。（CVE-2014-1738）

  - Xen の netback ドライバーは、softirq コンテキストでのスリープを許可しない特定の Linux バージョンを使用すると、ローカルゲスト管理者が無効な形式のパケットを送信し、サービス拒否攻撃 (atomic エラーとホストクラッシュによるスケジューリング) を引き起こす可能性があります。これにより、インターフェースを無効にしようとする際にミューテックスが取得される可能性があります。(CVE-2014-2580)

  -3.14.1 までのLinuxカーネルにおいて、net/ipv4/ping.c 内のping_init_sock関数での整数オーバーフローにより、ローカルユーザーは、不適切に管理されている参照カウンターを利用する細工されたアプリケーションを通じて、サービス拒否（use-after-freeとシステムクラッシュ）を引き起こしたり、権限を取得したりする可能性があります。
    (CVE-2014-2851)

  - 3.14.2 以前の Linux カーネルの XFS 実装における fs/xfs/xfs_da_btree.c の xfs_da3_fixhashpath 関数は、btree ハッシュ値を適切に比較しません。これにより、ハッシュ衝突があるディレクトリに対する操作 (rmdir 操作など) によって、ローカルユーザーがサービス拒否 (ファイルシステムの破損、OOPS またはパニック) を引き起こす可能性があります。(CVE-2014-7283)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

更新后的 kernel-rt 程序包修复了三个安全问题和多个缺陷，并添加了多种增强，现在可用于 Red Hat Enterprise MRG 2.5。

Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

kernel-rt 程序包包含 Linux 内核，后者是任何 Linux 操作系统的核心。

在 Linux 内核的 XFS 文件系统于某些情况下实现有序的目录哈希的方式中发现拒绝服务缺陷。本地攻击者可利用此缺陷，以冲突的哈希值创建目录来损坏文件系统，从而导致系统崩溃。（CVE-2014-7283，中危）

在 Linux 内核的 perf 子系统的 syscall 跟踪功能中发现一个越界内存访问缺陷。本地非特权用户可利用此缺陷导致系统崩溃。
（CVE-2014-7825，中危）

在 Linux 内核的 ftrace 子系统的 syscall 跟踪功能中发现一个越界内存访问缺陷。在启用 ftrace syscall 跟踪功能的系统上，本地非特权用户可以利用该缺陷使系统崩溃或升级其权限。
（CVE-2014-7826，中危）

Red Hat 在此感谢 Robert Święcki 报告 CVE-2014-7825 和 CVE-2014-7826。

kernel-rt 程序包已升级到上游版本 3.10.58，其提供对之前版本的多项缺陷补丁和增强。(BZ#1158105)

此更新还修复以下缺陷：

* 低优先级线程上的自动 NUMA 平衡可造成与同一进程中运行的高优先级线程争用内存。
这种争用可触发系统的实时性能差。
为避免此潜在内存争用，MRG Realtime 内核现在禁用 NUMA_BALANCING_DEFAULT_ENABLED。(BZ#1158940)

* 在跟踪错误时，WARN*() 函数可淹没环缓冲区，造成跟踪无用甚至环缓冲区溢出。为解决此问题，traceoff_on_warning 选项已新增到内核命令行，并新增为 sysctl 选项。此选项禁止警告消息写入环缓冲区，造成用于调试的跟踪信息更清晰。(BZ#1155200)

此外，此更新还添加了以下增强：

* MRG Realtime 内核中现在启用了 XHCI (USB 3) 支持。
(BZ#1134095)

建议所有 kernel-rt 用户升级这些更新后的程序包，其中修正了这些问题并添加这些增强。必须重新启动系统才能使此更新生效。

現已提供適用於 Red Hat Enterprise MRG 2.5 的更新版 kernel-rt 套件，可修正三個安全性問題、數個錯誤，並新增多個增強功能。

Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可針對每個弱點從〈參照〉一節的 CVE 連結中取得常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

kernel-rt 套件中包含 Linux 核心，這是任何 Linux 作業系統的核心。

在特定情形下，Linux 核心的 XFS 檔案系統實作排序目錄雜湊的方式有一個拒絕服務瑕疵。本機攻擊者可利用此瑕疵，建立雜湊值衝突的目錄，造成檔案系統損毀，進而可能導致系統當機。(CVE-2014-7283，中等)

在 Linux 核心之 perf 子系統的系統呼叫追蹤功能中發現一個超出邊界記憶體存取瑕疵。無權限的本機使用者可利用此瑕疵使系統當機。
(CVE-2014-7825，中等)

在 Linux 核心之 ftrace 子系統的系統呼叫追蹤功能中發現一個超出邊界記憶體存取瑕疵。在已啟用 ftrace 系統呼叫追蹤功能的系統中，無權限的本機使用者可利用此瑕疵造成系統當機，或提升自己的權限。
(CVE-2014-7826，中等)

Red Hat 要感謝 Robert Święcki 報告 CVE-2014-7825 和 CVE-2014-7826。

kernel-rt 套件已升級至上游版本 3.10.58，相較於先前的版本，此版本提供數個錯誤修正與增強功能。(BZ#1158105)

此更新也可修正下列錯誤：

* 對低優先順序執行緒自動進行 NUMA 平衡，可造成與在同個處理程序中執行的高優先順序執行緒發生記憶體爭用。
此爭用情形可在系統上觸發不良的即時效能。
為避免這種潛在的記憶體爭用，MRG Realtime 核心現已停用 NUMA_BALANCING_DEFAULT_ENABLED。(BZ#1158940)

* 追蹤錯誤時，WARN*() 函式可使環緩衝區溢流，造成追蹤沒有效用或甚至使環緩衝區溢位。為解決此問題，traceoff_on_warning 選項已新增至核心命令行，且已新增為 sysctl 選項。此選項會將對環緩衝區的警告訊息寫入停用，讓針對除錯的追蹤變得更加乾淨。(BZ#1155200)

此外，此更新還新增了下列增強功能：

* 在 MRG Realtime 核心中現已啟用 XHCI (USB 3) 的支援。
(BZ#1134095)

建議所有 kernel-rt 使用者皆升級至這些更新版套件，其可更正這些問題並新增這些增強功能。必須重新啟動系統，此更新才會生效。

遠端 Ubuntu 14.04 LTS 主機上安裝的一個套件受到 USN-2226-1 公告中所提及的多個弱點影響。

  - 在 3.13.10 版之前的 Linux 核心中，當停用可合併緩衝區時，drivers/vhost/net.c 不會正確驗證封包長度，這會允許來賓 OS 使用者透過特製封包，引致拒絕服務 (記憶體損毀和主機 OS 當機) 或可能取得主機 OS 的特權；這其實與 handle_rx 和 get_rx_bufs 函式有關。(CVE-2014-0077)

  - 在 3.14.3 版及更早版本的 Linux 核心中，drivers/block/floppy.c 的 raw_cmd_copyin 函式在處理 FDRAWCMD ioctl 呼叫時不會正確處置錯誤情形，進而允許本機使用者利用 /dev/fd 裝置的寫入存取觸發 kfree 作業並取得特權。(CVE-2014-1737)

  - 在 3.14.3 版及更早版本的 Linux 核心中，drivers/block/floppy.c 的 raw_cmd_copyout 函式在處理 FDRAWCMD ioctl 呼叫期間不會正確限制特定指標的存取，進而允許本機使用者利用 /dev/fd 裝置的寫入存取，從核心堆積記憶體取得敏感資訊。(CVE-2014-1738)

  - Xen 中的 netback 驅動程式使用不允許在 softirq 內容中休眠的特定 Linux 版本時，允許本機來賓系統管理員透過格式錯誤的封包造成拒絕服務 (在 atomic 錯誤和主機當機時排程)，從而導致在嘗試停用介面時採取互斥 。(CVE-2014-2580)

  - 在　3.14.1 版及其之前版本的 Linux 核心中，net/ipv4/ping.c 之 ping_init_sock 函式內的整數溢位允許本機使用者透過利用不當管理之參照計數器的特製應用程式造成拒絕服務 (釋放後使用及系統當機)，或可能取得權限。
    (CVE-2014-2851)

  - 在 3.14.2 之前的 Linux 核心中，xfs 實作中 fs/xfs/xfs_da_btree.c 的 xfs_da3_fixhashpath 函式未正確比較 btree 雜湊值，進而允許本機使用者透過對存在雜湊衝突的目錄執行作業來造成拒絕服務 (檔案系統損毀，以及 OOPS 或不穩定) ，rmdir 作業即為一例。(CVE-2014-7283)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Ubuntu 14.04 LTS 主机上安装的一个程序包受到 USN-2226-1 公告中提及的多个漏洞影响。

  - 在禁用可合并缓冲区的情况下，在 3.13.10 之前的 Linux 内核中的 drivers/vhost/net.c 未正确验证数据包长度，从而允许客户机操作系统用户通过构建的数据包造成拒绝服务（内存损坏和主机操作系统崩溃）或可能获得主机操作系统上的权限，该漏洞与 handle_rx 和 get_rx_bufs 函数有关。(CVE-2014-0077)

  - 在 3.14.3 及之前的 Linux 内核中，drivers/block/floppy.c 中的 raw_cmd_copyin 函数在 FDRAWCMD ioctl 调用的处理期间未正确处理错误情况，这允许本地用户通过利用对 /dev/fd 设备的写入访问触发 kfree 操作并获取权限。(CVE-2014-1737)

  - 在 3.14.3 及之前的 Linux 内核中，drivers/block/floppy.c 中的 raw_cmd_copyout 函数在 FDRAWCMD ioctl 调用的处理期间未正确限制对某些指针的访问权限，这允许本地用户通过利用对 /dev/fd 设备的写入访问获得内核堆内存中的敏感信息。(CVE-2014-1738)

  - 如果使用某些不允许在 softirq 上下文中休眠的 Linux 版本，Xen 中的 netback 驱动程序会允许本地客户机管理员通过畸形数据包造成拒绝服务（调度时发生原子错误和主机崩溃），此问题会导致尝试禁用该接口时，互拆体被获取。(CVE-2014-2580)

  - 3.14.1 及之前版本的 Linux 内核的 net/ipv4/ping.c 的 ping_init_sock 函数中的整数溢出允许本地用户通过利用未正确管理的引用计数器的构建应用程序造成拒绝服务（释放后使用和系统崩溃）或可能获得权限。
    (CVE-2014-2851)

  - 在 3.14.2 之前的 Linux 内核中，xfs 实现的 fs/xfs/xfs_da_btree.c 中的 xfs_da3_fixhashpath 函数未正确比较 btree 哈希值，导致本地用户可以通过对存在哈希冲突的目录执行操作造成拒绝服务（文件系统损坏，以及 OOPS 或错误），rmdir 操作即为一例。(CVE-2014-7283)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A race condition flaw was found in the way the Linux     kernel's mmap(2), madvise(2), and fallocate(2) system     calls interacted with each other while operating on     virtual memory file system files. A local user could     use this flaw to cause a denial of     service.(CVE-2014-4171)

  - An information leak flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled access of the user control's     state. A local, privileged user could use this flaw to     leak kernel memory to user space.(CVE-2014-4652)

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4653)

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4654)

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4655)

  - An integer overflow flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4656)

  - An integer underflow flaw was found in the way the     Linux kernel's Stream Control Transmission Protocol     (SCTP) implementation processed certain COOKIE_ECHO     packets. By sending a specially crafted SCTP packet, a     remote attacker could use this flaw to prevent     legitimate connections to a particular SCTP server     socket to be made.(CVE-2014-4667)

  - 'It was found that the Linux kernel's ptrace subsystem     allowed a traced process' instruction pointer to be set     to a non-canonical memory address without forcing the     non-sysret code path when returning to user space. A     local, unprivileged user could use this flaw to crash     the system or, potentially, escalate their privileges     on the system.

  - Note: The CVE-2014-4699 issue only affected systems     using an Intel CPU.(CVE-2014-4699)'

  - A flaw was found in the way the pppol2tp_setsockopt()     and pppol2tp_getsockopt() functions in the Linux     kernel's PPP over L2TP implementation handled requests     with a non-SOL_PPPOL2TP socket option level. A local,     unprivileged user could use this flaw to escalate their     privileges on the system.(CVE-2014-4943)

  - A flaw was found in the way the Linux kernel's VFS     subsystem handled reference counting when performing     unmount operations on symbolic links. A local,     unprivileged user could use this flaw to exhaust all     available memory on the system or, potentially, trigger     a use-after-free error, resulting in a system crash or     privilege escalation.(CVE-2014-5045)

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's Stream Control Transmission Protocol     (SCTP) implementation handled simultaneous connections     between the same hosts. A remote attacker could use     this flaw to crash the system.(CVE-2014-5077)

  - It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a     specially crafted ISO image to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-5471)

  - It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a     specially crafted ISO image to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-5472)

  - A stack overflow flaw caused by infinite recursion was     found in the way the Linux kernel's Universal Disk     Format (UDF) file system implementation processed     indirect Information Control Blocks (ICBs). An attacker     with physical access to the system could use a     specially crafted UDF image to crash the     system.(CVE-2014-6410)

  - Buffer overflow in net/ceph/auth_x.c in Ceph, as used     in the Linux kernel before 3.16.3, allows remote     attackers to cause a denial of service (memory     corruption and panic) or possibly have unspecified     other impact via a long unencrypted auth     ticket.(CVE-2014-6416)

  - net/ceph/auth_x.c in Ceph, as used in the Linux kernel     before 3.16.3, does not properly consider the     possibility of kmalloc failure, which allows remote     attackers to cause a denial of service (system crash)     or possibly have unspecified other impact via a long     unencrypted auth ticket.(CVE-2014-6417)

  - net/ceph/auth_x.c in Ceph, as used in the Linux kernel     before 3.16.3, does not properly validate auth replies,     which allows remote attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact via crafted data from the IP address of a     Ceph Monitor.(CVE-2014-6418)

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's Common Internet File System (CIFS)     implementation handled mounting of file system shares.
    A remote attacker could use this flaw to crash a client     system that would mount a file system share from a     malicious server.(CVE-2014-7145)

  - A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system crash.(CVE-2014-7283)

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7825)

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7826)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel-rt packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

  * A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system crash. (CVE-2014-7283,     Moderate)

  * An out-of-bounds memory access flaw was found in the     syscall tracing functionality of the Linux kernel's perf     subsystem. A local, unprivileged user could use this     flaw to crash the system. (CVE-2014-7825, Moderate)

  * An out-of-bounds memory access flaw was found in the     syscall tracing functionality of the Linux kernel's     ftrace subsystem. On a system with ftrace syscall     tracing enabled, a local, unprivileged user could use     this flaw to crash the system, or escalate their     privileges. (CVE-2014-7826, Moderate)

The kernel-rt packages have been upgraded to upstream version 3.10.58, which provides a number of bug fixes and enhancements over the previous version. (BZ#1158105)

This update also fixes the following bugs :

  * Automatic NUMA balancing on a low priority thread could     cause memory contention with a high priority thread     running in the same process. This contention could     trigger poor real time performance on the system. In     order to avoid this potential memory contention, the MRG     Realtime kernel now disables     NUMA_BALANCING_DEFAULT_ENABLED. (BZ#1158940)

  * When tracing a bug, WARN*() functions could flood the     ring buffer making the trace useless or even overflowing     the ring buffer. To address this issue, a     traceoff_on_warning option was added to the kernel     command line and as a sysctl option. This option     disables the writing of the warning messages to the ring     buffer, which results in a cleaner trace for debugging.
    (BZ#1155200)

In addition, this update adds the following enhancement :

  * Support for XHCI (USB 3) is now enabled in the MRG     Realtime kernel. (BZ#1134095)

All kernel-rt users are advised to upgrade to these updated packages, which contain correct these issues and add these enhancements. The system must be rebooted for this update to take effect.

ID	名稱	產品	系列	已發布	已更新	嚴重性
74214	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/1/9	high
124800	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1476)	Nessus	Huawei Local Security Checks	2019/5/13	2022/5/20	high
79684	RHEL 6：kernel-rt（RHSA-2014:1943）	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium
74214	Ubuntu 14.04 LTS : Linux カーネル脆弱性 (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/1/9	high
79684	RHEL 6：kernel-rt (RHSA-2014:1943)	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium
79684	RHEL 6：kernel-rt (RHSA-2014:1943)	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium
74214	Ubuntu 14.04 LTS：Linux 核心弱點 (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/1/9	high
74214	Ubuntu 14.04 LTS：Linux 内核漏洞 (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/1/9	high
124805	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1481)	Nessus	Huawei Local Security Checks	2019/5/13	2021/2/19	high
79684	RHEL 6 : kernel-rt (RHSA-2014:1943)	Nessus	Red Hat Local Security Checks	2014/12/3	2021/1/14	medium

偵測

搜尋 Plugin

high

high

medium

high

medium

medium

high

high

high

medium