kernel is vulnerable to denial of service (DoS). The vulnerability exists as a missing initialization flaw was found in the bfa driver used by Brocade Fibre Channel Host Bus Adapters. A local, unprivileged user could use this flaw to cause a denial of service by reading a file in the "/sys/class/fc_host/host#/statistics/" directory.
{"ubuntucve": [{"lastseen": "2023-02-15T16:22:20", "description": "drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not\ninitialize a certain port data structure, which allows local users to cause\na denial of service (system crash) via read operations on an fc_host\nstatistics file.\n\n#### Bugs\n\n * <https://bugzilla.redhat.com/show_bug.cgi?id=661182>\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2010-12-29T00:00:00", "type": "ubuntucve", "title": "CVE-2010-4343", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.7, "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4343"], "modified": "2010-12-29T00:00:00", "id": "UB:CVE-2010-4343", "href": "https://ubuntu.com/security/CVE-2010-4343", "cvss": {"score": 4.7, "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"}}], "cve": [{"lastseen": "2023-02-13T06:39:04", "description": "drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2010-12-29T18:00:00", "type": "cve", "title": "CVE-2010-4343", "cwe": ["CWE-665"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.7, "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-4343"], "modified": "2023-02-13T04:28:00", "cpe": ["cpe:/o:vmware:esx:4.1", "cpe:/o:vmware:esx:4.0"], "id": "CVE-2010-4343", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4343", "cvss": {"score": 4.7, "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*", "cpe:2.3:o:vmware:esx:4.1:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2019-05-29T18:39:53", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-1080-2", "cvss3": {}, "published": "2011-03-07T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux-ec2 vulnerabilities USN-1080-2", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-3865", "CVE-2010-4346", "CVE-2010-4527", "CVE-2010-4649", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-4526", "CVE-2011-1044", "CVE-2010-4248", "CVE-2010-3880"], "modified": "2019-03-13T00:00:00", "id": "OPENVAS:1361412562310840601", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310840601", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_1080_2.nasl 14132 2019-03-13 09:25:59Z cfischer $\n#\n# Ubuntu Update for linux-ec2 vulnerabilities USN-1080-2\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-1080-2/\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.840601\");\n script_version(\"$Revision: 14132 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 10:25:59 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-07 06:45:55 +0100 (Mon, 07 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"USN\", value:\"1080-2\");\n script_cve_id(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4649\", \"CVE-2011-1044\");\n script_name(\"Ubuntu Update for linux-ec2 vulnerabilities USN-1080-2\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU10\\.04 LTS\");\n script_tag(name:\"summary\", value:\"Ubuntu Update for Linux kernel vulnerabilities USN-1080-2\");\n script_tag(name:\"affected\", value:\"linux-ec2 vulnerabilities on Ubuntu 10.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"USN-1080-1 fixed vulnerabilities in the Linux kernel. This update provides\n the corresponding updates for the Linux kernel for use with EC2.\n\n Original advisory details:\n\n Thomas Pollet discovered that the RDS network protocol did not check\n certain iovec buffers. A local attacker could exploit this to crash the\n system or possibly execute arbitrary code as the root user. (CVE-2010-3865)\n\n Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did\n not correctly clear kernel memory. A local attacker could exploit this to\n read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)\n\n Vasiliy Kulikov discovered that the Linux kernel sockets implementation did\n not properly initialize certain structures. A local attacker could exploit\n this to read kernel stack memory, leading to a loss of privacy.\n (CVE-2010-3876)\n\n Vasiliy Kulikov discovered that the TIPC interface did not correctly\n initialize certain structures. A local attacker could exploit this to read\n kernel stack memory, leading to a loss of privacy. (CVE-2010-3877)\n\n Nelson Elhage discovered that the Linux kernel IPv4 implementation did not\n properly audit certain bytecodes in netlink messages. A local attacker\n could exploit this to cause the kernel to hang, leading to a denial of\n service. (CVE-2010-3880)\n\n It was discovered that multithreaded exec did not handle CPU timers\n correctly. A local attacker could exploit this to crash the system, leading\n to a denial of service. (CVE-2010-4248)\n\n Krishna Gudipati discovered that the bfa adapter driver did not correctly\n initialize certain structures. A local attacker could read files in /sys to\n crash the system, leading to a denial of service. (CVE-2010-4343)\n\n Tavis Ormandy discovered that the install_special_mapping function could\n bypass the mmap_min_addr restriction. A local attacker could exploit this\n to mmap 4096 bytes below the mmap_min_addr area, possibly improving the\n chances of performing NULL pointer dereference attacks. (CVE-2010-4346)\n\n It was discovered that the ICMP stack did not correctly handle certain\n unreachable messages. If a remote attacker were able to acquire a socket\n lock, they could send specially crafted traffic that would crash the\n system, leading to a denial of service. (CVE-2010-4526)\n\n Dan Rosenberg discovered that the OSS subsystem did not handle name\n termination correctly. A local attacker could exploit this crash the system\n or gain root privileges. (CVE-2010-4527)\n\n Dan Carpenter discovered that the Infiniband driver did not correctly\n handle certain requests. A local user could exploit this to crash the\n system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-313-ec2\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-313-ec2\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-ec2-doc\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-ec2-source-2.6.32\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-313\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:39:45", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-1080-1", "cvss3": {}, "published": "2011-03-07T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux vulnerabilities USN-1080-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-3865", "CVE-2010-4346", "CVE-2010-4527", "CVE-2010-4649", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-4526", "CVE-2011-1044", "CVE-2010-4248", "CVE-2010-3880"], "modified": "2019-03-13T00:00:00", "id": "OPENVAS:1361412562310840600", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310840600", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_1080_1.nasl 14132 2019-03-13 09:25:59Z cfischer $\n#\n# Ubuntu Update for linux vulnerabilities USN-1080-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-1080-1/\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.840600\");\n script_version(\"$Revision: 14132 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 10:25:59 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-07 06:45:55 +0100 (Mon, 07 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"USN\", value:\"1080-1\");\n script_cve_id(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4649\", \"CVE-2011-1044\");\n script_name(\"Ubuntu Update for linux vulnerabilities USN-1080-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU10\\.04 LTS\");\n script_tag(name:\"summary\", value:\"Ubuntu Update for Linux kernel vulnerabilities USN-1080-1\");\n script_tag(name:\"affected\", value:\"linux vulnerabilities on Ubuntu 10.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"Thomas Pollet discovered that the RDS network protocol did not check\n certain iovec buffers. A local attacker could exploit this to crash the\n system or possibly execute arbitrary code as the root user. (CVE-2010-3865)\n\n Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did\n not correctly clear kernel memory. A local attacker could exploit this to\n read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)\n\n Vasiliy Kulikov discovered that the Linux kernel sockets implementation did\n not properly initialize certain structures. A local attacker could exploit\n this to read kernel stack memory, leading to a loss of privacy.\n (CVE-2010-3876)\n\n Vasiliy Kulikov discovered that the TIPC interface did not correctly\n initialize certain structures. A local attacker could exploit this to read\n kernel stack memory, leading to a loss of privacy. (CVE-2010-3877)\n\n Nelson Elhage discovered that the Linux kernel IPv4 implementation did not\n properly audit certain bytecodes in netlink messages. A local attacker\n could exploit this to cause the kernel to hang, leading to a denial of\n service. (CVE-2010-3880)\n\n It was discovered that multithreaded exec did not handle CPU timers\n correctly. A local attacker could exploit this to crash the system, leading\n to a denial of service. (CVE-2010-4248)\n\n Krishna Gudipati discovered that the bfa adapter driver did not correctly\n initialize certain structures. A local attacker could read files in /sys to\n crash the system, leading to a denial of service. (CVE-2010-4343)\n\n Tavis Ormandy discovered that the install_special_mapping function could\n bypass the mmap_min_addr restriction. A local attacker could exploit this\n to mmap 4096 bytes below the mmap_min_addr area, possibly improving the\n chances of performing NULL pointer dereference attacks. (CVE-2010-4346)\n\n It was discovered that the ICMP stack did not correctly handle certain\n unreachable messages. If a remote attacker were able to acquire a socket\n lock, they could send specially crafted traffic that would crash the\n system, leading to a denial of service. (CVE-2010-4526)\n\n Dan Rosenberg discovered that the OSS subsystem did not handle name\n termination correctly. A local attacker could exploit this crash the system\n or gain root privileges. (CVE-2010-4527)\n\n Dan Carpenter discovered that the Infiniband driver did not correctly\n handle certain requests. A local user could exploit this to crash the\n system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29-386\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29-generic-pae\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29-generic\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-386\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-generic-pae\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-generic\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-virtual\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-libc-dev\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-tools-2.6.32-29\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-doc\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-source-2.6.32\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-tools-common\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"block-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"block-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"char-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"char-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"crypto-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"crypto-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fat-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fat-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fb-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fb-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"firewire-core-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"firewire-core-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"floppy-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"floppy-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-core-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-core-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-secondary-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-secondary-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"input-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"input-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"irda-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"irda-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"kernel-image-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"kernel-image-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"md-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"md-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"message-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"message-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"mouse-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"mouse-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nfs-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nfs-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-pcmcia-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-pcmcia-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-shared-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-shared-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-usb-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-usb-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"parport-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"parport-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pata-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pata-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-storage-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-storage-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"plip-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"plip-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"ppp-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"ppp-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"sata-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"sata-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"scsi-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"scsi-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"serial-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"serial-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"squashfs-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"squashfs-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"storage-core-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"storage-core-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"usb-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"usb-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"virtio-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"virtio-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"vlan-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"vlan-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-12-04T11:27:25", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-1080-2", "cvss3": {}, "published": "2011-03-07T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux-ec2 vulnerabilities USN-1080-2", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-3865", "CVE-2010-4346", "CVE-2010-4527", "CVE-2010-4649", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-4526", "CVE-2011-1044", "CVE-2010-4248", "CVE-2010-3880"], "modified": "2017-12-01T00:00:00", "id": "OPENVAS:840601", "href": "http://plugins.openvas.org/nasl.php?oid=840601", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_1080_2.nasl 7964 2017-12-01 07:32:11Z santu $\n#\n# Ubuntu Update for linux-ec2 vulnerabilities USN-1080-2\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"USN-1080-1 fixed vulnerabilities in the Linux kernel. This update provides\n the corresponding updates for the Linux kernel for use with EC2.\n\n Original advisory details:\n \n Thomas Pollet discovered that the RDS network protocol did not check\n certain iovec buffers. A local attacker could exploit this to crash the\n system or possibly execute arbitrary code as the root user. (CVE-2010-3865)\n \n Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did\n not correctly clear kernel memory. A local attacker could exploit this to\n read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)\n \n Vasiliy Kulikov discovered that the Linux kernel sockets implementation did\n not properly initialize certain structures. A local attacker could exploit\n this to read kernel stack memory, leading to a loss of privacy.\n (CVE-2010-3876)\n \n Vasiliy Kulikov discovered that the TIPC interface did not correctly\n initialize certain structures. A local attacker could exploit this to read\n kernel stack memory, leading to a loss of privacy. (CVE-2010-3877)\n \n Nelson Elhage discovered that the Linux kernel IPv4 implementation did not\n properly audit certain bytecodes in netlink messages. A local attacker\n could exploit this to cause the kernel to hang, leading to a denial of\n service. (CVE-2010-3880)\n \n It was discovered that multithreaded exec did not handle CPU timers\n correctly. A local attacker could exploit this to crash the system, leading\n to a denial of service. (CVE-2010-4248)\n \n Krishna Gudipati discovered that the bfa adapter driver did not correctly\n initialize certain structures. A local attacker could read files in /sys to\n crash the system, leading to a denial of service. (CVE-2010-4343)\n \n Tavis Ormandy discovered that the install_special_mapping function could\n bypass the mmap_min_addr restriction. A local attacker could exploit this\n to mmap 4096 bytes below the mmap_min_addr area, possibly improving the\n chances of performing NULL pointer dereference attacks. (CVE-2010-4346)\n \n It was discovered that the ICMP stack did not correctly handle certain\n unreachable messages. If a remote attacker were able to acquire a socket\n lock, they could send specially crafted traffic that would crash the\n system, leading to a denial of service. (CVE-2010-4526)\n \n Dan Rosenberg discovered that the OSS subsystem did not handle name\n termination correctly. A local attacker could exploit this crash the system\n or gain root privileges. (CVE-2010-4527)\n \n Dan Carpenter discovered that the Infiniband driver did not correctly\n handle certain requests. A local user could exploit this to crash the\n system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-1080-2\";\ntag_affected = \"linux-ec2 vulnerabilities on Ubuntu 10.04 LTS\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-1080-2/\");\n script_id(840601);\n script_version(\"$Revision: 7964 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 08:32:11 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-07 06:45:55 +0100 (Mon, 07 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"USN\", value: \"1080-2\");\n script_cve_id(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4649\", \"CVE-2011-1044\");\n script_name(\"Ubuntu Update for linux-ec2 vulnerabilities USN-1080-2\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-313-ec2\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-313-ec2\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-ec2-doc\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-ec2-source-2.6.32\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-313\", ver:\"2.6.32-313.26\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-04T11:26:52", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-1080-1", "cvss3": {}, "published": "2011-03-07T00:00:00", "type": "openvas", "title": "Ubuntu Update for linux vulnerabilities USN-1080-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-3865", "CVE-2010-4346", "CVE-2010-4527", "CVE-2010-4649", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-4526", "CVE-2011-1044", "CVE-2010-4248", "CVE-2010-3880"], "modified": "2017-12-01T00:00:00", "id": "OPENVAS:840600", "href": "http://plugins.openvas.org/nasl.php?oid=840600", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_1080_1.nasl 7964 2017-12-01 07:32:11Z santu $\n#\n# Ubuntu Update for linux vulnerabilities USN-1080-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Thomas Pollet discovered that the RDS network protocol did not check\n certain iovec buffers. A local attacker could exploit this to crash the\n system or possibly execute arbitrary code as the root user. (CVE-2010-3865)\n\n Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did\n not correctly clear kernel memory. A local attacker could exploit this to\n read kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)\n \n Vasiliy Kulikov discovered that the Linux kernel sockets implementation did\n not properly initialize certain structures. A local attacker could exploit\n this to read kernel stack memory, leading to a loss of privacy.\n (CVE-2010-3876)\n \n Vasiliy Kulikov discovered that the TIPC interface did not correctly\n initialize certain structures. A local attacker could exploit this to read\n kernel stack memory, leading to a loss of privacy. (CVE-2010-3877)\n \n Nelson Elhage discovered that the Linux kernel IPv4 implementation did not\n properly audit certain bytecodes in netlink messages. A local attacker\n could exploit this to cause the kernel to hang, leading to a denial of\n service. (CVE-2010-3880)\n \n It was discovered that multithreaded exec did not handle CPU timers\n correctly. A local attacker could exploit this to crash the system, leading\n to a denial of service. (CVE-2010-4248)\n \n Krishna Gudipati discovered that the bfa adapter driver did not correctly\n initialize certain structures. A local attacker could read files in /sys to\n crash the system, leading to a denial of service. (CVE-2010-4343)\n \n Tavis Ormandy discovered that the install_special_mapping function could\n bypass the mmap_min_addr restriction. A local attacker could exploit this\n to mmap 4096 bytes below the mmap_min_addr area, possibly improving the\n chances of performing NULL pointer dereference attacks. (CVE-2010-4346)\n \n It was discovered that the ICMP stack did not correctly handle certain\n unreachable messages. If a remote attacker were able to acquire a socket\n lock, they could send specially crafted traffic that would crash the\n system, leading to a denial of service. (CVE-2010-4526)\n \n Dan Rosenberg discovered that the OSS subsystem did not handle name\n termination correctly. A local attacker could exploit this crash the system\n or gain root privileges. (CVE-2010-4527)\n \n Dan Carpenter discovered that the Infiniband driver did not correctly\n handle certain requests. A local user could exploit this to crash the\n system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-1080-1\";\ntag_affected = \"linux vulnerabilities on Ubuntu 10.04 LTS\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-1080-1/\");\n script_id(840600);\n script_version(\"$Revision: 7964 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 08:32:11 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-07 06:45:55 +0100 (Mon, 07 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"USN\", value: \"1080-1\");\n script_cve_id(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4649\", \"CVE-2011-1044\");\n script_name(\"Ubuntu Update for linux vulnerabilities USN-1080-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29-386\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29-generic-pae\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29-generic\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-386\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-generic-pae\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-generic\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-2.6.32-29-virtual\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-libc-dev\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-tools-2.6.32-29\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-doc\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-headers-2.6.32-29\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-source-2.6.32\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-tools-common\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"block-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"block-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"char-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"char-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"crypto-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"crypto-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fat-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fat-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fb-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fb-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"firewire-core-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"firewire-core-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"floppy-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"floppy-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-core-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-core-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-secondary-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fs-secondary-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"input-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"input-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"irda-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"irda-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"kernel-image-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"kernel-image-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"md-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"md-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"message-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"message-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"mouse-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"mouse-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nfs-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nfs-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-pcmcia-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-pcmcia-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-shared-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-shared-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-usb-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"nic-usb-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"parport-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"parport-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pata-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pata-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-storage-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"pcmcia-storage-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"plip-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"plip-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"ppp-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"ppp-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"sata-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"sata-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"scsi-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"scsi-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"serial-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"serial-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"squashfs-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"squashfs-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"storage-core-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"storage-core-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"usb-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"usb-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"virtio-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"virtio-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"vlan-modules-2.6.32-29-generic-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"vlan-modules-2.6.32-29-generic-pae-di\", ver:\"2.6.32-29.58\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2020-08-08T14:11:50", "description": "Oracle Linux Local Security Checks ELSA-2011-0017", "cvss3": {}, "published": "2015-10-06T00:00:00", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2011-0017", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4081", "CVE-2010-4073", "CVE-2010-4072", "CVE-2010-4080", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-4158", "CVE-2010-3296", "CVE-2010-4263", "CVE-2010-4243", "CVE-2010-4238", "CVE-2010-4255", "CVE-2010-4075"], "modified": "2018-09-28T00:00:00", "id": "OPENVAS:1361412562310122281", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122281", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2011-0017.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.122281\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 14:15:54 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2011-0017\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2011-0017\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2011-0017.html\");\n script_cve_id(\"CVE-2010-3296\", \"CVE-2010-3877\", \"CVE-2010-4072\", \"CVE-2010-4073\", \"CVE-2010-4075\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4158\", \"CVE-2010-4238\", \"CVE-2010-4243\", \"CVE-2010-4255\", \"CVE-2010-4263\", \"CVE-2010-4343\");\n script_tag(name:\"cvss_base\", value:\"6.1\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:A/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux5\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-PAE\", rpm:\"kernel-PAE~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-PAE-devel\", rpm:\"kernel-PAE-devel~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-doc\", rpm:\"kernel-doc~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-xen\", rpm:\"kernel-xen~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"kernel-xen-devel\", rpm:\"kernel-xen-devel~2.6.18~238.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"ocfs2\", rpm:\"ocfs2~2.6.18~238.el5~1.4.8~2.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"ocfs2\", rpm:\"ocfs2~2.6.18~238.el5PAE~1.4.8~2.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"ocfs2\", rpm:\"ocfs2~2.6.18~238.el5debug~1.4.8~2.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"ocfs2\", rpm:\"ocfs2~2.6.18~238.el5xen~1.4.8~2.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"oracleasm\", rpm:\"oracleasm~2.6.18~238.el5~2.0.5~1.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"oracleasm\", rpm:\"oracleasm~2.6.18~238.el5PAE~2.0.5~1.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"oracleasm\", rpm:\"oracleasm~2.6.18~238.el5debug~2.0.5~1.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"oracleasm\", rpm:\"oracleasm~2.6.18~238.el5xen~2.0.5~1.el5\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-27T10:55:18", "description": "Check for the Version of Red Hat Enterprise Linux 5.6 kernel", "cvss3": {}, "published": "2011-01-14T00:00:00", "type": "openvas", "title": "RedHat Update for Red Hat Enterprise Linux 5.6 kernel RHSA-2011:0017-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4081", "CVE-2010-4073", "CVE-2010-4072", "CVE-2010-4080", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-4158", "CVE-2010-3296", "CVE-2010-4263", "CVE-2010-4258", "CVE-2010-4243", "CVE-2010-4238", "CVE-2010-4255", "CVE-2010-4075"], "modified": "2017-07-12T00:00:00", "id": "OPENVAS:870378", "href": "http://plugins.openvas.org/nasl.php?oid=870378", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for Red Hat Enterprise Linux 5.6 kernel RHSA-2011:0017-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The kernel packages contain the Linux kernel, the core of any Linux\n operating system.\n\n This update fixes the following security issues:\n \n * A NULL pointer dereference flaw was found in the igb driver in the Linux\n kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and\n promiscuous mode were enabled on an interface using igb, it could result in\n a denial of service when a tagged VLAN packet is received on that\n interface. (CVE-2010-4263, Important)\n \n * A missing sanity check was found in vbd_create() in the Xen hypervisor\n implementation. As CD-ROM drives are not supported by the blkback back-end\n driver, attempting to use a virtual CD-ROM drive with blkback could trigger\n a denial of service (crash) on the host system running the Xen hypervisor.\n (CVE-2010-4238, Moderate)\n \n * A flaw was found in the Linux kernel execve() system call implementation.\n A local, unprivileged user could cause large amounts of memory to be\n allocated but not visible to the OOM (Out of Memory) killer, triggering a\n denial of service. (CVE-2010-4243, Moderate)\n \n * A flaw was found in fixup_page_fault() in the Xen hypervisor\n implementation. If a 64-bit para-virtualized guest accessed a certain area\n of memory, it could cause a denial of service on the host system running\n the Xen hypervisor. (CVE-2010-4255, Moderate)\n \n * A missing initialization flaw was found in the bfa driver used by Brocade\n Fibre Channel Host Bus Adapters. A local, unprivileged user could use this\n flaw to cause a denial of service by reading a file in the\n "/sys/class/fc_host/host#/statistics/" directory. (CVE-2010-4343, Moderate)\n \n * Missing initialization flaws in the Linux kernel could lead to\n information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072,\n CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158,\n Low)\n \n Red Hat would like to thank Kosuke Tatsukawa for reporting CVE-2010-4263;\n Vladymyr Denysov for reporting CVE-2010-4238; Brad Spengler for reporting\n CVE-2010-4243; Dan Rosenberg for reporting CVE-2010-3296, CVE-2010-4073,\n CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, and CVE-2010-4158; Vasiliy\n Kulikov for reporting CVE-2010-3877; and Kees Cook for reporting\n CVE-2010-4072.\n \n These updated packages also include several hundred bug fixes for and\n enhancements to the Linux kernel. Space precludes documenting each of these\n changes in this advisory and users are directed to the Red Hat Enterprise\n Linux 5.6 Release Notes for information on the most significant of these\n ... \n\n Description truncated, for more information please check the Reference URL\";\n\ntag_affected = \"Red Hat Enterprise Linux 5.6 kernel on Red Hat Enterprise Linux (v. 5 server)\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/rhsa-announce/2011-January/msg00006.html\");\n script_id(870378);\n script_version(\"$Revision: 6685 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:44:46 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-01-14 16:07:43 +0100 (Fri, 14 Jan 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:H/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"RHSA\", value: \"2011:0017-01\");\n script_cve_id(\"CVE-2010-3296\", \"CVE-2010-3877\", \"CVE-2010-4072\", \"CVE-2010-4073\", \"CVE-2010-4075\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4158\", \"CVE-2010-4238\", \"CVE-2010-4243\", \"CVE-2010-4255\", \"CVE-2010-4263\", \"CVE-2010-4343\", \"CVE-2010-4258\");\n script_name(\"RedHat Update for Red Hat Enterprise Linux 5.6 kernel RHSA-2011:0017-01\");\n\n script_summary(\"Check for the Version of Red Hat Enterprise Linux 5.6 kernel\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-PAE\", rpm:\"kernel-PAE~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-PAE-debuginfo\", rpm:\"kernel-PAE-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-PAE-devel\", rpm:\"kernel-PAE-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-debuginfo\", rpm:\"kernel-debug-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debuginfo\", rpm:\"kernel-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debuginfo-common\", rpm:\"kernel-debuginfo-common~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen\", rpm:\"kernel-xen~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-debuginfo\", rpm:\"kernel-xen-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-devel\", rpm:\"kernel-xen-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-doc\", rpm:\"kernel-doc~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.2, "vector": "AV:LOCAL/AC:HIGH/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2020-08-08T14:22:30", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-01-14T00:00:00", "type": "openvas", "title": "RedHat Update for Red Hat Enterprise Linux 5.6 kernel RHSA-2011:0017-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4081", "CVE-2010-4073", "CVE-2010-4072", "CVE-2010-4080", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-4158", "CVE-2010-3296", "CVE-2010-4263", "CVE-2010-4258", "CVE-2010-4243", "CVE-2010-4238", "CVE-2010-4255", "CVE-2010-4075"], "modified": "2019-03-12T00:00:00", "id": "OPENVAS:1361412562310870378", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310870378", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for Red Hat Enterprise Linux 5.6 kernel RHSA-2011:0017-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2011-January/msg00006.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.870378\");\n script_version(\"$Revision: 14114 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-12 12:48:52 +0100 (Tue, 12 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-01-14 16:07:43 +0100 (Fri, 14 Jan 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:H/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"RHSA\", value:\"2011:0017-01\");\n script_cve_id(\"CVE-2010-3296\", \"CVE-2010-3877\", \"CVE-2010-4072\", \"CVE-2010-4073\", \"CVE-2010-4075\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4158\", \"CVE-2010-4238\", \"CVE-2010-4243\", \"CVE-2010-4255\", \"CVE-2010-4263\", \"CVE-2010-4343\", \"CVE-2010-4258\");\n script_name(\"RedHat Update for Red Hat Enterprise Linux 5.6 kernel RHSA-2011:0017-01\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'Red Hat Enterprise Linux 5.6 kernel'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_5\");\n script_tag(name:\"affected\", value:\"Red Hat Enterprise Linux 5.6 kernel on Red Hat Enterprise Linux (v. 5 server)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"The kernel packages contain the Linux kernel, the core of any Linux\n operating system.\n\n This update fixes the following security issues:\n\n * A NULL pointer dereference flaw was found in the igb driver in the Linux\n kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and\n promiscuous mode were enabled on an interface using igb, it could result in\n a denial of service when a tagged VLAN packet is received on that\n interface. (CVE-2010-4263, Important)\n\n * A missing sanity check was found in vbd_create() in the Xen hypervisor\n implementation. As CD-ROM drives are not supported by the blkback back-end\n driver, attempting to use a virtual CD-ROM drive with blkback could trigger\n a denial of service (crash) on the host system running the Xen hypervisor.\n (CVE-2010-4238, Moderate)\n\n * A flaw was found in the Linux kernel execve() system call implementation.\n A local, unprivileged user could cause large amounts of memory to be\n allocated but not visible to the OOM (Out of Memory) killer, triggering a\n denial of service. (CVE-2010-4243, Moderate)\n\n * A flaw was found in fixup_page_fault() in the Xen hypervisor\n implementation. If a 64-bit para-virtualized guest accessed a certain area\n of memory, it could cause a denial of service on the host system running\n the Xen hypervisor. (CVE-2010-4255, Moderate)\n\n * A missing initialization flaw was found in the bfa driver used by Brocade\n Fibre Channel Host Bus Adapters. A local, unprivileged user could use this\n flaw to cause a denial of service by reading a file in the\n '/sys/class/fc_host/host#/statistics/' directory. (CVE-2010-4343, Moderate)\n\n * Missing initialization flaws in the Linux kernel could lead to\n information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072,\n CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158,\n Low)\n\n Red Hat would like to thank Kosuke Tatsukawa for reporting CVE-2010-4263,\n Vladymyr Denysov for reporting CVE-2010-4238, Brad Spengler for reporting\n CVE-2010-4243, Dan Rosenberg for reporting CVE-2010-3296, CVE-2010-4073,\n CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, and CVE-2010-4158, Vasiliy\n Kulikov for reporting CVE-2010-3877, and Kees Cook for reporting\n CVE-2010-4072.\n\n These updated packages also include several hundred bug fixes for and\n enhancements to the Linux kernel. Space precludes documenting each of these\n changes in this advisory and users are directed to the Red Hat Enterprise\n Linux 5.6 Release Notes for information on the most significant of these\n ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-PAE\", rpm:\"kernel-PAE~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-PAE-debuginfo\", rpm:\"kernel-PAE-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-PAE-devel\", rpm:\"kernel-PAE-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-debuginfo\", rpm:\"kernel-debug-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debuginfo\", rpm:\"kernel-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debuginfo-common\", rpm:\"kernel-debuginfo-common~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen\", rpm:\"kernel-xen~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-debuginfo\", rpm:\"kernel-xen-debuginfo~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-devel\", rpm:\"kernel-xen-devel~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-doc\", rpm:\"kernel-doc~2.6.18~238.el5\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-10-09T15:25:31", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-05-06T00:00:00", "type": "openvas", "title": "SuSE Update for kernel SUSE-SA:2011:020", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-0521", "CVE-2010-4163", "CVE-2010-4529", "CVE-2011-1476", "CVE-2010-4668", "CVE-2010-3881", "CVE-2010-4346", "CVE-2010-4527", "CVE-2010-4649", "CVE-2011-1478", "CVE-2011-1012", "CVE-2010-4251", "CVE-2010-4525", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-3875", "CVE-2010-4656", "CVE-2010-3876", "CVE-2011-0711", "CVE-2010-3850", "CVE-2010-4650", "CVE-2011-0712", "CVE-2010-4248", "CVE-2010-3705", "CVE-2010-4243", "CVE-2011-1163", "CVE-2010-3848", "CVE-2010-4648", "CVE-2011-0191", "CVE-2010-3880", "CVE-2010-4250", "CVE-2010-4342", "CVE-2011-1010", "CVE-2010-3858", "CVE-2010-3699", "CVE-2011-1082", "CVE-2011-1477", "CVE-2011-1493", "CVE-2011-1182", "CVE-2011-1090", "CVE-2010-3849", "CVE-2010-4077", "CVE-2010-4075", "CVE-2010-4076"], "modified": "2019-10-07T00:00:00", "id": "OPENVAS:1361412562310850165", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310850165", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# SuSE Update for kernel SUSE-SA:2011:020\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.850165\");\n script_version(\"2019-10-07T14:34:48+0000\");\n script_tag(name:\"last_modification\", value:\"2019-10-07 14:34:48 +0000 (Mon, 07 Oct 2019)\");\n script_tag(name:\"creation_date\", value:\"2011-05-06 16:22:00 +0200 (Fri, 06 May 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"SUSE-SA\", value:\"2011-020\");\n script_cve_id(\"CVE-2010-3699\", \"CVE-2010-3705\", \"CVE-2010-3848\", \"CVE-2010-3849\", \"CVE-2010-3850\", \"CVE-2010-3858\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-3881\", \"CVE-2010-4075\", \"CVE-2010-4076\", \"CVE-2010-4077\", \"CVE-2010-4163\", \"CVE-2010-4243\", \"CVE-2010-4248\", \"CVE-2010-4250\", \"CVE-2010-4251\", \"CVE-2010-4342\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4525\", \"CVE-2010-4527\", \"CVE-2010-4529\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2010-4656\", \"CVE-2010-4668\", \"CVE-2011-0191\", \"CVE-2011-0521\", \"CVE-2011-0711\", \"CVE-2011-0712\", \"CVE-2011-1010\", \"CVE-2011-1012\", \"CVE-2011-1082\", \"CVE-2011-1090\", \"CVE-2011-1163\", \"CVE-2011-1182\", \"CVE-2011-1476\", \"CVE-2011-1477\", \"CVE-2011-1478\", \"CVE-2011-1493\");\n script_name(\"SuSE Update for kernel SUSE-SA:2011:020\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE11\\.3\");\n script_tag(name:\"impact\", value:\"remote denial of service\");\n script_tag(name:\"affected\", value:\"kernel on openSUSE 11.3\");\n script_tag(name:\"insight\", value:\"The openSUSE 11.3 kernel was updated to 2.6.34.8 to fix various bugs\n and security issues.\n\n The following security issues have been fixed:\n CVE-2011-1493: In the rose networking stack, when parsing the\n FAC_NATIONAL_DIGIS facilities field, it was possible for a remote\n host to provide more digipeaters than expected, resulting in heap\n corruption. Check against ROSE_MAX_DIGIS to prevent overflows,\n and abort facilities parsing on failure.\n\n CVE-2011-1182: Local attackers could send signals to their programs\n that looked like coming from the kernel, potentially gaining privileges\n in the context of setuid programs.\n\n CVE-2011-1082: The epoll subsystem in Linux did not prevent users\n from creating circular epoll file structures, potentially leading to\n a denial of service (kernel deadlock).\n\n CVE-2011-1478: An issue in the core GRO code where an skb belonging to\n an unknown VLAN is reused could result in a NULL pointer dereference.\n\n CVE-2011-1163: The code for evaluating OSF partitions (in\n fs/partitions/osf.c) contained a bug that leaks data from kernel heap\n memory to userspace for certain corrupted OSF partitions.\n\n CVE-2011-1012: The code for evaluating LDM partitions (in\n fs/partitions/ldm.c) contained a bug that could crash the kernel for\n certain corrupted LDM partitions.\n\n CVE-2011-1010: The code for evaluating Mac partitions (in\n fs/partitions/mac.c) contained a bug that could crash the kernel for\n certain corrupted Mac partitions.\n\n CVE-2011-1476: Specially crafted requests may be written to\n /dev/sequencer resulting in an underflow when calculating a size for a\n copy_from_user() operation in the driver for MIDI interfaces. On x86,\n this just returns an error, but it could have caused memory corruption\n on other architectures. Other malformed requests could have resulted\n in the use of uninitialized variables.\n\n CVE-2011-1477: Due to a failure to validate user-supplied indexes in\n the driver for Yamaha YM3812 and OPL-3 chips, a specially crafted\n ioctl request could have been sent to /dev/sequencer, resulting in\n reading and writing beyond the bounds of heap buffers, and potentially\n allowing privilege escalation.\n\n CVE-2011-0191: A information leak in the XFS geometry calls could be\n used by local attackers to gain access to kernel information.\n\n CVE-2011-1090: A page allocator issue in NFS v4 ACL handling that\n could lead to a denial of service (crash) was fixed.\n\n CVE-2010-3880: net/ipv4/inet_diag.c in the Linux kernel did not\n properly audit INET_DIAG bytecode, which allowed local users\n to cause a denial of service ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSE11.3\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-base\", rpm:\"kernel-debug-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default\", rpm:\"kernel-default~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-base\", rpm:\"kernel-default-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-devel\", rpm:\"kernel-default-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-desktop\", rpm:\"kernel-desktop~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-desktop-base\", rpm:\"kernel-desktop-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-desktop-devel\", rpm:\"kernel-desktop-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2\", rpm:\"kernel-ec2~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-base\", rpm:\"kernel-ec2-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-devel\", rpm:\"kernel-ec2-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-extra\", rpm:\"kernel-ec2-extra~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae\", rpm:\"kernel-pae~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-base\", rpm:\"kernel-pae-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-devel\", rpm:\"kernel-pae-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-syms\", rpm:\"kernel-syms~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-trace\", rpm:\"kernel-trace~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-trace-base\", rpm:\"kernel-trace-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-trace-devel\", rpm:\"kernel-trace-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla\", rpm:\"kernel-vanilla~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla-base\", rpm:\"kernel-vanilla-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla-devel\", rpm:\"kernel-vanilla-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vmi\", rpm:\"kernel-vmi~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vmi-base\", rpm:\"kernel-vmi-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vmi-devel\", rpm:\"kernel-vmi-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen\", rpm:\"kernel-xen~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-base\", rpm:\"kernel-xen-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-devel\", rpm:\"kernel-xen-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"preload-kmp-default\", rpm:\"preload-kmp-default~1.1_k2.6.34.8_0.2~19.1.19\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"preload-kmp-desktop\", rpm:\"preload-kmp-desktop~1.1_k2.6.34.8_0.2~19.1.19\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-12-12T11:19:25", "description": "Check for the Version of kernel", "cvss3": {}, "published": "2011-05-06T00:00:00", "type": "openvas", "title": "SuSE Update for kernel SUSE-SA:2011:020", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-0521", "CVE-2010-4163", "CVE-2010-4529", "CVE-2011-1476", "CVE-2010-4668", "CVE-2010-3881", "CVE-2010-4346", "CVE-2010-4527", "CVE-2010-4649", "CVE-2011-1478", "CVE-2011-1012", "CVE-2010-4251", "CVE-2010-4525", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-3875", "CVE-2010-4656", "CVE-2010-3876", "CVE-2011-0711", "CVE-2010-3850", "CVE-2010-4650", "CVE-2011-0712", "CVE-2010-4248", "CVE-2010-3705", "CVE-2010-4243", "CVE-2011-1163", "CVE-2010-3848", "CVE-2010-4648", "CVE-2011-0191", "CVE-2010-3880", "CVE-2010-4250", "CVE-2010-4342", "CVE-2011-1010", "CVE-2010-3858", "CVE-2010-3699", "CVE-2011-1082", "CVE-2011-1477", "CVE-2011-1493", "CVE-2011-1182", "CVE-2011-1090", "CVE-2010-3849", "CVE-2010-4077", "CVE-2010-4075", "CVE-2010-4076"], "modified": "2017-12-08T00:00:00", "id": "OPENVAS:850165", "href": "http://plugins.openvas.org/nasl.php?oid=850165", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# SuSE Update for kernel SUSE-SA:2011:020\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The openSUSE 11.3 kernel was updated to 2.6.34.8 to fix various bugs\n and security issues.\n\n Following security issues have been fixed:\n CVE-2011-1493: In the rose networking stack, when parsing the\n FAC_NATIONAL_DIGIS facilities field, it was possible for a remote\n host to provide more digipeaters than expected, resulting in heap\n corruption. Check against ROSE_MAX_DIGIS to prevent overflows,\n and abort facilities parsing on failure.\n\n CVE-2011-1182: Local attackers could send signals to their programs\n that looked like coming from the kernel, potentially gaining privileges\n in the context of setuid programs.\n\n CVE-2011-1082: The epoll subsystem in Linux did not prevent users\n from creating circular epoll file structures, potentially leading to\n a denial of service (kernel deadlock).\n\n CVE-2011-1478: An issue in the core GRO code where an skb belonging to\n an unknown VLAN is reused could result in a NULL pointer dereference.\n\n CVE-2011-1163: The code for evaluating OSF partitions (in\n fs/partitions/osf.c) contained a bug that leaks data from kernel heap\n memory to userspace for certain corrupted OSF partitions.\n\n CVE-2011-1012: The code for evaluating LDM partitions (in\n fs/partitions/ldm.c) contained a bug that could crash the kernel for\n certain corrupted LDM partitions.\n\n CVE-2011-1010: The code for evaluating Mac partitions (in\n fs/partitions/mac.c) contained a bug that could crash the kernel for\n certain corrupted Mac partitions.\n\n CVE-2011-1476: Specially crafted requests may be written to\n /dev/sequencer resulting in an underflow when calculating a size for a\n copy_from_user() operation in the driver for MIDI interfaces. On x86,\n this just returns an error, but it could have caused memory corruption\n on other architectures. Other malformed requests could have resulted\n in the use of uninitialized variables.\n\n CVE-2011-1477: Due to a failure to validate user-supplied indexes in\n the driver for Yamaha YM3812 and OPL-3 chips, a specially crafted\n ioctl request could have been sent to /dev/sequencer, resulting in\n reading and writing beyond the bounds of heap buffers, and potentially\n allowing privilege escalation.\n\n CVE-2011-0191: A information leak in the XFS geometry calls could be\n used by local attackers to gain access to kernel information.\n\n CVE-2011-1090: A page allocator issue in NFS v4 ACL handling that\n could lead to a denial of service (crash) was fixed.\n\n CVE-2010-3880: net/ipv4/inet_diag.c in the Linux kernel did not\n properly audit INET_DIAG bytecode, which allowed local users\n to cause a denial of service ... \n\n Description truncated, for more information please check the Reference URL\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_impact = \"remote denial of service\";\ntag_affected = \"kernel on openSUSE 11.3\";\n\n\nif(description)\n{\n script_id(850165);\n script_version(\"$Revision: 8041 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-08 08:28:21 +0100 (Fri, 08 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-05-06 16:22:00 +0200 (Fri, 06 May 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"SUSE-SA\", value: \"2011-020\");\n script_cve_id(\"CVE-2010-3699\", \"CVE-2010-3705\", \"CVE-2010-3848\", \"CVE-2010-3849\", \"CVE-2010-3850\", \"CVE-2010-3858\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-3881\", \"CVE-2010-4075\", \"CVE-2010-4076\", \"CVE-2010-4077\", \"CVE-2010-4163\", \"CVE-2010-4243\", \"CVE-2010-4248\", \"CVE-2010-4250\", \"CVE-2010-4251\", \"CVE-2010-4342\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4525\", \"CVE-2010-4527\", \"CVE-2010-4529\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2010-4656\", \"CVE-2010-4668\", \"CVE-2011-0191\", \"CVE-2011-0521\", \"CVE-2011-0711\", \"CVE-2011-0712\", \"CVE-2011-1010\", \"CVE-2011-1012\", \"CVE-2011-1082\", \"CVE-2011-1090\", \"CVE-2011-1163\", \"CVE-2011-1182\", \"CVE-2011-1476\", \"CVE-2011-1477\", \"CVE-2011-1478\", \"CVE-2011-1493\");\n script_name(\"SuSE Update for kernel SUSE-SA:2011:020\");\n\n script_summary(\"Check for the Version of kernel\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"openSUSE11.3\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-base\", rpm:\"kernel-debug-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default\", rpm:\"kernel-default~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-base\", rpm:\"kernel-default-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-default-devel\", rpm:\"kernel-default-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-desktop\", rpm:\"kernel-desktop~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-desktop-base\", rpm:\"kernel-desktop-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-desktop-devel\", rpm:\"kernel-desktop-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2\", rpm:\"kernel-ec2~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-base\", rpm:\"kernel-ec2-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-devel\", rpm:\"kernel-ec2-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-ec2-extra\", rpm:\"kernel-ec2-extra~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae\", rpm:\"kernel-pae~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-base\", rpm:\"kernel-pae-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-pae-devel\", rpm:\"kernel-pae-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-syms\", rpm:\"kernel-syms~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-trace\", rpm:\"kernel-trace~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-trace-base\", rpm:\"kernel-trace-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-trace-devel\", rpm:\"kernel-trace-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla\", rpm:\"kernel-vanilla~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla-base\", rpm:\"kernel-vanilla-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vanilla-devel\", rpm:\"kernel-vanilla-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vmi\", rpm:\"kernel-vmi~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vmi-base\", rpm:\"kernel-vmi-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-vmi-devel\", rpm:\"kernel-vmi-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen\", rpm:\"kernel-xen~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-base\", rpm:\"kernel-xen-base~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-xen-devel\", rpm:\"kernel-xen-devel~2.6.34.8~0.2.1\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"preload-kmp-default\", rpm:\"preload-kmp-default~1.1_k2.6.34.8_0.2~19.1.19\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"preload-kmp-desktop\", rpm:\"preload-kmp-desktop~1.1_k2.6.34.8_0.2~19.1.19\", rls:\"openSUSE11.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2020-08-11T14:22:29", "description": "The remote ESXi is missing one or more security related Updates from VMSA-2011-0012.3.", "cvss3": {}, "published": "2012-03-16T00:00:00", "type": "openvas", "title": "VMware ESXi/ESX updates to third party libraries and ESX Service Console (VMSA-2011-0012.3)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4242", "CVE-2010-2942", "CVE-2011-0521", "CVE-2010-3904", "CVE-2010-3078", "CVE-2010-4081", "CVE-2010-3865", "CVE-2010-4073", "CVE-2010-4072", "CVE-2010-4346", "CVE-2011-1658", "CVE-2010-2492", "CVE-2010-4083", "CVE-2010-2943", "CVE-2011-1494", "CVE-2010-0296", "CVE-2011-1478", "CVE-2010-3859", "CVE-2010-3477", "CVE-2010-3086", "CVE-2010-4251", "CVE-2010-4080", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-4158", "CVE-2010-3876", "CVE-2011-1659", "CVE-2010-3296", "CVE-2010-4526", "CVE-2010-3015", "CVE-2011-0710", "CVE-2011-0281", "CVE-2010-2938", "CVE-2010-4247", "CVE-2010-4263", "CVE-2010-3442", "CVE-2010-4248", "CVE-2011-1495", "CVE-2010-4243", "CVE-2010-3066", "CVE-2011-1071", "CVE-2010-3880", "CVE-2010-1083", "CVE-2010-4249", "CVE-2010-4157", "CVE-2010-4161", "CVE-2011-1010", "CVE-2010-3858", "CVE-2010-3067", "CVE-2010-3699", "CVE-2010-4238", "CVE-2011-0282", "CVE-2011-1095", "CVE-2010-4255", "CVE-2010-2798", "CVE-2010-3432", "CVE-2011-1090", "CVE-2011-0536", "CVE-2010-1323", "CVE-2010-4075", "CVE-2010-4655"], "modified": "2019-12-18T00:00:00", "id": "OPENVAS:1361412562310103455", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310103455", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# VMSA-2011-0012.3 VMware ESXi and ESX updates to third party libraries and ESX Service Console\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.103455\");\n script_cve_id(\"CVE-2010-1083\", \"CVE-2010-2492\", \"CVE-2010-2798\", \"CVE-2010-2938\", \"CVE-2010-2942\",\n \"CVE-2010-2943\", \"CVE-2010-3015\", \"CVE-2010-3066\", \"CVE-2010-3067\", \"CVE-2010-3078\",\n \"CVE-2010-3086\", \"CVE-2010-3296\", \"CVE-2010-3432\", \"CVE-2010-3442\", \"CVE-2010-3477\",\n \"CVE-2010-3699\", \"CVE-2010-3858\", \"CVE-2010-3859\", \"CVE-2010-3865\", \"CVE-2010-3876\",\n \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-3904\", \"CVE-2010-4072\", \"CVE-2010-4073\",\n \"CVE-2010-4075\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4083\", \"CVE-2010-4157\",\n \"CVE-2010-4158\", \"CVE-2010-4161\", \"CVE-2010-4238\", \"CVE-2010-4242\", \"CVE-2010-4243\",\n \"CVE-2010-4247\", \"CVE-2010-4248\", \"CVE-2010-4249\", \"CVE-2010-4251\", \"CVE-2010-4255\",\n \"CVE-2010-4263\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4655\",\n \"CVE-2011-0521\", \"CVE-2011-0710\", \"CVE-2011-1010\", \"CVE-2011-1090\", \"CVE-2011-1478\",\n \"CVE-2010-1323\", \"CVE-2011-0281\", \"CVE-2011-0282\", \"CVE-2010-0296\", \"CVE-2011-0536\",\n \"CVE-2011-1071\", \"CVE-2011-1095\", \"CVE-2011-1658\", \"CVE-2011-1659\", \"CVE-2011-1494\",\n \"CVE-2011-1495\");\n script_tag(name:\"cvss_base\", value:\"7.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:N\");\n script_version(\"2019-12-18T11:13:08+0000\");\n script_name(\"VMware ESXi/ESX updates to third party libraries and ESX Service Console (VMSA-2011-0012.3)\");\n script_tag(name:\"last_modification\", value:\"2019-12-18 11:13:08 +0000 (Wed, 18 Dec 2019)\");\n script_tag(name:\"creation_date\", value:\"2012-03-16 12:42:13 +0100 (Fri, 16 Mar 2012)\");\n script_category(ACT_GATHER_INFO);\n script_family(\"VMware Local Security Checks\");\n script_copyright(\"Copyright (C) 2012 Greenbone Networks GmbH\");\n script_dependencies(\"gb_vmware_esxi_init.nasl\");\n script_mandatory_keys(\"VMware/ESXi/LSC\", \"VMware/ESX/version\");\n\n script_xref(name:\"URL\", value:\"http://www.vmware.com/security/advisories/VMSA-2011-0012.html\");\n\n script_tag(name:\"summary\", value:\"The remote ESXi is missing one or more security related Updates from VMSA-2011-0012.3.\");\n\n script_tag(name:\"affected\", value:\"ESXi 5.0 without patch ESXi500-201112401-SG\n\n ESXi 4.1 without patch ESXi410-201110201-SG\n\n ESX 4.1 without patches ESX410-201110201-SG and ESX410-201110224-SG\n\n ESXi 4.0 without patch ESXi400-201110401-SG\n\n ESX 4.0 without patches ESX400-201110401-SG, ESX400-201110403-SG and ESX400-201110409-SG\n\n ESXi 3.5 without patch ESXe350-201203401-I-SG\n\n ESX 3.5 without patch ESX350-201203403-SG\");\n\n script_tag(name:\"insight\", value:\"VMware ESXi and ESX updates to third party libraries and ESX Service Console address several security issues.\n\n a. ESX third party update for Service Console kernel\n\n This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues.\n\n b. ESX third party update for Service Console krb5 RPMs\n\n This patch updates the krb5-libs and krb5-workstation RPMs of the console OS to version 1.6.1-55.el5_6.1, which resolves multiple security issues.\n\n c. ESXi and ESX update to third party component glibc\n\n The glibc third-party library is updated to resolve multiple security issues.\n\n d. ESX update to third party drivers mptsas, mpt2sas, and mptspi\n\n The mptsas, mpt2sas, and mptspi drivers are updated which addresses multiple security issues in the mpt2sas driver.\");\n\n script_tag(name:\"solution\", value:\"Apply the missing patch(es).\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if the target host is missing one or more patch(es).\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"vmware_esx.inc\");\ninclude(\"version_func.inc\");\n\nif(!get_kb_item(\"VMware/ESXi/LSC\"))\n exit(0);\n\nif(!esxVersion = get_kb_item(\"VMware/ESX/version\"))\n exit(0);\n\npatches = make_array(\"4.1.0\", \"ESXi410-201110201-SG\",\n \"4.0.0\", \"ESXi400-201110401-SG\",\n \"5.0.0\", \"VIB:esx-base:5.0.0-0.3.515841\");\n\nif(!patches[esxVersion])\n exit(99);\n\nif(report = esxi_patch_missing(esxi_version:esxVersion, patch:patches[esxVersion])) {\n security_message(port:0, data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-02T21:10:46", "description": "The remote ESXi is missing one or more security related Updates from VMSA-2011-0012.3.\n\nSummary\n\nVMware ESXi and ESX updates to third party libraries and ESX Service Console address several security issues.\n\nRelevant releases\n\nESXi 5.0 without patch ESXi500-201112401-SG.\nESXi 4.1 without patch ESXi410-201110201-SG.\nESX 4.1 without patches ESX410-201110201-SG and ESX410-201110224-SG.\nESXi 4.0 without patch ESXi400-201110401-SG.\nESX 4.0 without patches ESX400-201110401-SG, ESX400-201110403-SG and ESX400-201110409-SG.\nESXi 3.5 without patch ESXe350-201203401-I-SG.\nESX 3.5 without patch ESX350-201203403-SG.\n\nProblem Description\n\na. ESX third party update for Service Console kernel\n\n This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security\n issues.\n\nb. ESX third party update for Service Console krb5 RPMs\n\n This patch updates the krb5-libs and krb5-workstation RPMs of the console OS to version 1.6.1-55.el5_6.1,\n which resolves multiple security issues.\n\nc. ESXi and ESX update to third party component glibc\n\n The glibc third-party library is updated to resolve multiple security issues.\n\nd. ESX update to third party drivers mptsas, mpt2sas, and mptspi\n\n The mptsas, mpt2sas, and mptspi drivers are updated which addresses multiple security issues in the mpt2sas\n driver.", "cvss3": {}, "published": "2012-03-16T00:00:00", "type": "openvas", "title": "VMSA-2011-0012.3 VMware ESXi and ESX updates to third party libraries and ESX Service Console", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-4242", "CVE-2010-2942", "CVE-2011-0521", "CVE-2010-3904", "CVE-2010-3078", "CVE-2010-4081", "CVE-2010-3865", "CVE-2010-4073", "CVE-2010-4072", "CVE-2010-4346", "CVE-2011-1658", "CVE-2010-2492", "CVE-2010-4083", "CVE-2010-2943", "CVE-2011-1494", "CVE-2010-0296", "CVE-2011-1478", "CVE-2010-3859", "CVE-2010-3477", "CVE-2010-3086", "CVE-2010-4251", "CVE-2010-4080", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-4158", "CVE-2010-3876", "CVE-2011-1659", "CVE-2010-3296", "CVE-2010-4526", "CVE-2010-3015", "CVE-2011-0710", "CVE-2011-0281", "CVE-2010-2938", "CVE-2010-4247", "CVE-2010-4263", "CVE-2010-3442", "CVE-2010-4248", "CVE-2011-1495", "CVE-2010-4243", "CVE-2010-3066", "CVE-2011-1071", "CVE-2010-3880", "CVE-2010-1083", "CVE-2010-4249", "CVE-2010-4157", "CVE-2010-4161", "CVE-2011-1010", "CVE-2010-3858", "CVE-2010-3067", "CVE-2010-3699", "CVE-2010-4238", "CVE-2011-0282", "CVE-2011-1095", "CVE-2010-4255", "CVE-2010-2798", "CVE-2010-3432", "CVE-2011-1090", "CVE-2011-0536", "CVE-2010-1323", "CVE-2010-4075", "CVE-2010-4655"], "modified": "2017-04-17T00:00:00", "id": "OPENVAS:103455", "href": "http://plugins.openvas.org/nasl.php?oid=103455", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_VMSA-2011-0012.nasl 5958 2017-04-17 09:02:19Z teissa $\n#\n# VMSA-2011-0012.3 VMware ESXi and ESX updates to third party libraries and ESX Service Console\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_solution = \"Apply the missing patch(es).\n\nSee Also:\nhttp://www.vmware.com/security/advisories/VMSA-2011-0012.html\";\n\ntag_summary = \"The remote ESXi is missing one or more security related Updates from VMSA-2011-0012.3.\n\nSummary\n\nVMware ESXi and ESX updates to third party libraries and ESX Service Console address several security issues.\n\nRelevant releases\n\nESXi 5.0 without patch ESXi500-201112401-SG.\nESXi 4.1 without patch ESXi410-201110201-SG.\nESX 4.1 without patches ESX410-201110201-SG and ESX410-201110224-SG.\nESXi 4.0 without patch ESXi400-201110401-SG.\nESX 4.0 without patches ESX400-201110401-SG, ESX400-201110403-SG and ESX400-201110409-SG.\nESXi 3.5 without patch ESXe350-201203401-I-SG.\nESX 3.5 without patch ESX350-201203403-SG.\n\nProblem Description\n\na. ESX third party update for Service Console kernel\n\n This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security\n issues.\n\nb. ESX third party update for Service Console krb5 RPMs\n\n This patch updates the krb5-libs and krb5-workstation RPMs of the console OS to version 1.6.1-55.el5_6.1,\n which resolves multiple security issues.\n\nc. ESXi and ESX update to third party component glibc\n\n The glibc third-party library is updated to resolve multiple security issues.\n\nd. ESX update to third party drivers mptsas, mpt2sas, and mptspi\n\n The mptsas, mpt2sas, and mptspi drivers are updated which addresses multiple security issues in the mpt2sas\n driver.\";\n\n\nif (description)\n{\n script_id(103455);\n script_cve_id(\"CVE-2010-1083\",\"CVE-2010-2492\",\"CVE-2010-2798\",\"CVE-2010-2938\",\"CVE-2010-2942\",\"CVE-2010-2943\",\"CVE-2010-3015\",\"CVE-2010-3066\",\"CVE-2010-3067\",\"CVE-2010-3078\",\"CVE-2010-3086\",\"CVE-2010-3296\",\"CVE-2010-3432\",\"CVE-2010-3442\",\"CVE-2010-3477\",\"CVE-2010-3699\",\"CVE-2010-3858\",\"CVE-2010-3859\",\"CVE-2010-3865\",\"CVE-2010-3876\",\"CVE-2010-3877\",\"CVE-2010-3880\",\"CVE-2010-3904\",\"CVE-2010-4072\",\"CVE-2010-4073\",\"CVE-2010-4075\",\"CVE-2010-4080\",\"CVE-2010-4081\",\"CVE-2010-4083\",\"CVE-2010-4157\",\"CVE-2010-4158\",\"CVE-2010-4161\",\"CVE-2010-4238\",\"CVE-2010-4242\",\"CVE-2010-4243\",\"CVE-2010-4247\",\"CVE-2010-4248\",\"CVE-2010-4249\",\"CVE-2010-4251\",\"CVE-2010-4255\",\"CVE-2010-4263\",\"CVE-2010-4343\",\"CVE-2010-4346\",\"CVE-2010-4526\",\"CVE-2010-4655\",\"CVE-2011-0521\",\"CVE-2011-0710\",\"CVE-2011-1010\",\"CVE-2011-1090\",\"CVE-2011-1478\",\"CVE-2010-1323\",\"CVE-2011-0281\",\"CVE-2011-0282 CVE-2010-0296\",\"CVE-2011-0536\",\"CVE-2011-1071\",\"CVE-2011-1095\",\"CVE-2011-1658\",\"CVE-2011-1659 CVE-2011-1494\",\"CVE-2011-1495\");\n script_tag(name:\"cvss_base\", value:\"7.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:C/I:C/A:N\");\n script_version (\"$Revision: 5958 $\");\n script_name(\"VMSA-2011-0012.3 VMware ESXi and ESX updates to third party libraries and ESX Service Console\");\n\n script_tag(name:\"last_modification\", value:\"$Date: 2017-04-17 11:02:19 +0200 (Mon, 17 Apr 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-03-16 12:42:13 +0100 (Fri, 16 Mar 2012)\");\n script_category(ACT_GATHER_INFO);\n script_family(\"VMware Local Security Checks\");\n script_copyright(\"This script is Copyright (C) 2012 Greenbone Networks GmbH\");\n script_dependencies(\"gb_vmware_esxi_init.nasl\");\n script_mandatory_keys(\"VMware/ESXi/LSC\",\"VMware/ESX/version\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"vmware_esx.inc\");\ninclude(\"version_func.inc\");\n\nif(!get_kb_item('VMware/ESXi/LSC'))exit(0);\nif(! esxVersion = get_kb_item(\"VMware/ESX/version\"))exit(0);\n\npatches = make_array(\"4.1.0\",\"ESXi410-201110201-SG\",\n \"4.0.0\",\"ESXi400-201110401-SG\",\n \"5.0.0\",\"VIB:esx-base:5.0.0-0.3.515841\");\n\nif(!patches[esxVersion])exit(0);\n\nif(_esxi_patch_missing(esxi_version:esxVersion, patch:patches[esxVersion])) {\n\n security_message(port:0);\n exit(0);\n\n}\n\nexit(99);\n", "cvss": {"score": 7.9, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:NONE/"}}], "redhat": [{"lastseen": "2021-10-21T04:45:58", "description": "The kernel packages contain the Linux kernel, the core of any Linux\noperating system.\n\nThis update fixes the following security issues:\n\n* A NULL pointer dereference flaw was found in the igb driver in the Linux\nkernel. If both the Single Root I/O Virtualization (SR-IOV) feature and\npromiscuous mode were enabled on an interface using igb, it could result in\na denial of service when a tagged VLAN packet is received on that\ninterface. (CVE-2010-4263, Important)\n\n* A missing sanity check was found in vbd_create() in the Xen hypervisor\nimplementation. As CD-ROM drives are not supported by the blkback back-end\ndriver, attempting to use a virtual CD-ROM drive with blkback could trigger\na denial of service (crash) on the host system running the Xen hypervisor.\n(CVE-2010-4238, Moderate)\n\n* A flaw was found in the Linux kernel execve() system call implementation.\nA local, unprivileged user could cause large amounts of memory to be\nallocated but not visible to the OOM (Out of Memory) killer, triggering a\ndenial of service. (CVE-2010-4243, Moderate)\n\n* A flaw was found in fixup_page_fault() in the Xen hypervisor\nimplementation. If a 64-bit para-virtualized guest accessed a certain area\nof memory, it could cause a denial of service on the host system running\nthe Xen hypervisor. (CVE-2010-4255, Moderate)\n\n* A missing initialization flaw was found in the bfa driver used by Brocade\nFibre Channel Host Bus Adapters. A local, unprivileged user could use this\nflaw to cause a denial of service by reading a file in the\n\"/sys/class/fc_host/host#/statistics/\" directory. (CVE-2010-4343, Moderate)\n\n* Missing initialization flaws in the Linux kernel could lead to\ninformation leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072,\nCVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158,\nLow)\n\nRed Hat would like to thank Kosuke Tatsukawa for reporting CVE-2010-4263;\nVladymyr Denysov for reporting CVE-2010-4238; Brad Spengler for reporting\nCVE-2010-4243; Dan Rosenberg for reporting CVE-2010-3296, CVE-2010-4073,\nCVE-2010-4075, CVE-2010-4080, CVE-2010-4081, and CVE-2010-4158; Vasiliy\nKulikov for reporting CVE-2010-3877; and Kees Cook for reporting\nCVE-2010-4072.\n\nThese updated packages also include several hundred bug fixes for and\nenhancements to the Linux kernel. Space precludes documenting each of these\nchanges in this advisory and users are directed to the Red Hat Enterprise\nLinux 5.6 Release Notes for information on the most significant of these\nchanges:\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Release_Notes/index.html\n\nRefer to the kernel chapter in the Red Hat Enterprise Linux 5.6 Technical\nNotes for further information:\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Technical_Notes/kernel.html\n\nAll Red Hat Enterprise Linux 5 users are advised to install these updated\npackages, which address these vulnerabilities as well as fixing the bugs\nand adding the enhancements noted in the Red Hat Enterprise Linux 5.6\nRelease Notes and Technical Notes. The system must be rebooted for this\nupdate to take effect.\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 5.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2011-01-13T00:00:00", "type": "redhat", "title": "(RHSA-2011:0017) Important: Red Hat Enterprise Linux 5.6 kernel security and bug fix update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.9, "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-3296", "CVE-2010-3877", "CVE-2010-4072", "CVE-2010-4073", "CVE-2010-4075", "CVE-2010-4080", "CVE-2010-4081", "CVE-2010-4158", "CVE-2010-4238", "CVE-2010-4243", "CVE-2010-4255", "CVE-2010-4263", "CVE-2010-4343"], "modified": "2017-09-08T08:09:36", "id": "RHSA-2011:0017", "href": "https://access.redhat.com/errata/RHSA-2011:0017", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2023-02-15T14:54:36", "description": "Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the sixth regular update.\n\nThe Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nThis update fixes the following security issues :\n\n* A NULL pointer dereference flaw was found in the igb driver in the Linux kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and promiscuous mode were enabled on an interface using igb, it could result in a denial of service when a tagged VLAN packet is received on that interface. (CVE-2010-4263, Important)\n\n* A missing sanity check was found in vbd_create() in the Xen hypervisor implementation. As CD-ROM drives are not supported by the blkback back-end driver, attempting to use a virtual CD-ROM drive with blkback could trigger a denial of service (crash) on the host system running the Xen hypervisor. (CVE-2010-4238, Moderate)\n\n* A flaw was found in the Linux kernel execve() system call implementation. A local, unprivileged user could cause large amounts of memory to be allocated but not visible to the OOM (Out of Memory) killer, triggering a denial of service. (CVE-2010-4243, Moderate)\n\n* A flaw was found in fixup_page_fault() in the Xen hypervisor implementation. If a 64-bit para-virtualized guest accessed a certain area of memory, it could cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-4255, Moderate)\n\n* A missing initialization flaw was found in the bfa driver used by Brocade Fibre Channel Host Bus Adapters. A local, unprivileged user could use this flaw to cause a denial of service by reading a file in the '/sys/class/fc_host/host#/statistics/' directory. (CVE-2010-4343, Moderate)\n\n* Missing initialization flaws in the Linux kernel could lead to information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158, Low)\n\nRed Hat would like to thank Kosuke Tatsukawa for reporting CVE-2010-4263; Vladymyr Denysov for reporting CVE-2010-4238; Brad Spengler for reporting CVE-2010-4243; Dan Rosenberg for reporting CVE-2010-3296, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, and CVE-2010-4158; Vasiliy Kulikov for reporting CVE-2010-3877; and Kees Cook for reporting CVE-2010-4072.\n\nThese updated packages also include several hundred bug fixes for and enhancements to the Linux kernel. Space precludes documenting each of these changes in this advisory and users are directed to the Red Hat Enterprise Linux 5.6 Release Notes for information on the most significant of these changes :\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/ 5.6_Release_Notes/index.html\n\nRefer to the kernel chapter in the Red Hat Enterprise Linux 5.6 Technical Notes for further information :\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/ 5.6_Technical_Notes/kernel.html\n\nAll Red Hat Enterprise Linux 5 users are advised to install these updated packages, which address these vulnerabilities as well as fixing the bugs and adding the enhancements noted in the Red Hat Enterprise Linux 5.6 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2011-01-14T00:00:00", "type": "nessus", "title": "RHEL 5 : kernel (RHSA-2011:0017)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.9, "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-3296", "CVE-2010-3877", "CVE-2010-4072", "CVE-2010-4073", "CVE-2010-4075", "CVE-2010-4080", "CVE-2010-4081", "CVE-2010-4158", "CVE-2010-4238", "CVE-2010-4243", "CVE-2010-4255", "CVE-2010-4263", "CVE-2010-4343"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:kernel", "p-cpe:/a:redhat:enterprise_linux:kernel-PAE", "p-cpe:/a:redhat:enterprise_linux:kernel-PAE-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-debug", "p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-doc", "p-cpe:/a:redhat:enterprise_linux:kernel-headers", "p-cpe:/a:redhat:enterprise_linux:kernel-kdump", "p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel", "p-cpe:/a:redhat:enterprise_linux:kernel-xen", "p-cpe:/a:redhat:enterprise_linux:kernel-xen-devel", "cpe:/o:redhat:enterprise_linux:5"], "id": "REDHAT-RHSA-2011-0017.NASL", "href": "https://www.tenable.com/plugins/nessus/51522", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2011:0017. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(51522);\n script_version(\"1.23\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-3296\", \"CVE-2010-3877\", \"CVE-2010-4072\", \"CVE-2010-4073\", \"CVE-2010-4075\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4158\", \"CVE-2010-4238\", \"CVE-2010-4243\", \"CVE-2010-4255\", \"CVE-2010-4263\", \"CVE-2010-4343\");\n script_bugtraq_id(43221, 43806, 44630, 44758, 45004, 45054, 45058, 45063, 45073, 45099, 45208, 45262);\n script_xref(name:\"RHSA\", value:\"2011:0017\");\n\n script_name(english:\"RHEL 5 : kernel (RHSA-2011:0017)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated kernel packages that fix multiple security issues, address\nseveral hundred bugs, and add numerous enhancements are now available\nas part of the ongoing support and maintenance of Red Hat Enterprise\nLinux version 5. This is the sixth regular update.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS)\nbase scores, which give detailed severity ratings, are available for\neach vulnerability from the CVE links in the References section.\n\nThe kernel packages contain the Linux kernel, the core of any Linux\noperating system.\n\nThis update fixes the following security issues :\n\n* A NULL pointer dereference flaw was found in the igb driver in the\nLinux kernel. If both the Single Root I/O Virtualization (SR-IOV)\nfeature and promiscuous mode were enabled on an interface using igb,\nit could result in a denial of service when a tagged VLAN packet is\nreceived on that interface. (CVE-2010-4263, Important)\n\n* A missing sanity check was found in vbd_create() in the Xen\nhypervisor implementation. As CD-ROM drives are not supported by the\nblkback back-end driver, attempting to use a virtual CD-ROM drive with\nblkback could trigger a denial of service (crash) on the host system\nrunning the Xen hypervisor. (CVE-2010-4238, Moderate)\n\n* A flaw was found in the Linux kernel execve() system call\nimplementation. A local, unprivileged user could cause large amounts\nof memory to be allocated but not visible to the OOM (Out of Memory)\nkiller, triggering a denial of service. (CVE-2010-4243, Moderate)\n\n* A flaw was found in fixup_page_fault() in the Xen hypervisor\nimplementation. If a 64-bit para-virtualized guest accessed a certain\narea of memory, it could cause a denial of service on the host system\nrunning the Xen hypervisor. (CVE-2010-4255, Moderate)\n\n* A missing initialization flaw was found in the bfa driver used by\nBrocade Fibre Channel Host Bus Adapters. A local, unprivileged user\ncould use this flaw to cause a denial of service by reading a file in\nthe '/sys/class/fc_host/host#/statistics/' directory. (CVE-2010-4343,\nModerate)\n\n* Missing initialization flaws in the Linux kernel could lead to\ninformation leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072,\nCVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081,\nCVE-2010-4158, Low)\n\nRed Hat would like to thank Kosuke Tatsukawa for reporting\nCVE-2010-4263; Vladymyr Denysov for reporting CVE-2010-4238; Brad\nSpengler for reporting CVE-2010-4243; Dan Rosenberg for reporting\nCVE-2010-3296, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080,\nCVE-2010-4081, and CVE-2010-4158; Vasiliy Kulikov for reporting\nCVE-2010-3877; and Kees Cook for reporting CVE-2010-4072.\n\nThese updated packages also include several hundred bug fixes for and\nenhancements to the Linux kernel. Space precludes documenting each of\nthese changes in this advisory and users are directed to the Red Hat\nEnterprise Linux 5.6 Release Notes for information on the most\nsignificant of these changes :\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/\n5.6_Release_Notes/index.html\n\nRefer to the kernel chapter in the Red Hat Enterprise Linux 5.6\nTechnical Notes for further information :\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/\n5.6_Technical_Notes/kernel.html\n\nAll Red Hat Enterprise Linux 5 users are advised to install these\nupdated packages, which address these vulnerabilities as well as\nfixing the bugs and adding the enhancements noted in the Red Hat\nEnterprise Linux 5.6 Release Notes and Technical Notes. The system\nmust be rebooted for this update to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-3296\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-3877\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4072\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4073\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4075\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4081\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4238\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4243\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4255\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4263\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2010-4343\"\n );\n # http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?056c0c27\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2011:0017\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-PAE\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-PAE-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-kdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/09/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/01/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/01/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2010-3296\", \"CVE-2010-3877\", \"CVE-2010-4072\", \"CVE-2010-4073\", \"CVE-2010-4075\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4158\", \"CVE-2010-4238\", \"CVE-2010-4243\", \"CVE-2010-4255\", \"CVE-2010-4263\", \"CVE-2010-4343\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for RHSA-2011:0017\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2011:0017\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"kernel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"kernel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-PAE-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-PAE-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-debug-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"kernel-debug-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"kernel-debug-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-debug-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"kernel-debug-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"kernel-debug-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"kernel-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"kernel-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", reference:\"kernel-doc-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"kernel-headers-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"kernel-headers-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"kernel-headers-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"kernel-kdump-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"kernel-kdump-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-xen-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"kernel-xen-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"i686\", reference:\"kernel-xen-devel-2.6.18-238.el5\")) flag++;\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"kernel-xen-devel-2.6.18-238.el5\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel / kernel-PAE / kernel-PAE-devel / kernel-debug / etc\");\n }\n}\n", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-14T14:18:46", "description": "Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.\n(CVE-2010-3865)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)\n\nIt was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)\n\nKrishna Gudipati discovered that the bfa adapter driver did not correctly initialize certain structures. A local attacker could read files in /sys to crash the system, leading to a denial of service.\n(CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks.\n(CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain unreachable messages. If a remote attacker were able to acquire a socket lock, they could send specially crafted traffic that would crash the system, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's handling of TKIP countermeasures. This reduces the amount of time an attacker needs breach a wireless network using WPA+TKIP for security.\n(CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)\n\nA flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2011-03-03T00:00:00", "type": "nessus", "title": "Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1080-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-3865", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-4248", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4527", "CVE-2010-4648", "CVE-2010-4649", "CVE-2010-4650", "CVE-2011-0006", "CVE-2011-1044"], "modified": "2019-09-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-ec2-doc", "p-cpe:/a:canonical:ubuntu_linux:linux-ec2-source-2.6.32", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-ec2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-ec2", "cpe:/o:canonical:ubuntu_linux:10.04:-:lts"], "id": "UBUNTU_USN-1080-2.NASL", "href": "https://www.tenable.com/plugins/nessus/52528", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-1080-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(52528);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/09/19 12:54:26\");\n\n script_cve_id(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2011-0006\", \"CVE-2011-1044\");\n script_bugtraq_id(44549, 44630, 44665, 45028, 45262, 45323, 45629, 45661, 46073, 46488);\n script_xref(name:\"USN\", value:\"1080-2\");\n\n script_name(english:\"Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1080-2)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Thomas Pollet discovered that the RDS network protocol did not check\ncertain iovec buffers. A local attacker could exploit this to crash\nthe system or possibly execute arbitrary code as the root user.\n(CVE-2010-3865)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation\ndid not correctly clear kernel memory. A local attacker could exploit\nthis to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets\nimplementation did not properly initialize certain structures. A local\nattacker could exploit this to read kernel stack memory, leading to a\nloss of privacy. (CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly\ninitialize certain structures. A local attacker could exploit this to\nread kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did\nnot properly audit certain bytecodes in netlink messages. A local\nattacker could exploit this to cause the kernel to hang, leading to a\ndenial of service. (CVE-2010-3880)\n\nIt was discovered that multithreaded exec did not handle CPU timers\ncorrectly. A local attacker could exploit this to crash the system,\nleading to a denial of service. (CVE-2010-4248)\n\nKrishna Gudipati discovered that the bfa adapter driver did not\ncorrectly initialize certain structures. A local attacker could read\nfiles in /sys to crash the system, leading to a denial of service.\n(CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function\ncould bypass the mmap_min_addr restriction. A local attacker could\nexploit this to mmap 4096 bytes below the mmap_min_addr area, possibly\nimproving the chances of performing NULL pointer dereference attacks.\n(CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain\nunreachable messages. If a remote attacker were able to acquire a\nsocket lock, they could send specially crafted traffic that would\ncrash the system, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name\ntermination correctly. A local attacker could exploit this crash the\nsystem or gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's\nhandling of TKIP countermeasures. This reduces the amount of time an\nattacker needs breach a wireless network using WPA+TKIP for security.\n(CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly\nhandle certain requests. A local user could exploit this to crash the\nsystem or potentially gain root privileges. (CVE-2010-4649,\nCVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character\ndevice in Userspace). A local attacker might exploit this flaw to\nescalate privilege, if access to /dev/cuse has been modified to allow\nnon-root users. (CVE-2010-4650)\n\nA flaw was found in the kernel's Integrity Measurement Architecture\n(IMA). Changes made by an attacker might not be discovered by IMA, if\nSELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/1080-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-ec2-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-ec2-source-2.6.32\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-ec2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-ec2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/11/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/03/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/03/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(10\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 10.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2011-0006\", \"CVE-2011-1044\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-1080-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-ec2-doc\", pkgver:\"2.6.32-313.26\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-ec2-source-2.6.32\", pkgver:\"2.6.32-313.26\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-313\", pkgver:\"2.6.32-313.26\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-313-ec2\", pkgver:\"2.6.32-313.26\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-313-ec2\", pkgver:\"2.6.32-313.26\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-ec2-doc / linux-ec2-source-2.6.32 / linux-headers-2.6 / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-14T14:19:18", "description": "Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.\n(CVE-2010-3865)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)\n\nIt was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)\n\nKrishna Gudipati discovered that the bfa adapter driver did not correctly initialize certain structures. A local attacker could read files in /sys to crash the system, leading to a denial of service.\n(CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks.\n(CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain unreachable messages. If a remote attacker were able to acquire a socket lock, they could send specially crafted traffic that would crash the system, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's handling of TKIP countermeasures. This reduces the amount of time an attacker needs breach a wireless network using WPA+TKIP for security.\n(CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)\n\nA flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2011-03-02T00:00:00", "type": "nessus", "title": "Ubuntu 10.04 LTS : linux vulnerabilities (USN-1080-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-3865", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-4248", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4527", "CVE-2010-4648", "CVE-2010-4649", "CVE-2010-4650", "CVE-2011-0006", "CVE-2011-1044"], "modified": "2019-09-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-doc", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-generic-pae", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-preempt", "p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-server", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-generic-pae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-lpia", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-preempt", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-server", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-versatile", "p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-virtual", "p-cpe:/a:canonical:ubuntu_linux:linux-libc-dev", "p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.32", "p-cpe:/a:canonical:ubuntu_linux:linux-tools-2.6", "p-cpe:/a:canonical:ubuntu_linux:linux-tools-common", "cpe:/o:canonical:ubuntu_linux:10.04:-:lts"], "id": "UBUNTU_USN-1080-1.NASL", "href": "https://www.tenable.com/plugins/nessus/52499", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-1080-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(52499);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/09/19 12:54:26\");\n\n script_cve_id(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2011-0006\", \"CVE-2011-1044\");\n script_bugtraq_id(44549, 44630, 44665, 45028, 45262, 45323, 45629, 45661, 46073, 46488);\n script_xref(name:\"USN\", value:\"1080-1\");\n\n script_name(english:\"Ubuntu 10.04 LTS : linux vulnerabilities (USN-1080-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Thomas Pollet discovered that the RDS network protocol did not check\ncertain iovec buffers. A local attacker could exploit this to crash\nthe system or possibly execute arbitrary code as the root user.\n(CVE-2010-3865)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation\ndid not correctly clear kernel memory. A local attacker could exploit\nthis to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets\nimplementation did not properly initialize certain structures. A local\nattacker could exploit this to read kernel stack memory, leading to a\nloss of privacy. (CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly\ninitialize certain structures. A local attacker could exploit this to\nread kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did\nnot properly audit certain bytecodes in netlink messages. A local\nattacker could exploit this to cause the kernel to hang, leading to a\ndenial of service. (CVE-2010-3880)\n\nIt was discovered that multithreaded exec did not handle CPU timers\ncorrectly. A local attacker could exploit this to crash the system,\nleading to a denial of service. (CVE-2010-4248)\n\nKrishna Gudipati discovered that the bfa adapter driver did not\ncorrectly initialize certain structures. A local attacker could read\nfiles in /sys to crash the system, leading to a denial of service.\n(CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function\ncould bypass the mmap_min_addr restriction. A local attacker could\nexploit this to mmap 4096 bytes below the mmap_min_addr area, possibly\nimproving the chances of performing NULL pointer dereference attacks.\n(CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain\nunreachable messages. If a remote attacker were able to acquire a\nsocket lock, they could send specially crafted traffic that would\ncrash the system, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name\ntermination correctly. A local attacker could exploit this crash the\nsystem or gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's\nhandling of TKIP countermeasures. This reduces the amount of time an\nattacker needs breach a wireless network using WPA+TKIP for security.\n(CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly\nhandle certain requests. A local user could exploit this to crash the\nsystem or potentially gain root privileges. (CVE-2010-4649,\nCVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character\ndevice in Userspace). A local attacker might exploit this flaw to\nescalate privilege, if access to /dev/cuse has been modified to allow\nnon-root users. (CVE-2010-4650)\n\nA flaw was found in the kernel's Integrity Measurement Architecture\n(IMA). Changes made by an attacker might not be discovered by IMA, if\nSELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/1080-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-generic-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-preempt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-headers-2.6-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-generic-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-lpia\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-preempt\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-versatile\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-virtual\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-libc-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-source-2.6.32\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-tools-2.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-tools-common\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/11/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/03/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/03/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(10\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 10.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2010-3865\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-4248\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2011-0006\", \"CVE-2011-1044\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-1080-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-doc\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-29\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-29-386\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-29-generic\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-29-generic-pae\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-29-preempt\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-headers-2.6.32-29-server\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-386\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-generic\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-generic-pae\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-lpia\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-preempt\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-server\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-versatile\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-29-virtual\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-libc-dev\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-source-2.6.32\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-tools-2.6.32-29\", pkgver:\"2.6.32-29.58\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-tools-common\", pkgver:\"2.6.32-29.58\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-doc / linux-headers-2.6 / linux-headers-2.6-386 / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-18T14:32:54", "description": "The openSUSE 11.3 kernel was updated to 2.6.34.8 to fix various bugs and security issues.\n\nFollowing security issues have been fixed: CVE-2011-1493: In the rose networking stack, when parsing the FAC_NATIONAL_DIGIS facilities field, it was possible for a remote host to provide more digipeaters than expected, resulting in heap corruption. Check against ROSE_MAX_DIGIS to prevent overflows, and abort facilities parsing on failure.\n\nCVE-2011-1182: Local attackers could send signals to their programs that looked like coming from the kernel, potentially gaining privileges in the context of setuid programs.\n\nCVE-2011-1082: The epoll subsystem in Linux did not prevent users from creating circular epoll file structures, potentially leading to a denial of service (kernel deadlock).\n\nCVE-2011-1478: An issue in the core GRO code where an skb belonging to an unknown VLAN is reused could result in a NULL pointer dereference.\n\nCVE-2011-1163: The code for evaluating OSF partitions (in fs/partitions/osf.c) contained a bug that leaks data from kernel heap memory to userspace for certain corrupted OSF partitions.\n\nCVE-2011-1012: The code for evaluating LDM partitions (in fs/partitions/ldm.c) contained a bug that could crash the kernel for certain corrupted LDM partitions.\n\nCVE-2011-1010: The code for evaluating Mac partitions (in fs/partitions/mac.c) contained a bug that could crash the kernel for certain corrupted Mac partitions.\n\nCVE-2011-1476: Specially crafted requests may be written to /dev/sequencer resulting in an underflow when calculating a size for a copy_from_user() operation in the driver for MIDI interfaces. On x86, this just returns an error, but it could have caused memory corruption on other architectures. Other malformed requests could have resulted in the use of uninitialized variables.\n\nCVE-2011-1477: Due to a failure to validate user-supplied indexes in the driver for Yamaha YM3812 and OPL-3 chips, a specially crafted ioctl request could have been sent to /dev/sequencer, resulting in reading and writing beyond the bounds of heap buffers, and potentially allowing privilege escalation.\n\nCVE-2011-0191: A information leak in the XFS geometry calls could be used by local attackers to gain access to kernel information.\n\nCVE-2011-1090: A page allocator issue in NFS v4 ACL handling that could lead to a denial of service (crash) was fixed.\n\nCVE-2010-3880: net/ipv4/inet_diag.c in the Linux kernel did not properly audit INET_DIAG bytecode, which allowed local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions.\n\nCVE-2010-4656: Fixed a buffer size issue in 'usb iowarrior' module, where a malicious device could overflow a kernel buffer.\n\nCVE-2011-0521: The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel did not check the sign of a certain integer field, which allowed local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.\n\nCVE-2010-3875: The ax25_getname function in net/ax25/af_ax25.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.\n\nCVE-2010-3876: net/packet/af_packet.c in the Linux kernel did not properly initialize certain structure members, which allowed local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_RAW capability to read copies of the applicable structures.\n\nCVE-2010-3877: The get_name function in net/tipc/socket.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.\n\nCVE-2010-3705: The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel did not properly validate the hmac_ids array of an SCTP peer, which allowed remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.\n\nCVE-2011-0711: A stack memory information leak in the xfs FSGEOMETRY_V1 ioctl was fixed.\n\nCVE-2011-0712: Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel might have allowed attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.\n\nCVE-2010-4525: Linux kernel did not initialize the kvm_vcpu_events->interrupt.pad structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors.\n\nCVE-2010-3881: arch/x86/kvm/x86.c in the Linux kernel did not initialize certain structure members, which allowed local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device.\n\nCVE-2010-4075: The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.\n\nCVE-2010-4076: The rs_ioctl function in drivers/char/amiserial.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.\n\nCVE-2010-4077: The ntty_ioctl_tiocgicount function in drivers/char/nozomi.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.\n\nCVE-2010-4248: Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel allowed local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c.\n\nCVE-2010-4243: fs/exec.c in the Linux kernel did not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an 'OOM dodging issue,' a related issue to CVE-2010-3858.\n\nCVE-2010-4251: A system out of memory condition (denial of service) could be triggered with a large socket backlog, exploitable by local users. This has been addressed by backlog limiting.\n\nCVE-2010-4648: Fixed cryptographic weakness potentially leaking information to remote (but physically nearby) users in the orinoco wireless driver.\n\nCVE-2010-4527: The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel incorrectly expected that a certain name field ends with a '\\0' character, which allowed local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.\n\nCVE-2010-4668: The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel allowed local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device, related to an unaligned map. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4163.\n\nCVE-2010-4650: A kernel buffer overflow in the cuse server module was fixed, which might have allowed local privilege escalation. However only CUSE servers could exploit it and /dev/cuse is normally restricted to root.\n\nCVE-2010-4649: Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel allowed local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.\n\nCVE-2010-4250: A memory leak within inotify could be used by local attackers to cause the machine to run out of memory (denial of service).\n\nCVE-2010-4346: The install_special_mapping function in mm/mmap.c in the Linux kernel did not make an expected security_file_mmap function call, which allowed local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.\n\nCVE-2010-4529: Integer underflow in the irda_getsockopt function in net/irda/af_irda.c in the Linux kernel on platforms other than x86 allowed local users to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.\n\nCVE-2010-4342: The aun_incoming function in net/econet/af_econet.c in the Linux kernel, when Econet is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending an Acorn Universal Networking (AUN) packet over UDP.\n\nCVE-2010-3849: The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel, when an econet address is configured, allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.\n\nCVE-2010-3848: Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel when an econet address is configured, allowed local users to gain privileges by providing a large number of iovec structures.\n\nCVE-2010-3850: The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel did not require the CAP_NET_ADMIN capability, which allowed local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.\n\nCVE-2010-4343: drivers/scsi/bfa/bfa_core.c in the Linux kernel did not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.\n\nCVE-2010-3699: The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly, related to (1) netback, (2) blkback, or (3) blktap.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2014-06-13T00:00:00", "type": "nessus", "title": "openSUSE Security Update : kernel (openSUSE-SU-2011:0399-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-3699", "CVE-2010-3705", "CVE-2010-3848", "CVE-2010-3849", "CVE-2010-3850", "CVE-2010-3858", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-3881", "CVE-2010-4075", "CVE-2010-4076", "CVE-2010-4077", "CVE-2010-4163", "CVE-2010-4243", "CVE-2010-4248", "CVE-2010-4250", "CVE-2010-4251", "CVE-2010-4342", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4525", "CVE-2010-4527", "CVE-2010-4529", "CVE-2010-4648", "CVE-2010-4649", "CVE-2010-4650", "CVE-2010-4656", "CVE-2010-4668", "CVE-2011-0191", "CVE-2011-0521", "CVE-2011-0711", "CVE-2011-0712", "CVE-2011-1010", "CVE-2011-1012", "CVE-2011-1082", "CVE-2011-1090", "CVE-2011-1163", "CVE-2011-1182", "CVE-2011-1476", "CVE-2011-1477", "CVE-2011-1478", "CVE-2011-1493"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:kernel-debug", "p-cpe:/a:novell:opensuse:kernel-debug-base", "p-cpe:/a:novell:opensuse:kernel-debug-devel", "p-cpe:/a:novell:opensuse:kernel-default", "p-cpe:/a:novell:opensuse:kernel-default-base", "p-cpe:/a:novell:opensuse:kernel-default-devel", "p-cpe:/a:novell:opensuse:kernel-desktop", "p-cpe:/a:novell:opensuse:kernel-desktop-base", "p-cpe:/a:novell:opensuse:kernel-desktop-devel", "p-cpe:/a:novell:opensuse:kernel-devel", "p-cpe:/a:novell:opensuse:kernel-ec2", "p-cpe:/a:novell:opensuse:kernel-ec2-base", "p-cpe:/a:novell:opensuse:kernel-ec2-devel", "p-cpe:/a:novell:opensuse:kernel-ec2-extra", "p-cpe:/a:novell:opensuse:kernel-pae", "p-cpe:/a:novell:opensuse:kernel-pae-base", "p-cpe:/a:novell:opensuse:kernel-pae-devel", "p-cpe:/a:novell:opensuse:kernel-source", "p-cpe:/a:novell:opensuse:kernel-source-vanilla", "p-cpe:/a:novell:opensuse:kernel-syms", "p-cpe:/a:novell:opensuse:kernel-trace", "p-cpe:/a:novell:opensuse:kernel-trace-base", "p-cpe:/a:novell:opensuse:kernel-trace-devel", "p-cpe:/a:novell:opensuse:kernel-vanilla", "p-cpe:/a:novell:opensuse:kernel-vanilla-base", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel", "p-cpe:/a:novell:opensuse:kernel-vmi", "p-cpe:/a:novell:opensuse:kernel-vmi-base", "p-cpe:/a:novell:opensuse:kernel-vmi-devel", "p-cpe:/a:novell:opensuse:kernel-xen", "p-cpe:/a:novell:opensuse:kernel-xen-base", "p-cpe:/a:novell:opensuse:kernel-xen-devel", "p-cpe:/a:novell:opensuse:preload-kmp-default", "p-cpe:/a:novell:opensuse:preload-kmp-desktop", "cpe:/o:novell:opensuse:11.3"], "id": "SUSE_11_3_KERNEL-110414.NASL", "href": "https://www.tenable.com/plugins/nessus/75554", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update kernel-4374.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75554);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-3699\", \"CVE-2010-3705\", \"CVE-2010-3848\", \"CVE-2010-3849\", \"CVE-2010-3850\", \"CVE-2010-3858\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-3881\", \"CVE-2010-4075\", \"CVE-2010-4076\", \"CVE-2010-4077\", \"CVE-2010-4163\", \"CVE-2010-4243\", \"CVE-2010-4248\", \"CVE-2010-4250\", \"CVE-2010-4251\", \"CVE-2010-4342\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4525\", \"CVE-2010-4527\", \"CVE-2010-4529\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2010-4656\", \"CVE-2010-4668\", \"CVE-2011-0191\", \"CVE-2011-0521\", \"CVE-2011-0711\", \"CVE-2011-0712\", \"CVE-2011-1010\", \"CVE-2011-1012\", \"CVE-2011-1082\", \"CVE-2011-1090\", \"CVE-2011-1163\", \"CVE-2011-1182\", \"CVE-2011-1476\", \"CVE-2011-1477\", \"CVE-2011-1478\", \"CVE-2011-1493\");\n\n script_name(english:\"openSUSE Security Update : kernel (openSUSE-SU-2011:0399-1)\");\n script_summary(english:\"Check for the kernel-4374 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE 11.3 kernel was updated to 2.6.34.8 to fix various bugs\nand security issues.\n\nFollowing security issues have been fixed: CVE-2011-1493: In the rose\nnetworking stack, when parsing the FAC_NATIONAL_DIGIS facilities\nfield, it was possible for a remote host to provide more digipeaters\nthan expected, resulting in heap corruption. Check against\nROSE_MAX_DIGIS to prevent overflows, and abort facilities parsing on\nfailure.\n\nCVE-2011-1182: Local attackers could send signals to their programs\nthat looked like coming from the kernel, potentially gaining\nprivileges in the context of setuid programs.\n\nCVE-2011-1082: The epoll subsystem in Linux did not prevent users from\ncreating circular epoll file structures, potentially leading to a\ndenial of service (kernel deadlock).\n\nCVE-2011-1478: An issue in the core GRO code where an skb belonging to\nan unknown VLAN is reused could result in a NULL pointer dereference.\n\nCVE-2011-1163: The code for evaluating OSF partitions (in\nfs/partitions/osf.c) contained a bug that leaks data from kernel heap\nmemory to userspace for certain corrupted OSF partitions.\n\nCVE-2011-1012: The code for evaluating LDM partitions (in\nfs/partitions/ldm.c) contained a bug that could crash the kernel for\ncertain corrupted LDM partitions.\n\nCVE-2011-1010: The code for evaluating Mac partitions (in\nfs/partitions/mac.c) contained a bug that could crash the kernel for\ncertain corrupted Mac partitions.\n\nCVE-2011-1476: Specially crafted requests may be written to\n/dev/sequencer resulting in an underflow when calculating a size for a\ncopy_from_user() operation in the driver for MIDI interfaces. On x86,\nthis just returns an error, but it could have caused memory corruption\non other architectures. Other malformed requests could have resulted\nin the use of uninitialized variables.\n\nCVE-2011-1477: Due to a failure to validate user-supplied indexes in\nthe driver for Yamaha YM3812 and OPL-3 chips, a specially crafted\nioctl request could have been sent to /dev/sequencer, resulting in\nreading and writing beyond the bounds of heap buffers, and potentially\nallowing privilege escalation.\n\nCVE-2011-0191: A information leak in the XFS geometry calls could be\nused by local attackers to gain access to kernel information.\n\nCVE-2011-1090: A page allocator issue in NFS v4 ACL handling that\ncould lead to a denial of service (crash) was fixed.\n\nCVE-2010-3880: net/ipv4/inet_diag.c in the Linux kernel did not\nproperly audit INET_DIAG bytecode, which allowed local users to cause\na denial of service (kernel infinite loop) via crafted\nINET_DIAG_REQ_BYTECODE instructions in a netlink message that contains\nmultiple attribute elements, as demonstrated by INET_DIAG_BC_JMP\ninstructions.\n\nCVE-2010-4656: Fixed a buffer size issue in 'usb iowarrior' module,\nwhere a malicious device could overflow a kernel buffer.\n\nCVE-2011-0521: The dvb_ca_ioctl function in\ndrivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel did not check\nthe sign of a certain integer field, which allowed local users to\ncause a denial of service (memory corruption) or possibly have\nunspecified other impact via a negative value.\n\nCVE-2010-3875: The ax25_getname function in net/ax25/af_ax25.c in the\nLinux kernel did not initialize a certain structure, which allowed\nlocal users to obtain potentially sensitive information from kernel\nstack memory by reading a copy of this structure.\n\nCVE-2010-3876: net/packet/af_packet.c in the Linux kernel did not\nproperly initialize certain structure members, which allowed local\nusers to obtain potentially sensitive information from kernel stack\nmemory by leveraging the CAP_NET_RAW capability to read copies of the\napplicable structures.\n\nCVE-2010-3877: The get_name function in net/tipc/socket.c in the Linux\nkernel did not initialize a certain structure, which allowed local\nusers to obtain potentially sensitive information from kernel stack\nmemory by reading a copy of this structure.\n\nCVE-2010-3705: The sctp_auth_asoc_get_hmac function in net/sctp/auth.c\nin the Linux kernel did not properly validate the hmac_ids array of an\nSCTP peer, which allowed remote attackers to cause a denial of service\n(memory corruption and panic) via a crafted value in the last element\nof this array.\n\nCVE-2011-0711: A stack memory information leak in the xfs\nFSGEOMETRY_V1 ioctl was fixed.\n\nCVE-2011-0712: Multiple buffer overflows in the caiaq Native\nInstruments USB audio functionality in the Linux kernel might have\nallowed attackers to cause a denial of service or possibly have\nunspecified other impact via a long USB device name, related to (1)\nthe snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and\n(2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.\n\nCVE-2010-4525: Linux kernel did not initialize the\nkvm_vcpu_events->interrupt.pad structure member, which allowed local\nusers to obtain potentially sensitive information from kernel stack\nmemory via unspecified vectors.\n\nCVE-2010-3881: arch/x86/kvm/x86.c in the Linux kernel did not\ninitialize certain structure members, which allowed local users to\nobtain potentially sensitive information from kernel stack memory via\nread operations on the /dev/kvm device.\n\nCVE-2010-4075: The uart_get_count function in\ndrivers/serial/serial_core.c in the Linux kernel did not properly\ninitialize a certain structure member, which allowed local users to\nobtain potentially sensitive information from kernel stack memory via\na TIOCGICOUNT ioctl call.\n\nCVE-2010-4076: The rs_ioctl function in drivers/char/amiserial.c in\nthe Linux kernel did not properly initialize a certain structure\nmember, which allowed local users to obtain potentially sensitive\ninformation from kernel stack memory via a TIOCGICOUNT ioctl call.\n\nCVE-2010-4077: The ntty_ioctl_tiocgicount function in\ndrivers/char/nozomi.c in the Linux kernel did not properly initialize\na certain structure member, which allowed local users to obtain\npotentially sensitive information from kernel stack memory via a\nTIOCGICOUNT ioctl call.\n\nCVE-2010-4248: Race condition in the __exit_signal function in\nkernel/exit.c in the Linux kernel allowed local users to cause a\ndenial of service via vectors related to multithreaded exec, the use\nof a thread group leader in kernel/posix-cpu-timers.c, and the\nselection of a new thread group leader in the de_thread function in\nfs/exec.c.\n\nCVE-2010-4243: fs/exec.c in the Linux kernel did not enable the OOM\nKiller to assess use of stack memory by arrays representing the (1)\narguments and (2) environment, which allows local users to cause a\ndenial of service (memory consumption) via a crafted exec system call,\naka an 'OOM dodging issue,' a related issue to CVE-2010-3858.\n\nCVE-2010-4251: A system out of memory condition (denial of service)\ncould be triggered with a large socket backlog, exploitable by local\nusers. This has been addressed by backlog limiting.\n\nCVE-2010-4648: Fixed cryptographic weakness potentially leaking\ninformation to remote (but physically nearby) users in the orinoco\nwireless driver.\n\nCVE-2010-4527: The load_mixer_volumes function in\nsound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel\nincorrectly expected that a certain name field ends with a '\\0'\ncharacter, which allowed local users to conduct buffer overflow\nattacks and gain privileges, or possibly obtain sensitive information\nfrom kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.\n\nCVE-2010-4668: The blk_rq_map_user_iov function in block/blk-map.c in\nthe Linux kernel allowed local users to cause a denial of service\n(panic) via a zero-length I/O request in a device ioctl to a SCSI\ndevice, related to an unaligned map. NOTE: this vulnerability exists\nbecause of an incomplete fix for CVE-2010-4163.\n\nCVE-2010-4650: A kernel buffer overflow in the cuse server module was\nfixed, which might have allowed local privilege escalation. However\nonly CUSE servers could exploit it and /dev/cuse is normally\nrestricted to root.\n\nCVE-2010-4649: Integer overflow in the ib_uverbs_poll_cq function in\ndrivers/infiniband/core/uverbs_cmd.c in the Linux kernel allowed local\nusers to cause a denial of service (memory corruption) or possibly\nhave unspecified other impact via a large value of a certain structure\nmember.\n\nCVE-2010-4250: A memory leak within inotify could be used by local\nattackers to cause the machine to run out of memory (denial of\nservice).\n\nCVE-2010-4346: The install_special_mapping function in mm/mmap.c in\nthe Linux kernel did not make an expected security_file_mmap function\ncall, which allowed local users to bypass intended mmap_min_addr\nrestrictions and possibly conduct NULL pointer dereference attacks via\na crafted assembly-language application.\n\nCVE-2010-4529: Integer underflow in the irda_getsockopt function in\nnet/irda/af_irda.c in the Linux kernel on platforms other than x86\nallowed local users to obtain potentially sensitive information from\nkernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.\n\nCVE-2010-4342: The aun_incoming function in net/econet/af_econet.c in\nthe Linux kernel, when Econet is enabled, allowed remote attackers to\ncause a denial of service (NULL pointer dereference and OOPS) by\nsending an Acorn Universal Networking (AUN) packet over UDP.\n\nCVE-2010-3849: The econet_sendmsg function in net/econet/af_econet.c\nin the Linux kernel, when an econet address is configured, allowed\nlocal users to cause a denial of service (NULL pointer dereference and\nOOPS) via a sendmsg call that specifies a NULL value for the remote\naddress field.\n\nCVE-2010-3848: Stack-based buffer overflow in the econet_sendmsg\nfunction in net/econet/af_econet.c in the Linux kernel when an econet\naddress is configured, allowed local users to gain privileges by\nproviding a large number of iovec structures.\n\nCVE-2010-3850: The ec_dev_ioctl function in net/econet/af_econet.c in\nthe Linux kernel did not require the CAP_NET_ADMIN capability, which\nallowed local users to bypass intended access restrictions and\nconfigure econet addresses via an SIOCSIFADDR ioctl call.\n\nCVE-2010-4343: drivers/scsi/bfa/bfa_core.c in the Linux kernel did not\ninitialize a certain port data structure, which allows local users to\ncause a denial of service (system crash) via read operations on an\nfc_host statistics file.\n\nCVE-2010-3699: The backend driver in Xen 3.x allows guest OS users to\ncause a denial of service via a kernel thread leak, which prevents the\ndevice and guest OS from being shut down or create a zombie domain,\ncauses a hang in zenwatch, or prevents unspecified xm commands from\nworking properly, related to (1) netback, (2) blkback, or (3) blktap.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=554081\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=558740\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=564423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=575873\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=607239\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=617437\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=617764\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=623393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=625965\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=639143\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=641105\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=642309\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=643513\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=644807\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=647632\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=650897\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=651596\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=651599\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=653547\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=655220\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=655468\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=655693\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=655964\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=655973\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=658178\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=658461\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=658720\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=661429\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=661624\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=661945\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662031\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662202\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662663\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662931\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662945\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=662953\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=666836\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=666842\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=668101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=668929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=669889\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=671256\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=672499\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=672505\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=672524\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=673929\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=673992\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=674254\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=674735\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=676202\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=677286\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=677738\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=678472\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=678497\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=678970\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=679588\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=679812\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=681175\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=681540\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=681826\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=681999\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=682965\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2011-04/msg00074.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-desktop\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-desktop-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-desktop-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-trace\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-trace-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-trace-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vmi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vmi-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vmi-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:preload-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:preload-kmp-desktop\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-debug-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-debug-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-debug-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-default-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-default-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-default-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-desktop-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-desktop-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-desktop-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-ec2-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-ec2-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-ec2-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-ec2-extra-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-pae-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-pae-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-pae-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-source-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-source-vanilla-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-syms-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-trace-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-trace-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-trace-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-vanilla-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-vanilla-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-vanilla-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-vmi-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-vmi-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-vmi-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-xen-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-xen-base-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"kernel-xen-devel-2.6.34.8-0.2.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"preload-kmp-default-1.1_k2.6.34.8_0.2-19.1.19\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", reference:\"preload-kmp-desktop-1.1_k2.6.34.8_0.2-19.1.19\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:36:59", "description": "a. ESX third-party update for Service Console kernel\n\n This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158, CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243, CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251, CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346, CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710, CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues.\n\nb. ESX third-party update for Service Console krb5 RPMs\n\n This patch updates the krb5-libs and krb5-workstation RPMs of the console OS to version 1.6.1-55.el5_6.1, which resolves multiple security issues.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282 to these issues.\n\nc. ESXi and ESX update to third-party component glibc\n\n The glibc third-party library is updated to resolve multiple security issues.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071, CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues.\n\nd. ESX update to third-party drivers mptsas, mpt2sas, and mptspi\n\n The mptsas, mpt2sas, and mptspi drivers are updated which addresses multiple security issues in the mpt2sas driver.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2011-10-14T00:00:00", "type": "nessus", "title": "VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.9, "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-0296", "CVE-2010-1083", "CVE-2010-1323", "CVE-2010-2492", "CVE-2010-2798", "CVE-2010-2938", "CVE-2010-2942", "CVE-2010-2943", "CVE-2010-3015", "CVE-2010-3066", "CVE-2010-3067", "CVE-2010-3078", "CVE-2010-3086", "CVE-2010-3296", "CVE-2010-3432", "CVE-2010-3442", "CVE-2010-3477", "CVE-2010-3699", "CVE-2010-3858", "CVE-2010-3859", "CVE-2010-3865", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-3904", "CVE-2010-4072", "CVE-2010-4073", "CVE-2010-4075", "CVE-2010-4080", "CVE-2010-4081", "CVE-2010-4083", "CVE-2010-4157", "CVE-2010-4158", "CVE-2010-4161", "CVE-2010-4238", "CVE-2010-4242", "CVE-2010-4243", "CVE-2010-4247", "CVE-2010-4248", "CVE-2010-4249", "CVE-2010-4251", "CVE-2010-4255", "CVE-2010-4263", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4655", "CVE-2011-0281", "CVE-2011-0282", "CVE-2011-0521", "CVE-2011-0536", "CVE-2011-0710", "CVE-2011-1010", "CVE-2011-1071", "CVE-2011-1090", "CVE-2011-1095", "CVE-2011-1478", "CVE-2011-1494", "CVE-2011-1495", "CVE-2011-1658", "CVE-2011-1659"], "modified": "2021-01-06T00:00:00", "cpe": ["cpe:/o:vmware:esx:3.5", "cpe:/o:vmware:esx:4.0", "cpe:/o:vmware:esx:4.1", "cpe:/o:vmware:esxi:3.5", "cpe:/o:vmware:esxi:4.0", "cpe:/o:vmware:esxi:4.1", "cpe:/o:vmware:esxi:5.0"], "id": "VMWARE_VMSA-2011-0012.NASL", "href": "https://www.tenable.com/plugins/nessus/56508", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from VMware Security Advisory 2011-0012. \n# The text itself is copyright (C) VMware Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(56508);\n script_version(\"1.58\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2010-0296\", \"CVE-2010-1083\", \"CVE-2010-1323\", \"CVE-2010-2492\", \"CVE-2010-2798\", \"CVE-2010-2938\", \"CVE-2010-2942\", \"CVE-2010-2943\", \"CVE-2010-3015\", \"CVE-2010-3066\", \"CVE-2010-3067\", \"CVE-2010-3078\", \"CVE-2010-3086\", \"CVE-2010-3296\", \"CVE-2010-3432\", \"CVE-2010-3442\", \"CVE-2010-3477\", \"CVE-2010-3699\", \"CVE-2010-3858\", \"CVE-2010-3859\", \"CVE-2010-3865\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-3904\", \"CVE-2010-4072\", \"CVE-2010-4073\", \"CVE-2010-4075\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4083\", \"CVE-2010-4157\", \"CVE-2010-4158\", \"CVE-2010-4161\", \"CVE-2010-4238\", \"CVE-2010-4242\", \"CVE-2010-4243\", \"CVE-2010-4247\", \"CVE-2010-4248\", \"CVE-2010-4249\", \"CVE-2010-4251\", \"CVE-2010-4255\", \"CVE-2010-4263\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4655\", \"CVE-2011-0281\", \"CVE-2011-0282\", \"CVE-2011-0521\", \"CVE-2011-0536\", \"CVE-2011-0710\", \"CVE-2011-1010\", \"CVE-2011-1071\", \"CVE-2011-1090\", \"CVE-2011-1095\", \"CVE-2011-1478\", \"CVE-2011-1494\", \"CVE-2011-1495\", \"CVE-2011-1658\", \"CVE-2011-1659\");\n script_bugtraq_id(39042, 42124, 42237, 42477, 42527, 42529, 43022, 43221, 43353, 43480, 43578, 43787, 43806, 43809, 44219, 44301, 44354, 44549, 44630, 44648, 44665, 44754, 44755, 44758, 45004, 45014, 45028, 45029, 45037, 45039, 45054, 45058, 45063, 45064, 45073, 45099, 45118, 45208, 45262, 45323, 45661, 45795, 45972, 45986, 46265, 46271, 46421, 46492, 46563, 46637, 46766, 47056, 47185, 47370);\n script_xref(name:\"VMSA\", value:\"2011-0012\");\n\n script_name(english:\"VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console\");\n script_summary(english:\"Checks esxupdate output for the patches\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote VMware ESXi / ESX host is missing one or more\nsecurity-related patches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"a. ESX third-party update for Service Console kernel\n\n This update takes the console OS kernel package to\n kernel-2.6.18-238.9.1 which resolves multiple security issues.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798,\n CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015,\n CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086,\n CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477,\n CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865,\n CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904,\n CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080,\n CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158,\n CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243,\n CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251,\n CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346,\n CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710,\n CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues.\n\nb. ESX third-party update for Service Console krb5 RPMs\n\n This patch updates the krb5-libs and krb5-workstation RPMs of the\n console OS to version 1.6.1-55.el5_6.1, which resolves multiple\n security issues.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282\n to these issues.\n\nc. ESXi and ESX update to third-party component glibc\n\n The glibc third-party library is updated to resolve multiple\n security issues.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071,\n CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues.\n\nd. ESX update to third-party drivers mptsas, mpt2sas, and mptspi\n\n The mptsas, mpt2sas, and mptspi drivers are updated which addresses\n multiple security issues in the mpt2sas driver.\n\n The Common Vulnerabilities and Exposures project (cve.mitre.org) has\n assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://lists.vmware.com/pipermail/security-announce/2012/000164.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply the missing patches.\");\n script_set_cvss_base_vector(\"CVSS2#AV:A/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esx:3.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esx:4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esx:4.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esxi:3.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esxi:4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esxi:4.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esxi:5.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/04/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/10/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"VMware ESX Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/VMware/release\", \"Host/VMware/version\");\n script_require_ports(\"Host/VMware/esxupdate\", \"Host/VMware/esxcli_software_vibs\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"vmware_esx_packages.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/VMware/release\")) audit(AUDIT_OS_NOT, \"VMware ESX / ESXi\");\nif (\n !get_kb_item(\"Host/VMware/esxcli_software_vibs\") &&\n !get_kb_item(\"Host/VMware/esxupdate\")\n) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ninit_esx_check(date:\"2011-10-12\");\nflag = 0;\n\n\nif (esx_check(ver:\"ESX 3.5.0\", patch:\"ESX350-201203403-SG\")) flag++;\n\nif (\n esx_check(\n ver : \"ESX 4.0\",\n patch : \"ESX400-201110401-SG\",\n patch_updates : make_list(\"ESX400-201111201-SG\", \"ESX400-201203401-SG\", \"ESX400-201205401-SG\", \"ESX400-201206401-SG\", \"ESX400-201209401-SG\", \"ESX400-201302401-SG\", \"ESX400-201305401-SG\", \"ESX400-201310401-SG\", \"ESX400-201404401-SG\", \"ESX400-Update04\")\n )\n) flag++;\nif (\n esx_check(\n ver : \"ESX 4.0\",\n patch : \"ESX400-201110403-SG\",\n patch_updates : make_list(\"ESX400-201203407-SG\", \"ESX400-Update04\")\n )\n) flag++;\nif (\n esx_check(\n ver : \"ESX 4.0\",\n patch : \"ESX400-201110409-SG\",\n patch_updates : make_list(\"ESX400-Update04\")\n )\n) flag++;\n\nif (\n esx_check(\n ver : \"ESX 4.1\",\n patch : \"ESX410-201110201-SG\",\n patch_updates : make_list(\"ESX410-201201401-SG\", \"ESX410-201204401-SG\", \"ESX410-201205401-SG\", \"ESX410-201206401-SG\", \"ESX410-201208101-SG\", \"ESX410-201211401-SG\", \"ESX410-201301401-SG\", \"ESX410-201304401-SG\", \"ESX410-201307401-SG\", \"ESX410-201312401-SG\", \"ESX410-201404401-SG\", \"ESX410-Update02\", \"ESX410-Update03\")\n )\n) flag++;\nif (\n esx_check(\n ver : \"ESX 4.1\",\n patch : \"ESX410-201110224-SG\",\n patch_updates : make_list(\"ESX410-Update02\", \"ESX410-Update03\")\n )\n) flag++;\n\nif (esx_check(ver:\"ESXi 3.5.0\", patch:\"ESXe350-201203401-I-SG\")) flag++;\n\nif (\n esx_check(\n ver : \"ESXi 4.0\",\n patch : \"ESXi400-201110401-SG\",\n patch_updates : make_list(\"ESXi400-201203401-SG\", \"ESXi400-201205401-SG\", \"ESXi400-201206401-SG\", \"ESXi400-201209401-SG\", \"ESXi400-201302401-SG\", \"ESXi400-201305401-SG\", \"ESXi400-201310401-SG\", \"ESXi400-201404401-SG\", \"ESXi400-Update04\")\n )\n) flag++;\n\nif (\n esx_check(\n ver : \"ESXi 4.1\",\n patch : \"ESXi410-201110201-SG\",\n patch_updates : make_list(\"ESXi410-201201401-SG\", \"ESXi410-201204401-SG\", \"ESXi410-201205401-SG\", \"ESXi410-201206401-SG\", \"ESXi410-201208101-SG\", \"ESXi410-201211401-SG\", \"ESXi410-201301401-SG\", \"ESXi410-201304401-SG\", \"ESXi410-201307401-SG\", \"ESXi410-201312401-SG\", \"ESXi410-201404401-SG\", \"ESXi410-Update02\", \"ESXi410-Update03\")\n )\n) flag++;\n\nif (esx_check(ver:\"ESXi 5.0\", vib:\"VMware:esx-base:5.0.0-0.3.515841\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:esx_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T16:34:22", "description": "The remote VMware ESX / ESXi host is missing a security-related patch.\nIt is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :\n\n - Kernel\n - krb5\n - glibc\n - mtp2sas\n - mptsas\n - mptspi", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2016-03-04T00:00:00", "type": "nessus", "title": "VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.9, "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-0296", "CVE-2010-1083", "CVE-2010-1323", "CVE-2010-2492", "CVE-2010-2798", "CVE-2010-2938", "CVE-2010-2942", "CVE-2010-2943", "CVE-2010-3015", "CVE-2010-3066", "CVE-2010-3067", "CVE-2010-3078", "CVE-2010-3086", "CVE-2010-3296", "CVE-2010-3432", "CVE-2010-3442", "CVE-2010-3477", "CVE-2010-3699", "CVE-2010-3858", "CVE-2010-3859", "CVE-2010-3865", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-3904", "CVE-2010-4072", "CVE-2010-4073", "CVE-2010-4075", "CVE-2010-4080", "CVE-2010-4081", "CVE-2010-4083", "CVE-2010-4157", "CVE-2010-4158", "CVE-2010-4161", "CVE-2010-4238", "CVE-2010-4242", "CVE-2010-4243", "CVE-2010-4247", "CVE-2010-4248", "CVE-2010-4249", "CVE-2010-4251", "CVE-2010-4255", "CVE-2010-4263", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4655", "CVE-2011-0281", "CVE-2011-0282", "CVE-2011-0521", "CVE-2011-0536", "CVE-2011-0710", "CVE-2011-1010", "CVE-2011-1071", "CVE-2011-1090", "CVE-2011-1095", "CVE-2011-1478", "CVE-2011-1494", "CVE-2011-1495", "CVE-2011-1658", "CVE-2011-1659"], "modified": "2021-01-06T00:00:00", "cpe": ["cpe:/o:vmware:esx", "cpe:/o:vmware:esxi"], "id": "VMWARE_VMSA-2011-0012_REMOTE.NASL", "href": "https://www.tenable.com/plugins/nessus/89680", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(89680);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2010-0296\",\n \"CVE-2010-1083\",\n \"CVE-2010-1323\",\n \"CVE-2010-2492\",\n \"CVE-2010-2798\",\n \"CVE-2010-2938\",\n \"CVE-2010-2942\",\n \"CVE-2010-2943\",\n \"CVE-2010-3015\",\n \"CVE-2010-3066\",\n \"CVE-2010-3067\",\n \"CVE-2010-3078\",\n \"CVE-2010-3086\",\n \"CVE-2010-3296\",\n \"CVE-2010-3432\",\n \"CVE-2010-3442\",\n \"CVE-2010-3477\",\n \"CVE-2010-3699\",\n \"CVE-2010-3858\",\n \"CVE-2010-3859\",\n \"CVE-2010-3865\",\n \"CVE-2010-3876\",\n \"CVE-2010-3877\",\n \"CVE-2010-3880\",\n \"CVE-2010-3904\",\n \"CVE-2010-4072\",\n \"CVE-2010-4073\",\n \"CVE-2010-4075\",\n \"CVE-2010-4080\",\n \"CVE-2010-4081\",\n \"CVE-2010-4083\",\n \"CVE-2010-4157\",\n \"CVE-2010-4158\",\n \"CVE-2010-4161\",\n \"CVE-2010-4238\",\n \"CVE-2010-4242\",\n \"CVE-2010-4243\",\n \"CVE-2010-4247\",\n \"CVE-2010-4248\",\n \"CVE-2010-4249\",\n \"CVE-2010-4251\",\n \"CVE-2010-4255\",\n \"CVE-2010-4263\",\n \"CVE-2010-4343\",\n \"CVE-2010-4346\",\n \"CVE-2010-4526\",\n \"CVE-2010-4655\",\n \"CVE-2011-0281\",\n \"CVE-2011-0282\",\n \"CVE-2011-0521\",\n \"CVE-2011-0536\",\n \"CVE-2011-0710\",\n \"CVE-2011-1010\",\n \"CVE-2011-1071\",\n \"CVE-2011-1090\",\n \"CVE-2011-1095\",\n \"CVE-2011-1478\",\n \"CVE-2011-1494\",\n \"CVE-2011-1495\",\n \"CVE-2011-1658\",\n \"CVE-2011-1659\"\n );\n script_bugtraq_id(\n 39042,\n 42124,\n 42237,\n 42477,\n 42527,\n 42529,\n 43022,\n 43221,\n 43353,\n 43480,\n 43578,\n 43787,\n 43806,\n 43809,\n 44219,\n 44301,\n 44354,\n 44549,\n 44630,\n 44648,\n 44665,\n 44754,\n 44755,\n 44758,\n 45004,\n 45014,\n 45028,\n 45029,\n 45037,\n 45039,\n 45054,\n 45058,\n 45063,\n 45064,\n 45073,\n 45099,\n 45118,\n 45208,\n 45262,\n 45323,\n 45661,\n 45795,\n 45972,\n 45986,\n 46265,\n 46271,\n 46421,\n 46492,\n 46563,\n 46637,\n 46766,\n 47056,\n 47185,\n 47370\n );\n\n script_xref(name:\"VMSA\", value:\"2011-0012\");\n\n script_name(english:\"VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)\");\n script_summary(english:\"Checks the ESX / ESXi version and build number.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote VMware ESX / ESXi host is missing a security-related patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote VMware ESX / ESXi host is missing a security-related patch.\nIt is, therefore, affected by multiple vulnerabilities in several\nthird-party components and libraries :\n\n - Kernel\n - krb5\n - glibc\n - mtp2sas\n - mptsas\n - mptspi\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.vmware.com/security/advisories/VMSA-2011-0012\");\n script_set_attribute(attribute:\"see_also\", value:\"http://lists.vmware.com/pipermail/security-announce/2012/000164.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the appropriate patch according to the vendor advisory that\npertains to ESX version 3.5 / 4.0 / 4.1 or ESXi version 3.5 / 4.0 /\n4.1 / 5.0.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esx\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:esxi\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/02/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Misc.\");\n\n script_dependencies(\"vmware_vsphere_detect.nbin\");\n script_require_keys(\"Host/VMware/version\", \"Host/VMware/release\");\n script_require_ports(\"Host/VMware/vsphere\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nver = get_kb_item_or_exit(\"Host/VMware/version\");\nrel = get_kb_item_or_exit(\"Host/VMware/release\");\nport = get_kb_item_or_exit(\"Host/VMware/vsphere\");\nesx = '';\n\nif (\"ESX\" >!< rel)\n audit(AUDIT_OS_NOT, \"VMware ESX/ESXi\");\n\nextract = eregmatch(pattern:\"^(ESXi?) (\\d\\.\\d).*$\", string:ver);\nif (isnull(extract))\n audit(AUDIT_UNKNOWN_APP_VER, \"VMware ESX/ESXi\");\nelse\n{\n esx = extract[1];\n ver = extract[2];\n}\n\n# fixed build numbers are the same for ESX and ESXi\nfixes = make_array(\n \"3.5\", \"604481\",\n \"4.0\", \"480973\",\n \"4.1\", \"502767\",\n \"5.0\", \"515841\"\n );\n\nfix = FALSE;\nfix = fixes[ver];\n\n# get the build before checking the fix for the most complete audit trail\nextract = eregmatch(pattern:'^VMware ESXi?.* build-([0-9]+)$', string:rel);\nif (isnull(extract))\n audit(AUDIT_UNKNOWN_BUILD, \"VMware \" + esx, ver);\n\nbuild = int(extract[1]);\n\n# if there is no fix in the array, fix is FALSE\nif (!fix)\n audit(AUDIT_INST_VER_NOT_VULN, \"VMware \" + esx, ver, build);\n\nif (build < fix)\n{\n\n report = '\\n Version : ' + esx + \" \" + ver +\n '\\n Installed build : ' + build +\n '\\n Fixed build : ' + fix +\n '\\n';\n\n security_report_v4(port:port, extra:report, severity:SECURITY_HOLE);\n exit(0);\n}\nelse\n audit(AUDIT_INST_VER_NOT_VULN, \"VMware \" + esx, ver, build);\n", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-13T14:53:52", "description": "Dan Rosenberg discovered that the RDS network protocol did not correctly check certain parameters. A local attacker could exploit this gain root privileges. (CVE-2010-3904)\n\nNelson Elhage discovered several problems with the Acorn Econet protocol driver. A local user could cause a denial of service via a NULL pointer dereference, escalate privileges by overflowing the kernel stack, and assign Econet addresses to arbitrary interfaces.\n(CVE-2010-3848, CVE-2010-3849, CVE-2010-3850)\n\nBen Hutchings discovered that the ethtool interface did not correctly check certain sizes. A local attacker could perform malicious ioctl calls that could crash the system, leading to a denial of service.\n(CVE-2010-2478, CVE-2010-3084)\n\nEric Dumazet discovered that many network functions could leak kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. (CVE-2010-2942, CVE-2010-3477)\n\nDave Chinner discovered that the XFS filesystem did not correctly order inode lookups when exported by NFS. A remote attacker could exploit this to read or write disk blocks that had changed file assignment or had become unlinked, leading to a loss of privacy.\n(CVE-2010-2943)\n\nTavis Ormandy discovered that the IRDA subsystem did not correctly shut down. A local attacker could exploit this to cause the system to crash or possibly gain root privileges. (CVE-2010-2954)\n\nBrad Spengler discovered that the wireless extensions did not correctly validate certain request sizes. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. (CVE-2010-2955)\n\nTavis Ormandy discovered that the session keyring did not correctly check for its parent. On systems without a default session keyring, a local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-2960)\n\nKees Cook discovered that the Intel i915 graphics driver did not correctly validate memory regions. A local attacker with access to the video card could read and write arbitrary kernel memory to gain root privileges. (CVE-2010-2962)\n\nKees Cook discovered that the V4L1 32bit compat interface did not correctly validate certain parameters. A local attacker on a 64bit system with access to a video device could exploit this to gain root privileges. (CVE-2010-2963)\n\nTavis Ormandy discovered that the AIO subsystem did not correctly validate certain parameters. A local attacker could exploit this to crash the system or possibly gain root privileges. (CVE-2010-3067)\n\nDan Rosenberg discovered that certain XFS ioctls leaked kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. (CVE-2010-3078)\n\nRobert Swiecki discovered that ftrace did not correctly handle mutexes. A local attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3079)\n\nTavis Ormandy discovered that the OSS sequencer device did not correctly shut down. A local attacker could exploit this to crash the system or possibly gain root privileges. (CVE-2010-3080)\n\nDan Rosenberg discovered that several network ioctls did not clear kernel memory correctly. A local user could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3296, CVE-2010-3297, CVE-2010-3298)\n\nDan Rosenberg discovered that the ROSE driver did not correctly check parameters. A local attacker with access to a ROSE network device could exploit this to crash the system or possibly gain root privileges. (CVE-2010-3310)\n\nThomas Dreibholz discovered that SCTP did not correctly handle appending packet chunks. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.\n(CVE-2010-3432)\n\nDan Rosenberg discovered that the CD driver did not correctly check parameters. A local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy. (CVE-2010-3437)\n\nDan Rosenberg discovered that the Sound subsystem did not correctly validate parameters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3442)\n\nDan Jacobson discovered that ThinkPad video output was not correctly access controlled. A local attacker could exploit this to hang the system, leading to a denial of service. (CVE-2010-3448)\n\nIt was discovered that KVM did not correctly initialize certain CPU registers. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3698)\n\nDan Rosenberg discovered that SCTP did not correctly handle HMAC calculations. A remote attacker could send specially crafted traffic that would crash the system, leading to a denial of service.\n(CVE-2010-3705)\n\nBrad Spengler discovered that stack memory for new a process was not correctly calculated. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3858)\n\nDan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. (CVE-2010-3859)\n\nKees Cook discovered that the ethtool interface did not correctly clear kernel memory. A local attacker could read kernel heap memory, leading to a loss of privacy. (CVE-2010-3861)\n\nThomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.\n(CVE-2010-3865)\n\nDan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3873)\n\nDan Rosenberg discovered that the CAN protocol on 64bit systems did not correctly calculate the size of certain buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2010-3874)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)\n\nVasiliy Kulikov discovered that kvm did not correctly clear memory. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy. (CVE-2010-3881)\n\nKees Cook and Vasiliy Kulikov discovered that the shm interface did not clear kernel memory correctly. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-4072)\n\nDan Rosenberg discovered that IPC structures were not correctly initialized on 64bit systems. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-4073)\n\nDan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4075)\n\nDan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-4079)\n\nDan Rosenberg discovered that the RME Hammerfall DSP audio interface driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, CVE-2010-4081)\n\nDan Rosenberg discovered that the VIA video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4082)\n\nDan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)\n\nJames Bottomley discovered that the ICP vortex storage array controller driver did not validate certain sizes. A local attacker on a 64bit system could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-4157)\n\nDan Rosenberg discovered that the socket filters did not correctly initialize structure memory. A local attacker could create malicious filters to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4158)\n\nDan Rosenberg discovered that the Linux kernel L2TP implementation contained multiple integer signedness errors. A local attacker could exploit this to to crash the kernel, or possibly gain root privileges.\n(CVE-2010-4160)\n\nDan Rosenberg discovered that certain iovec operations did not calculate page counts correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4162)\n\nDan Rosenberg discovered that the SCSI subsystem did not correctly validate iov segments. A local attacker with access to a SCSI device could send specially crafted requests to crash the system, leading to a denial of service. (CVE-2010-4163, CVE-2010-4668)\n\nDan Rosenberg discovered multiple flaws in the X.25 facilities parsing. If a system was using X.25, a remote attacker could exploit this to crash the system, leading to a denial of service.\n(CVE-2010-4164)\n\nSteve Chen discovered that setsockopt did not correctly check MSS values. A local attacker could make a specially crafted socket call to crash the system, leading to a denial of service. (CVE-2010-4165)\n\nDave Jones discovered that the mprotect system call did not correctly handle merged VMAs. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4169)\n\nDan Rosenberg discovered that the RDS protocol did not correctly check ioctl arguments. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4175)\n\nAlan Cox discovered that the HCI UART driver did not correctly check if a write operation was available. If the mmap_min-addr sysctl was changed from the Ubuntu default to a value of 0, a local attacker could exploit this flaw to gain root privileges. (CVE-2010-4242)\n\nIt was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)\n\nVegard Nossum discovered that memory garbage collection was not handled correctly for active sockets. A local attacker could exploit this to allocate all available kernel memory, leading to a denial of service. (CVE-2010-4249)\n\nNelson Elhage discovered that the kernel did not correctly handle process cleanup after triggering a recoverable kernel bug. If a local attacker were able to trigger certain kinds of kernel bugs, they could create a specially crafted process to gain root privileges.\n(CVE-2010-4258)\n\nKrishna Gudipati discovered that the bfa adapter driver did not correctly initialize certain structures. A local attacker could read files in /sys to crash the system, leading to a denial of service.\n(CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks.\n(CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain unreachable messages. If a remote attacker were able to acquire a socket lock, they could send specially crafted traffic that would crash the system, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's handling of TKIP countermeasures. This reduces the amount of time an attacker needs breach a wireless network using WPA+TKIP for security.\n(CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)\n\nKees Cook discovered that some ethtool functions did not correctly clear heap memory. A local attacker with CAP_NET_ADMIN privileges could exploit this to read portions of kernel heap memory, leading to a loss of privacy. (CVE-2010-4655)\n\nKees Cook discovered that the IOWarrior USB device driver did not correctly check certain size fields. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges. (CVE-2010-4656)\n\nJoel Becker discovered that OCFS2 did not correctly validate on-disk symlink structures. If an attacker were able to trick a user or automated system into mounting a specially crafted filesystem, it could crash the system or expose kernel memory, leading to a loss of privacy. (CVE-2010-NNN2)\n\nA flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)\n\nDan Carpenter discovered that the TTPCI DVB driver did not check certain values during an ioctl. If the dvb-ttpci module was loaded, a local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges. (CVE-2011-0521)\n\nRafael Dominguez Vega discovered that the caiaq Native Instruments USB driver did not correctly validate string lengths. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges. (CVE-2011-0712)\n\nTimo Warns discovered that MAC partition parsing routines did not correctly calculate block counts. A local attacker with physical access could plug in a specially crafted block device to crash the system or potentially gain root privileges. (CVE-2011-1010)\n\nTimo Warns discovered that LDM partition parsing routines did not correctly calculate block counts. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1012)\n\nNelson Elhage discovered that the epoll subsystem did not correctly handle certain structures. A local attacker could create malicious requests that would hang the system, leading to a denial of service.\n(CVE-2011-1082)\n\nJohan Hovold discovered that the DCCP network stack did not correctly handle certain packet combinations. A remote attacker could send specially crafted network traffic that would crash the system, leading to a denial of service. (CVE-2011-1093).", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2013-03-08T00:00:00", "type": "nessus", "title": "Ubuntu 10.04 LTS / 10.10 : linux-mvl-dove vulnerabilities (USN-1093-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.3, "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2478", "CVE-2010-2942", "CVE-2010-2943", "CVE-2010-2954", "CVE-2010-2955", "CVE-2010-2960", "CVE-2010-2962", "CVE-2010-2963", "CVE-2010-3067", "CVE-2010-3078", "CVE-2010-3079", "CVE-2010-3080", "CVE-2010-3084", "CVE-2010-3296", "CVE-2010-3297", "CVE-2010-3298", "CVE-2010-3310", "CVE-2010-3432", "CVE-2010-3437", "CVE-2010-3442", "CVE-2010-3448", "CVE-2010-3477", "CVE-2010-3698", "CVE-2010-3705", "CVE-2010-3848", "CVE-2010-3849", "CVE-2010-3850", "CVE-2010-3858", "CVE-2010-3859", "CVE-2010-3861", "CVE-2010-3865", "CVE-2010-3873", "CVE-2010-3874", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-3881", "CVE-2010-3904", "CVE-2010-4072", "CVE-2010-4073", "CVE-2010-4075", "CVE-2010-4076", "CVE-2010-4077", "CVE-2010-4079", "CVE-2010-4080", "CVE-2010-4081", "CVE-2010-4082", "CVE-2010-4083", "CVE-2010-4157", "CVE-2010-4158", "CVE-2010-4160", "CVE-2010-4162", "CVE-2010-4163", "CVE-2010-4164", "CVE-2010-4165", "CVE-2010-4169", "CVE-2010-4175", "CVE-2010-4242", "CVE-2010-4248", "CVE-2010-4249", "CVE-2010-4258", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4527", "CVE-2010-4648", "CVE-2010-4649", "CVE-2010-4650", "CVE-2010-4655", "CVE-2010-4656", "CVE-2010-4668", "CVE-2011-0006", "CVE-2011-0521", "CVE-2011-0712", "CVE-2011-1010", "CVE-2011-1012", "CVE-2011-1044", "CVE-2011-1082", "CVE-2011-1093"], "modified": "2018-05-21T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:10.04:-:lts", "cpe:/o:canonical:ubuntu_linux:10.10"], "id": "UBUNTU_USN-1093-1.NASL", "href": "https://www.tenable.com/plugins/nessus/65103", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-1093-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(65103);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2018/05/21 12:08:49\");\n\n script_cve_id(\"CVE-2010-2478\", \"CVE-2010-2942\", \"CVE-2010-2943\", \"CVE-2010-2954\", \"CVE-2010-2955\", \"CVE-2010-2960\", \"CVE-2010-2962\", \"CVE-2010-2963\", \"CVE-2010-3067\", \"CVE-2010-3078\", \"CVE-2010-3079\", \"CVE-2010-3080\", \"CVE-2010-3084\", \"CVE-2010-3296\", \"CVE-2010-3297\", \"CVE-2010-3298\", \"CVE-2010-3310\", \"CVE-2010-3432\", \"CVE-2010-3437\", \"CVE-2010-3442\", \"CVE-2010-3448\", \"CVE-2010-3477\", \"CVE-2010-3698\", \"CVE-2010-3705\", \"CVE-2010-3848\", \"CVE-2010-3849\", \"CVE-2010-3850\", \"CVE-2010-3858\", \"CVE-2010-3859\", \"CVE-2010-3861\", \"CVE-2010-3865\", \"CVE-2010-3873\", \"CVE-2010-3874\", \"CVE-2010-3875\", \"CVE-2010-3876\", \"CVE-2010-3877\", \"CVE-2010-3880\", \"CVE-2010-3881\", \"CVE-2010-3904\", \"CVE-2010-4072\", \"CVE-2010-4073\", \"CVE-2010-4075\", \"CVE-2010-4076\", \"CVE-2010-4077\", \"CVE-2010-4079\", \"CVE-2010-4080\", \"CVE-2010-4081\", \"CVE-2010-4082\", \"CVE-2010-4083\", \"CVE-2010-4157\", \"CVE-2010-4158\", \"CVE-2010-4160\", \"CVE-2010-4162\", \"CVE-2010-4163\", \"CVE-2010-4164\", \"CVE-2010-4165\", \"CVE-2010-4169\", \"CVE-2010-4175\", \"CVE-2010-4242\", \"CVE-2010-4248\", \"CVE-2010-4249\", \"CVE-2010-4258\", \"CVE-2010-4343\", \"CVE-2010-4346\", \"CVE-2010-4526\", \"CVE-2010-4527\", \"CVE-2010-4648\", \"CVE-2010-4649\", \"CVE-2010-4650\", \"CVE-2010-4655\", \"CVE-2010-4656\", \"CVE-2010-4668\", \"CVE-2011-0006\", \"CVE-2011-0521\", \"CVE-2011-0712\", \"CVE-2011-1010\", \"CVE-2011-1012\", \"CVE-2011-1044\", \"CVE-2011-1082\", \"CVE-2011-1093\");\n script_xref(name:\"USN\", value:\"1093-1\");\n\n script_name(english:\"Ubuntu 10.04 LTS / 10.10 : linux-mvl-dove vulnerabilities (USN-1093-1)\");\n script_summary(english:\"Checks dpkg output for updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing one or more security-related patches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Dan Rosenberg discovered that the RDS network protocol did not\ncorrectly check certain parameters. A local attacker could exploit\nthis gain root privileges. (CVE-2010-3904)\n\nNelson Elhage discovered several problems with the Acorn Econet\nprotocol driver. A local user could cause a denial of service via a\nNULL pointer dereference, escalate privileges by overflowing the\nkernel stack, and assign Econet addresses to arbitrary interfaces.\n(CVE-2010-3848, CVE-2010-3849, CVE-2010-3850)\n\nBen Hutchings discovered that the ethtool interface did not correctly\ncheck certain sizes. A local attacker could perform malicious ioctl\ncalls that could crash the system, leading to a denial of service.\n(CVE-2010-2478, CVE-2010-3084)\n\nEric Dumazet discovered that many network functions could leak kernel\nstack contents. A local attacker could exploit this to read portions\nof kernel memory, leading to a loss of privacy. (CVE-2010-2942,\nCVE-2010-3477)\n\nDave Chinner discovered that the XFS filesystem did not correctly\norder inode lookups when exported by NFS. A remote attacker could\nexploit this to read or write disk blocks that had changed file\nassignment or had become unlinked, leading to a loss of privacy.\n(CVE-2010-2943)\n\nTavis Ormandy discovered that the IRDA subsystem did not correctly\nshut down. A local attacker could exploit this to cause the system to\ncrash or possibly gain root privileges. (CVE-2010-2954)\n\nBrad Spengler discovered that the wireless extensions did not\ncorrectly validate certain request sizes. A local attacker could\nexploit this to read portions of kernel memory, leading to a loss of\nprivacy. (CVE-2010-2955)\n\nTavis Ormandy discovered that the session keyring did not correctly\ncheck for its parent. On systems without a default session keyring, a\nlocal attacker could exploit this to crash the system, leading to a\ndenial of service. (CVE-2010-2960)\n\nKees Cook discovered that the Intel i915 graphics driver did not\ncorrectly validate memory regions. A local attacker with access to the\nvideo card could read and write arbitrary kernel memory to gain root\nprivileges. (CVE-2010-2962)\n\nKees Cook discovered that the V4L1 32bit compat interface did not\ncorrectly validate certain parameters. A local attacker on a 64bit\nsystem with access to a video device could exploit this to gain root\nprivileges. (CVE-2010-2963)\n\nTavis Ormandy discovered that the AIO subsystem did not correctly\nvalidate certain parameters. A local attacker could exploit this to\ncrash the system or possibly gain root privileges. (CVE-2010-3067)\n\nDan Rosenberg discovered that certain XFS ioctls leaked kernel stack\ncontents. A local attacker could exploit this to read portions of\nkernel memory, leading to a loss of privacy. (CVE-2010-3078)\n\nRobert Swiecki discovered that ftrace did not correctly handle\nmutexes. A local attacker could exploit this to crash the kernel,\nleading to a denial of service. (CVE-2010-3079)\n\nTavis Ormandy discovered that the OSS sequencer device did not\ncorrectly shut down. A local attacker could exploit this to crash the\nsystem or possibly gain root privileges. (CVE-2010-3080)\n\nDan Rosenberg discovered that several network ioctls did not clear\nkernel memory correctly. A local user could exploit this to read\nkernel stack memory, leading to a loss of privacy. (CVE-2010-3296,\nCVE-2010-3297, CVE-2010-3298)\n\nDan Rosenberg discovered that the ROSE driver did not correctly check\nparameters. A local attacker with access to a ROSE network device\ncould exploit this to crash the system or possibly gain root\nprivileges. (CVE-2010-3310)\n\nThomas Dreibholz discovered that SCTP did not correctly handle\nappending packet chunks. A remote attacker could send specially\ncrafted traffic to crash the system, leading to a denial of service.\n(CVE-2010-3432)\n\nDan Rosenberg discovered that the CD driver did not correctly check\nparameters. A local attacker could exploit this to read arbitrary\nkernel memory, leading to a loss of privacy. (CVE-2010-3437)\n\nDan Rosenberg discovered that the Sound subsystem did not correctly\nvalidate parameters. A local attacker could exploit this to crash the\nsystem, leading to a denial of service. (CVE-2010-3442)\n\nDan Jacobson discovered that ThinkPad video output was not correctly\naccess controlled. A local attacker could exploit this to hang the\nsystem, leading to a denial of service. (CVE-2010-3448)\n\nIt was discovered that KVM did not correctly initialize certain CPU\nregisters. A local attacker could exploit this to crash the system,\nleading to a denial of service. (CVE-2010-3698)\n\nDan Rosenberg discovered that SCTP did not correctly handle HMAC\ncalculations. A remote attacker could send specially crafted traffic\nthat would crash the system, leading to a denial of service.\n(CVE-2010-3705)\n\nBrad Spengler discovered that stack memory for new a process was not\ncorrectly calculated. A local attacker could exploit this to crash the\nsystem, leading to a denial of service. (CVE-2010-3858)\n\nDan Rosenberg discovered that the Linux kernel TIPC implementation\ncontained multiple integer signedness errors. A local attacker could\nexploit this to gain root privileges. (CVE-2010-3859)\n\nKees Cook discovered that the ethtool interface did not correctly\nclear kernel memory. A local attacker could read kernel heap memory,\nleading to a loss of privacy. (CVE-2010-3861)\n\nThomas Pollet discovered that the RDS network protocol did not check\ncertain iovec buffers. A local attacker could exploit this to crash\nthe system or possibly execute arbitrary code as the root user.\n(CVE-2010-3865)\n\nDan Rosenberg discovered that the Linux kernel X.25 implementation\nincorrectly parsed facilities. A remote attacker could exploit this to\ncrash the kernel, leading to a denial of service. (CVE-2010-3873)\n\nDan Rosenberg discovered that the CAN protocol on 64bit systems did\nnot correctly calculate the size of certain buffers. A local attacker\ncould exploit this to crash the system or possibly execute arbitrary\ncode as the root user. (CVE-2010-3874)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation\ndid not correctly clear kernel memory. A local attacker could exploit\nthis to read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets\nimplementation did not properly initialize certain structures. A local\nattacker could exploit this to read kernel stack memory, leading to a\nloss of privacy. (CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly\ninitialize certain structures. A local attacker could exploit this to\nread kernel stack memory, leading to a loss of privacy.\n(CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did\nnot properly audit certain bytecodes in netlink messages. A local\nattacker could exploit this to cause the kernel to hang, leading to a\ndenial of service. (CVE-2010-3880)\n\nVasiliy Kulikov discovered that kvm did not correctly clear memory. A\nlocal attacker could exploit this to read portions of the kernel\nstack, leading to a loss of privacy. (CVE-2010-3881)\n\nKees Cook and Vasiliy Kulikov discovered that the shm interface did\nnot clear kernel memory correctly. A local attacker could exploit this\nto read kernel stack memory, leading to a loss of privacy.\n(CVE-2010-4072)\n\nDan Rosenberg discovered that IPC structures were not correctly\ninitialized on 64bit systems. A local attacker could exploit this to\nread kernel stack memory, leading to a loss of privacy.\n(CVE-2010-4073)\n\nDan Rosenberg discovered that multiple terminal ioctls did not\ncorrectly initialize structure memory. A local attacker could exploit\nthis to read portions of kernel stack memory, leading to a loss of\nprivacy. (CVE-2010-4075)\n\nDan Rosenberg discovered that the ivtv V4L driver did not correctly\ninitialize certian structures. A local attacker could exploit this to\nread kernel stack memory, leading to a loss of privacy.\n(CVE-2010-4079)\n\nDan Rosenberg discovered that the RME Hammerfall DSP audio interface\ndriver did not correctly clear kernel memory. A local attacker could\nexploit this to read kernel stack memory, leading to a loss of\nprivacy. (CVE-2010-4080, CVE-2010-4081)\n\nDan Rosenberg discovered that the VIA video driver did not correctly\nclear kernel memory. A local attacker could exploit this to read\nkernel stack memory, leading to a loss of privacy. (CVE-2010-4082)\n\nDan Rosenberg discovered that the semctl syscall did not correctly\nclear kernel memory. A local attacker could exploit this to read\nkernel stack memory, leading to a loss of privacy. (CVE-2010-4083)\n\nJames Bottomley discovered that the ICP vortex storage array\ncontroller driver did not validate certain sizes. A local attacker on\na 64bit system could exploit this to crash the kernel, leading to a\ndenial of service. (CVE-2010-4157)\n\nDan Rosenberg discovered that the socket filters did not correctly\ninitialize structure memory. A local attacker could create malicious\nfilters to read portions of kernel stack memory, leading to a loss of\nprivacy. (CVE-2010-4158)\n\nDan Rosenberg discovered that the Linux kernel L2TP implementation\ncontained multiple integer signedness errors. A local attacker could\nexploit this to to crash the kernel, or possibly gain root privileges.\n(CVE-2010-4160)\n\nDan Rosenberg discovered that certain iovec operations did not\ncalculate page counts correctly. A local attacker could exploit this\nto crash the system, leading to a denial of service. (CVE-2010-4162)\n\nDan Rosenberg discovered that the SCSI subsystem did not correctly\nvalidate iov segments. A local attacker with access to a SCSI device\ncould send specially crafted requests to crash the system, leading to\na denial of service. (CVE-2010-4163, CVE-2010-4668)\n\nDan Rosenberg discovered multiple flaws in the X.25 facilities\nparsing. If a system was using X.25, a remote attacker could exploit\nthis to crash the system, leading to a denial of service.\n(CVE-2010-4164)\n\nSteve Chen discovered that setsockopt did not correctly check MSS\nvalues. A local attacker could make a specially crafted socket call to\ncrash the system, leading to a denial of service. (CVE-2010-4165)\n\nDave Jones discovered that the mprotect system call did not correctly\nhandle merged VMAs. A local attacker could exploit this to crash the\nsystem, leading to a denial of service. (CVE-2010-4169)\n\nDan Rosenberg discovered that the RDS protocol did not correctly check\nioctl arguments. A local attacker could exploit this to crash the\nsystem, leading to a denial of service. (CVE-2010-4175)\n\nAlan Cox discovered that the HCI UART driver did not correctly check\nif a write operation was available. If the mmap_min-addr sysctl was\nchanged from the Ubuntu default to a value of 0, a local attacker\ncould exploit this flaw to gain root privileges. (CVE-2010-4242)\n\nIt was discovered that multithreaded exec did not handle CPU timers\ncorrectly. A local attacker could exploit this to crash the system,\nleading to a denial of service. (CVE-2010-4248)\n\nVegard Nossum discovered that memory garbage collection was not\nhandled correctly for active sockets. A local attacker could exploit\nthis to allocate all available kernel memory, leading to a denial of\nservice. (CVE-2010-4249)\n\nNelson Elhage discovered that the kernel did not correctly handle\nprocess cleanup after triggering a recoverable kernel bug. If a local\nattacker were able to trigger certain kinds of kernel bugs, they could\ncreate a specially crafted process to gain root privileges.\n(CVE-2010-4258)\n\nKrishna Gudipati discovered that the bfa adapter driver did not\ncorrectly initialize certain structures. A local attacker could read\nfiles in /sys to crash the system, leading to a denial of service.\n(CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function\ncould bypass the mmap_min_addr restriction. A local attacker could\nexploit this to mmap 4096 bytes below the mmap_min_addr area, possibly\nimproving the chances of performing NULL pointer dereference attacks.\n(CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain\nunreachable messages. If a remote attacker were able to acquire a\nsocket lock, they could send specially crafted traffic that would\ncrash the system, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name\ntermination correctly. A local attacker could exploit this crash the\nsystem or gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's\nhandling of TKIP countermeasures. This reduces the amount of time an\nattacker needs breach a wireless network using WPA+TKIP for security.\n(CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly\nhandle certain requests. A local user could exploit this to crash the\nsystem or potentially gain root privileges. (CVE-2010-4649,\nCVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character\ndevice in Userspace). A local attacker might exploit this flaw to\nescalate privilege, if access to /dev/cuse has been modified to allow\nnon-root users. (CVE-2010-4650)\n\nKees Cook discovered that some ethtool functions did not correctly\nclear heap memory. A local attacker with CAP_NET_ADMIN privileges\ncould exploit this to read portions of kernel heap memory, leading to\na loss of privacy. (CVE-2010-4655)\n\nKees Cook discovered that the IOWarrior USB device driver did not\ncorrectly check certain size fields. A local attacker with physical\naccess could plug in a specially crafted USB device to crash the\nsystem or potentially gain root privileges. (CVE-2010-4656)\n\nJoel Becker discovered that OCFS2 did not correctly validate on-disk\nsymlink structures. If an attacker were able to trick a user or\nautomated system into mounting a specially crafted filesystem, it\ncould crash the system or expose kernel memory, leading to a loss of\nprivacy. (CVE-2010-NNN2)\n\nA flaw was found in the kernel's Integrity Measurement Architecture\n(IMA). Changes made by an attacker might not be discovered by IMA, if\nSELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)\n\nDan Carpenter discovered that the TTPCI DVB driver did not check\ncertain values during an ioctl. If the dvb-ttpci module was loaded, a\nlocal attacker could exploit this to crash the system, leading to a\ndenial of service, or possibly gain root privileges. (CVE-2011-0521)\n\nRafael Dominguez Vega discovered that the caiaq Native Instruments USB\ndriver did not correctly validate string lengths. A local attacker\nwith physical access could plug in a specially crafted USB device to\ncrash the system or potentially gain root privileges. (CVE-2011-0712)\n\nTimo Warns discovered that MAC partition parsing routines did not\ncorrectly calculate block counts. A local attacker with physical\naccess could plug in a specially crafted block device to crash the\nsystem or potentially gain root privileges. (CVE-2011-1010)\n\nTimo Warns discovered that LDM partition parsing routines did not\ncorrectly calculate block counts. A local attacker with physical\naccess could plug in a specially crafted block device to crash the\nsystem, leading to a denial of service. (CVE-2011-1012)\n\nNelson Elhage discovered that the epoll subsystem did not correctly\nhandle certain structures. A local attacker could create malicious\nrequests that would hang the system, leading to a denial of service.\n(CVE-2011-1082)\n\nJohan Hovold discovered that the DCCP network stack did not correctly\nhandle certain packet combinations. A remote attacker could send\nspecially crafted network traffic that would crash the system, leading\nto a denial of service. (CVE-2011-1093).\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected linux-image-2.6.32-216-dove and / or\nlinux-image-2.6.32-416-dove packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Reliable Datagram Sockets (RDS) Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/03/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/03/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2011-2013 Canonical, Inc. / NASL script (C) 2013-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif ( ! get_kb_item(\"Host/Ubuntu/release\") ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"10.04\", pkgname:\"linux-image-2.6.32-216-dove\", pkgver:\"2.6.32-216.33\")) flag++;\nif (ubuntu_check(osver:\"10.10\", pkgname:\"linux-image-2.6.32-416-dove\", pkgver:\"2.6.32-416.33\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:ubuntu_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2023-02-13T07:58:36", "description": "## Releases\n\n * Ubuntu 10.04 \n\n## Packages\n\n * linux \\- Linux kernel\n\nThomas Pollet discovered that the RDS network protocol did not check \ncertain iovec buffers. A local attacker could exploit this to crash the \nsystem or possibly execute arbitrary code as the root user. (CVE-2010-3865)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation did \nnot correctly clear kernel memory. A local attacker could exploit this to \nread kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets implementation did \nnot properly initialize certain structures. A local attacker could exploit \nthis to read kernel stack memory, leading to a loss of privacy. \n(CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly \ninitialize certain structures. A local attacker could exploit this to read \nkernel stack memory, leading to a loss of privacy. (CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did not \nproperly audit certain bytecodes in netlink messages. A local attacker \ncould exploit this to cause the kernel to hang, leading to a denial of \nservice. (CVE-2010-3880)\n\nIt was discovered that multithreaded exec did not handle CPU timers \ncorrectly. A local attacker could exploit this to crash the system, leading \nto a denial of service. (CVE-2010-4248)\n\nKrishna Gudipati discovered that the bfa adapter driver did not correctly \ninitialize certain structures. A local attacker could read files in /sys to \ncrash the system, leading to a denial of service. (CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function could \nbypass the mmap_min_addr restriction. A local attacker could exploit this \nto mmap 4096 bytes below the mmap_min_addr area, possibly improving the \nchances of performing NULL pointer dereference attacks. (CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain \nunreachable messages. If a remote attacker were able to acquire a socket \nlock, they could send specially crafted traffic that would crash the \nsystem, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name \ntermination correctly. A local attacker could exploit this crash the system \nor gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's handling of \nTKIP countermeasures. This reduces the amount of time an attacker needs \nbreach a wireless network using WPA+TKIP for security. (CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly \nhandle certain requests. A local user could exploit this to crash the \nsystem or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character device \nin Userspace). A local attacker might exploit this flaw to escalate \nprivilege, if access to /dev/cuse has been modified to allow non-root \nusers. (CVE-2010-4650)\n\nA flaw was found in the kernel's Integrity Measurement Architecture (IMA). \nChanges made by an attacker might not be discovered by IMA, if SELinux was \ndisabled, and a new IMA rule was loaded. (CVE-2011-0006)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2011-03-01T00:00:00", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-3865", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-4248", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4527", "CVE-2010-4648", "CVE-2010-4649", "CVE-2010-4650", "CVE-2011-0006", "CVE-2011-1044"], "modified": "2011-03-01T00:00:00", "id": "USN-1080-1", "href": "https://ubuntu.com/security/notices/USN-1080-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-13T07:58:36", "description": "## Releases\n\n * Ubuntu 10.04 \n\n## Packages\n\n * linux-ec2 \\- Linux kernel for EC2\n\nThomas Pollet discovered that the RDS network protocol did not check \ncertain iovec buffers. A local attacker could exploit this to crash the \nsystem or possibly execute arbitrary code as the root user. (CVE-2010-3865)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation did \nnot correctly clear kernel memory. A local attacker could exploit this to \nread kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets implementation did \nnot properly initialize certain structures. A local attacker could exploit \nthis to read kernel stack memory, leading to a loss of privacy. \n(CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly \ninitialize certain structures. A local attacker could exploit this to read \nkernel stack memory, leading to a loss of privacy. (CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did not \nproperly audit certain bytecodes in netlink messages. A local attacker \ncould exploit this to cause the kernel to hang, leading to a denial of \nservice. (CVE-2010-3880)\n\nIt was discovered that multithreaded exec did not handle CPU timers \ncorrectly. A local attacker could exploit this to crash the system, leading \nto a denial of service. (CVE-2010-4248)\n\nKrishna Gudipati discovered that the bfa adapter driver did not correctly \ninitialize certain structures. A local attacker could read files in /sys to \ncrash the system, leading to a denial of service. (CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function could \nbypass the mmap_min_addr restriction. A local attacker could exploit this \nto mmap 4096 bytes below the mmap_min_addr area, possibly improving the \nchances of performing NULL pointer dereference attacks. (CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain \nunreachable messages. If a remote attacker were able to acquire a socket \nlock, they could send specially crafted traffic that would crash the \nsystem, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name \ntermination correctly. A local attacker could exploit this crash the system \nor gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's handling of \nTKIP countermeasures. This reduces the amount of time an attacker needs \nbreach a wireless network using WPA+TKIP for security. (CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly \nhandle certain requests. A local user could exploit this to crash the \nsystem or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character device \nin Userspace). A local attacker might exploit this flaw to escalate \nprivilege, if access to /dev/cuse has been modified to allow non-root \nusers. (CVE-2010-4650)\n\nA flaw was found in the kernel's Integrity Measurement Architecture (IMA). \nChanges made by an attacker might not be discovered by IMA, if SELinux was \ndisabled, and a new IMA rule was loaded. (CVE-2011-0006)\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2011-03-02T00:00:00", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-3865", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-4248", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4527", "CVE-2010-4648", "CVE-2010-4649", "CVE-2010-4650", "CVE-2011-0006", "CVE-2011-1044"], "modified": "2011-03-02T00:00:00", "id": "USN-1080-2", "href": "https://ubuntu.com/security/notices/USN-1080-2", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-13T07:58:17", "description": "## Releases\n\n * Ubuntu 10.10 \n * Ubuntu 10.04 \n\n## Packages\n\n * linux-mvl-dove \\- Block storage devices (udeb)\n\nDan Rosenberg discovered that the RDS network protocol did not correctly \ncheck certain parameters. A local attacker could exploit this gain root \nprivileges. (CVE-2010-3904)\n\nNelson Elhage discovered several problems with the Acorn Econet protocol \ndriver. A local user could cause a denial of service via a NULL pointer \ndereference, escalate privileges by overflowing the kernel stack, and \nassign Econet addresses to arbitrary interfaces. (CVE-2010-3848, \nCVE-2010-3849, CVE-2010-3850)\n\nBen Hutchings discovered that the ethtool interface did not correctly check \ncertain sizes. A local attacker could perform malicious ioctl calls that \ncould crash the system, leading to a denial of service. (CVE-2010-2478, \nCVE-2010-3084)\n\nEric Dumazet discovered that many network functions could leak kernel stack \ncontents. A local attacker could exploit this to read portions of kernel \nmemory, leading to a loss of privacy. (CVE-2010-2942, CVE-2010-3477)\n\nDave Chinner discovered that the XFS filesystem did not correctly order \ninode lookups when exported by NFS. A remote attacker could exploit this to \nread or write disk blocks that had changed file assignment or had become \nunlinked, leading to a loss of privacy. (CVE-2010-2943)\n\nTavis Ormandy discovered that the IRDA subsystem did not correctly shut \ndown. A local attacker could exploit this to cause the system to crash or \npossibly gain root privileges. (CVE-2010-2954)\n\nBrad Spengler discovered that the wireless extensions did not correctly \nvalidate certain request sizes. A local attacker could exploit this to read \nportions of kernel memory, leading to a loss of privacy. (CVE-2010-2955)\n\nTavis Ormandy discovered that the session keyring did not correctly check \nfor its parent. On systems without a default session keyring, a local \nattacker could exploit this to crash the system, leading to a denial of \nservice. (CVE-2010-2960)\n\nKees Cook discovered that the Intel i915 graphics driver did not correctly \nvalidate memory regions. A local attacker with access to the video card \ncould read and write arbitrary kernel memory to gain root privileges. \n(CVE-2010-2962)\n\nKees Cook discovered that the V4L1 32bit compat interface did not correctly \nvalidate certain parameters. A local attacker on a 64bit system with access \nto a video device could exploit this to gain root privileges. \n(CVE-2010-2963)\n\nTavis Ormandy discovered that the AIO subsystem did not correctly validate \ncertain parameters. A local attacker could exploit this to crash the system \nor possibly gain root privileges. (CVE-2010-3067)\n\nDan Rosenberg discovered that certain XFS ioctls leaked kernel stack \ncontents. A local attacker could exploit this to read portions of kernel \nmemory, leading to a loss of privacy. (CVE-2010-3078)\n\nRobert Swiecki discovered that ftrace did not correctly handle mutexes. A \nlocal attacker could exploit this to crash the kernel, leading to a denial \nof service. (CVE-2010-3079)\n\nTavis Ormandy discovered that the OSS sequencer device did not correctly \nshut down. A local attacker could exploit this to crash the system or \npossibly gain root privileges. (CVE-2010-3080)\n\nDan Rosenberg discovered that several network ioctls did not clear kernel \nmemory correctly. A local user could exploit this to read kernel stack \nmemory, leading to a loss of privacy. (CVE-2010-3296, CVE-2010-3297, \nCVE-2010-3298)\n\nDan Rosenberg discovered that the ROSE driver did not correctly check \nparameters. A local attacker with access to a ROSE network device could \nexploit this to crash the system or possibly gain root privileges. \n(CVE-2010-3310)\n\nThomas Dreibholz discovered that SCTP did not correctly handle appending \npacket chunks. A remote attacker could send specially crafted traffic to \ncrash the system, leading to a denial of service. (CVE-2010-3432)\n\nDan Rosenberg discovered that the CD driver did not correctly check \nparameters. A local attacker could exploit this to read arbitrary kernel \nmemory, leading to a loss of privacy. (CVE-2010-3437)\n\nDan Rosenberg discovered that the Sound subsystem did not correctly \nvalidate parameters. A local attacker could exploit this to crash the \nsystem, leading to a denial of service. (CVE-2010-3442)\n\nDan Jacobson discovered that ThinkPad video output was not correctly access \ncontrolled. A local attacker could exploit this to hang the system, leading \nto a denial of service. (CVE-2010-3448)\n\nIt was discovered that KVM did not correctly initialize certain CPU \nregisters. A local attacker could exploit this to crash the system, leading \nto a denial of service. (CVE-2010-3698)\n\nDan Rosenberg discovered that SCTP did not correctly handle HMAC \ncalculations. A remote attacker could send specially crafted traffic that \nwould crash the system, leading to a denial of service. (CVE-2010-3705)\n\nBrad Spengler discovered that stack memory for new a process was not \ncorrectly calculated. A local attacker could exploit this to crash the \nsystem, leading to a denial of service. (CVE-2010-3858)\n\nDan Rosenberg discovered that the Linux kernel TIPC implementation \ncontained multiple integer signedness errors. A local attacker could \nexploit this to gain root privileges. (CVE-2010-3859)\n\nKees Cook discovered that the ethtool interface did not correctly clear \nkernel memory. A local attacker could read kernel heap memory, leading to a \nloss of privacy. (CVE-2010-3861)\n\nThomas Pollet discovered that the RDS network protocol did not check \ncertain iovec buffers. A local attacker could exploit this to crash the \nsystem or possibly execute arbitrary code as the root user. (CVE-2010-3865)\n\nDan Rosenberg discovered that the Linux kernel X.25 implementation \nincorrectly parsed facilities. A remote attacker could exploit this to \ncrash the kernel, leading to a denial of service. (CVE-2010-3873)\n\nDan Rosenberg discovered that the CAN protocol on 64bit systems did not \ncorrectly calculate the size of certain buffers. A local attacker could \nexploit this to crash the system or possibly execute arbitrary code as the \nroot user. (CVE-2010-3874)\n\nVasiliy Kulikov discovered that the Linux kernel X.25 implementation did \nnot correctly clear kernel memory. A local attacker could exploit this to \nread kernel stack memory, leading to a loss of privacy. (CVE-2010-3875)\n\nVasiliy Kulikov discovered that the Linux kernel sockets implementation did \nnot properly initialize certain structures. A local attacker could exploit \nthis to read kernel stack memory, leading to a loss of privacy. \n(CVE-2010-3876)\n\nVasiliy Kulikov discovered that the TIPC interface did not correctly \ninitialize certain structures. A local attacker could exploit this to read \nkernel stack memory, leading to a loss of privacy. (CVE-2010-3877)\n\nNelson Elhage discovered that the Linux kernel IPv4 implementation did not \nproperly audit certain bytecodes in netlink messages. A local attacker \ncould exploit this to cause the kernel to hang, leading to a denial of \nservice. (CVE-2010-3880)\n\nVasiliy Kulikov discovered that kvm did not correctly clear memory. A local \nattacker could exploit this to read portions of the kernel stack, leading \nto a loss of privacy. (CVE-2010-3881)\n\nKees Cook and Vasiliy Kulikov discovered that the shm interface did not \nclear kernel memory correctly. A local attacker could exploit this to read \nkernel stack memory, leading to a loss of privacy. (CVE-2010-4072)\n\nDan Rosenberg discovered that IPC structures were not correctly initialized \non 64bit systems. A local attacker could exploit this to read kernel stack \nmemory, leading to a loss of privacy. (CVE-2010-4073)\n\nDan Rosenberg discovered that multiple terminal ioctls did not correctly \ninitialize structure memory. A local attacker could exploit this to read \nportions of kernel stack memory, leading to a loss of privacy. \n(CVE-2010-4075)\n\nDan Rosenberg discovered that the ivtv V4L driver did not correctly \ninitialize certian structures. A local attacker could exploit this to read \nkernel stack memory, leading to a loss of privacy. (CVE-2010-4079)\n\nDan Rosenberg discovered that the RME Hammerfall DSP audio interface driver \ndid not correctly clear kernel memory. A local attacker could exploit this \nto read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, \nCVE-2010-4081)\n\nDan Rosenberg discovered that the VIA video driver did not correctly clear \nkernel memory. A local attacker could exploit this to read kernel stack \nmemory, leading to a loss of privacy. (CVE-2010-4082)\n\nDan Rosenberg discovered that the semctl syscall did not correctly clear \nkernel memory. A local attacker could exploit this to read kernel stack \nmemory, leading to a loss of privacy. (CVE-2010-4083)\n\nJames Bottomley discovered that the ICP vortex storage array controller \ndriver did not validate certain sizes. A local attacker on a 64bit system \ncould exploit this to crash the kernel, leading to a denial of service. \n(CVE-2010-4157)\n\nDan Rosenberg discovered that the socket filters did not correctly \ninitialize structure memory. A local attacker could create malicious \nfilters to read portions of kernel stack memory, leading to a loss of \nprivacy. (CVE-2010-4158)\n\nDan Rosenberg discovered that the Linux kernel L2TP implementation \ncontained multiple integer signedness errors. A local attacker could \nexploit this to to crash the kernel, or possibly gain root privileges. \n(CVE-2010-4160)\n\nDan Rosenberg discovered that certain iovec operations did not calculate \npage counts correctly. A local attacker could exploit this to crash the \nsystem, leading to a denial of service. (CVE-2010-4162)\n\nDan Rosenberg discovered that the SCSI subsystem did not correctly validate \niov segments. A local attacker with access to a SCSI device could send \nspecially crafted requests to crash the system, leading to a denial of \nservice. (CVE-2010-4163, CVE-2010-4668)\n\nDan Rosenberg discovered multiple flaws in the X.25 facilities parsing. If \na system was using X.25, a remote attacker could exploit this to crash the \nsystem, leading to a denial of service. (CVE-2010-4164)\n\nSteve Chen discovered that setsockopt did not correctly check MSS values. A \nlocal attacker could make a specially crafted socket call to crash the \nsystem, leading to a denial of service. (CVE-2010-4165)\n\nDave Jones discovered that the mprotect system call did not correctly \nhandle merged VMAs. A local attacker could exploit this to crash the \nsystem, leading to a denial of service. (CVE-2010-4169)\n\nDan Rosenberg discovered that the RDS protocol did not correctly check \nioctl arguments. A local attacker could exploit this to crash the system, \nleading to a denial of service. (CVE-2010-4175)\n\nAlan Cox discovered that the HCI UART driver did not correctly check if a \nwrite operation was available. If the mmap_min-addr sysctl was changed from \nthe Ubuntu default to a value of 0, a local attacker could exploit this \nflaw to gain root privileges. (CVE-2010-4242)\n\nIt was discovered that multithreaded exec did not handle CPU timers \ncorrectly. A local attacker could exploit this to crash the system, leading \nto a denial of service. (CVE-2010-4248)\n\nVegard Nossum discovered that memory garbage collection was not handled \ncorrectly for active sockets. A local attacker could exploit this to \nallocate all available kernel memory, leading to a denial of service. \n(CVE-2010-4249)\n\nNelson Elhage discovered that the kernel did not correctly handle process \ncleanup after triggering a recoverable kernel bug. If a local attacker were \nable to trigger certain kinds of kernel bugs, they could create a specially \ncrafted process to gain root privileges. (CVE-2010-4258)\n\nKrishna Gudipati discovered that the bfa adapter driver did not correctly \ninitialize certain structures. A local attacker could read files in /sys to \ncrash the system, leading to a denial of service. (CVE-2010-4343)\n\nTavis Ormandy discovered that the install_special_mapping function could \nbypass the mmap_min_addr restriction. A local attacker could exploit this \nto mmap 4096 bytes below the mmap_min_addr area, possibly improving the \nchances of performing NULL pointer dereference attacks. (CVE-2010-4346)\n\nIt was discovered that the ICMP stack did not correctly handle certain \nunreachable messages. If a remote attacker were able to acquire a socket \nlock, they could send specially crafted traffic that would crash the \nsystem, leading to a denial of service. (CVE-2010-4526)\n\nDan Rosenberg discovered that the OSS subsystem did not handle name \ntermination correctly. A local attacker could exploit this crash the system \nor gain root privileges. (CVE-2010-4527)\n\nAn error was reported in the kernel's ORiNOCO wireless driver's handling of \nTKIP countermeasures. This reduces the amount of time an attacker needs \nbreach a wireless network using WPA+TKIP for security. (CVE-2010-4648)\n\nDan Carpenter discovered that the Infiniband driver did not correctly \nhandle certain requests. A local user could exploit this to crash the \nsystem or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)\n\nAn error was discovered in the kernel's handling of CUSE (Character device \nin Userspace). A local attacker might exploit this flaw to escalate \nprivilege, if access to /dev/cuse has been modified to allow non-root \nusers. (CVE-2010-4650)\n\nKees Cook discovered that some ethtool functions did not correctly clear \nheap memory. A local attacker with CAP_NET_ADMIN privileges could exploit \nthis to read portions of kernel heap memory, leading to a loss of privacy. \n(CVE-2010-4655)\n\nKees Cook discovered that the IOWarrior USB device driver did not correctly \ncheck certain size fields. A local attacker with physical access could plug \nin a specially crafted USB device to crash the system or potentially gain \nroot privileges. (CVE-2010-4656)\n\nJoel Becker discovered that OCFS2 did not correctly validate on-disk \nsymlink structures. If an attacker were able to trick a user or automated \nsystem into mounting a specially crafted filesystem, it could crash the \nsystem or expose kernel memory, leading to a loss of privacy. \n(CVE-2010-NNN2)\n\nA flaw was found in the kernel's Integrity Measurement Architecture (IMA). \nChanges made by an attacker might not be discovered by IMA, if SELinux was \ndisabled, and a new IMA rule was loaded. (CVE-2011-0006)\n\nDan Carpenter discovered that the TTPCI DVB driver did not check certain \nvalues during an ioctl. If the dvb-ttpci module was loaded, a local \nattacker could exploit this to crash the system, leading to a denial of \nservice, or possibly gain root privileges. (CVE-2011-0521)\n\nRafael Dominguez Vega discovered that the caiaq Native Instruments USB \ndriver did not correctly validate string lengths. A local attacker with \nphysical access could plug in a specially crafted USB device to crash the \nsystem or potentially gain root privileges. (CVE-2011-0712)\n\nTimo Warns discovered that MAC partition parsing routines did not correctly \ncalculate block counts. A local attacker with physical access could plug in \na specially crafted block device to crash the system or potentially gain \nroot privileges. (CVE-2011-1010)\n\nTimo Warns discovered that LDM partition parsing routines did not correctly \ncalculate block counts. A local attacker with physical access could plug in \na specially crafted block device to crash the system, leading to a denial \nof service. (CVE-2011-1012)\n\nNelson Elhage discovered that the epoll subsystem did not correctly handle \ncertain structures. A local attacker could create malicious requests that \nwould hang the system, leading to a denial of service. (CVE-2011-1082)\n\nJohan Hovold discovered that the DCCP network stack did not correctly \nhandle certain packet combinations. A remote attacker could send specially \ncrafted network traffic that would crash the system, leading to a denial of \nservice. (CVE-2011-1093)\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2011-03-25T00:00:00", "type": "ubuntu", "title": "Linux Kernel vulnerabilities (Marvell Dove)", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 6.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 8.3, "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2478", "CVE-2010-2942", "CVE-2010-2943", "CVE-2010-2954", "CVE-2010-2955", "CVE-2010-2960", "CVE-2010-2962", "CVE-2010-2963", "CVE-2010-3067", "CVE-2010-3078", "CVE-2010-3079", "CVE-2010-3080", "CVE-2010-3084", "CVE-2010-3296", "CVE-2010-3297", "CVE-2010-3298", "CVE-2010-3310", "CVE-2010-3432", "CVE-2010-3437", "CVE-2010-3442", "CVE-2010-3448", "CVE-2010-3477", "CVE-2010-3698", "CVE-2010-3705", "CVE-2010-3848", "CVE-2010-3849", "CVE-2010-3850", "CVE-2010-3858", "CVE-2010-3859", "CVE-2010-3861", "CVE-2010-3865", "CVE-2010-3873", "CVE-2010-3874", "CVE-2010-3875", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-3881", "CVE-2010-3904", "CVE-2010-4072", "CVE-2010-4073", "CVE-2010-4075", "CVE-2010-4079", "CVE-2010-4080", "CVE-2010-4081", "CVE-2010-4082", "CVE-2010-4083", "CVE-2010-4157", "CVE-2010-4158", "CVE-2010-4160", "CVE-2010-4162", "CVE-2010-4163", "CVE-2010-4164", "CVE-2010-4165", "CVE-2010-4169", "CVE-2010-4175", "CVE-2010-4242", "CVE-2010-4248", "CVE-2010-4249", "CVE-2010-4258", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4527", "CVE-2010-4648", "CVE-2010-4649", "CVE-2010-4650", "CVE-2010-4655", "CVE-2010-4656", "CVE-2010-4668", "CVE-2011-0006", "CVE-2011-0521", "CVE-2011-0712", "CVE-2011-1010", "CVE-2011-1012", "CVE-2011-1044", "CVE-2011-1082", "CVE-2011-1093"], "modified": "2011-03-25T00:00:00", "id": "USN-1093-1", "href": "https://ubuntu.com/security/notices/USN-1093-1", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2016-09-04T11:27:55", "description": "The openSUSE 11.3 kernel was updated to 2.6.34.8 to fix various bugs and security issues.\n#### Solution\nThere is no known workaround, please install the update packages.", "cvss3": {}, "published": "2011-04-28T13:57:06", "type": "suse", "title": "remote denial of service in kernel", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2011-0521", "CVE-2010-4163", "CVE-2010-4529", "CVE-2011-1476", "CVE-2010-4668", "CVE-2010-3881", "CVE-2010-4346", "CVE-2010-4527", "CVE-2010-4649", "CVE-2011-1478", "CVE-2011-1012", "CVE-2010-4251", "CVE-2010-4525", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-3875", "CVE-2010-4656", "CVE-2010-3876", "CVE-2011-0711", "CVE-2010-3850", "CVE-2010-4650", "CVE-2011-0712", "CVE-2010-4248", "CVE-2010-3705", "CVE-2010-4243", "CVE-2011-1163", "CVE-2010-3848", "CVE-2010-4648", "CVE-2011-0191", "CVE-2010-3880", "CVE-2010-4250", "CVE-2010-4342", "CVE-2011-1010", "CVE-2010-3858", "CVE-2010-3699", "CVE-2011-1082", "CVE-2011-1477", "CVE-2011-1493", "CVE-2011-1182", "CVE-2011-1090", "CVE-2010-3849", "CVE-2010-4077", "CVE-2010-4075", "CVE-2010-4076"], "modified": "2011-04-28T13:57:06", "id": "SUSE-SA:2011:020", "href": "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00007.html", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:34:33", "description": "[2.6.18-238.el5]\n- [net] bnx2: remove extra call to pci_map_page (John Feeney) [663509]\n- [fs] nfs: set lock_context field in nfs_readpage_sync (Jeff Layton) [663853]\n[2.6.18-237.el5]\n- [block] fully zeroize request struct in rq_init (Rob Evers) [662154]\n- [scsi] qla4xxx: update to 5.02.04.02.05.06-d0 (Chad Dupuis) [656999]\n- [scsi] qla4xxx: make get_sys_info function return void (Chad Dupuis) [656999]\n- [scsi] qla4xxx: dont default device to FAILED state (Chad Dupuis) [656999]\n- [scsi] qla4xxx: mask bits in F/W Options during init (Chad Dupuis) [656999]\n- [scsi] qla4xxx: update to 5.02.04.01.05.06-d0 (Chad Dupuis) [661768]\n- [scsi] qla4xxx: disable irq instead of req pci_slot_reset (Chad Dupuis) [661768]\n- [scsi] qla4xxx: no device add until scsi_add_host success (Chad Dupuis) [661768]\n- [fs] nfs: set lock_context field in nfs_writepage_sync (Jeff Layton) [660580]\n- [scsi] bfa: fix crash reading driver sysfs statistics (Rob Evers) [659880] {CVE-2010-4343}\n- [misc] cpufeature: avoid corrupting cpuid vendor id (Matthew Garrett) [568751]\n- [char] drm: dont set signal blocker on master process (Dave Airlie) [570604]\n- [fs] nfs: remove problematic calls to nfs_clear_request (Jeff Layton) [656492]\n- [fs] nfs: handle alloc failures in nfs_create_request (Jeff Layton) [656492]\n- [fs] nfs: clean up nfs_create_request (Jeff Layton) [656492]\n- [net] forcedeth: fix race condition in latest backport (Ivan Vecera) [658434]\n- [net] cxgb3: fix read of uninitialized stack memory (Jay Fenlason) [633155] {CVE-2010-3296}\n- [net] tg3: increase jumbo flag threshold (John Feeney) [660506]\n- [net] s2io: fix netdev initialization failure (Bob Picco) [654948]\n- [net] igb: only use vlan_gro_receive if vlans registered (Stefan Assmann) [660190] {CVE-2010-4263}\n- [net] ipv6: try all routers with unknown reachable state (Thomas Graf) [661393]\n- [misc] kernel: fix address limit override in OOPS path (Dave Anderson) [659571] {CVE-2010-4258}\n[2.6.18-236.el5]\n- [powerpc] support DLPAR remove operations (Steve Best) [655089]\n- [net] igb: fix tx packet count (Stefan Assmann) [658801]\n- [usb] serial: new driver MosChip MCS7840 (Stefan Assmann) [574507]\n- [fs] exec: copy fixes into compat_do_execve paths (Oleg Nesterov) [625694] {CVE-2010-4243}\n- [fs] exec: make argv/envp memory visible to oom-killer (Oleg Nesterov) [625694] {CVE-2010-4243}\n- [misc] binfmts: kill bprm->argv_len (Oleg Nesterov) [625694] {CVE-2010-4243}\n- [mm] backport upstream stack guard page /proc reporting (Larry Woodman) [643426]\n- [mm] add guard page for stacks that grow upwards (Johannes Weiner) [630563]\n- [net] tipc: fix information leak to userland (Jiri Pirko) [649892] {CVE-2010-3877}\n- [sound] ALSA: fix sysfs unload and OSS mixer mutex issues (Jaroslav Kysela) [652165]\n- [net] tg3: fix 5719 bugs (John Feeney) [657097]\n- [net] bnx2: update firmware to 6.0.x (John Feeney) [644438]\n- [redhat] configs: add CONFIG_SECURITY_DMESG_RESTRICT (Frantisek Hrbata) [653250]\n- [misc] kernel: restrict unprivileged access to dmesg (Frantisek Hrbata) [653250]\n- [virt] xen: dont allow blkback virtual CDROM device (Andrew Jones) [635638] {CVE-2010-4238}\n- Revert: [xen] cd-rom drive does not recognize new media (Andrew Jones) [635638] {CVE-2010-4238}\n- [net] qlge: fix deadlock when interface is going down (Chad Dupuis) [654420]\n- [net] qlge: reset chip before freeing buffers (Chad Dupuis) [654420]\n- [net] qlge: restore vlan setting during ql_adapter_up (Chad Dupuis) [654420]\n- [scsi] qla4xxx: Update version to V5.02.04.00.05.06-d0 (Chad Dupuis) [656999]\n- [scsi] qla4xxx: Document Driver Versioning Scheme (Chad Dupuis) [656999]\n- [scsi] qla4xxx: Updated the Copyright header to 2010 (Chad Dupuis) [656999]\n- [scsi] qla4xxx: dont process devices untill probe done (Chad Dupuis) [656999]\n- [scsi] qla4xxx: free DDB when application calls for it (Chad Dupuis) [656999]\n- [scsi] qla4xxx: memory wedge with peg_halt test in loop (Chad Dupuis) [656999]\n- [scsi] qla4xxx: clear AF_FW_RECOVERY flag after reset (Chad Dupuis) [656999]\n- [scsi] qla4xxx: fix new IP address caching (Chad Dupuis) [656999]\n- [scsi] qla4xxx: replace hard coded values with macros (Chad Dupuis) [656999]\n- [scsi] qla4xxx: mark dev FAILED on 82XX init failure (Chad Dupuis) [656999]\n- [scsi] qla4xxx: fail init if pci mem write fails (Chad Dupuis) [656999]\n- [scsi] qla4xxx: ensure proper qla4xxx_conn_start state (Chad Dupuis) [656999]\n- [scsi] qla4xxx: do not process interrupts unconditionally (Chad Dupuis) [656999]\n- [scsi] qla4xxx: fix add w/iscsi2_create_conn not done yet (Chad Dupuis) [656999]\n- [scsi] qla4xxx: no fw hung if reset retry is in progress (Chad Dupuis) [656999]\n- [scsi] qla4xxx: correct use of cmd->host_scribble (Chad Dupuis) [656999]\n- [scsi] qla4xxx: msi init request_irq parameter usage fix (Chad Dupuis) [656999]\n- [scsi] qla4xxx: cleanup qla4xxx_wait_for_hba_online (Chad Dupuis) [656999]\n- [scsi] qla4xxx: grab hardware_lock before accessing srb (Chad Dupuis) [656999]\n- [scsi] qla4xxx: remove unwanted check for bad spd (Chad Dupuis) [656999]\n- [scsi] qla4xxx: update AER support for ISP82XX (Chad Dupuis) [656999]\n- [scsi] qla4xxx: clear rom lock if firmware died holding (Chad Dupuis) [656999]\n- [scsi] qla4xxx: CRB Register for Request Queue in-pointer (Chad Dupuis) [656999]\n- [scsi] qla4xxx: dump mailbox registers on System Error (Chad Dupuis) [656999]\n- [scsi] qla4xxx: add support for 8130/8131 AENs (Chad Dupuis) [656999]\n- [scsi] qla4xxx: fix seconds_since_last_heartbeat reset (Chad Dupuis) [656999]\n- [scsi] qla4xxx: no wait for outstanding command complete (Chad Dupuis) [656999]\n- [scsi] qla4xxx: free_irqs on failed initialize_adapter (Chad Dupuis) [656999]\n- [virt] xen: fix netback hotplug regression in xenbus fix (Laszlo Ersek) [635999]\n- [xen] fix 64-bit PV guest user mode segv crashing host (Paolo Bonzini) [658354] {CVE-2010-4255}\n[2.6.18-235.el5]\n- [net] filter: fix backport error in prior filter fix (Jarod Wilson) [651703]\n[2.6.18-234.el5]\n- [s390] vmlogrdr: purge after recording is switched off (Hendrik Brueckner) [653479]\n- [wireless] ieee80211: fix deauthentication (Stanislaw Gruszka) [644367]\n- [wireless] zd1211rw: fix associate after disassociate (Stanislaw Gruszka) [644367]\n- [fs] proc: fix NULL ->i_fop oops (Steve Best) [655083]\n- [scsi] lpfc: Update version to 8.2.0.87.1p (Rob Evers) [655119]\n- [scsi] lpfc: set heartbeat timer off by default (Rob Evers) [655119]\n- [scsi] lpfc: fix NULL deref duing allocation failure (Rob Evers) [655119]\n- [scsi] lpfc: fix remote SLI4 firmware download data bug (Rob Evers) [655119]\n- [scsi] lpfc: fix FDMI_DID login failure after link bounce (Rob Evers) [655119]\n- [scsi] lpfc: handle CVL after nameserver PLOGI timeouts (Rob Evers) [655119]\n- [scsi] lpfc: cleanup mbox cmds in mboxq_cmpl if CVL rcvd (Rob Evers) [655119]\n- [misc] posix-cpu-timers: workaround for mt exec problems (Oleg Nesterov) [656266]\n- [fs] setup_arg_pages: diagnose excessive argument size (Oleg Nesterov) [645227]\n- [net] bnx2x: force interrupt mode for iscsi unset mac (Michal Schmidt) [655885]\n- [scsi] bnx2i: allow to abort connect if request times out (Mike Christie) [653991]\n- [scsi] bnx2i: fix remote TCP RST handling for 570X (1g) (Mike Christie) [653991]\n- [scsi] bnx2i: fix a cid leak issue for 5771X (10g) (Mike Christie) [653991]\n- [scsi] bnx2i: fix endian bug in TMF LUN cmd send (Mike Christie) [653991]\n- [misc] prevent divide by 0 in the kernel during boot (Larry Woodman) [508140]\n- [net] filter: make sure filters dont read uninit memory (Jiri Pirko) [651703] {CVE-2010-4158}\n- [net] inet_diag: make sure we run audited bytecode (Jiri Pirko) [651267]\n- [net] limit sendto/recvfrom/iovec total length to INT_MAX (Jiri Pirko) [645872] {CVE-2010-3859}\n- [bluetooth] hci_ldisc: fix missing NULL check (Jarod Wilson) [655666]\n- [net] be2net: avoid firmware update if interface not open (Ivan Vecera) [651948]\n- [ipc] shm: fix information leak to userland (Danny Feng) [648687] {CVE-2010-4072}\n- [ipc] initialize struct memory to 0 for compat functions (Danny Feng) [648693] {CVE-2010-4073}\n- [net] netxen: dont use reset_devices, it may go away (Chad Dupuis) [643254]\n- [net] netxen: fix kdump (Chad Dupuis) [643254]\n- [net] qlcnic: avoid reset_devices, it may become obsolete (Chad Dupuis) [656008]\n- [net] qlcnic: fix for kdump (Chad Dupuis) [656008]\n- [pci] block on access to temporarily unavailable device (Chad Dupuis) [656008]\n- [serial] serial_core: clean data before filling it (Mauro Carvalho Chehab) [648701] {CVE-2010-4075}\n- [edac] i7core_edac: return -ENODEV if dev already probed (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: properly terminate pci_dev_table (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: fix PCI refcounting on reloads (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: fix refcount error at PCI devices (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: safe to unregister mci when mci NULL (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: fix an oops at i7core probe (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: remove unused member in i7core_pvt (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: remove unused arg in get_dimm_config (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: reduce args of i7core_register_mci (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: use saved pointers (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: check probe counter in i7core_remove (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: call pci_dev_put on alloc failure (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: fix error path of i7core_register_mci (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: fix line order in i7core_register_mci (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: always do get/put for all devices (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: ensure edac pci handler release (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: introduce free_i7core_dev (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: introduce alloc_i7core_dev (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: reduce args of i7core_get_onedevice (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: fix the logic in i7core_remove (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: dont do legacy PCI probe by default (Mauro Carvalho Chehab) [651869]\n- [edac] edac_core: print debug messages at release calls (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: remove PCI devices from devices list (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: MCE NMI handling should stop first (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: improve debug register/remove errors (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: move #if PAGE_SHIFT to edac_core.h (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: terminate the group of udimm counters (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: mark const static vars as such (Mauro Carvalho Chehab) [651869]\n- [edac] i7core_edac: move static vars to the top of file (Mauro Carvalho Chehab) [651869]\n- [virt] xen: add bounds req-process loop in blkback/blktap (Laszlo Ersek) [654546] {CVE-2010-4247}\n- [virt] xen: dont leak dev refs on bad xenbus transitions (Laszlo Ersek) [635999] {CVE-2010-3699}\n- [mm] fix possible integer overflow in mm/fremap.c (Larry Woodman) [637047]\n- [misc] futex: replace LOCK_PREFIX in futex.h (Jiri Pirko) [633176] {CVE-2010-3086}\n[2.6.18-233.el5]\n- [scsi] mpt2sas: use sas device list for enclosure id (Tomas Henzl) [652284]\n- [scsi] ipr: fix mailbox register definition and add delay (Steve Best) [654446]\n- [scsi] ipr: fix lun assignment and comparison (Steve Best) [654446]\n- [powerpc] add AT_BASE_PLATFORM to Aux Vector and power7 (Steve Best) [652279]\n- [infiniband] ehea: use shca_list_lock spinlock (Steve Best) [613797]\n- [powerpc] kdump: CPUs assume context of oopsing CPU (Steve Best) [509792]\n- [scsi] lpfc: Update version for 8.2.0.87 driver release (Rob Evers) [649489]\n- [scsi] lpfc: add handling SLI4 unsolicted ELS RTV (Rob Evers) [649489]\n- [scsi] lpfc: add handling ECHO response support (Rob Evers) [649489]\n- [scsi] lpfc: add handling of SLI4 unsolicted ELS (Rob Evers) [649489]\n- [scsi] lpfc: fix locking for security mailbox commands (Rob Evers) [649489]\n- [scsi] lpfc: abort I/Os and wait on XRI in SLI4 unload (Rob Evers) [649489]\n- [scsi] lpfc: handle devloss timeout in FIP engine (Rob Evers) [649489]\n- [scsi] lpfc: fix crashes on NULL pnode dereference (Rob Evers) [649489]\n- [net] cnic: Add cnic_free_uio (Mike Christie) [651287]\n- [net] cnic: Add cnic_uio_dev struct (Mike Christie) [651287]\n- [net] cnic: Add cnic_free_uio (Mike Christie) [651287]\n- [net] cnic: Fine-tune ring init code (Mike Christie) [651287]\n- [misc] fix dirty_bytes sysctl name (Larry Woodman) [635782]\n- [fs] procfs: acquire inode mutex around llseek operation (Lachlan McIlroy) [644726]\n- [virt] netfront: default to copying instead of flipping (Laszlo Ersek) [653262]\n- [virt] netback: dont balloon up for copying receivers (Laszlo Ersek) [653501]\n- [net] rds: fix rds_iovec page count overflow (Jiri Pirko) [647422]\n- [net] virtio_net: add link status handling (Jason Wang) [649573]\n- [net] be2net: Update be2net to version 2.102.512r (Ivan Vecera) [647259]\n- [char] watchdog: another LPC Controller ID for Patsburg (David Milburn) [570868]\n- [misc] another LPC Controller ID for Intel Patsburg PCH (David Milburn) [570868]\n- [i2c] i2c-i801: Add Intel Patsburg device ID (David Milburn) [570868]\n- [misc] pci: update Intel Patsburg defines (David Milburn) [570868]\n- [misc] x86/PCI irq and pci_ids for Intel Patsburg Devices (David Milburn) [570868]\n- [sound] ALSA HD Audio for Intel Patsburg DeviceIDs (David Milburn) [570868]\n- [char] watchdog: TCO Watchdog for Intel Patsburg Devices (David Milburn) [570868]\n- [ata] ahci: AHCI and RAID mode for Intel Patsburg Devices (David Milburn) [570868]\n- [ata] ata_piix: IDE Mode SATA for Intel Patsburg Devices (David Milburn) [570868]\n- [net] fix deadlock in sock_queue_rcv_skb (Danny Feng) [652537]\n- [scsi] qla2xxx: check null fcport in _queuecommands (Chad Dupuis) [644863]\n- [net] qlcnic: Fix missing error codes (Chad Dupuis) [637194]\n- [usb] wacom: add support for Cintiq 21UX2 (Aristeu Rozanski) [652731]\n- [xen] hvm: add HVMOP_get_time hypercall (Paolo Bonzini) [638082]\n[2.6.18-232.el5]\n- [scsi] mpt2sas: use correct pci_resource_flag for compare (Tomas Henzl) [649885]\n- [sound] rme9652: prevent reading uninitialized stack mem (Stanislaw Gruszka) [648709 648714] {CVE-2010-4080 CVE-2010-4081}\n- [net] packet: fix information leak to userland (Jiri Pirko) [649898]\n- [ipc] sys_semctl: fix kernel stack leakage (Danny Feng) [648722] {CVE-2010-4083}\n- [misc] kernel: remove yield from stop_machine paths (Oleg Nesterov) [634454]\n- [fs] dlm: reduce cond_resched during send (David Teigland) [604139]\n- [fs] dlm: use TCP_NODELAY (David Teigland) [604139]\n- [fs] nfs: fix a referral error Oops (Steve Dickson) [556886]\n- [fs] gfs2: fix race in unlinked inode deallocation (Robert S Peterson) [643165]\n- [scsi] retry on DID_REQUEUE errors (Mike Christie) [627836]\n- [net] sctp: do not reset packet during sctp_packet_config (Jiri Pirko) [637867]\n- [net] bnx2: add AER support (John Feeney) [617024]\n- [net] bonding: no lock on copy/clear VLAN list on slave (Andy Gospodarek) [627974]\n- [scsi] gdth: prevent integer overflow in ioc_general (Frantisek Hrbata) [651176]\n[2.6.18-231.el5]\n- [scsi] scsi_dh_alua: remove IBM Power Virtual SCSI ALUA (Steve Best) [567292]\n- [fs] gfs2: flock (LOCK_EX|LOCK_NB) blocks (Robert S Peterson) [648602]\n- [scsi] lpfc: update version for 8.2.0.86 driver release (Rob Evers) [645881]\n- [scsi] lpfc: fix race sending FDISC to un-init VPI (Rob Evers) [645881]\n- [scsi] lpfc: fix mailbox handling for UNREG_RPI_ALL case (Rob Evers) [645881]\n- [kernel] add stop_machine barrier to fix lock contention (Prarit Bhargava) [634454]\n- [scsi] bnx2i: fix ip address formatting and oops (Mike Christie) [646708]\n- [scsi] be2iscsi: remove premature free of cid (Mike Christie) [640029]\n- [fs] proc: make proc pid limits world readable (Jiri Olsa) [611535]\n- [ide] atiixp: fix locking hang in ide layer ATIIXP driver (James Leddy) [586482]\n- [security] only check mmap_min_addr perms for write (Eric Paris) [623519]\n- [ata] sata_sil24: add DID for another adaptec flavor (David Milburn) [640586]\n- [s390] cio: prevent panic in I/O cancel function (Hendrik Brueckner) [647807]\n- [s390] cio: prevent panic after unexpected I/O interrupt (Hendrik Brueckner) [647502]\n[2.6.18-230.el5]\n- [fs] nfs: fix regression in NFS Direct I/O path (Steve Dickson) [647297]\n- [fs] nfs: allow different protocol mounts to same server (Steve Dickson) [460659]\n- [scsi] lpfc: update version for 8.2.0.85 driver release (Rob Evers) [639028]\n- [scsi] lpfc: fix a BUG_ON in lpfc_abort_handler (Rob Evers) [639028]\n- [scsi] lpfc: use pci reset function on driver unload (Rob Evers) [639028]\n- [scsi] lpfc: replace some spin_lock_irqs w/spin_locks (Rob Evers) [639028]\n- [scsi] lpfc: fail io w/lost frame and target check cond (Rob Evers) [639028]\n- [scsi] lpfc: fix abort WQEs for FIP frames (Rob Evers) [639028]\n- [scsi] lpfc: update version for 8.2.0.84 driver release (Rob Evers) [639028]\n- [scsi] lpfc: unreg all rpi mbox command before unreg vpi (Rob Evers) [639028]\n- [scsi] lpfc: make all error values negative (Rob Evers) [639028]\n- [scsi] lpfc: remove duplicate code from lpfc_els_retry (Rob Evers) [639028]\n- [scsi] lpfc: fix circular spinlock dep w/scsi midlayer (Rob Evers) [639028]\n- [scsi] lpfc: update version for 8.2.0.83 driver release (Rob Evers) [639028]\n- [scsi] lpfc: fix FLOGI issue with McData4700 FC switch (Rob Evers) [639028]\n- [scsi] lpfc: fix possible roundrobin failover failure (Rob Evers) [639028]\n- [scsi] lpfc: fix unregister of unused FCF on timeout (Rob Evers) [639028]\n- [scsi] lpfc: fix heartbeat timeout during pause test (Rob Evers) [639028]\n- [scsi] lpfc: update version for 8.2.0.82 driver release (Rob Evers) [639028]\n- [scsi] lpfc: fix lpfc_els_retry delay/retry for PLOGI (Rob Evers) [639028]\n- [scsi] lpfc: streamline some spin locks (Rob Evers) [639028]\n- [scsi] lpfc: fix lpfc_initial_flogi return on failure (Rob Evers) [639028]\n- [scsi] lpfc: fix stray state update issue with new FCF (Rob Evers) [639028]\n- [scsi] lpfc: treat FCF prop with different index as error (Rob Evers) [639028]\n- [scsi] lpfc: fix misc auth issues on EmulexSecure FC HBA (Rob Evers) [639028]\n- [scsi] lpfc: update version for 8.2.0.81 driver release (Rob Evers) [639028]\n- [scsi] lpfc: move unload flag earlier in vport delete (Rob Evers) [639028]\n- [scsi] lpfc: fix IOCB leak on FDISC completion (Rob Evers) [639028]\n- [scsi] lpfc: fix possible crash on non-SLI4 hba (Rob Evers) [639028]\n- [scsi] mpt2sas: fix panic w/direct attached SEP (Jarod Wilson) [641086]\n- [redhat] spec: clean up rpmbuild kabideps detritus (Jarod Wilson) [644129]\n- [net] bnx2: Increase max rx ring size from 1K to 2K (Andy Gospodarek) [640026]\n- [net] bnx2: fixup broken NAPI accounting (Andy Gospodarek) [640026]\n- [s390] qeth: portno 1 support for OSM-device insufficient (Hendrik Brueckner) [644008]\n[2.6.18-229.el5]\n- [pci] include DL580 G7 in bfsort whitelist (Tony Camuso) [644879]\n- [net] igb: fix TX hang when loading igb with max_vfs > 7 (Stefan Assmann) [645284]\n- [virt] fix timekeeping_use_tsc check in init_tsc_timer (Prarit Bhargava) [643926]\n- [net] bonding: support netconsole over bonded link (Neil Horman) [235343]\n- [virt] xen: increase txqueuelen of netback vif devices (Miroslav Rezanina) [539626]\n- [sound] core: prevent heap corruption in snd_ctl_new (Jerome Marchand) [638484] {CVE-2010-3442}\n- [net] updated drivers need version string updates too (Andy Gospodarek) [635027]\n- [misc] softlockup: increase timeout to 60 seconds (Don Zickus) [643707]\n- [virt] xen: fix vdso failure under xen pv environment (Danny Feng) [644860]\n- [scsi] qla2xxx: fix zero test on array in ql_fc_loopback (Chad Dupuis) [644136]\n- [usb] net/catc: change NICs TX_MAX_BURST, fixes probe (Bob Picco) [637826]\n- [virt] console: dont block guest if host doesnt read (Amit Shah) [644735]\n- [media] video: remove compat code for VIDIOCSMICROCODE (Mauro Carvalho Chehab) [642471] {CVE-2010-2963}\n- [xen] vtd: let IOMMU use another IRQ without conflict (Don Dugger) [575790]\n- [net] bonding: correctly process non-linear skbs (Andy Gospodarek) [619070]\n- [net] rds: fix local privilege escalation (Eugene Teo) [642898] {CVE-2010-3904}\n[2.6.18-228.el5]\n- [char] tpm: pay attention to IRQ info from PNP in tpm_tis (Stefan Assmann) [636760]\n- [misc] cpufreq: add missing cpufreq_cpu_put (Prarit Bhargava) [643080]\n- [md] fix softlockup issue waiting for resync to finish (James Paradis) [573106]\n- [s390] dasd_eckd: remove PSF order/suborder ioctl check (John Feeney) [565973]\n- [fs] xfs: fix speculative allocation beyond eof (Dave Chinner) [638753]\n[2.6.18-227.el5]\n- [net] ixgbe: add option to control interrupt mode (Andy Gospodarek) [571495]\n- [md] raid0: fix data corruption on 32-bit w/large storage (Stanislaw Gruszka) [573185]\n- [scsi] fix write buffer length in scsi_req_map_sg (Steve Best) [637235]\n- [scsi] ipr: back out isr optimization changes (Steve Best) [634213]\n- [scsi] ipr: fix rsrc addr format and add attr for dev ID (Steve Best) [634213]\n- [fs] jbd2: properly align sized slab caches (Eric Sandeen) [638961]\n- [fs] ext4: dont scan/accumulate too many pages (Eric Sandeen) [572930]\n- [fs] gfs2: fix fatal filesystem consistency error (Robert S Peterson) [529914]\n- [scsi] lpfc: update version for 8.2.0.80 driver release (Rob Evers) [619917]\n- [scsi] lpfc: add Security Crypto support to CONFIG_PORT (Rob Evers) [619917]\n- [scsi] lpfc: remove unused variables (Rob Evers) [619917]\n- [scsi] lpfc: log msg 0318 is a warning, not an error (Rob Evers) [619917]\n- [scsi] lpfc: fix bug w/cable swap and non-empty nodelist (Rob Evers) [619917]\n- [scsi] lpfc: fix a failure to roundrobin on all FCFs (Rob Evers) [619917]\n- [scsi] lpfc: fix heartbeat timeout during fabric reconfig (Rob Evers) [619917]\n- [scsi] lpfc: update version for 8.2.0.79 driver release (Rob Evers) [619917]\n- [scsi] lpfc: fix a Clear Virtual Link recovery failure (Rob Evers) [619917]\n- [scsi] lpfc: clear VFI_REGISTERED flag after UNREG_VFI (Rob Evers) [619917]\n- [scsi] lpfc: ignore failure of REG_VPI mbox w/UPD bit set (Rob Evers) [619917]\n- [scsi] lpfc: fix ioctl using inactive ndlp for ct resp (Rob Evers) [619917]\n- [scsi] lpfc: fix bug w/ndlp not activated post-cable swap (Rob Evers) [619917]\n- [scsi] lpfc: add support UPD bit of REG_VPI mailbox cmd (Rob Evers) [619917]\n- [scsi] lpfc: fix driver discovery issue after link bounce (Rob Evers) [619917]\n- [scsi] lpfc: fix VLAN ID 0xFFF set to reg_fcfi mbox cmd (Rob Evers) [619917]\n- [scsi] lpfc: update version for 8.2.0.78 driver release (Rob Evers) [619917]\n- [scsi] lpfc: fix race condition causing >1 FLOGI commands (Rob Evers) [619917]\n- [scsi] lpfc: enhance round-robin FCF failover algorithm (Rob Evers) [619917]\n- [scsi] lpfc: clear Ignore Reg Login when purging mailbox (Rob Evers) [619917]\n- [scsi] lpfc: fix for ELS commands stuck on txq (Rob Evers) [619917]\n- [scsi] lpfc: added target queuedepth module parameter (Rob Evers) [619917]\n- [scsi] lpfc: fix RoundRobin FCF failover issue (Rob Evers) [619917]\n- [scsi] re-enable transistions from OFFLINE to RUNNING (Mike Christie) [641193]\n- [edac] i7300_edac: properly init per-csrow memory size (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: better initialize page counts (Mauro Carvalho Chehab) [487428]\n- [redhat] configs: enable edac debugging debug kernels (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: backport driver to RHEL5.6 codebase (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: add appropriate MAINTAINERS info (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: coding style cleanups (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: improve inline comments/documentation (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: reorganize file contents (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: properly detect channel on CE errors (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: enrich FBD info for corrected errors (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: enrich FBD error info for fatal errors (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: pre-allocate buffer for error messages (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: fix MTR x4/x8 detection logic (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: make debug messages consistent (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: remove stale get_error_info logic (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: add error registers cleanup support (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: add support for reporting FBD errors (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: properly detect error correction type (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: detect if device is in single mode (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: add detection of enhanced scrub mode (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: clear error bit after reading (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: add error detection for global errors (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: better PCI device names (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: Add FIXME about error correction type (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: add global error registers (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: display info if ECC is enabled or not (Mauro Carvalho Chehab) [487428]\n- [edac] i7300_edac: new driver for Intel i7300 chipset (Mauro Carvalho Chehab) [487428]\n- [mm] kswapd: dont get stuck in D state w/fragmented mem (Larry Woodman) [609668]\n- [misc] x86_64: fix hang at Booting processor 1/8 APIC (John Villalovos) [639851]\n- [misc] oprofile: add backtraces for compat mode processes (Jiri Olsa) [622024]\n- [net] tg3: re-enable 5717 B0 support (John Feeney) [634320]\n- [net] tg3: fix 5717/57765/5719 memory leak (John Feeney) [631963]\n- [net] tg3: display FW version, handle FW events correctly (John Feeney) [634325]\n- [net] bnx2: improve tx fast path performance (John Feeney) [632057]\n- [net] enic: update to upstream version 1.4.1.2 (Andy Gospodarek) [568111]\n- [net] ixgbe: fix 82598 link issue and panic w/shared irq (Andy Gospodarek) [637331]\n- [net] mlx4: bump max log_mtts_per_seg memory reservation (Jay Fenlason) [636198]\n- [usb] net: add support for CDC EEM (Don Zickus) [572519]\n- [scsi] qla2xxx: clear post-uncorrectable non-fatal errors (Chad Dupuis) [572258]\n- [net] qlcnic: fix poll implementation (Chad Dupuis) [625084]\n- [net] qlcnic: TSO feature added for vlan devices (Chad Dupuis) [625084]\n- [net] qlcnic: fix diag resource allocation (Chad Dupuis) [625084]\n- [net] qlcnic: fix loopback test (Chad Dupuis) [625084]\n- [net] qlcnic: fix bandwidth check (Chad Dupuis) [625084]\n- [net] qlcnic: fix gro support (Chad Dupuis) [625084]\n- [s390] kernel: fix fork vs /proc/stat race (Hendrik Brueckner) [627298]\n- [misc] amd_iommu: fix kdump OOM issue seen with iommu=pt (Bhavna Sarathy) [627663]\n- [fs] execve: fix interactivity and response to SIGKILL (Dave Anderson) [629176]\n- [virt] virtio_console: fix userspace NULL buffer submits (Amit Shah) [636046]\n- [virt] virtio_console: fix poll blocking when data ready (Amit Shah) [636020]\n- [virt] virtio_console: send SIGIO as needed for host evts (Amit Shah) [636053]\n- [virt] virtio_console: make hot-unplug safe (Amit Shah) [628828]\n- [net] virtio_net: defer skb allocation in receive path (Anthony Liguori) [565560]\n- [misc] increase logbuf size to 512K (Don Zickus) [563535]\n- [xen] hvm: correct accuracy of pmtimer (Andrew Jones) [633028]\n- [xen] fix guest crash on non-EPT machine may crash host (Paolo Bonzini) [621430] {CVE-2010-2938}\n[2.6.18-226.el5]\n- [net] bonding: fix IGMP report on slave during failover (Flavio Leitner) [637764]\n[2.6.18-225.el5]\n- [usb] serial/pl2303: add id for HP LD220-HP POS display (Don Zickus) [580698]\n[2.6.18-224.el5]\n- [scsi] mpt2sas: recover from injected PCIe bus errors (Tomas Henzl) [568281]\n- [message] fusion: remove unnecessary printk flooding logs (Tomas Henzl) [629081]\n- [scsi] scsi_dh_alua: handle transitioning state correctly (Mike Snitzer) [619361]\n- [scsi] lpfc: fix ioctl crash in lpfc_nlp_put (Rob Evers) [625841]\n- [net] trace: fix sk_buff typo in network tracepoints (Neil Horman) [568614]\n- [net] sched: fix info leak in traffic policing (Neil Horman) [636392]\n- [md] dm: fix deadlock with fsync vs. resize in lvm (Mikulas Patocka) [624068]\n- [misc] amd_iommu: fix slab corruption with iommu enabled (Larry Woodman) [530619]\n- [mm] add dirty_background_bytes and dirty_bytes sysctls (Larry Woodman) [635782]\n- [scsi] add scsi_dispatch_* tracepoints (Jiri Olsa) [568290]\n- [misc] oprofile: support Intel CPU Family 6, Model 22, 29 (Jiri Olsa) [493047]\n- [fs] aio: fix flush_workqueue deadlock (Jeff Moyer) [546700]\n- [net] be2net: use generated MAC addr for VFs, fix BUG_ON (Ivan Vecera) [630680]\n- [fs] sysfs: add labeling support for sysfs (Eric Paris) [582374]\n- [selinux] inode_*secctx hooks to access security ctx info (Eric Paris) [582374]\n- [fs] xattr: refactor vfs_setxattr for SELinux hook use (Eric Paris) [582374]\n- [redhat] configs: compile TCG modules for kernel-xen (Andrew Jones) [636100]\n- [net] netxen: fix poll implementation (Chad Dupuis) [625079]\n- [net] netxen: fix a race in netxen_nic_get_stats() (Chad Dupuis) [625079]\n- [net] netxen: update version 4.0.74 (Chad Dupuis) [625079]\n- [net] netxen: fix feature setting for vlan devices (Chad Dupuis) [625079]\n- [net] netxen: fix tx csum setting (Chad Dupuis) [625079]\n- [scsi] qla2xxx: recover on mmio_enable function for 82XX (Chad Dupuis) [613134]\n- [scsi] qla2xxx: add AER support for 82XX (Chad Dupuis) [613134]\n- [misc] amd_iommu: change default to passthrough mode (Bhavna Sarathy) [628018]\n- [misc] amd_iommu: add passthrough mode support (Bhavna Sarathy) [561127]\n- [misc] amd: dont use mwait_idle on AMD CPUs (Bhavna Sarathy) [610199]\n- [misc] amd: show L3 cache info for all CPU families (Bhavna Sarathy) [610199]\n- [misc] amd: unify L3 cache index disable checking (Bhavna Sarathy) [610199]\n- [misc] amd: avoid dupe sysfs bits for thresholding banks (Bhavna Sarathy) [610199]\n- [misc] amd: remove superfluous CPU family/model check (Bhavna Sarathy) [610199]\n- [misc] fix race in pid generation causing immediate reuse (Dave Anderson) [634850]\n[2.6.18-223.el5]\n- [redhat] kabi: add net symbols for RHEL5.6 (Jon Masters) [547689 555708 558999 568558 569606 613193]\n- [redhat] kabi: add Block and SCSI symbols for RHEL5.6 (Jon Masters) [547689 558999 566767 569606 574557]\n- [redhat] kabi: add PCI kernel symbols for RHEL5.6 (Jon Masters) [547689 555708 566767 568558 569606 597143 613193]\n- [redhat] kabi: add core kernel symbols for RHEL5.6 (Jon Masters) [545218 562242]\n- [net] ipvs: add one-packet scheduler (Thomas Graf) [578836]\n- [pci] fix pci_mmcfg_init making some memory uncacheable (Shyam Iyer) [581933]\n- [virt] xen: fix crashing of x86 hvm guest on x86_64 (Radim Krcmar) [605697]\n- [scsi] fix disk spinup for shorter path restore times (Rob Evers) [608109]\n- [scsi] aacraid: fix file system falsely going read-only (Rob Evers) [523920]\n- [misc] x86: fix cpuid_level on Intel pre-model 13 cpus (Prarit Bhargava) [606851]\n- [net] cxgb3: alt buffer freeing strategy when xen dom0 (Paolo Bonzini) [488882]\n- [net] bonding: enable output slave selection (Neil Horman) [516289]\n- [md] dm-raid1: fix data lost at mirror log failure (Mikulas Patocka) [555197]\n- [md] kcopyd: dm snapshot performance improvement (Mikulas Patocka) [466088]\n- [scsi] increase sync cache timeout (Mike Christie) [592322]\n- [scsi] log msg when getting Unit Attention (Mike Christie) [585431]\n- [virt] xen: add dummy mwait for xen to make it compile (Luming Yu) [573514]\n- [x86_64] use apic as main timer if non-stop-apic timer (Luming Yu) [573514]\n- [acpi] cpu: use MWAIT for C-state (Luming Yu) [573514]\n- [net] ipv4/defrag: check socket type before reference (Jiri Olsa) [632266]\n- [net] ipv4: prevent chained skb destined to UFO device (Jiri Olsa) [633450]\n- [block] cfq: no merges for queues w/no process references (Jeff Moyer) [605265]\n- [fs] aio: check for multiplication overflow in io_submit (Jeff Moyer) [629449] {CVE-2010-3067}\n- [misc] make compat_alloc_user_space incorporate access_ok (Don Howard) [634464] {CVE-2010-3081}\n- [fs] xfs: prevent reading uninitialized stack memory (Dave Chinner) [630807] {CVE-2010-3078}\n- [fs] aio: fix cleanup in io_submit_one (Jeff Moyer) [631721] {CVE-2010-3066}\n[2.6.18-222.el5]\n- [cpufreq] powernow-k8: fix per core frequency control (Bhavna Sarathy) [502397]\n- [misc] uid/gid: fix integer overflow in groups_search (Jerome Marchand) [629626]\n- [virt] xen: remove dead code (Paolo Bonzini) [507846]\n- [virt] xen: dont give up ballooning under mem pressure (Paolo Bonzini) [507846]\n- [net] ipv4: fix oops in writing to forwarding sysctl (Neil Horman) [629638]\n- [net] trace: backport some networking tracepoints (Neil Horman) [568614]\n- [misc] rename topology_*_cpumask back to *_siblings (Michal Schmidt) [633388]\n- [scsi] 3w_sas: add new 3ware SAS driver (Tomas Henzl) [572011]\n- [scsi] 3w-9xxx: update to 2.26.08.007-2.6.18RH (Tomas Henzl) [572004]\n- [scsi] megaraid: fix suspend function (Tomas Henzl) [630927]\n- [net] ipv6: add modes to do RA/RS when in forwarding mode (Thomas Graf) [614064]\n- [fs] nfsv4: fix bug when server returns NFS4ERR_RESOURCE (Steve Dickson) [620502]\n- [fs] nfsv4: ensure lockowners are labelled correctly (Steve Dickson) [620502]\n- [fs] nfsv4: add support for RELEASE_LOCKOWNER operation (Steve Dickson) [620502]\n- [fs] nfsv4: clean up for lockowner XDR encoding (Steve Dickson) [620502]\n- [fs] nfsv4: ensure we track lock state in r/w requests (Steve Dickson) [620502]\n- [scsi] qla4xxx: add PCIe AER support (Chad Dupuis) [624710]\n- [scsi] qla4xxx: update version to 5.02.03.00.05.06-d1 (Chad Dupuis) [623675]\n- [scsi] qla4xxx: resolve name space error with qla2xxx (Chad Dupuis) [623675]\n- [net] qlcnic: add AER support and miscellaneous fixes (Chad Dupuis) [614281]\n- [net] qlcnic: add NIC partitioning and other misc fixes (Chad Dupuis) [614281]\n- [net] qlcnic: misc upstream fixes for RHEL5.6 (Chad Dupuis) [614281]\n- [net] ipv4: fix buffer overflow in icmpmsg_put (Frantisek Hrbata) [601391]\n- [proc] allow access to /proc//fd after setuid (Danny Feng) [617707]\n- [fs] xfs: fix missing untrusted inode lookup tag (Dave Chinner) [607032]\n- [wireless] fixes from 2.6.32.18 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.17 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.16 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.14 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.13 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.12 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.11 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.10 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.9 (Stanislaw Gruszka) [621105]\n- [wireless] fixes from 2.6.32.8 (Stanislaw Gruszka) [621105]\n- [xen] emulate task switching (Paolo Bonzini) [625903]\n- [xen] introduce hvm_set_cr3 (Paolo Bonzini) [625903]\n- [xen] introduce hvm_virtual_to_linear_addr (Paolo Bonzini) [625903]\n- [xen] introduce hvm_set_segment_register (Paolo Bonzini) [625903]\n- [xen] hvm: big cleanups and fixes to event deliver logic (Paolo Bonzini) [625903]\n- [xen] vmx: simplify event-injection logic (Paolo Bonzini) [625903]\n- [xen] xm trigger NMI support for HVM guests (Paolo Bonzini) [625902]\n- [xen] virtual NMI support (Paolo Bonzini) [625902]\n- [xen] emulate injection of guest NMI (Paolo Bonzini) [625902]\n- [xen] introduce get_isa_irq_vector and is_isa_irq_masked (Paolo Bonzini) [625902]\n- [xen] hvm: fix UP suspend/resume/migration w/PV drivers (Miroslav Rezanina) [629773]\n[2.6.18-221.el5]\n- [acpi] check _PPC state on cpufreq start (Matthew Garrett) [581037]\n- [fs] aio: bump i_count instead of using igrab (Jeff Moyer) [626963]\n- [redhat] dont generate kABI deps when building w/o kABI (Jon Masters) [456765]\n- [watchdog] support for iTCO on Ibex Peak and Cougar Point (John Villalovos) [534152]\n- [edac] amd64_edac: whitespace cleanups (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: minor formatting fix (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: fix operator precedence error (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: fix syndrome calculation on K8 (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: simplify ECC override handling (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: do not falsely trigger kerneloops (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: restrict PCI config space access (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: fix forcing module load/unload (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: fix driver instance freeing (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: fix k8 chip select reporting (Bhavna Sarathy) [568576]\n- [edac] amd64_edac: add leaner syndrome decoding algorithm (Bhavna Sarathy) [568576]\n- [scsi] bnx2i: link hba and cnic device before device reg (Mike Christie) [578005]\n- [scsi] bnx2i: make fw use statsn field to build header (Mike Christie) [578005]\n- [net] cnic: select bug fixes from upstream for RHEL5.6 (Mike Christie) [595548 619767]\n- [scsi] bnx2i: update version to bnx2i-2.1.3 (Mike Christie) [568606]\n- [scsi] bnx2i: add chip cleanup for remove module path (Mike Christie) [568606]\n- [scsi] bnx2i: rebind CFC cleanup to cm_abort/close comp (Mike Christie) [568606]\n- [scsi] bnx2i: add support for additional TMFs (Mike Christie) [568606]\n- [scsi] bnx2i: fix protocol violation on nopout responses (Mike Christie) [568606]\n- [scsi] bnx2i: fix response panic on unsolicited NOP-In (Mike Christie) [568606]\n- [scsi] bnx2i: fix bugs in handling of unsolicited NOP-Ins (Mike Christie) [568606]\n- [scsi] bnx2i: add host param ISCSI_HOST_PARAM_IPADDRESS (Mike Christie) [568606]\n- [scsi] bnx2i: fix TCP graceful termination initiation (Mike Christie) [568606]\n- [scsi] bnx2i: fine tune misc destroy timeout values (Mike Christie) [568606]\n- [scsi] bnx2i: optimize bnx2i_stop connection clean up (Mike Christie) [568606]\n- [scsi] bnx2i: create active linklist holding endpoints (Mike Christie) [568606]\n- [scsi] bnx2i: split hardware cleanup from ep_disconnect (Mike Christie) [568606]\n- [fs] dlm: fix try 1cb failure, part 2 (Abhijith Das) [504188]\n- [fs] dlm: no node callback when try 1cb lock req fails (David Teigland) [504188]\n- [misc] crypto: add Intel x86_64 hardware CRC32 support (Prarit Bhargava) [626018]\n- [net] bnx2: update to v2.0.8+ with new 5709 firmware j15 (John Feeney) [568601]\n- [net] tg3: update to 3.108+ and add 5718 B0, 5719 support (John Feeney) [567462]\n- [misc] move dev_name to device.h (John Feeney) [568551]\n- [misc] add WARN_ONCE macro (John Feeney) [568551]\n- [dma_v3] update I/O AT and DCA drivers (John Feeney) [568551]\n- [net] forcedeth: update to latest upstream for RHEL5.6 (Ivan Vecera) [628831]\n- [net] e1000e: update to upstream version 1.2.7-k2 (Andy Gospodarek) [566021]\n- [net] qla2xxx: fix display of link down state (Chad Dupuis) [627612]\n- [scsi] qla2xxx: rom lock recover if fw hangs holding lock (Chad Dupuis) [619814]\n- [scsi] qla2xxx: update AER support, do early abort cmds (Chad Dupuis) [619814]\n- [scsi] qla2xxx: add IS_QLA82XX check in update_fw_options (Chad Dupuis) [619814]\n- [scsi] qla2xxx: cover UNDERRUN case where SCSI status set (Chad Dupuis) [619814]\n- [scsi] qla2xxx: fix set fw hung and complete waiting mbx (Chad Dupuis) [619814]\n- [scsi] qla2xxx: fix seconds_since_last_heartbeat reset (Chad Dupuis) [619814]\n- [scsi] qla2xxx: correct extended sense-data handling (Chad Dupuis) [619814]\n- [scsi] qla2xxx: dont {s,g}et port MBC if invalid port id (Chad Dupuis) [619814]\n- [scsi] qla2xxx: stop firmware before doing init firmware (Chad Dupuis) [619814]\n- [xen] oprofile: force use of architectural perfmon (Don Dugger) [538564]\n- [xen] oprofile: support Intels arch perfmon registers (Don Dugger) [538564]\n- [xen] oprofile: add support for Core i7 and Atom (Don Dugger) [538564]\n[2.6.18-220.el5]\n- [block] cciss: version string to 3.6.22.RH1 (Tomas Henzl) [568830]\n- [block] cciss: bus_unregister_once not once per hba (Tomas Henzl) [568830]\n- [block] cciss: rename cciss_sector_size (Tomas Henzl) [568830]\n- [block] cciss: make log_unit_to_scsi3addr an inline (Tomas Henzl) [568830]\n- [block] cciss: fix enxio weirdness (Tomas Henzl) [568830]\n- [block] cciss: reorder functions (Tomas Henzl) [568830]\n- [block] cciss: fix raid level sysfs permissions (Tomas Henzl) [568830]\n- [block] cciss: make device attributes static (Tomas Henzl) [568830]\n- [block] cciss: make cciss_seq_show handle drv_array holes (Tomas Henzl) [568830]\n- [block] cciss: add via_ioctl param to rebuild_lun_table (Tomas Henzl) [568830]\n- [block] cciss: add support for multi-lun tape devices (Tomas Henzl) [568830]\n- [block] cciss: notify scsi midlayer of device changes (Tomas Henzl) [568830]\n- [block] cciss: fix scatter-gather on scsi side (Tomas Henzl) [568830]\n- [block] cciss: add more commands for tapes (Tomas Henzl) [568830]\n- [block] cciss: factor out scsi dma code (Tomas Henzl) [568830]\n- [block] cciss: eliminate unnecessary pointer use (Tomas Henzl) [568830]\n- [block] cciss: dont use void pointer for hba (Tomas Henzl) [568830]\n- [block] cciss: detect bad alignment (Tomas Henzl) [568830]\n- [block] cciss: factor out sg chain block mapping code (Tomas Henzl) [568830]\n- [block] cciss: fix DMA direction kludge (Tomas Henzl) [568830]\n- [block] cciss: simplify scatter gather code (Tomas Henzl) [568830]\n- [block] cciss: factor out scatter gather alloc and free (Tomas Henzl) [568830]\n- [block] cciss: enhanced scatter-gather support (Tomas Henzl) [568830]\n- [block] cciss: remove the scan thread (Tomas Henzl) [568830]\n- [block] cciss: fix scsi status typo (Tomas Henzl) [568830]\n- [block] cciss: remove sendcmd (Tomas Henzl) [568830]\n- [block] cciss: clean up code in cciss_shutdown (Tomas Henzl) [568830]\n- [block] cciss: retry driver cmds with unit attention cond (Tomas Henzl) [568830]\n- [block] cciss: no pci_release_regions on regions not held (Tomas Henzl) [568830]\n- [block] cciss: fix memory leak in cciss_init_one (Tomas Henzl) [568830]\n- [block] cciss: dynamically allocate drive info struct (Tomas Henzl) [568830]\n- [block] cciss: fix raid label related magic number (Tomas Henzl) [568830]\n- [block] cciss: no check busy initializing in cciss open (Tomas Henzl) [568830]\n- [block] cciss: add usage_count attribute to logical drive (Tomas Henzl) [568830]\n- [block] cciss: add raid_level attribute to logical drives (Tomas Henzl) [568830]\n- [block] cciss: add lunid attribute to log drives in /sys (Tomas Henzl) [568830]\n- [block] cciss: dont call putdisk excessively (Tomas Henzl) [568830]\n- [block] cciss: zero out drive info on removal (Tomas Henzl) [568830]\n- [block] cciss: handle special case for /dev/cciss/c0d0 (Tomas Henzl) [568830]\n- [block] cciss: handle cases when cciss_add_disk fails (Tomas Henzl) [568830]\n- [block] cciss: fix and rearrange logical drive sysfs code (Tomas Henzl) [568830]\n- [block] cciss: dynamic allocate struct device for logical (Tomas Henzl) [568830]\n- [block] cciss: Use helper functions to access drive_data (Tomas Henzl) [568830]\n- [block] cciss: remove withirq parameter where possible (Tomas Henzl) [568830]\n- [block] cciss: remove sysfs entries during driver cleanup (Tomas Henzl) [568830]\n- [block] cciss: add cciss_sysfs_stat_inquiry function (Tomas Henzl) [568830]\n- [block] cciss: add CTLR_LUNID define (Tomas Henzl) [568830]\n- [block] cciss: Remove unused was_only_controller_node (Tomas Henzl) [568830]\n- [block] cciss: fix problem with LUN addressing (Tomas Henzl) [568830]\n- [block] cciss: fix problem with SG_IO completions (Tomas Henzl) [568830]\n- [block] cciss: retry commands from within sendcmd_withirq (Tomas Henzl) [568830]\n- [block] cciss: change SCSI error handling code (Tomas Henzl) [568830]\n- [block] cciss: remove sendcmd reject processing (Tomas Henzl) [568830]\n- [block] cciss: let scsi error handling work w/interrupts (Tomas Henzl) [568830]\n- [block] cciss: factor out error processing code (Tomas Henzl) [568830]\n- [block] cciss: factor out target status code (Tomas Henzl) [568830]\n- [block] cciss: simplify device addressing methods (Tomas Henzl) [568830]\n- [block] cciss: factor out sendcmd_withirq core (Tomas Henzl) [568830]\n- [block] cciss: use uninterruptible timeout when waiting (Tomas Henzl) [568830]\n- [block] cciss: fix lun reset code (Tomas Henzl) [568830]\n- [block] cciss: factor out sendcmd core for sane interface (Tomas Henzl) [568830]\n- [block] cciss: remove double setting of h->busy (Tomas Henzl) [568830]\n- [block] cciss: disable scan thread, it prevents rmmod (Tomas Henzl) [568830]\n- [net] netxen: fix inconsistent lock state (Chad Dupuis) [562937]\n- [net] netxen: protect tx timeout recovery by rtnl lock (Chad Dupuis) [562937]\n- [net] netxen: fix for kdump (Chad Dupuis) [562937]\n- [net] netxen: fix caching window register (Chad Dupuis) [562937]\n- [net] netxen: fix rcv buffer leak (Chad Dupuis) [562937]\n- [net] netxen: fix memory leaks in error path (Chad Dupuis) [562937]\n- [net] netxen: remove unnecessary returns (Chad Dupuis) [562937]\n- [net] netxen: handle queue manager access (Chad Dupuis) [562937]\n- [net] netxen: to fix onchip memory access. (Chad Dupuis) [562937]\n- [net] netxen: remove unnecessary size checks (Chad Dupuis) [562937]\n- [net] netxen: fix register usage (Chad Dupuis) [562937]\n- [net] netxen: fix deadlock in aer (Chad Dupuis) [562937]\n- [net] netxen: fix interrupt for NX2031 (Chad Dupuis) [562937]\n- [net] netxen: fix fw load from file (Chad Dupuis) [562937]\n- [net] netxen: validate unified romimage (Chad Dupuis) [562937]\n- [net] netxen: fix corner cases of firmware recovery (Chad Dupuis) [562937]\n- [net] netxen: update version to 4.0.73 (Chad Dupuis) [562937]\n- [net] netxen: fix tx csum status (Chad Dupuis) [562937]\n- [net] netxen: added sanity check for pci map (Chad Dupuis) [562937]\n- [net] netxen: fix warning in ioaddr for NX3031 chip (Chad Dupuis) [562937]\n- [net] netxen: fix bios version calculation (Chad Dupuis) [562937]\n- [net] netxen: disable on NX_P3_B1 hardware (Chad Dupuis) [562937]\n- [net] netxen: protect resource cleanup by rtnl lock (Chad Dupuis) [562937]\n- [net] netxen: fix tx timeout recovery for NX2031 chip (Chad Dupuis) [562937]\n- [net] netxen: fix sparse warning (Chad Dupuis) [562937]\n- [net] netxen: fix license header (Chad Dupuis) [562937]\n- [net] netxen: fix endianness intr coalesce (Chad Dupuis) [562937]\n- [net] netxen: fix endianness read mac address (Chad Dupuis) [562937]\n- [net] netxen: use DEFINE_PCI_DEVICE_TABLE() (Chad Dupuis) [562937]\n- [net] netxen: update version to 4.0.72 (Chad Dupuis) [562937]\n- [net] netxen: fix set mac addr (Chad Dupuis) [562937]\n- [net] netxen: fix smatch warning (Chad Dupuis) [562937]\n- [net] netxen: fix tx ring memory leak (Chad Dupuis) [562937]\n- [net] netxen: fix ethtool link test (Chad Dupuis) [562937]\n- [net] netxen: move && and || to end of previous line (Chad Dupuis) [562937]\n- [net] netxen: fix ethtool register dump (Chad Dupuis) [562937]\n- [net] netxen: fix unified fw size check (Chad Dupuis) [562937]\n- [net] netxen: support pci error handlers (Chad Dupuis) [562937]\n- [net] netxen: fix tx timeout recovery (Chad Dupuis) [562937]\n- [net] netxen: minor suspend resume fixes (Chad Dupuis) [562937]\n- [net] netxen: use module parameter correctly (Chad Dupuis) [562937]\n- [net] netxen: fix firmware type check (Chad Dupuis) [562937]\n- [net] netxen: fix napi intr enable check (Chad Dupuis) [562937]\n- [net] netxen: protect device reset by rtnl_lock (Chad Dupuis) [562937]\n- [net] netxen: fix failure cases for fw hang recovery (Chad Dupuis) [562937]\n- [net] netxen: fix debug tools access for NX2031 (Chad Dupuis) [562937]\n- [misc] clone: fix race between copy_process and de_thread (Jiri Olsa) [590864]\n- [s390] dasd: let recovery cqr get flags from failed cqr (Hendrik Brueckner) [628838]\n- [net] ipv4: fix leak, rcu and length in route cache gc (Thomas Graf) [541224]\n- [net] tcp: zero out rx_opt in tcp_disconnect (Thomas Graf) [539560]\n- [net] ipv6: Update Neighbor Cache when IPv6 RA received (Thomas Graf) [560870]\n- [net] ipv6: Plug sk_buff leak in ipv6_rcv (Thomas Graf) [574913]\n- [redhat] configs: enable building k10temp sensor driver (Michal Schmidt) [443745]\n- [hwmon] add k10temp sensor driver (Michal Schmidt) [443745]\n- [pci] add AMD 10h, 11h PCI IDs to pci_ids.h (Michal Schmidt) [443745]\n- [net] vxge: fix multicast issues (Michal Schmidt) [608598]\n- [net] vxge: show startup message with KERN_INFO (Michal Schmidt) [608598]\n- [net] vxge: fix memory leak in vxge_alloc_msix error path (Michal Schmidt) [608598]\n- [net] vxge: fix checkstack warning in vxge_probe (Michal Schmidt) [608598]\n- [net] vxge: remove unnecessary returns from void functs (Michal Schmidt) [608598]\n- [net] vxge: version update (Michal Schmidt) [608598]\n- [net] vxge: pass correct number of VFs value to sriov (Michal Schmidt) [608598]\n- [net] vxge: allow load for all enumerated pci functions (Michal Schmidt) [608598]\n- [net] vxge: fix possible memory leak in device init (Michal Schmidt) [608598]\n- [net] vxge: add missing vlan_rx_kill_vid method (Michal Schmidt) [594404 608598]\n- [net] vxge: remove trailing space in messages (Michal Schmidt) [608598]\n- [net] vxge: use pci_dma_mapping_error to test return val (Michal Schmidt) [608598]\n- [net] vxge: use DEFINE_PCI_DEVICE_TABLE (Michal Schmidt) [608598]\n- [net] vxge: use DMA_BIT_MASK instead of plain values (Michal Schmidt) [608598]\n- [net] vxge: move && and || to end of previous line (Michal Schmidt) [608598]\n- [net] bnx2x: fix wrong return from bnx2x_trylock_hw_lock (Michal Schmidt) [572012]\n- [net] bnx2x: small fix in stats handling (Michal Schmidt) [572012]\n- [net] bnx2x: update bnx2x version to 1.52.53-4 (Michal Schmidt) [572012]\n- [net] bnx2x: fix PHY locking problem (Michal Schmidt) [572012]\n- [net] bnx2x: adjust confusing if indentation (Michal Schmidt) [572012]\n- [net] bnx2x: load firmware in open instead of probe (Michal Schmidt) [572012]\n- [net] bnx2x: fix net/ip6_checksum.h include (Michal Schmidt) [572012]\n- [net] bnx2x: update driver version to 1.52.53-3 (Michal Schmidt) [572012]\n- [net] bnx2x: move statistics handling code to own files (Michal Schmidt) [572012]\n- [net] bnx2x: create separate file for ethtool routines (Michal Schmidt) [572012]\n- [net] bnx2x: create bnx2x_cmn.* files (Michal Schmidt) [572012]\n- [net] bnx2x: main netdev does not need ->poll, ->weight (Michal Schmidt) [572012]\n- [net] bnx2x: move global variable load_count to bnx2x.h (Michal Schmidt) [572012]\n- [net] bnx2x: store module parameters in main structure (Michal Schmidt) [572012]\n- [net] bnx2x: create separate folder for bnx2x driver (Michal Schmidt) [572012]\n- [net] bnx2x: set RXHASH for LRO packets (Michal Schmidt) [572012]\n- [net] bnx2x: return -EINVAL for unsupported flags (Michal Schmidt) [572012]\n- [net] bnx2x: fail when trying to setup unsupported features (Michal Schmidt) [572012]\n- [net] bnx2x: fix link problem with some DACs (Michal Schmidt) [572012]\n- [net] bnx2x: protect a SM state change (Michal Schmidt) [572012]\n- [net] bnx2x: avoid TX timeout when stopping device (Michal Schmidt) [572012]\n- [net] bnx2x: fix check to get RX hash (Michal Schmidt) [572012]\n- [net] bnx2x: remove two unneeded prefetch calls (Michal Schmidt) [572012]\n- [net] bnx2x: add support for receive hashing (Michal Schmidt) [572012]\n- [net] bnx2x: update date and version to 1.52.53-1 (Michal Schmidt) [572012]\n- [net] bnx2x: dont report link down if already down (Michal Schmidt) [572012]\n- [net] bnx2x: rework power state handling code (Michal Schmidt) [572012]\n- [net] bnx2x: use register mask to avoid parity error (Michal Schmidt) [572012]\n- [net] bnx2x: fix MSI-X enabling flow (Michal Schmidt) [572012]\n- [net] bnx2x: add new statistics (Michal Schmidt) [572012]\n- [net] bnx2x: white space and formatting fixups (Michal Schmidt) [572012]\n- [net] bnx2x: protect code with NOMCP (Michal Schmidt) [572012]\n- [net] bnx2x: increase DMAE max write size for 57711 (Michal Schmidt) [572012]\n- [net] bnx2x: add skeleton VPD firmware version read code (Michal Schmidt) [572012]\n- [net] bnx2x: parity error handling for 57710 and 57711 (Michal Schmidt) [572012]\n- [net] bnx2x: use DEFINE_PCI_DEVICE_TABLE() (Michal Schmidt) [572012]\n- [net] bnx2x: move && and || to end of previous line (Michal Schmidt) [572012]\n- [net] bnx2x: remove trailing space in messages (Michal Schmidt) [572012]\n- [net] bnx2x: clean up debug prints (Michal Schmidt) [572012]\n- [net] bnx2x: use macro for phy address (Michal Schmidt) [572012]\n- [net] bnx2x: convert more to %pM (Michal Schmidt) [572012]\n- [net] bnx2x: use pci_ioremap_bar (Michal Schmidt) [572012]\n- [net] bnx2x: make NAPI poll routine closer to upstream (Michal Schmidt) [572012]\n- [net] bnx2x: typo fixes (Michal Schmidt) [572012]\nmacro helpers (Michal Schmidt) [572012]\n- [net] bnx2x: use DMA_BIT_MASK(64) over DMA_64BIT_MASK (Michal Schmidt) [572012]\n- [net] sfc: update to upstream version 2.6.36-rc1 code (Michal Schmidt) [556476]\n- [net] sfc: undo now unnecessary RHEL workqueue changes (Michal Schmidt) [556476]\n- [net] netdevice: add netdev_for_each_mc_addr (Michal Schmidt) [556476]\n- [misc] add round_jiffies_up and related routines (Michal Schmidt) [556476]\n- [net] core: bug fix for vlan + gro issue (Michal Schmidt) [556476]\n- [net] vlan/bridge: fix skb_pull_rcsum fatal exception (Michal Schmidt) [556476]\n- [fs] proc: add file position and flags info in /proc (Jerome Marchand) [498081]\n- [net] e100*/igb*/ixgb*: add missing read memory barrier (Andy Gospodarek) [629761]\n- [net] igb/igbvf: turn on TSO for VLAN interfaces (Andy Gospodarek) [629457]\n- [net] vlan: control vlan device TSO status with ethtool (Andy Gospodarek) [629457]\n- [xen] vtd: fix parameter iommu=no-intremap (Paolo Bonzini) [576478]\n[2.6.18-219.el5]\n- [net] udp: fix bogus UFO packet generation (Jarod Wilson) [632266]\n- [virt] xen: fix xennet driver to not corrupt data (Neil Horman) [630129]\n- [virt] fix 64-bit compile issue in VMWare TSC update (Prarit Bhargava) [538022]\n[2.6.18-218.el5]\n- [net] tcp: prevent sending past receiver window with TSO (Thomas Graf) [494400]\n- [misc] netdevice: add printk helpers for net drivers (Michal Schmidt) [629634]\n- [misc] drivers: remove private definitions of pr_* macros (Michal Schmidt) [629634]\n- [misc] kernel: add pr_* family of printk helper macros (Michal Schmidt) [629634]\n- [infiniband] iw_cxgb3: always define states[] (Michal Schmidt) [629634]\n- [net] ifb: fix syntax error in pr_debug usage (Michal Schmidt) [629634]\n- [net] tg3: disable PME bit during resume (John Feeney) [598530]\n- [net] netfilter: fix crashes caused by fragment jumps (Jiri Pirko) [617268]\n- [virt] update VMWare TSC code (Prarit Bhargava) [538022]\n[2.6.18-217.el5]\n- [time] implement fine grained accounting for PM timer (Ulrich Obergfell) [586285]\n- [time] initialize tick_nsec based on kernel parameters (Ulrich Obergfell) [586285]\n- [time] introduce 'pmtimer_fine_grained' kernel parameter (Ulrich Obergfell) [586285]\n- [scsi] ibmvfc: Fix terminate_rport_io (Steve Best) [628615]\n- [fs] ext3: flush disk caches on fsync when needed (Eric Sandeen) [592961]\n- [fs] ext4: move aio completion after unwritten extent con (Eric Sandeen) [617690]\n- [fs] xfs: move aio completion after unwritten extent conv (Eric Sandeen) [617690]\n- [fs] direct-io: move aio_complete into ->end_io (Eric Sandeen) [617690]\n- [fs] ext4: quota updates for RHEL5.6 (Eric Sandeen) [457153]\n- [fs] ext4: quota infrastructure updates for RHEL5.6 (Eric Sandeen) [457153]\n- [fs] ext4: core updates for RHEL5.6 (Eric Sandeen) [457153]\n- [fs] ext4: add new kernel helpers for RHEL5.6 (Eric Sandeen) [457153]\n- [infiniband] sync iser driver with upstream for RHEL5.6 (Mike Christie) [623595]\n- [net] cxgb3: dont flush workqueue if called from wq (Doug Ledford) [630124]\n- [net] cxgb3: get fatal parity error status on interrupt (Doug Ledford) [630124]\n- [net] cxgb3: clear fatal parity error register on init (Doug Ledford) [630124]\n- [net] cxgb3: add define for fatal parity error bit (Doug Ledford) [630124]\n- [net] qlge: update driver version to 1.00.00.25 (Chad Dupuis) [567402]\n- [net] qlge: fix a eeh handler to not add a pending timer (Chad Dupuis) [567402]\n- [net] qlge: update driver version to 1.00.00.24 (Chad Dupuis) [567402]\n- [net] qlge: remove error pkt flags, enable net csum error (Chad Dupuis) [567402]\n- [net] qlge: restore promiscuous setting in ql_adapter_up (Chad Dupuis) [567402]\n- [net] qlge: change cpu_to_be16 to htons for udp checksum (Chad Dupuis) [567402]\n- [net] qlge: remove firmware dependency for MPI coredump (Chad Dupuis) [567402]\n- [net] qlge: adding ndev->last_rx = jiffies (Chad Dupuis) [567402]\n- [net] qlge: fix pktgen issue reported by Cisco (Chad Dupuis) [567402]\n- [virtio] fix balloon without VIRTIO_BALLOON_F_STATS_VQ (Amit Shah) [601692]\n- [virtio] fix sched while atomic in virtio_balloon stats (Amit Shah) [601692]\n- [virtio] add memory stat reporting to balloon driver (Amit Shah) [601692]\n[2.6.18-216.el5]\n- [net] hashlimit: check allocation before freeing memory (Wade Mealing) [615229]\n- [net] clusterip: check allocation before freeing memory (Wade Mealing) [615227]\n- [ia64] mca: save I-resources when INIT is sent (Takao Indoh) [471136]\n- [scsi] mpt2sas: update to 05.101.00.02 (Tomas Henzl) [568281]\n- [scsi] ipr: bump the version number and date (Steve Best) [626566]\n- [scsi] ipr: fix resource type update and add attributes (Steve Best) [626566]\n- [scsi] ipr: fix transition to operational on new adapters (Steve Best) [626566]\n- [scsi] ipr: change endian swap key for hw spec change (Steve Best) [626566]\n- [scsi] ipr: add support for Obsidian-E embedded adapter (Steve Best) [626566]\n- [scsi] ipr: add MMIO write for BIST on 64-bit adapters (Steve Best) [626566]\n- [scsi] ipr: move setting of allow_restart flag (Steve Best) [626566]\n- [scsi] ipr: add writeq definition if needed (Steve Best) [626566]\n- [scsi] ipr: add endian swap enable for 64-bit adapters (Steve Best) [626566]\n- [scsi] ipr: fix resource path display and formatting (Steve Best) [626566]\n- [scsi] ipr: improve interrupt service routine performance (Steve Best) [626566]\n- [scsi] ipr: set data list length in request control block (Steve Best) [626566]\n- [scsi] ipr: fix register read address on 64-bit adapters (Steve Best) [626566]\n- [scsi] ipr: add resource path to IOA status area struct (Steve Best) [626566]\n- [scsi] ipr: implement fixes for 64-bit adapter support (Steve Best) [626566]\n- [scsi] ipr: fix compile warning (Steve Best) [626566]\n- [fs] ext4: allocate ->s_blockgroup_lock separately (Eric Sandeen) [614957]\n- [pci] xen: disable broken msi/msix on ia64 xen (Radim Krcmar) [518463]\n- [misc] fix non-CONFIG_NUMA x86_64 compile (Prarit Bhargava) [583673]\n- [pnp] ignore both UNSET and DISABLED ioresources (Prarit Bhargava) [560540]\n- [pnp] reserve system board iomem and ioport resources (Prarit Bhargava) [560540]\n- [net] ipv4: add IP_NODEFRAG option for IPv4 socket (Jiri Olsa) [562220]\n- [nfs] sunrpc: cancel task_cleanup work in xprt_destroy (Jeff Layton) [611938]\n- [fs] nfs: fix file create failure with HPUX client (Jeff Layton) [605720]\n- [net] ixgbe: update to upstream version 2.0.84-k2 (Andy Gospodarek) [568602]\n- [net] vlan: add VLAN bitfield defines (Andy Gospodarek) [566027]\n- [net] igb: actually support self_test ethtool command (Andy Gospodarek) [593862]\n- [net] ixgbe: actually support self_test ethtool command (Andy Gospodarek) [593862]\n- [net] ixgbevf: update to version 1.0.0-k1 (Andy Gospodarek) [566027]\n- [net] bonding: fix ALB mode to balance traffic on VLANs (Andy Gospodarek) [578531]\n- [net] igb: do register dump just before resetting adapter (Andy Gospodarek) [568602]\n- [kernel] nmi_watchdog: output count during check on boot (Don Zickus) [613667]\n- [misc] nmi: fix bogus nmi watchdog stuck messages (Don Zickus) [455323]\n- [virt] nmi: dont print NMI stuck messages on guests (Don Zickus) [455323]\n- [misc] nmi_watchdog: add /proc/sys/kernel/nmi_watchdog (Don Zickus) [455323]\n- [misc] scripts: use system python instead of env (Don Zickus) [521878]\n- [pci] sr-iov: fix broken resource alignment calculations (Don Dutile) [523341]\n- [pci] clean up resource alignment management (Don Dutile) [523341]\n- [pci] sr-iov: assign pci resources earlier (Don Dutile) [523341]\n- [net] vxge: update version to reflect RHEL5.6 changes (Bob Picco) [580413]\n- [net] vxge: set func_id 0 as privileged for normal func (Bob Picco) [580413]\n- [net] vxge: fix MSIX interrupt configuration (Bob Picco) [580413]\n- [net] vxge: fix ethtool -d output (Bob Picco) [580413]\n- [net] vxge: align tmemory only if misaligned (Bob Picco) [580413]\n- [net] vxge: fix hw buffer starvation from short packets (Bob Picco) [580413]\n- [net] vxge: fix receive stall w/ driver/chip out-of-sync (Bob Picco) [580413]\n- [cpufreq] add APERF/MPERF support for AMD processors (Bhavna Sarathy) [621335]\n- [xen] vmx: fix handling of FS/GS base MSRs (Michal Novotny) [613187]\n- [xen] hv: improve backtrace support on ia64 (Andrew Jones) [499553]\n- [xen] support new AMD family 0x15 CPU and NB hardware (Bhavna Sarathy) [619092]\n- [xen] allow dom0 to control core performance boost (Bhavna Sarathy) [568771]\n- [xen] add support for dom0 to access APERF/MPERF for AMD (Bhavna Sarathy) [568772]\n[2.6.18-215.el5]\n- [sound] ALSA HDA driver update for RHEL5.6 (Jaroslav Kysela) [592199]\n- [net] igbvf: update to latest upstream for RHEL5.6 (Stefan Assmann) [566028]\n- [net] igb: update igb driver to support Portville ACS (Stefan Assmann) [566024]\n- [net] igb: fix error in igb AER code (Stefan Assmann) [612212]\n- [ata] libata: fix suspend/resume for ATA SEMB devices (David Milburn) [622559]\n- [ata] sata_mv: msi masking fix (David Milburn) [554872]\n- [ata] sata_mv: Properly initialize main irq mask (David Milburn) [554872]\n- [ata] sata_mv: remove bogus nsect restriction (David Milburn) [554872]\n- [ata] sata_mv: dont read hc_irq_cause (David Milburn) [554872]\n- [ata] sata_mv: add the Gen IIE flag to the SoC devices (David Milburn) [554872]\n- [ata] sata_mv: dont issue two DMA commands concurrently (David Milburn) [554872]\n- [ata] sata_mv: safer logic for limit warnings (David Milburn) [554872]\n- [ata] sata_mv: warn on PIO with multiple DRQs (David Milburn) [554872]\n- [ata] sata_mv: enable async_notify for 60x1 Rev.C0 and up (David Milburn) [554872]\n- [s390] zfcp: Do not print bit mask as link speed (Hendrik Brueckner) [619857]\n- [s390] dasd: force online does not work (Hendrik Brueckner) [619466]\n- [s390] dasd: allocate fallback cqr for reserve/release (Hendrik Brueckner) [619465]\n- [s390] qeth: wait for finished recovery (Hendrik Brueckner) [619456]\n- [s390] qeth: avoid loop if ipa command response missing (Hendrik Brueckner) [619451]\n- [s390] zfcp: no force close when port is already closed (Hendrik Brueckner) [612263]\n- [s390] zfcp: Do not unblock rport from REOPEN_PORT_FORCED (Hendrik Brueckner) [612266]\n- [s390] zfcp: Fail erp after timeout (Hendrik Brueckner) [612261]\n- [message] fusion: update to 3.4.15 (Tomas Henzl) [568292]\n- [net] ipv6: reroute packets after netfilter mangling (Thomas Graf) [517327]\n- [scsi] lpfc: update driver from 8.2.0.76.1p to 8.2.0.77 (Rob Evers) [603806]\n- [virt] xenbus: avoid deadlock unregistering xenbus watch (Paolo Bonzini) [429102]\n- [ia64] kdump: prevent hang on INIT interrupt during boot (Neil Horman) [506694]\n- [net] qla3xxx: fix oops on too-long netdev priv structure (Neil Horman) [620508]\n- [kprobes] kretprobe: set status to fix fault handling (Josh Stone) [615121]\n- [net] bonding: fix a race in calls to slave MII ioctls (Flavio Leitner) [621280]\n- [virt] xen-kernel: improve backtrace support on ia64 (Andrew Jones) [499553]\n- [acpi] thinkpad-acpi: lock down video output state access (Don Howard) [607037]\n- [fs] xfs: fix untrusted inode number lookup (Dave Chinner) [624862]\n[2.6.18-214.el5]\n- [mm] accept an abutting stack segment (Jiri Pirko) [607858] {CVE-2010-2240}\n- [fs] fix dcache accounting bug (Josef Bacik) [596548]\n- [scsi] mptsas: enable TLR for SSP TAPE drives (Tomas Henzl) [599420]\n- [scsi] sas: add transport layer retry support (Tomas Henzl) [599420]\n- [scsi] fix potential kmalloc failure in scsi_get_vpd_page (Tomas Henzl) [599420]\n- [scsi] fix bugs in scsi_vpd_inquiry (Tomas Henzl) [599420]\n- [scsi] add VPD helper (Tomas Henzl) [599420]\n- [x86_64] implement vDSO randomization (Danny Feng) [459763]\n- [virt] xen: dont adjust time for ntp clock slowing (Bretislav Kabele) [553407]\n- [net] ibmveth: fix lost IRQ that leads to service loss (Steve Best) [626841]\n- [scsi] cxgb3i: sync driver with upstream for RHEL5.6 (Mike Christie) [567444]\n- [net] sched: fix some kernel memory leaks (Jiri Pirko) [624638] {CVE-2010-2942}\n- [tpm] autoload tpm_tis driver (John Feeney) [530123]\n- [usb] fix usbfs information leak (Eugene Teo) [566629] {CVE-2010-1083}\n- [virtio] console: Backport driver for RHEL 5.6 (Amit Shah) [620037]\n- [virtio] add virtqueue_ vq_ops wrappers (Amit Shah) [620037]\n- [virtio] initialize vq->data entries to NULL (Amit Shah) [620037]\n- [virtio] add ability to detach unused buffers from vrings (Amit Shah) [620037]\n- [virtio] make add_buf return capacity remaining (Amit Shah) [620037]\n- [virtio] find_vqs/del_vqs virtio operations (Amit Shah) [620037]\n- [virtio] add names to virtqueue struct (Amit Shah) [620037]\n- [virtio] more neatening of virtio_ring macros (Amit Shah) [620037]\n- [virtio] fix BAD_RING, START_US and END_USE macros (Amit Shah) [620037]\n[2.6.18-213.el5]\n- [mm] pass correct mm when growing stack (Jiri Pirko) [607858] {CVE-2010-2240}\n- [mm] fix up some user-visible effects of stack guard page (Jiri Pirko) [607858] {CVE-2010-2240}\n- [mm] fix page table unmap for stack guard page properly (Jiri Pirko) [607858] {CVE-2010-2240}\n- [mm] fix missing unmap for stack guard page failure case (Jiri Pirko) [607858] {CVE-2010-2240}\n- [mm] keep a guard page below a grow-down stack segment (Jiri Pirko) [607858] {CVE-2010-2240}\n- [net] tcp: fix div by zero in congestion control protos (Neil Horman) [608641]\n- [net] tcp: tcp_vegas ssthresh bug fix (Thomas Graf) [612709]\n- [net] tcp: tcp_vegas cong avoid fix (Thomas Graf) [612709]\n- [net] tcp: fix overflow bug in Vegas (Thomas Graf) [612709]\n- [net] tcp: fix Vegas bug in disabling slow start (Thomas Graf) [612709]\n- [net] tcp: increase Vegas default alpha and beta params (Thomas Graf) [612709]\n- [net] tcp: tcp_hybla zero congestion window growth fix (Thomas Graf) [612709]\n- [net] tcp: htcp last_cong bug fix (Thomas Graf) [612709]\n- [net] tcp: TCP cubic v2.2 (Thomas Graf) [612709]\n- [net] tcp: faster cube root (Thomas Graf) [612709]\n- [net] tcp: backport cubic update for net-2.6.22 (Thomas Graf) [612709]\n- [net] tcp: set Cubic and BIC default thresholds to zero (Thomas Graf) [612709]\n- [net] tcp: congestion control initialization (Thomas Graf) [612709]\n- [net] tcp: uninline tcp_is_cwnd_limited (Thomas Graf) [612709]\n- [net] tcp: move prior_in_flight collect to better spot (Thomas Graf) [612709]\n- [fs] ext4: consolidate in_range definitions (Eric Sandeen) [624332] {CVE-2010-3015}\n- [net] dont double count UDP_INERRORS (Neil Horman) [618818]\n- [scsi] be2iscsi: sync with upstream for RHEL5.6 (Mike Christie) [569643]\n- [mmc] sdhci: fix system cannot enter S4 with SD card (Matthew Garrett) [606899]\n- [cpufreq] powernow-k8: support AMD Core Performance Boost (Matthew Garrett) [568751]\n- [fs] cifs: remove force parm from cifs_unix_info_to_inode (Jeff Layton) [619112]\n- [fs] nfs: fix NFS4ERR_FILE_OPEN handling in Linux/NFS (Jeff Layton) [604044]\n- [usb] fix test of wrong variable in create_by_name (Don Howard) [594635]\n- [s390] cio: fix cause of unexpected recovery actions (Hendrik Brueckner) [621330]\n[2.6.18-212.el5]\n- [ipmi] add parameter to limit CPU usage in kipmid (Takao Indoh) [494680]\n- [net] bnx2x: Added GRO support (Stanislaw Gruszka) [573114]\n- [net] bnx2x: fix memory barriers (Stanislaw Gruszka) [569370]\n- [ppc] partition hibernation support (Steve Best) [565570]\n- [ppc] Add resume handler to powerpc time management code (Steve Best) [565570]\n- [scsi] ibmvscsi: Fix soft lockup on resume (Steve Best) [565570]\n- [scsi] ibmvfc: Fix soft lockup on resume (Steve Best) [565570]\n- [scsi] ibmvfc: Add suspend/resume support (Steve Best) [565570]\n- [scsi] ibmvscsi: Add suspend/resume support (Steve Best) [565570]\n- [net] ibmveth: Add suspend/resume support (Steve Best) [565570]\n- [ppc] vio: add power management support (Steve Best) [565570]\n- [ppc] add hooks to put CPU in appropriate offline state (Steve Best) [565570]\n- [virt] xen: fix passthrough of SR-IOV VF (Paolo Bonzini) [582886]\n- [mm] add option to skip ZERO_PAGE mmap of /dev/zero (Larry Woodman) [619541]\n- [net] bonding: check if clients MAC addr has changed (Flavio Leitner) [610234]\n- [virt] xen: fix pud_present compile warnings (Don Zickus) [590760]\n- [xen] CPU synchronization during MTRR register update (Don Dugger) [594546]\n[2.6.18-211.el5]\n- [pci] fix remove of proc entry for hotplug devices (Wade Mealing) [618114]\n- [ide]: atiixp: no pio autotune on AMD Hudson2 (Prarit Bhargava) [618075]\n- [pci] msi: add option for lockless interrupt mode (Prarit Bhargava) [599295]\n- [virt] xenbus: implement O_NONBLOCK (Paolo Bonzini) [470801]\n- [net] ip4v/tcp: no additional reset on closed sockets (Neil Horman) [605259]\n- [misc] xen: fix migration using xen-vnif in smp hvm guest (Miroslav Rezanina) [555910]\n- [edac] fix i7core_edac in multi-socket systems (Mauro Carvalho Chehab) [468877]\n- [net] arp_tables: fix unaligned accesses (Jiri Pirko) [582268]\n- [fs] ext3: handle journal_start failure properly (Josef Bacik) [588599]\n- [misc] handle dead hung uninterruptible tasks correctly (Jerome Marchand) [582237]\n- [fs] ecryptfs: fix ecryptfs_uid_hash buffer overflow (Jerome Marchand) [611387] {CVE-2010-2492}\n- [infiniband] check local reserved ports (Jerome Marchand) [557884]\n- [infiniband] randomize local port allocation (Jerome Marchand) [557884]\n- [net] reserve ports for apps using fixed port numbers (Jerome Marchand) [557884]\n- [kernel] sysctl: add proc_do_large_bitmap (Jerome Marchand) [557884]\n- [scsi] lpfc: use kernel-provided random32 (Jarod Wilson) [605816]\n- [lib] make tausworthe random32 generator available to all (Jarod Wilson) [605816]\n- [net] be2net: increase POST timeout for EEH recovery (Ivan Vecera) [616512]\n- [hwmon] coretemp: get TjMax value from MSR (Dean Nelson) [580699]\n- [hwmon] coretemp: detect the thermal sensors by CPUID (Dean Nelson) [580699]\n- [fs] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED (Dave Chinner) [607032]\n- [fs] xfs: validate untrusted inode numbers during lookup (Dave Chinner) [607032]\n- [fs] xfs: always use iget in bulkstat (Dave Chinner) [607032]\n- [s390] qeth: support for OSA CHPID types OSX and OSM (Hendrik Brueckner) [599644]\n- [s390] qeth: dont allow layer switch with open interface (Hendrik Brueckner) [612195]\n- [s390] zfcp: fix reference counting on adisc (Hendrik Brueckner) [610089]\n- [s390] kernel: initrd vs bootmem bitmap (Hendrik Brueckner) [610837]\n- [s390] hypfs: fix high cpu time output (Hendrik Brueckner) [589282]\n- [s390] dasd: fix race between tasklet and dasd_sleep_on (Hendrik Brueckner) [593756]\n- [s390] cmm: fix module unload handling (Hendrik Brueckner) [598549]\n- [fs] gfs: clean up stuffed file data copy handling (Abhijith Das) [580867]\n[2.6.18-210.el5]\n- [scsi] ips driver sleeps while holding spin_lock (Steve Best) [616961]\n- [net] fix lockups and dupe addresses w/bonding and ipv6 (Shyam Iyer) [516985]\n- [scsi] megaraid_sas: update driver to version 4.31 (Tomas Henzl) [564249]\n- [scsi] megaraid_sas: update driver to version 4.27 (Rob Evers) [564249]\n- [net] nat: avoid rerouting packets if only key changed (Jiri Pirko) [566144]\n- [fs] cifs: remove bogus check in NTLM session setup code (Jeff Layton) [479418]\n- [ata] ahci: add em_buffer attribute for AHCI hosts (David Milburn) [568364]\n- [scsi] qla4xxx: add support for ISP82XX (Chad Dupuis) [546592]\n- [scsi] qla4xxx: Fixes from upstream for 5.6 (Chad Dupuis) [546592]\n- [scsi] qla2xxx: more upstream updates for RHEL 5.6 (Chad Dupuis) [567428]\n- [scsi] qla2xxx: add support for ISP82XX (Chad Dupuis) [567428]\n- [scsi] qla2xxx: more updates from upstream for RHEL 5.6 (Chad Dupuis) [567428]\n- [scsi] qla2xxx: update to 8.03.01.05.05.06-k (Chad Dupuis) [567428]\n- [xen] correct bitsize calculation for 32-on-64 (Andrew Jones) [616827]\n[2.6.18-209.el5]\n- [net] r8169: fix for broken register writes (Ivan Vecera) [581654]\n- [serial] remove contact info for ite887x chip support (Dean Nelson) [563271]\n- [serial] fix modpost warning in ite887x driver (Dean Nelson) [563271]\n- [serial] add support for ite887x chips (Dean Nelson) [563271]\n- [parport] increase ite887xs I/O port range (Dean Nelson) [563271]\n- [scsi] qla2xxx: update firmware to version 5.03.02 (Chad Dupuis) [578444 598946]\n- [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612171] {CVE-2010-2524}\n- [security] keys: new key flag for add_key from userspace (Jeff Layton) [612171] {CVE-2010-2524}\n[2.6.18-208.el5]\n- [fs] gfs2: fix rename causing kernel oops (Robert S Peterson) [602025]\n- [misc] io_apic: skip timer_irq_works check when on VMware (Prarit Bhargava) [575309]\n- [scsi] be2iscsi: fix for 64k data length sge (Mike Christie) [608801]\n- [mm] fix excessive memory reclaim from zones w/lots free (Larry Woodman) [604779]\n- [mm] properly release all hugepages on database shutdown (Larry Woodman) [593131]\n- [net] fix accept_local handling for dev with no xattrs (Jiri Olsa) [601370]\n- [fs] nfs: i_nlinks changes must set NFS_INO_INVALID_ATTR (Jeff Layton) [601800]\n- [fs] nfs: fix resolution in nfs_inode_attrs_need_update (Jeff Layton) [601800]\n- [fs] nfs: fix compiler warnings introduced recently (Jeff Layton) [601800]\n- [fs] nfs: fix attribute updates even more (Jeff Layton) [601800]\n- [fs] nfs: fix the NFS attribute update (Jeff Layton) [601800]\n- [fs] nfs: clean up inode handling functions (Jeff Layton) [601800]\n- [fs] nfs: nfs_refresh_inode should clear cache_validity (Jeff Layton) [601800]\n- [fs] nfs: use nfs_refresh_inode in __nfs_revalidate_inode (Jeff Layton) [601800]\n- [ata] ahci, pata_marvell: fixup competition for PATA port (David Milburn) [237372]\n- [net] qlcnic: Add QLCNIC to Kconfig and Makefile (Chad Dupuis) [562723]\n- [net] qlcnic: enable building driver module (Chad Dupuis) [562723]\n- [net] qlcnic: remove extra space from board names (Chad Dupuis) [562723]\n- [net] qlcnic: fix bios version check (Chad Dupuis) [562723]\n- [net] qlcnic: validate unified fw image (Chad Dupuis) [562723]\n- [net] qlcnic: fix multicast handling (Chad Dupuis) [562723]\n- [net] qlcnic: additional driver statistics. (Chad Dupuis) [562723]\n- [net] qlcnic: fix tx csum status (Chad Dupuis) [562723]\n- [net] qlcnic: add loopback diagnostic test (Chad Dupuis) [562723]\n- [net] qlcnic: add interrupt diagnostic test (Chad Dupuis) [562723]\n- [net] qlcnic: support LED blink for device identification (Chad Dupuis) [562723]\n- [net] qlcnic: protect resoruce cleanup by rtnl lock (Chad Dupuis) [562723]\n- [net] qlcnic: clear device reset state after fw recovery (Chad Dupuis) [562723]\n- [net] qlcnic: add ethernet identifier in board info (Chad Dupuis) [562723]\n- [net] qlcnic: use DEFINE_PCI_DEVICE_TABLE (Chad Dupuis) [562723]\n- [net] qlcnic: add Qlogic ethernet driver for CNA devices (Chad Dupuis) [562723]\n- Revert: [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612171] {CVE-2010-2524}\n- Revert: [security] keys: new key flag for add_key from userspace (Jeff Layton) [612171] {CVE-2010-2524}\n[2.6.18-207.el5]\n- [usb] uhci: fix oops in uhci_scan_schedule (Pete Zaitcev) [516851]\n- [wireless] rtl818x: use cancel_work_sync (Stanislaw Gruszka) [582191]\n- [wireless] iwlwifi: use cancel_work_sync (Stanislaw Gruszka) [582191]\n- [wireless] ath9k: use cancel_work_sync (Stanislaw Gruszka) [582191]\n- [wireless] rt2x00: use cancel_work_sync (Stanislaw Gruszka) [582191]\n- Revert: [wireless] rt2x00: fix work cancel race condition (Stanislaw Gruszka) [582191]\n- [wireless] use cancel_work_sync in mac80211 and core (Stanislaw Gruszka) [582191]\n- [misc] workqueue: add cancel_work_sync to include (Stanislaw Gruszka) [582191]\n- [net] igb: drop support for UDP hashing w/ RSS (Stefan Assmann) [613780]\n- [misc] signals: avoid unnecessary credentials check (Oleg Nesterov) [459901]\n- [acpi] tell platformthat we support fixed hw T-states (Matthew Garrett) [569590]\n- [edac] i7core_edac: Backport driver to RHEL5 (Mauro Carvalho Chehab) [468877]\n- [edac] i7core_edac: add driver for new Nehalem (Mauro Carvalho Chehab) [468877]\n- [x86_64] mce: fix misplaced 'continue' in mce.c (Mauro Carvalho Chehab) [468877]\n- [pci] Add a probing code that seeks for an specific bus (Mauro Carvalho Chehab) [468877]\n- [edac] add support for DDR3 at EDAC core (Mauro Carvalho Chehab) [468877]\n- [wireless] Kconfig: select WIRELESS_COMPAT as needed (John Linville) [583767]\n- [i386] oprofile: fix detection of Intel CPU family 6 (John Villalovos) [581919]\n- [misc] intel: support for Intel Cougar Point Chipset (John Villalovos) [566854]\n- [fs] xfs: dont let swapext operate on write-only files (Jiri Pirko) [605161] {CVE-2010-2226}\n- [fs] nfs: fix bug in nfsd4 read_buf (Jiri Olsa) [612035] {CVE-2010-2521}\n- [fs] nfsd: add lockdep annotation to nfsd4 recover code (Jeff Layton) [567092]\n- [fs] nfs: wait for close before silly-renaming (Jeff Layton) [565974]\n- [fs] cifs: enable CONFIG_CIFS_STATS (Jeff Layton) [574795]\n- [net] sunrpc: translate an -ENETUNREACH to -ENOTCONN (Jeff Layton) [481372]\n- [fs] cifs: merge CIFSSMBQueryEA with CIFSSMBQAllEAs (Jeff Layton) [527268]\n- [fs] cifs: verify lengths of QueryAllEAs reply (Jeff Layton) [527268]\n- [fs] cifs: increase maximum buffer size in CIFSSMBQAllEAs (Jeff Layton) [527268]\n- [fs] cifs: rename name_len to list_len in CIFSSMBQAllEAs (Jeff Layton) [527268]\n- [fs] cifs: clean up indentation in CIFSSMBQAllEAs (Jeff Layton) [527268]\n- [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612171] {CVE-2010-2524}\n- [fs] cifs: add parens around smb_var in BCC macros (Jeff Layton) [527268]\n- [security] keys: new key flag for add_key from userspace (Jeff Layton) [612171] {CVE-2010-2524}\n- [specfile] skip xen tarball and patching if building w/o xen (Jarod Wilson)\n- [specfile] replace ancient and deprecated rpm syntax (Jarod Wilson)\n- [virt] xen: remove sysdata hack from irq-xen.c (Paolo Bonzini) [561390]\n- [xen] msi fixmap cleanup and vector teardown (Don Dugger) [516236]\n[2.6.18-206.el5]\n- [x86] kprobes: introduce kprobes jump optimization (Masami Hiramatsu) [516313]\n- [x86] add x86_64 alternatives_text_reserved interface (Masami Hiramatsu) [516313]\n- [x86_64] kprobes: upstream update for rhel5.6 (Masami Hiramatsu) [516313]\n- [x86_64] add instruction decoder API (Masami Hiramatsu) [516313]\n- [fusion] mpt: fix deregister calls in exit path (hiro muneda) [581523]\n- [net] cxgb3: wait longer for control packets on init (Steve Best) [587670]\n- [scsi] scsi_dh_alua: add IBM Power Virtual SCSI ALUA dev (Steve Best) [567292]\n- [fs] gfs2: fix stuck in inode wait, no glocks stuck (Robert S Peterson) [595397]\n- [message] mptsas: fix disk add failing due to timeout (Rob Evers) [542892]\n- [scsi] lpfc: update from 8.2.0.73.1p to 8.2.0.76.1p (Rob Evers) [591674]\n- [scsi] lpfc: update from 8.2.0.63.p3 to 8.2.0.73.1p (Rob Evers) [571862]\n- [i2c] fix exports types for recently added i2c symbols (Prarit Bhargava) [611774]\n- [virt] xen: fix 32-bit syscalls on 64-bit kernel (Paolo Bonzini) [561394]\n- [virt] xen: add tracepoint for kernel pagefault event (Paolo Bonzini) [561385]\n- [security] selinux: fix race with re-parenting (Oleg Nesterov) [556675]\n- [net] sctp: fix length checks (Neil Horman) [605305]\n- [acpi] intel: avoid skipping ARB_DISABLE on model 0x0e (Matthew Garrett) [602846]\n- [block] cfq-iosched: fix bad locking in changed_ioprio (Jeff Moyer) [582435]\n- [block] cfq-iosched: kill cfq_exit_lock (Jeff Moyer) [582435]\n- [fs] cifs: fix kernel BUG with remote OS/2 server (Jeff Layton) [608588] {CVE-2010-2248}\n- [fs] cifs: dont try busy-file rename unless in same dir (Jeff Layton) [603706]\n- [fs] nfsd: dont break lease while servicing COMMIT call (Jeff Layton) [575817]\n- [fs] force target reval when following LAST_BIND symlinks (Jeff Layton) [571518]\n- [net] be2net: update to v2.102.348r with SR-IOV support (Ivan Vecera) [568388]\n- [net] virtio_net: add set_multicast_list (Herbert Xu) [552574]\n- [net] gro: fix bogus gso_size on the first fraglist entry (Herbert Xu) [588015]\n- [time] fix softlockups in RHEL5 virt guests (Glauber Costa) [607443]\n- [time] count ticks when loss gt cycle_accounted_limit (Glauber Costa) [584679]\n- [net] e1000e: dont inadvertently re-set INTX_DISABLE (Dean Nelson) [496127]\n- [scsi] fixup size on read capacity failure (David Milburn) [569654]\n- [s390] smsgiucv: add missing check for z/VM (Hendrik Brueckner) [590737]\n- [s390] zcore: fix reipl device detection (Hendrik Brueckner) [587027]\n- [s390] zcrypt: print error message for 8/72 error (Hendrik Brueckner) [563545]\n- [s390] kernel: fix dump indicator (Hendrik Brueckner) [546288]\n- [net] bluetooth: fix possible bad memory access via sysfs (Mauro Carvalho Chehab) [576021] {CVE-2010-1084}\n[2.6.18-205.el5]\n- [scsi] ipr: adds PCI ID definitions for new adapters (Steve Best) [563589]\n- [scsi] ipr: add support for new IOASCs (Steve Best) [563589]\n- [scsi] ipr: add support for multiple stages of init (Steve Best) [563589]\n- [scsi] ipr: implement shutdown changes (Steve Best) [563589]\n- [scsi] ipr: hardware assisted smart dump functionality (Steve Best) [563589]\n- [scsi] ipr: add error handling updates for next gen chip (Steve Best) [563589]\n- [scsi] ipr: update the config table for next gen chip (Steve Best) [563589]\n- [scsi] ipr: define register offsets for next gen chip (Steve Best) [563589]\n- [scsi] ipr: add command structures for next gen chip (Steve Best) [563589]\n- [scsi] ipr: differentiate pci-x and pci-e based adapters (Steve Best) [563589]\n- [scsi] ipr: add test for MSI interrupt support (Steve Best) [563589]\n- [scsi] ipr: add message to error table (Steve Best) [563589]\n- [scsi] ipr: handle logically bad block write errors (Steve Best) [563589]\n- [scsi] ipr: convert to use the data buffer accessors (Steve Best) [563589]\n- [scsi] ipr: add some defines that are missing in RHEL5.5 (Steve Best) [563589]\n- [scsi] ipr: add workaround for MSI interrupts on P7 (Steve Best) [572333]\n- [net] tcp: fix rcv mss estimate for lro (Stanislaw Gruszka) [593801]\n- [virt] xen netback: copy skbuffs if head crosses pages (Paolo Bonzini) [578259]\n- [virt] xen: handle softirqs at end of event processing (Paolo Bonzini) [564523]\n- [virt] fix tsccount clocksource under kvm guests (Glauber Costa) [581396]\n- [net] benet: compat header cleanups, part 2 (Ivan Vecera) [546740]\n- [net] benet: compat header cleanups, part 1 (Prarit Bhargava) [546740]\n- [net] bnx2: compat header cleanups (Prarit Bhargava) [546740]\n- [net] e1000/e1000e: compat header cleanup (Prarit Bhargava) [546740]\n- [net] enic: compat header cleanup (Prarit Bhargava) [546740]\n- [net] forcedeth: compat header cleanup (Prarit Bhargava) [546740]\n- [net] igb: compat header cleanups (Prarit Bhargava) [546740]\n- [net] ixgbe: compat header cleanups (Prarit Bhargava) [546740]\n- [net] myri10ge: compat header cleanups (Prarit Bhargava) [546740]\n- [net] netxen: compat header cleanup (Prarit Bhargava) [546740]\n- [net] niu: compat header cleanup (Prarit Bhargava) [546740]\n- [net] qlge: compat header cleanup (Prarit Bhargava) [546740]\n- [net] r8169: compat header cleanups, part 2 (Ivan Vecera) [546740]\n- [net] r8169: compat header cleanups, part 1 (Prarit Bhargava) [546740]\n- [net] sfc: compat header cleanups (Prarit Bhargava) [546740]\n- [net] sky2: compat header cleanup (Prarit Bhargava) [546740]\n- [net] tg3: compat header cleanup (Prarit Bhargava) [546740]\n- [net] bonding: compat header cleanup (Prarit Bhargava) [546740]\n- [net] move compat header file contents to proper includes (Prarit Bhargava) [546740]\n- [net] ethernet: compat header cleanups (Prarit Bhargava) [546740]\n- [net] chelsio: compat header cleanups (Prarit Bhargava) [546740]\n- [net] s2io: compat header cleanups (Prarit Bhargava) [546740]\n- [net] vxge: compat header cleanup (Prarit Bhargava) [546740]\n- [infiniband] compat header cleanups (Prarit Bhargava) [546740]\n- [scsi] compat header cleanups (Prarit Bhargava) [546740]\n- [misc] readq/writeq compat header cleanup (Prarit Bhargava) [546740]\n- [pci] compat header cleanups (Prarit Bhargava) [546740]\n- [misc] compat.h cleanup: add cancel_delayed_work_sync (Prarit Bhargava) [546740]\n- [i2c] compat header cleanups (Prarit Bhargava) [546740]\n- [fs] nfs: fix memory leak when using -onolock on nfs v2/3 (Jeff Layton) [592908]\n[2.6.18-204.el5]\n- [fs] gfs2: fix ordering of ordered writes (Steven Whitehouse) [581013]\n- [net] cnic: fix bnx2x panic w/multiple interfaces enabled (Stanislaw Gruszka) [602402]\n- [x86_64] unify apic mapping code (Prarit Bhargava) [573858]\n- [virt] xen: fix Connected state after netback dev closed (Paolo Bonzini) [591548]\n- [net] ipv4: add sysctl to accept packets w/local source (Jiri Olsa) [601370]\n- [nfs] fix unitialized list head on error exit in recovery (Jeff Layton) [569342]\n- [virt] virtio_blk: add support for cache flushes (Christoph Hellwig) [571735]\n- [xen] ia64: unset be from the task psr (Andrew Jones) [587477] {CVE-2010-2070}\n[2.6.18-203.el5]\n- [misc] permit larger than 2TB USB and FW drives (Pete Zaitcev) [503864]\n- [net] cnic: fix panic when nl msg rcvd when device down (Stanislaw Gruszka) [595862]\n- [infiniband] ehca: require in_wc in process_mad (Steve Best) [571517]\n- [net] igb: Add support for pci-e Advanced Error Reporting (Stefan Assmann) [568221]\n- [fs] ext4: MOVE_EXT cant overwrite append-only files (Eric Sandeen) [601008] {CVE-2010-2066}\n- [net] wireless: convert reg_regdb_search_lock to mutex (John Linville) [597334]\n- [net] tcp: dont send keepalive probes if receiving data (Flavio Leitner) [593040]\n- [hwmon] add support for additional CPU models to coretemp (Dean Nelson) [559228]\n- [fs] gfs2: use -EUSERS when mounting w/o enough journals (Abhijith Das) [600387]\n- [misc] workqueue: make cancel_work_sync EXPORT_SYMBOL_GPL (Oleg Nesterov) [596626]\n[2.6.18-202.el5]\n- [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595399] {CVE-2010-1641}\n- [mm] clear page errors when issuing a fresh read of page (Rik van Riel) [590763]\n- [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585100] {CVE-2010-1437}\n- [misc] workqueue: silence kabi checker (Stanislaw Gruszka) [596626]\n- [misc] workqueue: implement cancel_work_sync (Oleg Nesterov) [596626]\n- [misc] workqueue: implement try_to_grab_pending (Oleg Nesterov) [596626]\n- [misc] workqueue: prep flush_cpu_workqueue for additions (Oleg Nesterov) [596626]\n- [misc] workqueue: implement wait_on_work (Oleg Nesterov) [596626]\n- [misc] workqueue: add set_wq_data and get_wq_data helpers (Oleg Nesterov) [596626]\n- [misc] workqueue: cwq instead of wq where appropriate (Oleg Nesterov) [596626]\n- [misc] workqueue: initial prep for cancel_work_sync (Oleg Nesterov) [596626]\n- [net] sctp: file must be valid before setting timeout (Jiri Pirko) [578261]\n- [net] tg3: fix panic in tg3_interrupt (John Feeney) [569106]\n- [net] e1000/e1000e: implement simple interrupt moderation (Andy Gospodarek) [586416]\n- [virt] dont compute pvclock adjustments if we trust tsc (Glauber Costa) [570824]\n- [virt] add a global synchronization point for pvclock (Glauber Costa) [570824]\n- [virt] enable pvclock flags in vcpu_time_info structure (Glauber Costa) [570824]\n- [misc] add atomic64_cmpxcgh to x86_64 include files (Glauber Costa) [570824]\n- [x86] grab atomic64 types from upstream (Glauber Costa) [570824]\n- [pci] cleanup error return for pcix get/set mmrbc calls (Dean Nelson) [578492]\n- [pci] fix pcix access of PCI_X_CMD get/set mmrbc calls (Dean Nelson) [578492]\n- [pci] fix return value from pcix_get_max_mmrbc() (Dean Nelson) [578492]\n- [pci] prepare for backport of upstream fixes and cleanup (Dean Nelson) [578492]\n- [net] ipv6: fix more memory leaks when ndisc_init fails (Amerigo Wang) [555338]\n- [xen] bring back VMXE/SVME flags (Andrew Jones) [570091]\n[2.6.18-201.el5]\n- [s390] qdio: continue polling for buffer state ERROR (Hendrik Brueckner) [565531]\n- [pci] acpiphp: fix missing acpiphp_glue_exit (Prarit Bhargava) [515556]\n- [net] cnic: Fix crash during bnx2x MTU change (Stanislaw Gruszka) [582367]\n- [net] bxn2x: add dynamic lro disable support (Stanislaw Gruszka) [582367]\n- [net] implement dev_disable_lro api for RHEL5 (Stanislaw Gruszka) [582367]\n[2.6.18-200.el5]\n- [fs] getrusage: fill ru_maxrss value (Amerigo Wang) [466157]\n- [net] bonding: fix broken multicast with round-robin mode (Andy Gospodarek) [570645]\n- [usb] input: fix keyboard LEDs on all the time (Pete Zaitcev) [513934]\n- [x86_64] fix time drift due to faulty lost tick tracking (Ulrich Obergfell) [579711]\n- [cciss] remove extraneous printk (Tomas Henzl) [582465]\n- [sunrpc] fix AUTH_SYS using sec=sys export option (Sachin Prabhu) [573652]\n- [misc] fix itimers periodic tics precision (Stanislaw Gruszka) [441134]\n- [net] tg3: fix INTx fallback when MSI fails (Steve Best) [587666]\n- [fs] quota: fix possible infinite loop in quota code (Eric Sandeen) [546060]\n- [misc] add {thread,core}_siblings_list to /sys (Prarit Bhargava) [570610]\n- [misc] add /sys/devices/system/node/nodeX/cpulist files (Prarit Bhargava) [572285]\n- [net] tun: orphan an skb on tx (Michael S. Tsirkin) [584412]\n- [edac] fix panic when a corrected error happens on i5000 (Mauro Carvalho Chehab) [533391]\n- [net] iwlwifi: re-enable IWLWIFI_LEDS (John Linville) [582003]\n- [net] calc TCPs connection closethreshold as time value (Jiri Pirko) [582722]\n- [net] sched: fix SFQ qdisc crash w/limit of 2 packets (Jiri Pirko) [579774]\n- [net] missed and reordered checks in {arp,ip,ip6}_tables (Jiri Pirko) [554563]\n- [net] neigh: fix state transitions via Netlink request (Jiri Pirko) [485903]\n- [net] route: fix BUG_ON in rt_secret_rebuild_oneshot (Jiri Olsa) [566104]\n- [net] netfilter: fix vmalloc ENOMEM caused by iptables (Jiri Olsa) [570491]\n- [block] cciss: fix multi-line printk log level (Jerome Marchand) [556921]\n- [nfs] revert retcode check in nfs_revalidate_mapping() (Jeff Layton) [557423]\n- [nfs] dont decode GETATTR if DELEGRETURN returned error (Jeff Layton) [551028]\n- [md] dm-log: fix bad log status after failure (Jonathan E Brassow) [570583]\n- [net] igmp: fix ip_mc_sf_allow race (Flavio Leitner) [552886]\n- [hwmon] add 0x prefix to hex coretemp module output (Dean Nelson) [571864]\n- [net] e1000e: fix WoL init when WoL disabled in EEPROM (Dean Nelson) [568562]\n- [ata] libata: handle semb signature (David Milburn) [533093]\n- [ata] libata-acpi: missing _SDD is not an error (David Milburn) [559815]\n- [scsi] sg: rate limit warning (Doug Ledford) [536937]\n- [net] tun: check supplemental groups in TUN/TAP driver (Danny Feng) [540786]\n- [s390] nss: add missing .previous call to asm function (Hendrik Brueckner) [581522]\n- [misc] lockdep: dump stack when hitting a limit (Amerigo Wang) [546554]\n- [net] ipv6: dont panic when kmem_cache_create fails (Amerigo Wang) [555338]\n- [misc] ipc: HARD_MSGMAX should be higher on 64bit (Amerigo Wang) [548334]\n- [fs] gfs2: make quota file size a multiple of gfs2_quota (Abhijith Das) [546455]\n[2.6.18-199.el5]\n- [mm] fix hugepage corruption using vm.drop_caches (Larry Woodman) [579469]\n- [misc] taskstats: enable CONFIG_TASK_XACCT (Jiri Olsa) [516961]\n- [misc] taskstats: new structure/cmd to avoid KABI break (Jiri Olsa) [516961]\n- [misc] taskstats: common fix for KABI breakage (Jiri Olsa) [516961]\n- [misc] taskstats: upgrade to version 4 (Jiri Olsa) [516961]\n- [misc] futex: handle futex value corruption gracefully (Jerome Marchand) [480396] {CVE-2010-0622}\n- [misc] futex: handle user space corruption gracefully (Jerome Marchand) [480396] {CVE-2010-0622}\n- [misc] futex: fix fault handling in futex_lock_pi (Jerome Marchand) [480396] {CVE-2010-0622}\n- [x86] utrace: block-step fix (Jerome Marchand) [463950]\n- [nfs] dont unhash dentry in nfs_lookup_revalidate (Jeff Layton) [582321]\n- [net] sunrpc: fix panic when reloading rpcsec_gss_krb5 (Harshula Jayasuriya) [570044]\n- [net] bonding: fix updating of speed/duplex changes (Andy Gospodarek) [567604]\n- [net] e1000: fix WoL init when WoL disabled in EEPROM (Dean Nelson) [568561]\n- [ata] ahci: support FIS-based switching (David Milburn) [474294]\n- [audit] make sure filterkey rules are reported (Alexander Viro) [579479]\n- [audit] clean up rule ordering, part 2 (Alexander Viro) [579479]\n- [audit] clean up rule ordering, part 1 (Alexander Viro) [579479]\n- [audit] fix selinux_audit_rule_update w/audit_inode_hash (Alexander Viro) [579479]\n- [virtio] fix GFP flags passed by virtio balloon driver (Amit Shah) [584683]\n- [net] sctp: fix skb_over_panic w/too many unknown params (Neil Horman) [584658] {CVE-2010-1173}\n- [xen] arpl on MMIO area crashes the guest (Paolo Bonzini) [572982] {CVE-2010-0730}\n[2.6.18-198.el5]\n- [acpi] warn on hot-add of memory exceeding 4G boundary (Prarit Bhargava) [571544]\n- [net] tipc: fix various oopses in uninitialized code (Neil Horman) [558693] {CVE-2010-1187}\n- [acpi] fix WARN on unregister in power meter driver (Matthew Garrett) [576246]\n- [block] cfq-iosched: fix IOPRIO_CLASS_IDLE accounting (Jeff Moyer) [574285]\n- [block] cfq-iosched: async queue allocation per priority (Jeff Moyer) [574285]\n- [block] cfq-iosched: fix async queue behaviour (Jeff Moyer) [574285]\n- [block] cfq-iosched: propagate down request sync flag (Jeff Moyer) [574285]\n- [block] introduce the rq_is_sync macro (Jeff Moyer) [574285]\n- [fs] vfs: fix LOOKUP_FOLLOW on automount symlinks (Jeff Layton) [567816] {CVE-2010-1088}\n- [nfs] fix an oops when truncating a file (Jeff Layton) [567195] {CVE-2010-1087}\n- [net] bnx2: fix lost MSI-X problem on 5709 NICs (John Feeney) [511368]\n- [misc] make the keyring quotas controllable via /proc/sys (Amerigo Wang) [441243]\n- [fs] fix kernel oops while copying from ext3 to gfs2 (Abhijith Das) [555754] {CVE-2010-1436}\n[2.6.18-197.el5]\n- [cpu] fix boot crash in 32-bit install on AMD cpus (Bhavna Sarathy) [575799]\n[2.6.18-196.el5]\n- [mm] fix boot on s390x after bootmem overlap patch (Amerigo Wang) [550974]\n- [net] bnx2: avoid restarting cnic in some contexts (Andy Gospodarek) [554706]\n- [misc] add missing CVE labels for entries in 2.6.18-195.el5 (Jarod Wilson)\n[2.6.18-195.el5]\n- [redhat] make sha512hmac sig failure more obvious (Jarod Wilson)\n- [mm] keep get_unmapped_area_prot functional (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] switch do_brk to get_unmapped_area (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] take arch_mmap_check into get_unmapped_area (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] get rid of open-coding in ia64_brk (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] unify sys_mmap* functions (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] kill ancient cruft in s390 compat mmap (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] fix pgoff in have to relocate case of mremap (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] fix the arch checks in MREMAP_FIXED case (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] fix checks for expand-in-place mremap (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] add new vma_expandable helper function (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] move MREMAP_FIXED into its own header (Danny Feng) [556710] {CVE-2010-0291}\n- [mm] move locating vma code and checks on it (Danny Feng) [556710] {CVE-2010-0291}\n- [iscsi] fix slow failover times (Mike Christie) [570681]\n- [misc] kernel: fix elf load DoS on x86_64 (Danny Feng) [560553] {CVE-2010-0307}\n- [netlink] connector: delete buggy notification code (Jiri Olsa) [561685] {CVE-2010-0410}\n- [sound] hda_intel: avoid divide by zero in azx devices (Jaroslav Kysela) [567172] {CVE-2010-1085}\n- [dvb] fix endless loop when decoding ULE at dvb-core (Mauro Carvalho Chehab) [569242] {CVE-2010-1086}\n- [scsi] fnic: fix tx queue handling (Mike Christie) [576709]\n- [fusion] mptsas: fix event_data alignment (Tomas Henzl) [570000]\n- [edac] fix internal error message in amd64_edac driver (Bhavna Sarathy) [569938]\n- [fs] remove unneccessary f_ep_lock from fasync_helper (Lachlan McIlroy) [567479]\n- [x86_64] fix floating point state corruption after signal (Oleg Nesterov) [560891]\n- [mm] dont let reserved memory overlap bootmem_map (Amerigo Wang) [550974]\n- [s390] kernel: correct TLB flush of page table entries (Hendrik Brueckner) [545527]\n- [xen] iommu: clear IO-APIC pins on boot and shutdown (Paolo Bonzini) [548201]\n- [xen] vtd: fix ioapic pin array (Don Dugger) [563546]\n- [xen] set hypervisor present CPUID bit (Paolo Bonzini) [573771]\n[2.6.18-194.el5]\n- [net] mlx4: pass attributes down to vlan interfaces (Doug Ledford) [573098]\n- [block] cfq-iosched: fix sequential read perf regression (Jeff Moyer) [571818]\n[2.6.18-193.el5]\n- [fs] gfs2: locking fix for potential dos (Steven Whitehouse) [572390] {CVE-2010-0727}\n- [acpi] power_meter: avoid oops on driver load (Matthew Garrett) [566575]\n- [net] r8169: fix assignments in backported net_device_ops (Ivan Vecera) [568040]\n- [net] virtio_net: refill rx buffer on out-of-memory (Herbert Xu) [554078]", "cvss3": {}, "published": "2011-01-20T00:00:00", "type": "oraclelinux", "title": "Oracle Linux 5.6 kernel security and bug fix update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2010-0307", "CVE-2010-2942", "CVE-2010-3904", "CVE-2010-3078", "CVE-2010-2066", "CVE-2010-4081", "CVE-2010-1641", "CVE-2010-2248", "CVE-2010-4073", "CVE-2010-2226", "CVE-2010-0410", "CVE-2010-4072", "CVE-2010-0730", "CVE-2010-2492", "CVE-2010-2521", "CVE-2010-4083", "CVE-2010-1437", "CVE-2010-3859", "CVE-2010-3086", "CVE-2010-0727", "CVE-2010-1187", "CVE-2010-4080", "CVE-2010-2963", "CVE-2010-0291", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-4158", "CVE-2010-2070", "CVE-2010-2524", "CVE-2010-3296", "CVE-2010-1084", "CVE-2010-3015", "CVE-2010-2938", "CVE-2010-4247", "CVE-2010-4263", "CVE-2010-4258", "CVE-2010-3442", "CVE-2010-4243", "CVE-2010-3066", "CVE-2010-2240", "CVE-2010-1083", "CVE-2010-3081", "CVE-2010-0622", "CVE-2010-3067", "CVE-2010-3699", "CVE-2010-4238", "CVE-2010-1085", "CVE-2010-1086", "CVE-2010-1436", "CVE-2010-4255", "CVE-2010-1173", "CVE-2010-1088", "CVE-2010-1087", "CVE-2010-4075"], "modified": "2011-01-20T00:00:00", "id": "ELSA-2011-0017", "href": "http://linux.oracle.com/errata/ELSA-2011-0017.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "vmware": [{"lastseen": "2021-06-08T18:38:41", "description": "a. ESX third party update for Service Console kernel \nThis update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues. \nThe Common Vulnerabilities and Exposures project ( [cve.mitre.org](<http://cve.mitre.org/>)) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158, CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243, CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251, CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346, CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710, CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues. \nColumn 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. \n\n", "cvss3": {}, "published": "2011-10-12T00:00:00", "type": "vmware", "title": "VMware ESX third party updates for Service Console packages glibc and dhcp", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2010-4242", "CVE-2010-2942", "CVE-2011-0521", "CVE-2010-3904", "CVE-2010-3078", "CVE-2010-4081", "CVE-2010-3865", "CVE-2010-4073", "CVE-2010-4072", "CVE-2010-4346", "CVE-2011-1658", "CVE-2010-2492", "CVE-2010-4083", "CVE-2010-2943", "CVE-2011-1494", "CVE-2010-0296", "CVE-2011-1478", "CVE-2010-3859", "CVE-2010-3477", "CVE-2010-3086", "CVE-2010-4251", "CVE-2010-4080", "CVE-2010-4343", "CVE-2010-3877", "CVE-2010-4158", "CVE-2010-3876", "CVE-2011-1659", "CVE-2010-3296", "CVE-2010-4526", "CVE-2010-3015", "CVE-2011-0710", "CVE-2011-0281", "CVE-2010-2938", "CVE-2010-4247", "CVE-2010-4263", "CVE-2010-3442", "CVE-2010-4248", "CVE-2011-1495", "CVE-2010-4243", "CVE-2010-3066", "CVE-2011-1071", "CVE-2010-3880", "CVE-2010-1083", "CVE-2010-4249", "CVE-2010-4157", "CVE-2010-4161", "CVE-2011-1010", "CVE-2010-3858", "CVE-2010-3067", "CVE-2010-3699", "CVE-2010-4238", "CVE-2011-0282", "CVE-2011-1095", "CVE-2010-4255", "CVE-2010-2798", "CVE-2010-3432", "CVE-2011-1090", "CVE-2011-0536", "CVE-2010-1323", "CVE-2010-4075", "CVE-2010-4655"], "modified": "2012-03-08T00:00:00", "id": "VMSA-2011-0012", "href": "https://www.vmware.com/security/advisories/VMSA-2011-0012.html", "cvss": {"score": 7.9, "vector": "AV:N/AC:M/Au:S/C:C/I:C/A:N"}}, {"lastseen": "2022-06-19T20:02:46", "description": "a. ESX third party update for Service Console kernelThis update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues.The Common Vulnerabilities and Exposures project ( cve.mitre.org) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158, CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243, CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251, CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346, CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710, CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues.Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.2}, "published": "2011-10-12T00:00:00", "type": "vmware", "title": "VMware ESXi and ESX updates to third party libraries and ESX Service Console", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.9, "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-0296", "CVE-2010-1083", "CVE-2010-1323", "CVE-2010-2492", "CVE-2010-2798", "CVE-2010-2938", "CVE-2010-2942", "CVE-2010-2943", "CVE-2010-3015", "CVE-2010-3066", "CVE-2010-3067", "CVE-2010-3078", "CVE-2010-3086", "CVE-2010-3296", "CVE-2010-3432", "CVE-2010-3442", "CVE-2010-3477", "CVE-2010-3699", "CVE-2010-3858", "CVE-2010-3859", "CVE-2010-3865", "CVE-2010-3876", "CVE-2010-3877", "CVE-2010-3880", "CVE-2010-3904", "CVE-2010-4072", "CVE-2010-4073", "CVE-2010-4075", "CVE-2010-4080", "CVE-2010-4081", "CVE-2010-4083", "CVE-2010-4157", "CVE-2010-4158", "CVE-2010-4161", "CVE-2010-4238", "CVE-2010-4242", "CVE-2010-4243", "CVE-2010-4247", "CVE-2010-4248", "CVE-2010-4249", "CVE-2010-4251", "CVE-2010-4255", "CVE-2010-4263", "CVE-2010-4343", "CVE-2010-4346", "CVE-2010-4526", "CVE-2010-4655", "CVE-2011-0281", "CVE-2011-0282", "CVE-2011-0521", "CVE-2011-0536", "CVE-2011-0710", "CVE-2011-1010", "CVE-2011-1071", "CVE-2011-1090", "CVE-2011-1095", "CVE-2011-1478", "CVE-2011-1494", "CVE-2011-1495", "CVE-2011-1658", "CVE-2011-1659"], "modified": "2012-03-08T00:00:00", "id": "VMSA-2011-0012.3", "href": "https://www.vmware.com/security/advisories/VMSA-2011-0012.3.html", "cvss": {"score": 7.9, "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"}}]}
Denial Of Service (DoS)
