ID de Prueba:	1.3.6.1.4.1.25623.1.0.871823
Categoría:	Red Hat Local Security Checks
Título:	RedHat Update for kernel RHSA-2017:1308-01
Resumen:	The remote host is missing an update for the 'kernel'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'kernel' package(s) announced via the referenced advisory. Vulnerability Insight: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * It was found that the packet_set_ring() function of the Linux kernel's networking implementation did not properly validate certain block-size data. A local attacker with CAP_NET_RAW capability could use this flaw to trigger a buffer overflow, resulting in the crash of the system. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (CVE-2017-7308, Important) * Mounting a crafted EXT4 image read-only leads to an attacker controlled memory corruption and SLAB-Out-of-Bounds reads. (CVE-2016-10208, Moderate) * A flaw was found in the Linux kernel's implementation of seq_file where a local attacker could manipulate memory in the put() function pointer. This could lead to memory corruption and possible privileged escalation. (CVE-2016-7910, Moderate) * A vulnerability was found in the Linux kernel. An unprivileged local user could trigger oops in shash_async_export() by attempting to force the in-kernel hashing algorithms into decrypting an empty data set. (CVE-2016-8646, Moderate) * It was reported that with Linux kernel, earlier than version v4.10-rc8, an application may trigger a BUG_ON in sctp_wait_for_sndbuf if the socket tx buffer is full, a thread is waiting on it to queue more data, and meanwhile another thread peels off the association being used by the first thread. (CVE-2017-5986, Moderate) Red Hat would like to thank Igor Redko (Virtuozzo kernel team) for reporting CVE-2016-8646. Additional Changes: This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Technical Notes document linked to in the References section. Affected Software/OS: kernel on Red Hat Enterprise Linux Server (v. 7) Solution: Please Install the Updated Packages. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-10208 BugTraq ID: 94354 http://www.securityfocus.com/bid/94354 http://seclists.org/fulldisclosure/2016/Nov/75 https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html http://www.openwall.com/lists/oss-security/2017/02/05/3 RedHat Security Advisories: RHSA-2017:1297 https://access.redhat.com/errata/RHSA-2017:1297 RedHat Security Advisories: RHSA-2017:1298 https://access.redhat.com/errata/RHSA-2017:1298 RedHat Security Advisories: RHSA-2017:1308 https://access.redhat.com/errata/RHSA-2017:1308 https://usn.ubuntu.com/3754-1/ Common Vulnerability Exposure (CVE) ID: CVE-2016-7910 BugTraq ID: 94135 http://www.securityfocus.com/bid/94135 RedHat Security Advisories: RHSA-2017:0892 https://access.redhat.com/errata/RHSA-2017:0892 Common Vulnerability Exposure (CVE) ID: CVE-2016-8646 94309 http://www.securityfocus.com/bid/94309 RHSA-2017:1297 RHSA-2017:1298 RHSA-2017:1308 [oss-security] 20161115 CVE-2016-8646: linux kernel - oops in shash_async_export() http://www.openwall.com/lists/oss-security/2016/11/15/2 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4afa5f9617927453ac04b24b584f6c718dfb4f45 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.6 https://bugzilla.redhat.com/show_bug.cgi?id=1388821 https://github.com/torvalds/linux/commit/4afa5f9617927453ac04b24b584f6c718dfb4f45 Common Vulnerability Exposure (CVE) ID: CVE-2017-5986 BugTraq ID: 96222 http://www.securityfocus.com/bid/96222 Debian Security Information: DSA-3804 (Google Search) http://www.debian.org/security/2017/dsa-3804 http://www.openwall.com/lists/oss-security/2017/02/14/6 Common Vulnerability Exposure (CVE) ID: CVE-2017-7308 BugTraq ID: 97234 http://www.securityfocus.com/bid/97234 https://www.exploit-db.com/exploits/41994/ https://www.exploit-db.com/exploits/44654/ https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html RedHat Security Advisories: RHSA-2018:1854 https://access.redhat.com/errata/RHSA-2018:1854
Copyright	Copyright (C) 2017 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.