The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2522 advisory.

  - hw: vt-d related privilege escalation (CVE-2020-24489)

  - kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32     GB from vcpu->run (CVE-2021-3501)

  - polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync() (CVE-2021-3560)

  - glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to     32 bits (CVE-2021-27219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - polkit is a toolkit for defining and handling     authorizations. It isused for allowing unprivileged     processes to speak to     privilegedprocesses.(CVE-2021-3560)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests,     elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged     local attacker to, for example, create a new local administrator. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3560)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202107-31 (polkit: Privilege escalation)

    The function polkit_system_bus_name_get_creds_sync() was called without       checking for error, and as such temporarily treats the authentication       request as coming from root.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2238 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has polkit packages installed that are affected by a vulnerability:

  - It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests,     elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged     local attacker to, for example, create a new local administrator. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2237 advisory.

  - polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync() (CVE-2021-3560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for polkit fixes the following issues :

CVE-2021-3560: Fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the polkit package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2238 advisory.

    The polkit packages provide a component for controlling system-wide privileges. This component provides a     uniform and organized way for non-privileged processes to communicate with privileged ones.

    Security Fix(es):

    * polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync() (CVE-2021-3560)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Cedric Buissart reports :

The function polkit_system_bus_name_get_creds_sync is used to get the uid and pid of the process requesting the action. It does this by sending the unique bus name of the requesting process, which is typically something like ':1.96', to dbus-daemon. These unique names are assigned and managed by dbus-daemon and cannot be forged, so this is a good way to check the privileges of the requesting process.

The vulnerability happens when the requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync starts. In this scenario, the unique bus name is no longer valid, so dbus-daemon sends back an error reply. This error case is handled in polkit_system_bus_name_get_creds_sync by setting the value of the error parameter, but it still returns TRUE, rather than FALSE. This behavior means that all callers of polkit_system_bus_name_get_creds_sync need to carefully check whether an error was set. If the calling function forgets to check for errors then it will think that the uid of the requesting process is 0 (because the AsyncGetBusNameCredsData struct is zero initialized). In other words, it will think that the action was requested by a root process, and will therefore allow it.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1843-1 advisory.

  - polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync() (CVE-2021-3560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests,     elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged     local attacker to, for example, create a new local administrator. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3560)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
150950	RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.4.6] (Important) (RHSA-2021:2522)	Nessus	Red Hat Local Security Checks	2021/6/22	2024/4/28	high
152407	EulerOS 2.0 SP8 : polkit (EulerOS-SA-2021-2311)	Nessus	Huawei Local Security Checks	2021/8/10	2023/12/4	high
155507	EulerOS Virtualization 2.9.0 : polkit (EulerOS-SA-2021-2765)	Nessus	Huawei Local Security Checks	2021/11/17	2023/11/23	high
155510	EulerOS Virtualization 2.9.1 : polkit (EulerOS-SA-2021-2738)	Nessus	Huawei Local Security Checks	2021/11/17	2023/11/23	high
156969	GLSA-202107-31 : polkit: Privilege escalation	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	high
157732	Rocky Linux 8 : polkit (RLSA-2021:2238)	Nessus	Rocky Linux Local Security Checks	2022/2/9	2023/11/10	high
160784	NewStart CGSL MAIN 6.02 : polkit Vulnerability (NS-SA-2022-0061)	Nessus	NewStart CGSL Local Security Checks	2022/5/9	2023/10/30	high
150161	RHEL 8 : polkit (RHSA-2021:2237)	Nessus	Red Hat Local Security Checks	2021/6/3	2024/4/28	high
150270	SUSE SLES15 Security Update : polkit (SUSE-SU-2021:1844-1)	Nessus	SuSE Local Security Checks	2021/6/4	2023/12/27	high
150288	Photon OS 2.0: Polkit PHSA-2021-2.0-0350	Nessus	PhotonOS Local Security Checks	2021/6/4	2023/12/27	high
150293	RHEL 8 : polkit (RHSA-2021:2238)	Nessus	Red Hat Local Security Checks	2021/6/4	2024/6/4	high
150314	FreeBSD : polkit -- local privilege escalation using polkit_system_bus_name_get_creds_sync (36a35d83-c560-11eb-84ab-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	2021/6/7	2023/12/27	high
151717	openSUSE 15 Security Update : polkit (openSUSE-SU-2021:1843-1)	Nessus	SuSE Local Security Checks	2021/7/16	2023/12/8	high
153754	EulerOS 2.0 SP9 : polkit (EulerOS-SA-2021-2537)	Nessus	Huawei Local Security Checks	2021/9/27	2023/11/29	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high