The version of kernel installed on the remote host is prior to 4.14.200-116.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1437 advisory.

    In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure. (CVE-2019-19448)

    A flaw was found in the Linux kernel's implementation of BTRFS free space management, where the kernel     does not correctly manage the lifetime of internal data structures used. An attacker could use this flaw     to corrupt memory or escalate privileges. (CVE-2020-12888)

    A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to     directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable     access to the devices' MMIO memory address spaces. If a user attempts to access the read/write devices'     MMIO address space when it is disabled, some h/w devices issue an interrupt to the CPU to indicate a fatal     error condition, crashing the system. This flaw allows a guest user or process to crash the host system     resulting in a denial of service. A memory out-of-bounds read flaw was found in the Linux kernel before     5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw     allows a local user to crash the system if the directory exists. The highest threat from this     vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14331)

    A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14390)

    A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur     leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. A flaw was found in the NFSv4 implementation where when mounting a remote     attacker controlled server it could return specially crafted response allow for local memory corruption     and possibly privilege escalation. A TOCTOU mismatch in the NFS client code in the Linux kernel before     5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because     a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. (CVE-2020-25212)

    A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel.
    Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add     or remove Rados Block Devices from the system. (CVE-2020-25284)

    A flaw was found in the Linux kernels sysctl handling code for hugepages managment. When multiple root     level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on     internal variables leading to a system crash or memory corruption. A race condition between hugetlb sysctl     handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt     memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
    (CVE-2020-25285)

    A flaw was found in the Linux kernel's implementation of biovecs. A zero-length biovec request issued by     the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This     flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25641)

    A flaw was found in the HDLC_PPP module of the Linux kernel.  Memory corruption and a read overflow is     caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or     cause a denial of service.  The highest threat from this vulnerability is to data confidentiality and     integrity as well as system availability. (CVE-2020-25643)

    A flaw was found in the Linux kernel. Traffic between two Geneve endpoints may be unencrypted when IPsec     is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone in     between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to     data confidentiality. (CVE-2020-25645)

    A missing capabilities check when creating NFC raw sockets could be used by local attackers to create raw     sockets, bypassing security mechanisms allowing them to create or listen to NFC communication frames.
    (CVE-2020-26088)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.68-34.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-016 advisory.

    A flaw was found in the Linux kernel's implementation of BTRFS free space management, where the kernel     does not correctly manage the lifetime of internal data structures used. An attacker could use this flaw     to corrupt memory or escalate privileges. (CVE-2019-19448)

    A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a     local attacker with special user (or root) privilege to crash the system at the time of file or directory     removal. This vulnerability can lead to a kernel information leak. The highest threat from this     vulnerability is to system availability. (CVE-2019-19770)

    A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to     directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable     access to the devices' MMIO memory address spaces. If a user attempts to access the read/write devices'     MMIO address space when it is disabled, some h/w devices issue an interrupt to the CPU to indicate a fatal     error condition, crashing the system. This flaw allows a guest user or process to crash the host system     resulting in a denial of service. (CVE-2020-12888)

    A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it     accesses a directory with broken indexing. This flaw allows a local user to crash the system if the     directory exists. The highest threat from this vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel. A failure of the file system metadata validator in XFS can cause an     inode with a valid, user-creatable extended attribute to be flagged as corrupt.  This can lead to the     filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial     of service. The highest threat from this vulnerability is to system availability. (CVE-2020-14385)

    A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur     leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2020-14390)

    A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it     could return specially crafted response allow for local memory corruption and possibly privilege     escalation. (CVE-2020-25212)

    A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel.
    Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add     or remove Rados Block Devices from the system. (CVE-2020-25284)

    A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root     level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on     internal variables leading to a system crash or memory corruption. (CVE-2020-25285)

    A flaw was found in the Linux kernel's implementation of biovecs. A zero-length biovec request issued by     the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This     flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25641)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5913 advisory.

    - powercap: restrict energy meter to root access (Kanth Ghatraju)  [Orabug: 32040805]  {CVE-2020-8694}     {CVE-2020-8695}
    - hdlc_ppp: add range checks in ppp_cp_parse_cr() (Dan Carpenter)  [Orabug: 31989189]  {CVE-2020-25643}
    - geneve: add transport ports in route lookup for geneve (Mark Gray)  [Orabug: 32014099]  {CVE-2020-25645}
    - certs: Add EFI_CERT_X509_GUID support for dbx entries (Eric Snowberg)  [Orabug: 31961118]     {CVE-2020-26541}
    - btrfs: Don't submit any btree write bio if the fs has errors (Qu Wenruo)  [Orabug: 31265337]     {CVE-2019-19377} {CVE-2019-19377} {CVE-2019-19377}
    - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik)     [Orabug: 31351023]  {CVE-2019-19448} {CVE-2019-19448}
    - xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen)  [Orabug: 31895824]  {CVE-2020-14385}
    - nbd_genl_status: null check for nla_nest_start (Navid Emamdoost)  [Orabug: 31351789]  {CVE-2019-16089}
    - efi/x86/Add missing error handling to old_memmap 1:1 mapping code (Gen Zhang)  [Orabug: 31351924]     {CVE-2019-12380}
    - cgroup: fix cgroup_sk_alloc() for sk_clone_lock() (Cong Wang)  [Orabug: 31779798]  {CVE-2020-14356}
    - netfilter: ctnetlink: add a range check for l3/l4 protonum (Will McVicker)  [Orabug: 31872862]     {CVE-2020-25211}
    - vgacon: remove software scrollback support (Linus Torvalds)  [Orabug: 31914690]  {CVE-2020-14390}
    - fbcon: remove soft scrollback code (Linus Torvalds)  [Orabug: 31914690]  {CVE-2020-14390}
    - block: allow for_each_bvec to support zero len bvec (Ming Lei)  [Orabug: 31955141]  {CVE-2020-25641}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
141961	Amazon Linux AMI : kernel (ALAS-2020-1437)	Nessus	Amazon Linux Local Security Checks	2020/10/28	2026/1/26	high
160437	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-016)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2026/2/26	high
180881	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5913)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/2/9	high

偵測

搜尋 Plugin

high

high

high