Vulnerabilities > CVE-2013-7265 - Improper Input Validation vulnerability in Linux Kernel
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Nessus
NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2108-1.NASL description A flaw was discovered in the Linux kernel last seen 2020-03-18 modified 2014-02-19 plugin id 72572 published 2014-02-19 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72572 title Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2108-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-2108-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(72572); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2013-6383", "CVE-2013-7263", "CVE-2013-7264", "CVE-2013-7265", "CVE-2013-7281"); script_xref(name:"USN", value:"2108-1"); script_name(english:"Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2108-1)"); script_summary(english:"Checks dpkg output for updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Ubuntu host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383) mpd reported an information leak in the recvfrom, recvmmsg, and recvmsg system calls in the Linux kernel. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7263) mpb reported an information leak in the Layer Two Tunneling Protocol (l2tp) of the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7264) mpb reported an information leak in the Phone Network protocol (phonet) in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7265) mpb reported an information leak in the Low-Rate Wireless Personal Area Networks support (IEEE 802.15.4) in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7281). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/2108-1/" ); script_set_attribute( attribute:"solution", value:"Update the affected linux-image-2.6-ec2 package." ); script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-2.6-ec2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/11/26"); script_set_attribute(attribute:"patch_publication_date", value:"2014/02/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/19"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("ksplice.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(10\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); if (get_one_kb_item("Host/ksplice/kernel-cves")) { rm_kb_item(name:"Host/uptrack-uname-r"); cve_list = make_list("CVE-2013-6383", "CVE-2013-7263", "CVE-2013-7264", "CVE-2013-7265", "CVE-2013-7281"); if (ksplice_cves_check(cve_list)) { audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for USN-2108-1"); } else { _ubuntu_report = ksplice_reporting_text(); } } flag = 0; if (ubuntu_check(osver:"10.04", pkgname:"linux-image-2.6.32-361-ec2", pkgver:"2.6.32-361.74")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "linux-image-2.6-ec2"); }
NASL family SuSE Local Security Checks NASL id SUSE_11_KERNEL-140321.NASL description The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix various bugs and security issues. ---------------------------------------------------------------------- - WARNING: If you are running KVM with PCI pass-through on a system with one of the following Intel chipsets: 5500 (revision 0x13), 5520 (revision 0x13) or X58 (revisions 0x12, 0x13, 0x22), please make sure to read the following support document before installing this update: https://www.suse.com/support/kb/doc.php?id=7014344 . You will have to update your KVM setup to no longer make use of PCI pass-through before rebooting to the updated kernel. ---------------------------------------------------------------------- - The following security bugs were fixed : - The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c. (bnc#847672). (CVE-2013-4470) - The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#852967). (CVE-2013-6885) - The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. (bnc#857643). (CVE-2013-7263) - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643). (CVE-2013-7264) - The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643). (CVE-2013-7265) - The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (bnc#864025). (CVE-2014-0069) The following non-security bugs were fixed : - kabi: protect symbols modified by bnc#864833 fix. (bnc#864833) - mm: mempolicy: fix mbind_range() && vma_adjust() interaction (VM Functionality (bnc#866428)). - mm: merging memory blocks resets mempolicy (VM Functionality (bnc#866428)). - mm/page-writeback.c: do not count anon pages as dirtyable memory (High memory utilisation performance (bnc#859225)). - mm: vmscan: Do not force reclaim file pages until it exceeds anon (High memory utilisation performance (bnc#859225)). - mm: vmscan: fix endless loop in kswapd balancing (High memory utilisation performance (bnc#859225)). - mm: vmscan: Update rotated and scanned when force reclaimed (High memory utilisation performance (bnc#859225)). - mm: exclude memory less nodes from zone_reclaim. (bnc#863526) - mm: fix return type for functions nr_free_*_pages kabi fixup. (bnc#864058) - mm: fix return type for functions nr_free_*_pages. (bnc#864058) - mm: swap: Use swapfiles in priority order (Use swap files in priority order (bnc#862957)). - x86: Save cr2 in NMI in case NMIs take a page fault (follow-up for patches.fixes/x86-Add-workaround-to-NMI-iret-woes.patch) . - powerpc: Add VDSO version of getcpu (fate#316816, bnc#854445). - vmscan: change type of vm_total_pages to unsigned long. (bnc#864058) - audit: dynamically allocate audit_names when not enough space is in the names array. (bnc#857358) - audit: make filetype matching consistent with other filters. (bnc#857358) - arch/x86/mm/srat: Skip NUMA_NO_NODE while parsing SLIT. (bnc#863178) - hwmon: (coretemp) Fix truncated name of alarm attributes. - privcmd: allow preempting long running user-mode originating hypercalls. (bnc#861093) - nohz: Check for nohz active instead of nohz enabled. (bnc#846790) - nohz: Fix another inconsistency between CONFIG_NO_HZ=n and nohz=off. (bnc#846790) - iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets. (bnc#844513) - balloon: do not crash in HVM-with-PoD guests. - crypto: s390 - fix des and des3_ede ctr concurrency issue (bnc#862796, LTC#103744). - crypto: s390 - fix des and des3_ede cbc concurrency issue (bnc#862796, LTC#103743). - kernel: oops due to linkage stack instructions (bnc#862796, LTC#103860). - crypto: s390 - fix concurrency issue in aes-ctr mode (bnc#862796, LTC#103742). - dump: Fix dump memory detection (bnc#862796,LTC#103575). - net: change type of virtio_chan->p9_max_pages. (bnc#864058) - inet: Avoid potential NULL peer dereference. (bnc#864833) - inet: Hide route peer accesses behind helpers. (bnc#864833) - inet: Pass inetpeer root into inet_getpeer*() interfaces. (bnc#864833) - tcp: syncookies: reduce cookie lifetime to 128 seconds. (bnc#833968) - tcp: syncookies: reduce mss table to four values. (bnc#833968) - ipv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag. (bnc#865783) - ipv6: send router reachability probe if route has an unreachable gateway. (bnc#853162) - sctp: Implement quick failover draft from tsvwg. (bnc#827670) - ipvs: fix AF assignment in ip_vs_conn_new(). (bnc#856848) - NFSD/sunrpc: avoid deadlock on TCP connection due to memory pressure. (bnc#853455) - btrfs: bugfix collection - fs/nfsd: change type of max_delegations, nfsd_drc_max_mem and nfsd_drc_mem_used. (bnc#864058) - fs/buffer.c: change type of max_buffer_heads to unsigned long. (bnc#864058) - ncpfs: fix rmdir returns Device or resource busy. (bnc#864880) - fs/fscache: Handle removal of unadded object to the fscache_object_list rb tree. (bnc#855885) - scsi_dh_alua: fixup RTPG retry delay miscalculation. (bnc#854025) - scsi_dh_alua: Simplify state machine. (bnc#854025) - xhci: Fix resume issues on Renesas chips in Samsung laptops. (bnc#866253) - bonding: disallow enslaving a bond to itself. (bnc#599263) - USB: hub: handle -ETIMEDOUT during enumeration. (bnc#855825) - dm-multipath: Do not stall on invalid ioctls. (bnc#865342) - scsi_dh_alua: endless STPG retries for a failed LUN. (bnc#865342) - net/mlx4_en: Fix pages never dma unmapped on rx. (bnc#858604) - dlm: remove get_comm. (bnc#827670) - dlm: Avoid LVB truncation. (bnc#827670) - dlm: disable nagle for SCTP. (bnc#827670) - dlm: retry failed SCTP sends. (bnc#827670) - dlm: try other IPs when sctp init assoc fails. (bnc#827670) - dlm: clear correct bit during sctp init failure handling. (bnc#827670) - dlm: set sctp assoc id during setup. (bnc#827670) - dlm: clear correct init bit during sctp setup. (bnc#827670) - dlm: fix deadlock between dlm_send and dlm_controld. (bnc#827670) - dlm: Fix return value from lockspace_busy(). (bnc#827670) - Avoid occasional hang with NFS. (bnc#852488) - mpt2sas: Fix unsafe using smp_processor_id() in preemptible. (bnc#853166) - lockd: send correct lock when granting a delayed lock. (bnc#859342) last seen 2017-10-29 modified 2014-06-13 plugin id 73244 published 2014-03-28 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=73244 title SuSE 11.3 Security Update : Linux Kernel (SAT Patch Numbers 9047 / 9050 / 9051) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2107-1.NASL description A flaw was discovered in the Linux kernel last seen 2020-03-18 modified 2014-02-19 plugin id 72571 published 2014-02-19 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72571 title Ubuntu 10.04 LTS : linux vulnerabilities (USN-2107-1) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2117-1.NASL description Saran Neti reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (panic). (CVE-2013-4563) Mathy Vanhoef discovered an error in the the way the ath9k driver was handling the BSSID masking. A remote attacker could exploit this error to discover the original MAC address after a spoofing atack. (CVE-2013-4579) Andrew Honig reported a flaw in the Linux Kernel last seen 2020-03-18 modified 2014-02-19 plugin id 72578 published 2014-02-19 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72578 title Ubuntu 13.10 : linux vulnerabilities (USN-2117-1) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1477.NASL description According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7265) - The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7266) - The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7267) - The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7268) - The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7269) - The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7270) - The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7271) - The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.(CVE-2013-7281) - A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel last seen 2020-06-01 modified 2020-06-02 plugin id 124801 published 2019-05-13 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124801 title EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1477) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2014-0439.NASL description Updated kernel-rt packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.5. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. * A denial of service flaw was found in the way the Linux kernel last seen 2020-06-01 modified 2020-06-02 plugin id 76674 published 2014-07-22 reporter This script is Copyright (C) 2014-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/76674 title RHEL 6 : MRG (RHSA-2014:0439) NASL family Scientific Linux Local Security Checks NASL id SL_20140312_KERNEL_ON_SL5_X.NASL description * A buffer overflow flaw was found in the way the qeth_snmp_command() function in the Linux kernel last seen 2020-03-18 modified 2014-03-14 plugin id 73012 published 2014-03-14 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/73012 title Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20140312) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2014-3034.NASL description The remote Oracle Linux host is missing a security update for the Unbreakable Enterprise kernel package(s). last seen 2020-06-01 modified 2020-06-02 plugin id 74101 published 2014-05-20 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74101 title Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2014-3034) NASL family F5 Networks Local Security Checks NASL id F5_BIGIP_SOL15984.NASL description The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. last seen 2020-06-01 modified 2020-06-02 plugin id 80529 published 2015-01-15 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/80529 title F5 Networks BIG-IP : Linux kernel vulnerability (SOL15984) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2113-1.NASL description Saran Neti reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (panic). (CVE-2013-4563) Mathy Vanhoef discovered an error in the the way the ath9k driver was handling the BSSID masking. A remote attacker could exploit this error to discover the original MAC address after a spoofing atack. (CVE-2013-4579) Andrew Honig reported a flaw in the Linux Kernel last seen 2020-03-18 modified 2014-02-19 plugin id 72576 published 2014-02-19 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72576 title Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2113-1) NASL family Fedora Local Security Checks NASL id FEDORA_2013-23653.NASL description The 3.12.5 kernel contains support for new devices, and a number of bug fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-12-23 plugin id 71598 published 2013-12-23 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/71598 title Fedora 19 : kernel-3.12.5-200.fc19 (2013-23653) NASL family SuSE Local Security Checks NASL id SUSE_11_KERNEL-140408.NASL description The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues. ---------------------------------------------------------------------- - WARNING: If you are running KVM with PCI pass-through on a system with one of the following Intel chipsets: 5500 (revision 0x13), 5520 (revision 0x13) or X58 (revisions 0x12, 0x13, 0x22), please make sure to read the following support document before installing this update : https://www.suse.com/support/kb/doc.php?id=7014344 You will have to update your KVM setup to no longer make use of PCI pass-through before rebooting to the updated kernel. ---------------------------------------------------------------------- - The following security bugs have been fixed : - The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c. (bnc#847672). (CVE-2013-4470) - The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#852967). (CVE-2013-6885) - The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. (bnc#857643). (CVE-2013-7263) - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643). (CVE-2013-7264) - The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643). (CVE-2013-7265) - The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (bnc#864025). (CVE-2014-0069) Also the following non-security bugs have been fixed : - kabi: protect symbols modified by bnc#864833 fix. (bnc#864833) - mm: mempolicy: fix mbind_range() && vma_adjust() interaction (VM Functionality (bnc#866428)). - mm: merging memory blocks resets mempolicy (VM Functionality (bnc#866428)). - mm/page-writeback.c: do not count anon pages as dirtyable memory (High memory utilisation performance (bnc#859225)). - mm: vmscan: Do not force reclaim file pages until it exceeds anon (High memory utilisation performance (bnc#859225)). - mm: vmscan: fix endless loop in kswapd balancing (High memory utilisation performance (bnc#859225)). - mm: vmscan: Update rotated and scanned when force reclaimed (High memory utilisation performance (bnc#859225)). - mm: exclude memory less nodes from zone_reclaim. (bnc#863526) - mm: fix return type for functions nr_free_*_pages kabi fixup. (bnc#864058) - mm: fix return type for functions nr_free_*_pages. (bnc#864058) - mm: swap: Use swapfiles in priority order (Use swap files in priority order (bnc#862957)). - x86: Save cr2 in NMI in case NMIs take a page fault (follow-up for patches.fixes/x86-Add-workaround-to-NMI-iret-woes.patch) . - powerpc: Add VDSO version of getcpu (fate#316816, bnc#854445). - vmscan: change type of vm_total_pages to unsigned long. (bnc#864058) - audit: dynamically allocate audit_names when not enough space is in the names array. (bnc#857358) - audit: make filetype matching consistent with other filters. (bnc#857358) - arch/x86/mm/srat: Skip NUMA_NO_NODE while parsing SLIT. (bnc#863178) - hwmon: (coretemp) Fix truncated name of alarm attributes. - privcmd: allow preempting long running user-mode originating hypercalls. (bnc#861093) - nohz: Check for nohz active instead of nohz enabled. (bnc#846790) - nohz: Fix another inconsistency between CONFIG_NO_HZ=n and nohz=off. (bnc#846790) - iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets. (bnc#844513) - balloon: do not crash in HVM-with-PoD guests. - crypto: s390 - fix des and des3_ede ctr concurrency issue (bnc#862796, LTC#103744). - crypto: s390 - fix des and des3_ede cbc concurrency issue (bnc#862796, LTC#103743). - kernel: oops due to linkage stack instructions (bnc#862796, LTC#103860). - crypto: s390 - fix concurrency issue in aes-ctr mode (bnc#862796, LTC#103742). - dump: Fix dump memory detection (bnc#862796,LTC#103575). - net: change type of virtio_chan->p9_max_pages. (bnc#864058) - inet: handle rt{,6}_bind_peer() failure correctly. (bnc#870801) - inet: Avoid potential NULL peer dereference. (bnc#864833) - inet: Hide route peer accesses behind helpers. (bnc#864833) - inet: Pass inetpeer root into inet_getpeer*() interfaces. (bnc#864833) - tcp: syncookies: reduce cookie lifetime to 128 seconds. (bnc#833968) - tcp: syncookies: reduce mss table to four values. (bnc#833968) - ipv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag. (bnc#865783) - ipv6: send router reachability probe if route has an unreachable gateway. (bnc#853162) - sctp: Implement quick failover draft from tsvwg. (bnc#827670) - ipvs: fix AF assignment in ip_vs_conn_new(). (bnc#856848) - NFSD/sunrpc: avoid deadlock on TCP connection due to memory pressure. (bnc#853455) - btrfs: bugfix collection - fs/nfsd: change type of max_delegations, nfsd_drc_max_mem and nfsd_drc_mem_used. (bnc#864058) - fs/buffer.c: change type of max_buffer_heads to unsigned long. (bnc#864058) - ncpfs: fix rmdir returns Device or resource busy. (bnc#864880) - scsi_dh_alua: fixup RTPG retry delay miscalculation. (bnc#854025) - scsi_dh_alua: Simplify state machine. (bnc#854025) - xhci: Fix resume issues on Renesas chips in Samsung laptops. (bnc#866253) - bonding: disallow enslaving a bond to itself. (bnc#599263) - USB: hub: handle -ETIMEDOUT during enumeration. (bnc#855825) - dm-multipath: Do not stall on invalid ioctls. (bnc#865342) - scsi_dh_alua: endless STPG retries for a failed LUN. (bnc#865342) - net/mlx4_en: Fix pages never dma unmapped on rx. (bnc#858604) - dlm: remove get_comm. (bnc#827670) - dlm: Avoid LVB truncation. (bnc#827670) - dlm: disable nagle for SCTP. (bnc#827670) - dlm: retry failed SCTP sends. (bnc#827670) - dlm: try other IPs when sctp init assoc fails. (bnc#827670) - dlm: clear correct bit during sctp init failure handling. (bnc#827670) - dlm: set sctp assoc id during setup. (bnc#827670) - dlm: clear correct init bit during sctp setup. (bnc#827670) - dlm: fix deadlock between dlm_send and dlm_controld. (bnc#827670) - dlm: Fix return value from lockspace_busy(). (bnc#827670) - Avoid occasional hang with NFS. (bnc#852488) - mpt2sas: Fix unsafe using smp_processor_id() in preemptible. (bnc#853166) - lockd: send correct lock when granting a delayed lock. (bnc#859342) last seen 2020-06-05 modified 2014-04-16 plugin id 73554 published 2014-04-16 reporter This script is Copyright (C) 2014-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/73554 title SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9102 / 9104 / 9105) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2136-1.NASL description Mathy Vanhoef discovered an error in the the way the ath9k driver was handling the BSSID masking. A remote attacker could exploit this error to discover the original MAC address after a spoofing atack. (CVE-2013-4579) Andrew Honig reported a flaw in the Linux Kernel last seen 2020-03-18 modified 2014-03-10 plugin id 72899 published 2014-03-10 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72899 title Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2136-1) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2014-0159.NASL description From Red Hat Security Advisory 2014:0159 : Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A buffer overflow flaw was found in the way the qeth_snmp_command() function in the Linux kernel last seen 2020-06-01 modified 2020-06-02 plugin id 72469 published 2014-02-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72469 title Oracle Linux 6 : kernel (ELSA-2014-0159) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2135-1.NASL description Mathy Vanhoef discovered an error in the the way the ath9k driver was handling the BSSID masking. A remote attacker could exploit this error to discover the original MAC address after a spoofing atack. (CVE-2013-4579) Andrew Honig reported a flaw in the Linux Kernel last seen 2020-03-18 modified 2014-03-10 plugin id 72898 published 2014-03-10 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72898 title Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-2135-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2014-0772-1.NASL description The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. The following security issues have been addressed : CVE-2013-6382: Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c. (bnc#852553) CVE-2013-7263: The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. (bnc#857643) CVE-2013-7264: The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) CVE-2013-7265: The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) CVE-2014-1737: The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (bnc#875798) CVE-2014-1738: The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (bnc#875798) Additionally, the following non-security bugs have been fixed : - tcp: syncookies: reduce cookie lifetime to 128 seconds (bnc#833968). - tcp: syncookies: reduce mss table to four values (bnc#833968). - ia64: Change default PSR.ac from last seen 2020-06-05 modified 2015-05-20 plugin id 83626 published 2015-05-20 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/83626 title SUSE SLES10 Security Update : kernel (SUSE-SU-2014:0772-1) NASL family SuSE Local Security Checks NASL id OPENSUSE-2014-375.NASL description This Linux kernel security update fixes various security issues and bugs. The Linux Kernel was updated to fix various security issues and bugs. Main security issues fixed : A security issue in the tty layer that was fixed that could be used by local attackers for code execution (CVE-2014-0196). Two security issues in the floppy driver were fixed that could be used by local attackers on machines with the floppy to crash the kernel or potentially execute code in the kernel (CVE-2014-1737 CVE-2014-1738). Other security issues and bugfixes : - netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper (bnc#860835 CVE-2014-1690). - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH (bnc#866102, CVE-2014-0101). - [media] ivtv: Fix Oops when no firmware is loaded (bnc#875440). - ALSA: hda - Add dock pin setups for Thinkpad T440 (bnc#876699). - ip6tnl: fix double free of fb_tnl_dev on exit (bnc#876531). - Update arm config files: Enable all USB-to-serial drivers Specifically, enable USB_SERIAL_WISHBONE and USB_SERIAL_QT2 on all arm flavors. - mei: limit the number of consecutive resets (bnc#821619,bnc#852656). - mei: revamp mei reset state machine (bnc#821619,bnc#852656). - mei: use hbm idle state to prevent spurious resets (bnc#821619). - mei: do not run reset flow from the interrupt thread (bnc#821619,bnc#852656). - mei: don last seen 2020-06-05 modified 2014-06-13 plugin id 75363 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75363 title openSUSE Security Update : kernel (openSUSE-SU-2014:0678-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2014-0159.NASL description Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A buffer overflow flaw was found in the way the qeth_snmp_command() function in the Linux kernel last seen 2020-06-01 modified 2020-06-02 plugin id 72437 published 2014-02-12 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72437 title CentOS 6 : kernel (CESA-2014:0159) NASL family Fedora Local Security Checks NASL id FEDORA_2013-22669.NASL description The 3.11.10 stable update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-12-08 plugin id 71249 published 2013-12-08 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/71249 title Fedora 19 : kernel-3.11.10-200.fc19 (2013-22669) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2014-3011.NASL description Description of changes: [3.8.13-26.1.1.el6uek] - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa) [18247287] {CVE-2013-7263} {CVE-2013-7265} - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa) [18238377] {CVE-2013-7263} {CVE-2013-7265} - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook) [18238348] {CVE-2013-2929} last seen 2020-06-01 modified 2020-06-02 plugin id 72535 published 2014-02-17 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72535 title Oracle Linux 6 : unbreakable enterprise kernel (ELSA-2014-3011) NASL family Scientific Linux Local Security Checks NASL id SL_20140211_KERNEL_ON_SL6_X.NASL description * A buffer overflow flaw was found in the way the qeth_snmp_command() function in the Linux kernel last seen 2020-03-18 modified 2014-02-13 plugin id 72475 published 2014-02-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72475 title Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20140211) NASL family OracleVM Local Security Checks NASL id ORACLEVM_OVMSA-2017-0057.NASL description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details. last seen 2020-06-01 modified 2020-06-02 plugin id 99163 published 2017-04-03 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/99163 title OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2138-1.NASL description Mathy Vanhoef discovered an error in the the way the ath9k driver was handling the BSSID masking. A remote attacker could exploit this error to discover the original MAC address after a spoofing atack. (CVE-2013-4579) Andrew Honig reported a flaw in the Linux Kernel last seen 2020-03-18 modified 2014-03-10 plugin id 72901 published 2014-03-10 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72901 title Ubuntu 12.10 : linux vulnerabilities (USN-2138-1) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1516.NASL description According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The hi3660_stub_clk_probe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows local users to cause a denial of service (NULL pointer dereference) by triggering a failure of resource retrieval.(CVE-2018-10074i1/4%0 - An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) backend driver of the iSCSI Target subsystem of the Linux kernel. A privileged user could use this flaw to leak the contents of kernel memory to an iSCSI initiator remote client.(CVE-2014-4027i1/4%0 - It was found that in the Linux kernel version 4.2-rc1 to 4.3-rc1, a use of uninitialized last seen 2020-03-19 modified 2019-05-13 plugin id 124837 published 2019-05-13 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124837 title EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1516) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2014-3010.NASL description Description of changes: [2.6.32-400.34.3.el6uek] - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa) [18247290] {CVE-2013-7263} {CVE-2013-7265} [2.6.32-400.34.2.el6uek] - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook) [18239033] {CVE-2013-2929} {CVE-2013-2929} - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa) [18239036] {CVE-2013-7263} {CVE-2013-7265} last seen 2020-06-01 modified 2020-06-02 plugin id 72534 published 2014-02-17 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72534 title Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3010) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2109-1.NASL description Vasily Kulikov reported a flaw in the Linux kernel last seen 2020-03-18 modified 2014-02-19 plugin id 72573 published 2014-02-19 reporter Ubuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72573 title Ubuntu 12.04 LTS : linux vulnerabilities (USN-2109-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2014-0773-1.NASL description The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. The following security issues have been addressed : CVE-2013-6382: Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c. (bnc#852553) CVE-2013-7263: The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. (bnc#857643) CVE-2013-7264: The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) CVE-2013-7265: The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) CVE-2014-1737: The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (bnc#875798) CVE-2014-1738: The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (bnc#875798) Additionally, the following non-security bugs have been fixed : - tcp: syncookies: reduce cookie lifetime to 128 seconds (bnc#833968). - tcp: syncookies: reduce mss table to four values (bnc#833968). - ia64: Change default PSR.ac from last seen 2020-06-05 modified 2015-05-20 plugin id 83627 published 2015-05-20 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/83627 title SUSE SLES10 Security Update : kernel (SUSE-SU-2014:0773-1) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2013-258.NASL description Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c. last seen 2020-06-01 modified 2020-06-02 plugin id 71398 published 2013-12-14 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/71398 title Amazon Linux AMI : kernel (ALAS-2013-258) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2014-001.NASL description Multiple vulnerabilities has been found and corrected in the Linux kernel : The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address (CVE-2013-6368). The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value (CVE-2013-6367). Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c (CVE-2013-6382). Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value (CVE-2013-4587). The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7266). The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7267). The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7268). The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7269). The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7270). The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7271). The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c (CVE-2013-7263). The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7264). The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7265). The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call (CVE-2013-7281). The updated packages provides a solution for these security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 71936 published 2014-01-14 reporter This script is Copyright (C) 2014-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/71936 title Mandriva Linux Security Advisory : kernel (MDVSA-2014:001) NASL family Fedora Local Security Checks NASL id FEDORA_2013-23445.NASL description The 3.12.5 kernel contains support for new devices, and a number of bug fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-12-23 plugin id 71593 published 2013-12-23 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/71593 title Fedora 20 : kernel-3.12.5-302.fc20 (2013-23445) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2906.NASL description Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-0343 George Kargiotakis reported an issue in the temporary address handling of the IPv6 privacy extensions. Users on the same LAN can cause a denial of service or obtain access to sensitive information by sending router advertisement messages that cause temporary address generation to be disabled. - CVE-2013-2147 Dan Carpenter reported issues in the cpqarray driver for Compaq Smart2 Controllers and the cciss driver for HP Smart Array controllers allowing users to gain access to sensitive kernel memory. - CVE-2013-2889 Kees Cook discovered missing input sanitization in the HID driver for Zeroplus game pads that could lead to a local denial of service. - CVE-2013-2893 Kees Cook discovered that missing input sanitization in the HID driver for various Logitech force feedback devices could lead to a local denial of service. - CVE-2013-2929 Vasily Kulikov discovered that a flaw in the get_dumpable() function of the ptrace subsytsem could lead to information disclosure. Only systems with the fs.suid_dumpable sysctl set to a non-default value of last seen 2020-03-17 modified 2014-04-27 plugin id 73713 published 2014-04-27 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/73713 title Debian DSA-2906-1 : linux-2.6 - privilege escalation/denial of service/information leak NASL family Fedora Local Security Checks NASL id FEDORA_2013-22818.NASL description Fixes for SELinux issues and crashes related to big_key (krb) functionality. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-12-10 plugin id 71284 published 2013-12-10 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/71284 title Fedora 20 : kernel-3.11.10-301.fc20 (2013-22818) NASL family SuSE Local Security Checks NASL id SUSE_SU-2014-0832-1.NASL description The SUSE Linux Enterprise Server 10 SP3 LTSS received a roll up update to fix several security and non-security issues. The following security issues have been fixed : CVE-2013-0343: The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages. (bnc#805226) CVE-2013-2888: Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID. (bnc#835839) CVE-2013-2893: The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c. (bnc#835839) CVE-2013-2897: Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device. (bnc#835839) CVE-2013-4470: The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c. (bnc#847672) CVE-2013-4483: The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application. (bnc#848321) CVE-2013-4588: Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33, when CONFIG_IP_VS is used, allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call, related to the do_ip_vs_get_ctl function, or (2) a setsockopt system call, related to the do_ip_vs_set_ctl function. (bnc#851095) CVE-2013-6382: Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c. (bnc#852553) CVE-2013-6383: The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call. (bnc#852558) CVE-2013-7263: The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. (bnc#857643) CVE-2013-7264: The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) CVE-2013-7265: The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) CVE-2014-1444: The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call. (bnc#858869) CVE-2014-1445: The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call. (bnc#858870) CVE-2014-1446: The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call. (bnc#858872) CVE-2014-1737: The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (bnc#875798) CVE-2014-1738: The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (bnc#875798) The following bugs have been fixed : - kernel: sclp console hangs (bnc#830344, LTC#95711, bnc#860304). - ia64: Change default PSR.ac from last seen 2020-06-05 modified 2015-05-20 plugin id 83628 published 2015-05-20 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/83628 title SUSE SLES10 Security Update : kernel (SUSE-SU-2014:0832-1) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2014-289.NASL description The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context. The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. last seen 2020-06-01 modified 2020-06-02 plugin id 72745 published 2014-03-02 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/72745 title Amazon Linux AMI : kernel (ALAS-2014-289) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2014-0159.NASL description Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * A buffer overflow flaw was found in the way the qeth_snmp_command() function in the Linux kernel last seen 2020-06-01 modified 2020-06-02 plugin id 72454 published 2014-02-12 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72454 title RHEL 6 : kernel (RHSA-2014:0159) NASL family Fedora Local Security Checks NASL id FEDORA_2013-22695.NASL description The 3.11.10 stable update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-12-10 plugin id 71283 published 2013-12-10 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/71283 title Fedora 18 : kernel-3.11.10-100.fc18 (2013-22695) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2014-3009.NASL description Description of changes: [2.6.39-400.214.3.el6uek] - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa) [18247289] {CVE-2013-7263} {CVE-2013-7265} [2.6.39-400.214.2.el6uek] - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa) [18238382] {CVE-2013-7263} {CVE-2013-7265} - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook) [18238353] {CVE-2013-2929} last seen 2020-06-01 modified 2020-06-02 plugin id 72533 published 2014-02-17 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72533 title Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3009)
Redhat
advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
rpms |
|
References
- http://www.openwall.com/lists/oss-security/2013/11/28/13
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.4
- https://bugzilla.redhat.com/show_bug.cgi?id=1035875
- https://github.com/torvalds/linux/commit/bceaa90240b6019ed73b49965eac7d167610be69
- http://secunia.com/advisories/56036
- http://secunia.com/advisories/55882
- http://seclists.org/oss-sec/2014/q1/29
- http://www.ubuntu.com/usn/USN-2109-1
- http://rhn.redhat.com/errata/RHSA-2014-0159.html
- http://www.ubuntu.com/usn/USN-2113-1
- http://www.ubuntu.com/usn/USN-2110-1
- http://www.ubuntu.com/usn/USN-2117-1
- http://www.ubuntu.com/usn/USN-2108-1
- http://www.ubuntu.com/usn/USN-2107-1
- http://www.ubuntu.com/usn/USN-2138-1
- http://www.ubuntu.com/usn/USN-2136-1
- http://www.ubuntu.com/usn/USN-2139-1
- http://www.ubuntu.com/usn/USN-2141-1
- http://www.ubuntu.com/usn/USN-2135-1
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bceaa90240b6019ed73b49965eac7d167610be69