リモートの OracleVM システムには、重要なセキュリティ更新に対処するために必要なパッチがありません。

  - EL7+利用可能な「force-intel」ファイルパスを認識 [orabug 31655792]

  - UEK4ランデブータイムアウトのため、％post中のライブロードを無効 [orabug 31655792]

  -dracutによる早期ロードのためにOracleの変更をマージ

  - 06-2d-07と06-55-04に対する不適切な警告を削除

  - 初期のロードロジックと互換性を持たせるために、他の警告サポートを削除

  -安全とマークされたUEK4カーネルのインストール時の遅延ロードを有効にします（BDW-79を除く）

  -早期ロードのバグを回避するために、仮想化ゲストで早期にmicrocode = 'no'を設定[Orabug: 30618737]

  - Intel CPUマイクロコードをマイクロコード-20201027リリースに更新します。CVE-2020-8694、CVE-2020-8695、CVE-2020-8696に対処します（CVE-2020-8698、#1893243、#1893238）:

  - リビジョン0x700001eでの06-55-0b/0xbf（CPX-SP A1）マイクロコード（microcode.dat内）の追加 

  -リビジョン0x68での06-8c-01/0x80（TGL-UP3/UP4 B1）マイクロコード（microcode.dat内）の追加 

  - リビジョン0xe0での06-a5-02/0x20（CML-H R1）マイクロコード（microcode.dat内）の追加 

  - リビジョン0xe0での06-a5-03/0x22（CML-S 6+2 G1）マイクロコード（microcode.dat内）の追加 

  - リビジョン0xe0での06-a5-05/0x22（CML-S 10+2 Q0）マイクロコード（microcode.dat内）の追加 

  - リビジョン0xe0での06-a6-01/0x80（CML-U 6+2 v2 K0）マイクロコード（microcode.dat内）の追加 

  - リビジョン0xdcから0xe2への06-4e-03/0xc0（SKL-U/U 2+3e/Y D0/K1）マイクロコード（microcode-06-4e-03.dat内）の更新 

  - リビジョン0x2006906から0x2006a08への06-55-04/0xb7（SKX-D/SP/W/X H0/M0/M1/U0）マイクロコード（microcode-06-55-04.dat内）の更新 

  - リビジョン0xdcから0xe2への06-5e-03/0x36（SKL-H/S/Xeon E3 N0/R0/S0）マイクロコード（microcode-06-5e-03.dat内）の更新 

  - リビジョン0x43から0x44への06-3f-02/0x6f（HSX-E/EN/EP/EP 4S C0/C1/M1/R2）マイクロコード（microcode.dat内）の更新 

  - リビジョン0x1000157から0x1000159への06-55-03/0x97（SKX-SP B1）マイクロコード（microcode.dat内）の更新 

  - リビジョン0x4002f01から0x4003003への06-55-06/0xbf（CLX-SP B0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0x5002f01から0x5003003への06-55-07/0xbf（CLX-SP/W/X B1/L1）マイクロコード（microcode.dat内）の更新 

  - リビジョン0x38から0x40への06-5c-09/0x03（APL D0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0x16から0x1eへの06-5c-0a/0x03（APL B1/F1）マイクロコード（microcode.dat内）の更新 

  - リビジョン0x16から0x18への06-7a-08/0x01（GLK-R R0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0x78から0xa0への06-7e-05/0x80（ICL-U/Y D1）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-8e-09/0x10（AML-Y 2+2 H0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-8e-09/0xc0（KBL-U/U 2+3e/Y H0/J1）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xe0への06-8e-0a/0xc0（CFL-U 4+3e D0、KBL-R Y0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-8e-0b/0xd0（WHL-U W0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-8e-0c/0x94（AML-Y 4+2 V0、CML-U 4+2 V0、WHL-U V0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-9e-09/0x2a（KBL-G/H/S/X/Xeon E3 B0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-9e-0a/0x22（CFL-H/S/Xeon E U0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-9e-0b/0x02（CFL-E/H/S B0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-9e-0c/0x22（CFL-H/S/Xeon E P0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xd6から0xdeへの06-9e-0d/0x22（CFL-H/S/Xeon E R0）マイクロコード（microcode.dat内）の更新 

  - リビジョン0xcaから0xe0への06-a6-00/0x80（CML-U 6+2 A0）マイクロコード（microcode.dat内）の更新

  - ドキュメントディレクトリにREADMEファイルを追加します。

  - 公開ソースのコードネームリストを追加してgen_provides.shに提供し、後者を更新して多少異なる形式を処理します。

  - マイクロコードファイルヘッダーからのメタデータ情報を含むSUMMARY.intel-ucodeファイルを追加します。

リモートホストにインストールされているテスト済み製品のバージョンは、テスト済みバージョンより前です。したがって、ALAS2-2020-1566のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - **係争中** Linuxカーネル 4.19.83に、fs/debugfs/inode.c内のdebugfs_remove関数にメモリ解放後使用（Use-After-Free）があります（これは、debugfsのファイルまたはdebugfs_create_fileなどの別のdebugfs関数への呼び出しの際に作成されたディレクトリを削除するために使用されます ）。注：Linuxカーネル開発者は、この問題がdebugfsに関する問題ではなくblktrace内のdebugfsの誤用による問題であるとして、係争中です。（CVE-2019-19770）

  - Linuxカーネルに欠陥が見つかりました。メモリ解放後使用（Use-After-Free）の欠陥がperfサブシステムで見つかりました。このため、perfイベントを監視する権限を持つローカルの攻撃者がメモリを破損し、権限を昇格させる可能性があります。この脆弱性が最大の脅威となるのは、データの機密性と整合性、ならびにシステムの可用性です。（CVE-2020-14351）

  - Linuxカーネルに欠陥が見つかりました。コンソールサブシステムがioctlのKDGKBSENTおよびKDSKBSENTを使用する方法に、メモリ解放後使用（Use-After-Free）が見つかりました。ローカルユーザーがこの欠陥を利用して、領域外で読み取りメモリアクセスを取得する可能性があります。この脆弱性による主な脅威は、データの機密性に関するものです。（CVE-2020-25656）

  - PERF_EVENT_IOC_SET_FILTERを使用している場合に、Linuxカーネルパフォーマンス監視サブシステムのメモリリークの欠陥があることが確認されました。ローカルユーザーがこの欠陥を利用してリソースを枯渇させ、サービス拒否を引き起こす可能性があります。（CVE-2020-25704）

  - 4.14.xまでのXenで使用されている5.9.1までのLinuxカーネルに、問題が発見されました。ゲストのOSユーザーが、dom0に対するイベントの高レート（別名：CID-e99502f76271）を介して、サービス拒否（ホストOSのハングアップ）を引き起こす可能性があります。
    （CVE-2020-27673）

  - 4.14.xまでのXenで使用されている5.9.1までのLinuxカーネルに、問題が発見されました。
    drivers/xen/events/events_base.cを使用すると、イベント処理ループ（競合状態）中にイベントチャネルを削除することが可能です。このため、再構成中の準仮想化デバイス（別名：CID-073d0552ead5）のイベントを介したdom0クラッシュなど、メモリ解放後使用（Use-After-Free）またはNULLポインターデリファレンスを引き起こす可能性があります。（CVE-2020-27675）

  - 5.9.9までのLinuxカーネル内のdrivers/accessibility/speakup/spk_ttyio.cに、問題が見つかりました 。
    peakupドライバーを備えたシステム上のローカルの攻撃者が、ローカルでサービス拒否攻撃（別名：CID-d41227544427）を引き起こす可能性があります。これは、回線制御が複数回使用されるときの無効な解放が原因です。
    （CVE-2020-28941）

  - ローカルの攻撃者が5.9.7以前のLinuxカーネルのfbconにおけるスラブ領域外書き込みを使用して、特権情報を読み取るか、カーネル（別名：CID-3c4e0dff2095）のクラッシュを引き起こす可能性があります。これは、drivers/tty/vt/vt.cのKD_FONT_OP_COPYをフォントの高さなどの操作に使用できるために発生します。（CVE-2020-28974）

  - 一部のIntel(R)プロセッサのLinuxカーネルドライバーのアクセス制御が不十分なため、認証されたユーザーがローカルアクセスを介して情報漏えいを引き起こす可能性があります。（CVE-2020-8694）

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

この更新では、SUSE Linux Enterprise 15-SP2コードストリームのRTカーネルを同期します。この更新はSUSEからインポートされました：SLE-15-SP2: 更新プロジェクトを更新します。

リモートの SUSE Linux SLES12 / SLES_SAP12 ホストには、SUSE-SU-2023:4625-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Linux hwmon サービスに対する AMD 拡張の潜在的な脆弱性により、攻撃者が Linux ベースの実行平均電力制限 (RAPL) インターフェースを使用して、さまざまなサイドチャネル攻撃を表示する可能性があります。業界のパートナーと一致して、AMD は RAPL インターフェースを更新し、権限のあるアクセスを要求しています。(CVE-2020-12912)

  - 一部の Intel(R) プロセッサの Linux カーネルドライバーのアクセス制御が不十分なため、認証されたユーザーがローカルアクセスを介して情報漏洩を引き起こす可能性があります。(CVE-2020-8694)

  - 一部の Intel(R) プロセッサ用の RAPL インターフェースに不一致が見られるため、特権ユーザーがローカルアクセスを介して情報漏洩を引き起こす可能性があります。(CVE-2020-8695)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5923 advisory.

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5924 advisory.

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - A locking vulnerability was found in the tty subsystem     of the Linux kernel in drivers/tty/tty_jobctrl.c. This     flaw allows a local attacker to possibly corrupt memory     or escalate privileges. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-29661)

  - The Linux kernel is the kernel used by the open source     operating system Linux released by the Linux     Foundation. The Linux kernel con_font_op() has a code     problem vulnerability, which can force the use of freed     memory, resulting in denial of service or execution of     custom code.(CVE-2020-25668 CVE-2020-4788     CVE-2020-27830)

  - A flaw was found in the Linux kernel's implementation     of MIDI, where an attacker with a local account and the     permissions to issue ioctl commands to midi devices     could trigger a use-after-free issue. A write to this     specific memory while freed and before use causes the     flow of execution to change and possibly allow for     memory corruption or privilege escalation. The highest     threat from this vulnerability is to confidentiality,     integrity, as well as system (CVE-2020-27786)

  - In various methods of hid-multitouch.c, there is a     possible out of bounds write due to a missing bounds     check. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-162844689References: Upstream kernel(CVE-2020-0465)

  - In the nl80211_policy policy of nl80211.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with System execution privileges needed. User     interaction is not required for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-119770583(CVE-2020-27068)

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c,     there is a possible use after free due to a logic     error. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel(CVE-2020-0466)

  - In audit_free_lsm_field of auditfilter.c, there is a     possible bad kfree due to a logic error in     audit_data_to_entry. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-150693166References: Upstream     kernel(CVE-2020-0444)

  - No description is available for this     CVE.(CVE-2020-27815)

  - A flaw was found in the Linux kernel. The marvell wifi     driver could allow a local attacker to execute     arbitrary code via a long SSID value in     mwifiex_cmd_802_11_ad_hoc_start function. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-36158)

  - In create_pinctrl of core.c, there is a possible out of     bounds read due to a use after free. This could lead to     local information disclosure with no additional     execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-140550171(CVE-2020-0427)

  - In binder_release_work of binder.c, there is a possible     use-after-free due to improper locking. This could lead     to local escalation of privilege in the kernel with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-161151868References: N/A(CVE-2020-0423)

  - In drivers/target/target_core_xcopy.c in the Linux     kernel before 5.10.7, insufficient identifier checking     in the LIO SCSI target code can be used by remote     attackers to read or write files via directory     traversal in an XCOPY request, aka CID-2896c93811e3.
    For example, an attack can occur over a network if the     attacker has access to one iSCSI LUN. The attacker     gains control over file access because I/O operations     are proxied via an attacker-selected     backstore.(CVE-2020-28374)

  - A flaw in the way reply ICMP packets are limited in the     Linux kernel functionality was found that allows to     quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypassing source     port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)

  - Insufficient access control in the Linux kernel driver     for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via     local access.(CVE-2020-8694)

  - A flaw was found in the Linux kernel's futex     implementation. This flaw allows a local attacker to     corrupt system memory or escalate their privileges when     creating a futex on a filesystem that is about to be     unmounted. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system     availability.(CVE-2020-14381)

  - In tun_get_user of tun.c, there is possible memory     corruption due to a use after free. This could lead to     local escalation of privilege with System execution     privileges required. User interaction is not required     for exploitation. Product: Android Versions: Android     kernel Android ID: A-146554327.(CVE-2021-0342)

  - A flaw was found in the Linux kernel. A use-after-free     memory flaw in the Fast Userspace Mutexes functionality     allowing a local user to crash the system or escalate     their privileges on the system. The highest threat from     this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2021-3347)

  - A use after free flaw in the Linux kernel network block     device (NBD) subsystem was found in the way user calls     an ioctl NBD_SET_SOCK at a certain point during device     setup.(CVE-2021-3348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In create_pinctrl of core.c, there is a possible out of     bounds read due to a use after free. This could lead to     local information disclosure with no additional     execution privileges needed.(CVE-2020-0427)

  - NULL-ptr deref in the spk_ttyio_receive_buf2() function     in spk_ttyio.c.(CVE-2020-27830)

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c,     there is a possible use after free due to a logic     error. This could lead to local escalation of privilege     with no additional execution privileges     needed.(CVE-2020-0466)

  - In the nl80211_policy policy of nl80211.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with System execution privileges     needed.(CVE-2020-27068)

  - use-after-free read in sunkbd_reinit in     drivers/input/keyboard/sunkbd.c.(CVE-2020-25669)

  - A flaw was found in the Linux kernels implementation of     MIDI, where an attacker with a local account and the     permissions to issue an ioctl commands to midi devices,     could trigger a use-after-free. A write to this     specific memory while freed and before use could cause     the flow of execution to change and possibly allow for     memory corruption or privilege     escalation.(CVE-2020-27786)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - A locking issue was discovered in the tty subsystem of     the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free     attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)

  - An issue was discovered in     drivers/accessibility/speakup/spk_ttyio.c in the Linux     kernel through 5.9.9. Local attackers on systems with     the speakup driver could cause a local denial of     service attack, aka CID-d41227544427. This occurs     because of an invalid free when the line discipline is     used more than once.(CVE-2020-28941)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - A flaw in the way reply ICMP packets are limited in the     Linux kernel functionality was found that allows to     quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypassing source     port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)

  - race condition in fg_console can lead to use-after-free     in con_font_op.(CVE-2020-25668)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high     rate of events to dom0, aka     CID-e99502f76271.(CVE-2020-27673)

  - An issue was discovered in __split_huge_pmd in     mm/huge_memory.c in the Linux kernel before 5.7.5. The     copy-on-write implementation can grant unintended write     access because of a race condition in a THP mapcount     check, aka CID-c444eb564fb1.(CVE-2020-29368)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)

  - A flaw was found in the way RTAS handled memory     accesses in userspace to kernel communication. On a     locked down (usually due to Secure Boot) guest system     running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to     further increase their privileges to that of a running     kernel.(CVE-2020-27777)

  - There is a memory leak in     perf_event_parse_addr_filter.(CVE-2020-25704)

  - Insufficient access control in the Linux kernel driver     for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via     local access.(CVE-2020-8694)

  - A flaw was found in the Linux kernel. A use-after-free     was found in the way the console subsystem was using     ioctls KDGKBSENT and KDSKBSENT. A local user could use     this flaw to get read memory access out of bounds. The     highest threat from this vulnerability is to data     confidentiality.(CVE-2020-25656)

  - In kbd_keycode of keyboard.c, there is a possible out     of bounds write due to a missing bounds check. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-144161459(CVE-2020-0431)

  - A flaw was found in the HDLC_PPP module of the Linux     kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input     validation in the ppp_cp_parse_cr function which can     cause the system to crash or cause a denial of service.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25643)

  - A flaw was found in the Linux kernel in versions before     5.9-rc7. Traffic between two Geneve endpoints may be     unencrypted when IPsec is configured to encrypt traffic     for the specific UDP port used by the GENEVE tunnel     allowing anyone between the two endpoints to read the     traffic unencrypted. The main threat from this     vulnerability is to data     confidentiality.(CVE-2020-25645)

  - An information leak flaw was found in the way the Linux     kernel's Bluetooth stack implementation handled     initialization of stack memory when handling certain     AMP packets. A remote attacker in adjacent range could     use this flaw to leak small portions of stack memory on     the system by sending a specially crafted AMP packets.
    The highest threat from this vulnerability is to data     confidentiality.(CVE-2020-12352)

  - A flaw was found in the way the Linux kernel Bluetooth     implementation handled L2CAP packets with A2MP CID. A     remote attacker in adjacent range could use this flaw     to crash the system causing denial of service or     potentially execute arbitrary code on the system by     sending a specially crafted L2CAP packet. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-12351)

  - A missing CAP_NET_RAW check in NFC socket creation in     net/nfc/rawsock.c in the Linux kernel before 5.8.2     could be used by local attackers to create raw sockets,     bypassing security mechanisms, aka     CID-26896f01467a.(CVE-2020-26088)

  - A flaw was found in the Linux kernel's implementation     of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could     cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker     with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest     threat from this vulnerability is to system     availability.(CVE-2020-25641)

  - In skb_to_mamac of networking.c, there is a possible     out of bounds write due to an integer overflow. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-143560807(CVE-2020-0432)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/ nfs/ nfs4proc.c     instead of fs/ nfs/ nfs4xdr.c, aka     CID-b4487b935452..(CVE-2020-25212)

  - A flaw was found in the Linux kernel before 5.9-rc4. A     failure of the file system metadata validator in XFS     can cause an inode with a valid, user-creatable     extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise     rendered inaccessible until it is remounted, leading to     a denial of service. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14385)

  - In uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel(CVE-2020-0404)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - A race condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)

  - A memory out-of-bounds read flaw was found in the Linux     kernel before 5.9-rc2 with the ext3/ext4 file system,     in the way it accesses a directory with broken     indexing. This flaw allows a local user to crash the     system if the directory exists. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14314)

  - A flaw was found in the Linux kernel before 5.9-rc4.
    Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest     threat from this vulnerability is to data     confidentiality and integrity.(CVE-2020-14386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):An issue was discovered in
    __split_huge_pmd in mm/huge_memory.c in the Linux     kernel before 5.7.5. The copy-on-write implementation     can grant unintended write access because of a race     condition in a THP mapcount check, aka     CID-c444eb564fb1.(CVE-2020-29368)An issue was     discovered in kmem_cache_alloc_bulk in mm/slub.c in the     Linux kernel before 5.5.11. The slowpath lacks the     required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)An issue was     discovered in the Linux kernel before 5.2.6. On NUMA     systems, the Linux fair scheduler has a use-after-free     in show_numa_stats() because NUMA fault statistics are     inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)kernel:use-after-free     read in sunkbd_reinit in     drivers/input/keyboard/sunkbd.c(CVE-2020-25669)A buffer     over-read (at the framebuffer layer) in the fbcon code     in the Linux kernel before 5.8.15 could be used by     local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)IBM Power9 (AIX 7.1,     7.2, and VIOS 3.1) processors could allow a local user     to obtain sensitive information from the data in the L1     cache under extenuating circumstances. IBM X-Force ID:
    189296.(CVE-2020-4788)kernel: powerpc: RTAS calls can     be used to compromise kernel     integrity(CVE-2020-27777)There is a use-after-free in     kernel versions before 5.5 due to a race condition     between the release of ptp_clock and cdev while     resource deallocation. When a (high privileged) process     allocates a ptp device file (like /dev/ptpX) and     voluntarily goes to sleep. During this time if the     underlying device is removed, it can cause an     exploitable condition as the process wakes up to     terminate and clean all attached files. The system     crashes due to the cdev structure being invalid (as     already freed) which is pointed to by the     inode.(CVE-2020-10690)An issue was discovered in the     Linux kernel through 5.9.1, as used with Xen through     4.14.x. Guest OS users can cause a denial of service     (host OS hang) via a high rate of events to dom0, aka     CID-e99502f76271.(CVE-2020-27673)An issue was     discovered in the Linux kernel through 5.9.1, as used     with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)A flaw     memory leak in the Linux kernel performance monitoring     subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this     flaw to starve the resources causing denial of     service.(CVE-2020-25704)Insufficient access control in     the Linux kernel driver for some Intel(R) Processors     may allow an authenticated user to potentially enable     information disclosure via local     access.(CVE-2020-8694)kernel: race condition in     fg_console can lead to use-after-free in     con_font_op(CVE-2020-25668)A flaw in the way reply ICMP     packets are limited in the Linux kernel functionality     was found that allows to quickly scan open UDP ports.
    This flaw allows an off-path remote user to effectively     bypassing source port UDP randomization. The highest     threat from this vulnerability is to confidentiality     and possibly integrity, because software that relies on     UDP source port randomization are indirectly affected     as well. Kernel versions before 5.10 may be vulnerable     to this issue.(CVE-2020-25705)A slab-out-of-bounds read     in fbcon in the Linux kernel before 5.9.7 could be used     by local attackers to read privileged information or     potentially crash the kernel, aka CID-3c4e0dff2095.
    This occurs because KD_FONT_OP_COPY in     drivers/tty/vt/vt.c can be used for manipulations such     as font height.(CVE-2020-28974)A flaw was found in the     Linux kernel. A use-after-free was found in the way the     console subsystem was using ioctls KDGKBSENT and     KDSKBSENT. A local user could use this flaw to get read     memory access out of bounds. The highest threat from     this vulnerability is to data     confidentiality.(CVE-2020-25656)In kbd_keycode of     keyboard.c, there is a possible out of bounds write due     to a missing bounds check. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-144161459(CVE-2020-0431)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).

CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).

CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).

CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).

CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)

CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

CVE-2019-19039

'Team bobfuzzer' reported a bug in Btrfs that could lead to an assertion failure (WARN). A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash) if the panic_on_warn kernel parameter is set.

CVE-2019-19377

'Team bobfuzzer' reported a bug in Btrfs that could lead to a use-after-free. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2019-19770

The syzbot tool discovered a race condition in the block I/O tracer (blktrace) that could lead to a system crash. Since blktrace can only be controlled by privileged users, the security impact of this is unclear.

CVE-2019-19816

'Team bobfuzzer' reported a bug in Btrfs that could lead to an out-of-bounds write. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-0423

A race condition was discovered in the Android binder driver, that could result in a use-after-free. On systems using this driver, a local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-8694

Multiple researchers discovered that the powercap subsystem allowed all users to read CPU energy meters, by default. On systems using Intel CPUs, this provided a side channel that could leak sensitive information between user processes, or from the kernel to user processes. The energy meters are now readable only by root, by default.

This issue can be mitigated by running :

chmod go-r /sys/devices/virtual/powercap/*/*/energy_uj

This needs to be repeated each time the system is booted with an unfixed kernel version.

CVE-2020-14351

A race condition was discovered in the performance events subsystem, which could lead to a use-after-free. A local user permitted to access performance events could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2020-25656

Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with the CAP_SYS_TTY_CONFIG capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25668

Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25669

Bodong Zhao discovered a bug in the Sun keyboard driver (sunkbd) that could lead to a use-after-free. On a system using this driver, a local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25704

kiyin(&#x5C39;&#x4EAE;) discovered a potential memory leak in the performance events subsystem. A local user permitted to access performance events could use this to cause a denial of service (memory exhaustion).

Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2020-25705

Keyu Man reported that strict rate-limiting of ICMP packet transmission provided a side-channel that could help networked attackers to carry out packet spoofing. In particular, this made it practical for off-path networked attackers to 'poison' DNS caches with spoofed responses ('SAD DNS' attack).

This issue has been mitigated by randomising whether packets are counted against the rate limit.

CVE-2020-27673 / XSA-332

Julien Grall from Arm discovered a bug in the Xen event handling code.
Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (excessive CPU usage or hang) in dom0.

CVE-2020-27675 / XSA-331

Jinoh Kang of Theori discovered a race condition in the Xen event handling code. Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (crash) in dom0.

CVE-2020-28941

Shisong Qin and Bodong Zhao discovered a bug in the Speakup screen reader subsystem. Speakup assumed that it would only be bound to one terminal (tty) device at a time, but did not enforce this. A local user could exploit this bug to cause a denial of service (crash or memory exhaustion).

CVE-2020-28974

Yuan Ming discovered a bug in the virtual terminal (vt) driver that could lead to an out-of-bounds read. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could possibly use this to obtain sensitive information from the kernel or to cause a denial of service (crash).

The specific ioctl operation affected by this bug (KD_FONT_OP_COPY) has been disabled, as it is not believed that any programs depended on it.

For Debian 9 stretch, these problems have been fixed in version 4.19.160-2~deb9u1.

We recommend that you upgrade your linux-4.19 packages.

For the detailed security status of linux-4.19 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux-4.19

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4936-1 advisory.

  - A potential vulnerability in the AMD extension to Linux hwmon service may allow an attacker to use the     Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line     with industry partners, AMD has updated the RAPL interface to require privileged access. (CVE-2020-12912)

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5917 advisory.

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
143132	OracleVM 3.4：microcode_ctl（OVMSA-2020-0053）	Nessus	OracleVM Local Security Checks	2020/11/20	2024/2/8	medium
143589	Amazon Linux 2：カーネル（ALAS-2020-1566）	Nessus	Amazon Linux Local Security Checks	2020/12/9	2024/2/6	high
146282	openSUSEセキュリティ更新プログラム：RTカーネル（openSUSE-2021-242）	Nessus	SuSE Local Security Checks	2021/2/8	2023/2/9	critical
186520	SUSE SLES12 セキュリティ更新プログラム: containerd、docker、runc (SUSE-SU-2023:4625-1)	Nessus	SuSE Local Security Checks	2023/12/2	2023/12/2	medium
142868	Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2020-5923)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/1/16	medium
142869	Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2020-5924)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/1/16	medium
147588	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2021-1386)	Nessus	Huawei Local Security Checks	2021/3/10	2023/2/9	critical
147690	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2021-1642)	Nessus	Huawei Local Security Checks	2021/3/11	2023/2/9	critical
144168	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-2514)	Nessus	Huawei Local Security Checks	2020/12/14	2024/2/2	high
143875	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:3532-1)	Nessus	SuSE Local Security Checks	2020/12/9	2022/12/5	high
144097	Debian DLA-2483-1 : linux-4.19 security update	Nessus	Debian Local Security Checks	2020/12/11	2024/2/2	high
187143	SUSE SLES15 / openSUSE 15 Security Update : docker, rootlesskit (SUSE-SU-2023:4936-1)	Nessus	SuSE Local Security Checks	2023/12/21	2023/12/21	medium
180919	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5917)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2023/9/7	medium

偵測

搜尋 Plugin

medium

high

critical

medium

medium

medium

critical

critical

high

high

high

medium

medium