リモートのAlmaLinux 8ホストには、ALSA-2021:1578アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - 5.3.9 までの Linux カーネルにおける sound/soc/sof/ipc.c の sof_set_get_large_ctrl_data() 関数でのメモリリークにより、攻撃者はsof_get_ctrl_copy_params() 障害をトリガーすることによって、サービス拒否 (メモリ消費) を引き起こすこします (別名 CID-45c1380358b1)。(CVE-2019-18811) 

  - 5.3.7 より前の Linux カーネルにおいて、drivers/usb/misc/adutux.c ドライバーの悪意のある USB デバイスによって引き起こされるメモリ解放後使用(Use After Free) のバグがあります (別名 CID-44efc269db79)。(CVE-2019-19523)

  -5.3.7より前のLinuxカーネルにおいて、drivers/usb/misc/iowarrior.cドライバーの悪意のあるUSBデバイスによって引き起こされるメモリ解放後使用（Use After Free）のバグがあります（別名CID-edc4746f253d）。（CVE-2019-19528）

  -keyboard.cのkbd_keycodeでは、境界チェックが欠落しているために領域外書き込みが発生する可能性があります。これにより、追加の実行権限が不要になり、ローカルで権限が昇格される可能性があります。悪用にユーザーインタラクションは必要ありません。製品AndroidバージョンAndroidカーネルAndroid IDA-144161459CVE-2020-0431

  -5.6.1より前のLinuxカーネルで問題が発見されました。drivers/media/usb/gspca/ov519.cでは、ゼロエンドポイントがある場合にov511_mode_init_regsおよびov518_mode_init_regsでNULLポインターデリファレンスが引き起こされます。(別名CID-998912346c0d)。(CVE-2020-11608)

  -Linuxのカーネルで4.4.221より前の4.4.x、4.9.221より前の4.9.x、4.14.178より前の4.14.x、4.19.119より前の4.19.x、および5.3より前の5.xにおける、fs/namespace.cのpivot_rootの競合状態により、ローカルユーザーがマウントポイント参照カウンターの破損により、サービス拒否（panic）を引き起こします。（CVE-2020-12114）

  -バージョン26.20.100.7212より前、および Linux カーネルバージョン5.5より前の、Intel(R) Graphics Drivers for Windows *の一部のファームウェアにおける整数オーバーフローにより、特権ユーザーがローカルアクセスを介して、権限昇格を有効化する可能性があります。(CVE-2020-12362)

  - バージョン26.20.100.7212より前、および Linux カーネルバージョン5.5より前の、一部のIntel(R) Graphics Drivers for Windows *の入力検証が不適切なため、特権ユーザーがローカルアクセスを介して、サービス拒否を引き起こす可能性があります。(CVE-2020-12363) 　　

  - バージョン26.20.100.7212より前、およびLinuxカーネルバージョン5.5より前の、一部のIntel(R) Graphics Drivers for Windows *のNULL ポインターリファレンスのため、特権ユーザーがローカルアクセスを介して、サービス拒否を引き起こす可能性があります。(CVE-2020-12364)

  - 転送が参照することなく発生するため、5.6.8より前のLinuxカーネル内のdrivers/usb/core/message.cのusb_sg_cancelにメモリ解放後使用（Use After Free）があります。（別名CID-056ad39ee925）（CVE-2020-12464）

  - ext3/ext4ファイルシステムを使用する5.9-rc2より前のLinuxカーネルに、破損しているインデックスでディレクトリにアクセスすることによるメモリ領域外読み取りの欠陥が見つかりました。この欠陥により、そのディレクトリが存在する場合、ローカルユーザーがシステムをクラッシュさせる可能性があります。この脆弱性が最大の脅威となるのは、システムの可用性です。
    （CVE-2020-14314）

  - 5.7.10以前のバージョンのLinuxカーネルcgroupv2サブシステムで、システムを再起動するときの方法において、NULLポインターデリファレンスの欠陥が見つかりました。ローカルユーザーはこの欠陥を利用して、システムをクラッシュしたり、システム上で権限を昇格したりする可能性があります。(CVE-2020-14356)

  - バージョン 5.8 より前の Linux カーネルは、drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() の NULL ポインターデリファレンスに脆弱です。これにより、ローカルユーザーが、初期化されていない。CVE-2020-15437

  -5.7.8より前の Linux カーネルでは、ファイルシステムに ACL サポートがない場合に、fs/nfsd/vfs.c (NFS サーバー内) が新しいファイルシステムオブジェクトに不適切なアクセス許可を設定する可能性があります (別名 CID-22cf8419f131)。これは、現在の umask が考慮されないために発生します。(CVE-2020-24394)

  - 5.8.3より以前のLinuxカーネルにおいて、NFSクライアントコードにあるTOCTOUの不一致は、サイズチェックがfs/nfs/nfs4xdr.cではなくfs/nfs/nfs4proc.cで行われるため、ローカルの攻撃者がメモリを破損させたり、詳細不明なその他の影響を与えたりするために使用されます（別名CID-b4487b935452）。（CVE-2020-25212）

  -5.8.9までのLinuxカーネル内のdrivers/block/rbd.cにおけるRBDブロックデバイスドライバが、RBDブロックデバイスをマップまたはマップ解除するローカル攻撃者によって利用することができたRBDデバイスへのアクセスをチェックし、不完全な許可を使用しました（別名CID-f44d04e696fe）。（CVE-2020-25284）

  - 5.8.8より前のLinuxカーネルにおけるmm/hugetlb.cでhugetlb sysctlハンドラー間の競合状態がローカルの攻撃者によって使用されると、メモリの破損が発生し、NULLポインターデリファレンスや、特定されない他の影響を引き起こす可能性があります。 (CVE-2020-25285)

  -5.9-rc7以前のバージョンのLinuxカーネルのHDLC_PPPモジュールに欠陥が見つかりました。メモリ破損と読み取りオーバーフローは、ppp_cp_parse_cr関数の不適切な入力検証によって引き起こされ、システムをクラッシュさせたり、サービス拒否を引き起こされたりする可能性があります。この脆弱性が最大の脅威となるのは、データの機密性と整合性、ならびにシステムの可用性です。(CVE-2020-25643) 

  - PERF_EVENT_IOC_SET_FILTERを使用している場合に、Linux カーネルパフォーマンス監視サブシステムのメモリリークの欠陥があることが確認されました。ローカルユーザーがこの欠陥を利用してリソースを枯渇させ、サービス拒否を引き起こす可能性があります。(CVE-2020-25704)

  - MIDI の Linux カーネルの実装に欠陥が見つかりました。このため、ローカルアカウントと、midi デバイスに対して ioctl コマンドを発行する権限を持つ攻撃者が、メモリ解放後使用（Use After Free）の問題を発生させる可能性があります。解放中および使用前のこの特定のメモリへの書き込みにより、実行のフローが変化し、メモリの破損や権限昇格が引き起こされます。この脆弱性が最大の脅威となるのは、機密性と整合性、ならびにシステムの可用性です。(CVE-2020-27786)

  - ユーザーがdevファイルとforkを開いた後にIoctlを呼び出す方法において、5.10-rc6より前のバージョンのLinux カーネルinfiniband hfi1ドライバーのUse-After-Freeが見つかりました。ローカルユーザーがこの欠陥を使用して、システムをクラッシュする可能性があります。
    (CVE-2020-27835)

  - ローカルの攻撃者が5.9.7以前のLinux カーネルのfbconにおけるスラブ領域外書き込みを使用して、特権情報を読み取るか、カーネル (別名：CID-3c4e0dff2095) のクラッシュを引き起こす可能性があります。これは、drivers/tty/vt/vt.cのKD_FONT_OP_COPYをフォントの高さなどの操作に使用できるために発生します。(CVE-2020-28974)

  -シグナルハンドラーをフィルタリング中のLinuxカーネルの子/親プロセスの識別処理において、競合状態およびプロセスIDの不適切な初期化という欠陥の可能性が見つかりました。ローカルの攻撃者がこの欠陥を悪用してチェックをバイパスし、権限のあるプロセスに信号を送信する可能性があります。（CVE-2020-35508）

  - 5.10.6より前の Linux カーネルにおける FUSE ファイルシステムの実装で問題が発見されました (別名 CID-5d069dbe8aaf.)。fuse_do_getattr() が、不適切な状況で、make_bad_inode() を呼び出し、システムクラッシュを引き起こします。注意: この脆弱性に対する元の修正は不完全であり、その不完全性は CVE-2021-28950として追跡されています。(CVE-2020-36322)

  -tun.cのtun_get_userで、メモリ解放後使用（Use-After-Free）によるメモリ破損の可能性があります。これにより、システム実行権限が必要なローカルでの権限昇格が引き起こされる可能性があります。悪用するのに、ユーザーの操作を必要としません。製品: Android。バージョン Android カーネルAndroid ID: A-146554327。CVE-2021-0342

  - af_key.c の pfkey_dump には、境界チェックの欠落による、領域外読み取りの可能性があります。これにより、カーネルでシステム実行権限が必要なローカルでの情報漏洩が引き起こされる可能性があります。悪用にユーザーインタラクションは必要ありません。製品AndroidバージョンAndroidカーネルAndroid IDA-110373476CVE-2021-0605

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12114: Fixed A pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2019-2182     Hanjun Guo and Lei Li reported a race condition in the     arm64 virtual memory management code, which could lead     to an information disclosure, denial of service (crash),     or possibly privilege escalation.

  - CVE-2019-5108     Mitchell Frank of Cisco discovered that when the IEEE     802.11 (WiFi) stack was used in AP mode with roaming, it     would trigger roaming for a newly associated station     before the station was authenticated. An attacker within     range of the AP could use this to cause a denial of     service, either by filling up a switching table or by     redirecting traffic away from other stations.

  - CVE-2019-19319     Jungyeon discovered that a crafted filesystem can cause     the ext4 implementation to deallocate or reallocate     journal blocks. A user permitted to mount filesystems     could use this to cause a denial of service (crash), or     possibly for privilege escalation.

  - CVE-2019-19462     The syzbot tool found a missing error check in the     'relay' library used to implement various files under     debugfs. A local user permitted to access debugfs could     use this to cause a denial of service (crash) or     possibly for privilege escalation.

  - CVE-2019-19768     Tristan Madani reported a race condition in the blktrace     debug facility that could result in a use-after-free. A     local user able to trigger removal of block devices     could possibly use this to cause a denial of service     (crash) or for privilege escalation.

  - CVE-2019-20806     A potential NULL pointer dereference was discovered in     the tw5864 media driver. The security impact of this is     unclear.

  - CVE-2019-20811     The Hulk Robot tool found a reference-counting bug in an     error path in the network subsystem. The security impact     of this is unclear.

  - CVE-2020-0543     Researchers at VU Amsterdam discovered that on some     Intel CPUs supporting the RDRAND and RDSEED     instructions, part of a random value generated by these     instructions may be used in a later speculative     execution on any core of the same physical CPU.
    Depending on how these instructions are used by     applications, a local user or VM guest could use this to     obtain sensitive information such as cryptographic keys     from other users or VMs.

  This vulnerability can be mitigated by a microcode update, either as   part of system firmware (BIOS) or through the intel-microcode   package in Debian's non-free archive section. This kernel update   only provides reporting of the vulnerability and the option to   disable the mitigation if it is not needed.

  - CVE-2020-2732     Paulo Bonzini discovered that the KVM implementation for     Intel processors did not properly handle instruction     emulation for L2 guests when nested virtualization is     enabled. This could allow an L2 guest to cause privilege     escalation, denial of service, or information leaks in     the L1 guest.

  - CVE-2020-8428     Al Viro discovered a potential use-after-free in the     filesystem core (vfs). A local user could exploit this     to cause a denial of service (crash) or possibly to     obtain sensitive information from the kernel.

  - CVE-2020-8647, CVE-2020-8649     The Hulk Robot tool found a potential MMIO out-of-bounds     access in the vgacon driver. A local user permitted to     access a virtual terminal (/dev/tty1 etc.) on a system     using the vgacon driver could use this to cause a denial     of service (crash or memory corruption) or possibly for     privilege escalation.

  - CVE-2020-8648     The syzbot tool found a race condition in the the     virtual terminal driver, which could result in a     use-after-free. A local user permitted to access a     virtual terminal could use this to cause a denial of     service (crash or memory corruption) or possibly for     privilege escalation.

  - CVE-2020-9383     Jordy Zomer reported an incorrect range check in the     floppy driver which could lead to a static out-of-bounds     access. A local user permitted to access a floppy drive     could use this to cause a denial of service (crash or     memory corruption) or possibly for privilege escalation.

  - CVE-2020-10711     Matthew Sheets reported NULL pointer dereference issues     in the SELinux subsystem while receiving CIPSO packet     with null category. A remote attacker can take advantage     of this flaw to cause a denial of service (crash). Note     that this issue does not affect the binary packages     distributed in Debian as CONFIG_NETLABEL is not enabled.

  - CVE-2020-10732     An information leak of kernel private memory to     userspace was found in the kernel's implementation of     core dumping userspace processes.

  - CVE-2020-10751     Dmitry Vyukov reported that the SELinux subsystem did     not properly handle validating multiple messages, which     could allow a privileged attacker to bypass SELinux     netlink restrictions.

  - CVE-2020-10757     Fan Yang reported a flaw in the way mremap handled DAX     hugepages, allowing a local user to escalate their     privileges

  - CVE-2020-10942     It was discovered that the vhost_net driver did not     properly validate the type of sockets set as back-ends.
    A local user permitted to access /dev/vhost-net could     use this to cause a stack corruption via crafted system     calls, resulting in denial of service (crash) or     possibly privilege escalation.

  - CVE-2020-11494     It was discovered that the slcan (serial line CAN)     network driver did not fully initialise CAN headers for     received packets, resulting in an information leak from     the kernel to user-space or over the CAN network.

  - CVE-2020-11565     Entropy Moe reported that the shared memory filesystem     (tmpfs) did not correctly handle an 'mpol' mount option     specifying an empty node list, leading to a stack-based     out-of-bounds write. If user namespaces are enabled, a     local user could use this to cause a denial of service     (crash) or possibly for privilege escalation.

  - CVE-2020-11608, CVE-2020-11609, CVE-2020-11668     It was discovered that the ov519, stv06xx, and     xirlink_cit media drivers did not properly validate USB     device descriptors. A physically present user with a     specially constructed USB device could use this to cause     a denial-of-service (crash) or possibly for privilege     escalation.

  - CVE-2020-12114     Piotr Krysiuk discovered a race condition between the     umount and pivot_root operations in the filesystem core     (vfs). A local user with the CAP_SYS_ADMIN capability in     any user namespace could use this to cause a denial of     service (crash).

  - CVE-2020-12464     Kyungtae Kim reported a race condition in the USB core     that can result in a use-after-free. It is not clear how     this can be exploited, but it could result in a denial     of service (crash or memory corruption) or privilege     escalation.

  - CVE-2020-12652     Tom Hatskevich reported a bug in the mptfusion storage     drivers. An ioctl handler fetched a parameter from user     memory twice, creating a race condition which could     result in incorrect locking of internal data structures.
    A local user permitted to access /dev/mptctl could use     this to cause a denial of service (crash or memory     corruption) or for privilege escalation.

  - CVE-2020-12653     It was discovered that the mwifiex WiFi driver did not     sufficiently validate scan requests, resulting a     potential heap buffer overflow. A local user with     CAP_NET_ADMIN capability could use this to cause a     denial of service (crash or memory corruption) or     possibly for privilege escalation.

  - CVE-2020-12654     It was discovered that the mwifiex WiFi driver did not     sufficiently validate WMM parameters received from an     access point (AP), resulting a potential heap buffer     overflow. A malicious AP could use this to cause a     denial of service (crash or memory corruption) or     possibly to execute code on a vulnerable system.

  - CVE-2020-12770     It was discovered that the sg (SCSI generic) driver did     not correctly release internal resources in a particular     error case. A local user permitted to access an sg     device could possibly use this to cause a denial of     service (resource exhaustion).

  - CVE-2020-13143     Kyungtae Kim reported a potential heap out-of-bounds     write in the USB gadget subsystem. A local user     permitted to write to the gadget configuration     filesystem could use this to cause a denial of service     (crash or memory corruption) or potentially for     privilege escalation.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A stack information leak flaw was found in s390/s390x     in the Linux kernel's memory manager functionality,     where it incorrectly writes to the     /proc/sys/vm/cmm_timeout file. This flaw allows a local     user to see the kernel data.(CVE-2020-10773)

  - In the Android kernel in the video driver there is a     use after free due to a race condition. This could lead     to local escalation of privilege with no additional     execution privileges needed. User interaction is not     needed for exploitation.(CVE-2019-9458)

  - An issue was discovered in the Linux kernel before     5.2.6. On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - An out-of-bounds memory write flaw was found in how the     Linux kernel's Voice Over IP H.323 connection tracking     functionality handled connections on ipv6 port 1720.
    This flaw allows an unauthenticated remote user to     crash the system, causing a denial of service. The     highest threat from this vulnerability is to     confidentiality, integrity, as well as system     availability.(CVE-2020-14305)

  - A locking issue was discovered in the tty subsystem of     the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free     attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - Use-after-free vulnerability in fs/block_dev.c in the     Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging     improper access to a certain error     field.(CVE-2020-15436)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

  - An issue was discovered in kmem_cache_alloc_bulk in     mm/slub.c in the Linux kernel before 5.5.11. The     slowpath lacks the required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)

  - A flaw was found in the Linux kernel. A use-after-free     memory flaw was found in the perf subsystem allowing a     local attacker with permission to monitor perf events     to corrupt memory and possibly escalate privileges. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - Improper access control in BlueZ may allow an     unauthenticated user to potentially enable information     disclosure via adjacent access.(CVE-2020-12352)

  - In cdev_get of char_dev.c, there is a possible     use-after-free due to a race condition. This could lead     to local escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions:
    Android-10Android ID: A-153467744(CVE-2020-0305)

  - A flaw was found in the HDLC_PPP module of the Linux     kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input     validation in the ppp_cp_parse_cr function which can     cause the system to crash or cause a denial of service.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25643)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. The privileged user 'root' with CAP_NET_ADMIN     can create a CAN frame modification rule that makes the     data length code a higher value than the available CAN     frame data size. In combination with a configured     checksum calculation where the result is stored     relatively to the end of the data (e.g.
    cgw_csum_xor_rel) the tail of the skb (e.g. frag_list     pointer in skb_shared_info) can be rewritten which     finally can cause a system crash. Because of a missing     check, the CAN drivers may write arbitrary content     beyond the data registers in the CAN controller's I/O     memory when processing can-gw manipulated outgoing     frames.(CVE-2019-3701)

  - In the Android kernel in Pixel C USB monitor driver     there is a possible OOB write due to a missing bounds     check. This could lead to local escalation of privilege     with System execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2019-9456)

  - A pivot_root race condition in fs/ namespace.c in the     Linux kernel 4.4.x before 4.4.221, 4.9.x before     4.9.221, 4.14.x before 4.14.178, 4.19.x before     4.19.119, and 5.x before 5.3 allows local users to     cause a denial of service (panic) by corrupting a     mountpoint reference counter.(CVE-2020-12114)

  - A flaw was found in the Linux kernel in versions before     5.9-rc7. Traffic between two Geneve endpoints may be     unencrypted when IPsec is configured to encrypt traffic     for the specific UDP port used by the GENEVE tunnel     allowing anyone between the two endpoints to read the     traffic unencrypted. The main threat from this     vulnerability is to data     confidentiality.(CVE-2020-25645)

  - In kbd_keycode of keyboard.c, there is a possible out     of bounds write due to a missing bounds check. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-144161459(CVE-2020-0431)

  - In blk_mq_queue_tag_busy_iter of blk-mq-tag.c, there is     a possible use after free due to improper locking. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-151939299(CVE-2020-0433)

  - In the Linux kernel through 5.8.7, local attackers able     to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering     use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/ netfilter/     nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)

  - A memory out-of-bounds read flaw was found in the Linux     kernel before 5.9-rc2 with the ext3/ext4 file system,     in the way it accesses a directory with broken     indexing. This flaw allows a local user to crash the     system if the directory exists. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14314)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/ nfs/ nfs4proc.c     instead of fs/ nfs/ nfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - A race condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)

  - A flaw was found in the Linux kernel before 5.9-rc4.
    Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest     threat from this vulnerability is to data     confidentiality and integrity.(CVE-2020-14386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2019-2182

Hanjun Guo and Lei Li reported a race condition in the arm64 virtual memory management code, which could lead to an information disclosure, denial of service (crash), or possibly privilege escalation.

CVE-2019-5108

Mitchell Frank of Cisco discovered that when the IEEE 802.11 (WiFi) stack was used in AP mode with roaming, it would trigger roaming for a newly associated station before the station was authenticated. An attacker within range of the AP could use this to cause a denial of service, either by filling up a switching table or by redirecting traffic away from other stations.

CVE-2019-19319

Jungyeon discovered that a crafted filesystem can cause the ext4 implementation to deallocate or reallocate journal blocks. A user permitted to mount filesystems could use this to cause a denial of service (crash), or possibly for privilege escalation.

CVE-2019-19462

The syzbot tool found a missing error check in the 'relay' library used to implement various files under debugfs. A local user permitted to access debugfs could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2019-19768

Tristan Madani reported a race condition in the blktrace debug facility that could result in a use-after-free. A local user able to trigger removal of block devices could possibly use this to cause a denial of service (crash) or for privilege escalation.

CVE-2019-20806

A potential NULL pointer dereference was discovered in the tw5864 media driver. The security impact of this is unclear.

CVE-2019-20811

The Hulk Robot tool found a reference-counting bug in an error path in the network subsystem. The security impact of this is unclear.

CVE-2020-0543

Researchers at VU Amsterdam discovered that on some Intel CPUs supporting the RDRAND and RDSEED instructions, part of a random value generated by these instructions may be used in a later speculative execution on any core of the same physical CPU. Depending on how these instructions are used by applications, a local user or VM guest could use this to obtain sensitive information such as cryptographic keys from other users or VMs.

This vulnerability can be mitigated by a microcode update, either as part of system firmware (BIOS) or through the intel-microcode package in Debian's non-free archive section. This kernel update only provides reporting of the vulnerability and the option to disable the mitigation if it is not needed.

CVE-2020-2732

Paulo Bonzini discovered that the KVM implementation for Intel processors did not properly handle instruction emulation for L2 guests when nested virtualization is enabled. This could allow an L2 guest to cause privilege escalation, denial of service, or information leaks in the L1 guest.

CVE-2020-8428

Al Viro discovered a potential use-after-free in the filesystem core (vfs). A local user could exploit this to cause a denial of service (crash) or possibly to obtain sensitive information from the kernel.

CVE-2020-8647, CVE-2020-8649

The Hulk Robot tool found a potential MMIO out-of-bounds access in the vgacon driver. A local user permitted to access a virtual terminal (/dev/tty1 etc.) on a system using the vgacon driver could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-8648

The syzbot tool found a race condition in the the virtual terminal driver, which could result in a use-after-free. A local user permitted to access a virtual terminal could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-9383

Jordy Zomer reported an incorrect range check in the floppy driver which could lead to a static out-of-bounds access. A local user permitted to access a floppy drive could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-10711

Matthew Sheets reported NULL pointer dereference issues in the SELinux subsystem while receiving CIPSO packet with null category. A remote attacker can take advantage of this flaw to cause a denial of service (crash). Note that this issue does not affect the binary packages distributed in Debian as CONFIG_NETLABEL is not enabled.

CVE-2020-10732

An information leak of kernel private memory to userspace was found in the kernel's implementation of core dumping userspace processes.

CVE-2020-10751

Dmitry Vyukov reported that the SELinux subsystem did not properly handle validating multiple messages, which could allow a privileged attacker to bypass SELinux netlink restrictions.

CVE-2020-10757

Fan Yang reported a flaw in the way mremap handled DAX hugepages, allowing a local user to escalate their privileges

CVE-2020-10942

It was discovered that the vhost_net driver did not properly validate the type of sockets set as back-ends. A local user permitted to access /dev/vhost-net could use this to cause a stack corruption via crafted system calls, resulting in denial of service (crash) or possibly privilege escalation.

CVE-2020-11494

It was discovered that the slcan (serial line CAN) network driver did not fully initialise CAN headers for received packets, resulting in an information leak from the kernel to user-space or over the CAN network.

CVE-2020-11565

Entropy Moe reported that the shared memory filesystem (tmpfs) did not correctly handle an 'mpol' mount option specifying an empty node list, leading to a stack-based out-of-bounds write. If user namespaces are enabled, a local user could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2020-11608, CVE-2020-11609, CVE-2020-11668

It was discovered that the ov519, stv06xx, and xirlink_cit media drivers did not properly validate USB device descriptors. A physically present user with a specially constructed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2020-12114

Piotr Krysiuk discovered a race condition between the umount and pivot_root operations in the filesystem core (vfs). A local user with the CAP_SYS_ADMIN capability in any user namespace could use this to cause a denial of service (crash).

CVE-2020-12464

Kyungtae Kim reported a race condition in the USB core that can result in a use-after-free. It is not clear how this can be exploited, but it could result in a denial of service (crash or memory corruption) or privilege escalation.

CVE-2020-12652

Tom Hatskevich reported a bug in the mptfusion storage drivers. An ioctl handler fetched a parameter from user memory twice, creating a race condition which could result in incorrect locking of internal data structures. A local user permitted to access /dev/mptctl could use this to cause a denial of service (crash or memory corruption) or for privilege escalation.

CVE-2020-12653

It was discovered that the mwifiex WiFi driver did not sufficiently validate scan requests, resulting a potential heap buffer overflow. A local user with CAP_NET_ADMIN capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-12654

It was discovered that the mwifiex WiFi driver did not sufficiently validate WMM parameters received from an access point (AP), resulting a potential heap buffer overflow. A malicious AP could use this to cause a denial of service (crash or memory corruption) or possibly to execute code on a vulnerable system.

CVE-2020-12770

It was discovered that the sg (SCSI generic) driver did not correctly release internal resources in a particular error case. A local user permitted to access an sg device could possibly use this to cause a denial of service (resource exhaustion).

CVE-2020-13143

Kyungtae Kim reported a potential heap out-of-bounds write in the USB gadget subsystem. A local user permitted to write to the gadget configuration filesystem could use this to cause a denial of service (crash or memory corruption) or potentially for privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 4.9.210-1+deb9u1~deb8u1. This version also fixes some related bugs that do not have their own CVE IDs, and a regression in the macvlan driver introduced in the previous security update (bug #952660).

We recommend that you upgrade your linux-4.9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's implementation     of GRO. This flaw allows an attacker with local access     to crash the system.(CVE-2020-10720)

  - A NULL pointer dereference flaw was found in the Linux     kernel's SELinux subsystem. This flaw occurs while     importing the Commercial IP Security Option (CIPSO)     protocol's category bitmap into the SELinux extensible     bitmap via the' ebitmap_netlbl_import' routine. While     processing the CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security     attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue     leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This     flaw allows a remote network user to crash the system     kernel, resulting in a denial of     service.(CVE-2020-10711)

  - A signal access-control issue was discovered in the     Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
    Because exec_id in include/linux/sched.h is only 32     bits, an integer overflow can interfere with a     do_notify_parent protection mechanism. A child process     can send an arbitrary signal to a parent process in a     different security domain. Exploitation limitations     include the amount of elapsed time before an integer     overflow occurs, and the lack of scenarios where     signals to a parent process present a substantial     operational threat.(CVE-2020-12826)

  - An issue was discovered in the Linux kernel before     5.4.17. drivers/spi/spi-dw.c allows attackers to cause     a panic via concurrent calls to dw_spi_irq and     dw_spi_transfer_one, aka     CID-19b61392c5a8.(CVE-2020-12769)

  - An issue was discovered in the Linux kernel through     5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka     CID-83c6f2390040.(CVE-2020-12770)

  - An issue was discovered in the Linux kernel through     5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c     has a deadlock if a coalescing operation     fails.(CVE-2020-12771)

  - The __mptctl_ioctl function in     drivers/message/fusion/mptctl.c in the Linux kernel     before 5.4.14 allows local users to hold an incorrect     lock during the ioctl operation and trigger a race     condition, i.e., a 'double fetch' vulnerability, aka     CID-28d76df18f0a. NOTE: the vendor states 'The security     impact of this bug is not as bad as it could have been     because these operations are all privileged and root     already has enormous destructive     power.'(CVE-2020-12652)

  - An issue was discovered in xfs_agf_verify in     fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through     5.6.10. Attackers may trigger a sync of excessive     duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767.(CVE-2020-12655)

  - A pivot_root race condition in fs amespace.c in the     Linux kernel 4.4.x before 4.4.221, 4.9.x before     4.9.221, 4.14.x before 4.14.178, 4.19.x before     4.19.119, and 5.x before 5.3 allows local users to     cause a denial of service (panic) by corrupting a     mountpoint reference counter.(CVE-2020-12114)

  - An issue was discovered in the Linux kernel before     5.6.5. There is a use-after-free in block/bfq-iosched.c     related to bfq_idle_slice_timer_body.(CVE-2020-12657)

  - usb_sg_cancel in drivers/usb/core/message.c in the     Linux kernel before 5.6.8 has a use-after-free because     a transfer occurs without a reference, aka     CID-056ad39ee925.(CVE-2020-12464)

  - An issue was found in Linux kernel before 5.5.4. The     mwifiex_cmd_append_vsie_tlv() function in drivers     et/wireless/marvell/mwifiex/scan.c allows local users     to gain privileges or cause a denial of service because     of an incorrect memcpy and buffer overflow, aka     CID-b70261a288ea.(CVE-2020-12653)

  - gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c     in the rpcsec_gss_krb5 implementation in the Linux     kernel through 5.6.10 lacks certain domain_release     calls, leading to a memory leak.(CVE-2020-12656)

  - An issue was discovered in the Linux kernel before     5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an     out-of-bounds write (by a user with the CAP_NET_ADMIN     capability) because of a lack of headroom     validation.(CVE-2020-12659)

  - An array overflow was discovered in mt76_add_fragment     in drivers et/wireless/mediatek/mt76/dma.c in the Linux     kernel before 5.5.10, aka CID-b102f0c522cf. An     oversized packet with too many rx fragments can corrupt     memory of adjacent pages.(CVE-2020-12465)

  - An issue was found in Linux kernel before 5.5.4.
    mwifiex_ret_wmm_get_status() in drivers     et/wireless/marvell/mwifiex/wmm.c allows a remote AP to     trigger a heap-based buffer overflow because of an     incorrect memcpy, aka CID-3a9b153c5591.(CVE-2020-12654)

  - In the Linux kernel through 5.6.7 on the s390 platform,     code execution may occur because of a race condition,     as demonstrated by code in enable_sacf_uaccess in     arch/s390/lib/uaccess.c that fails to protect against a     concurrent page table upgrade, aka CID-3f777e19d171. A     crash could also occur.(CVE-2020-11884)

  - relay_open in kernel/relay.c in the Linux kernel     through 5.4.1 allows local users to cause a denial of     service (such as relay blockage) by triggering a NULL     alloc_percpu result.(CVE-2019-19462)

  - In the Linux kernel 5.0.21, mounting a crafted btrfs     filesystem image, performing some operations, and     unmounting can lead to a use-after-free in     btrfs_queue_work in     fs/btrfs/async-thread.c.(CVE-2019-19377)

  - In the Linux kernel before 5.5.8, get_raw_socket in     drivers/vhost et.c lacks validation of an sk_family     field, which might allow attackers to trigger kernel     stack corruption via crafted system     calls.(CVE-2020-10942)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4391-1 advisory.

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     setxattr operations in some situations. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2019-19319)

    It was discovered that memory contents previously stored in microarchitectural special registers after     RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly     exposed to processes on the same or different processor cores. A local attacker could use this to expose     sensitive information. (CVE-2020-0543)

    Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)

    It was discovered that the USB susbsystem's scatter-gather implementation in the Linux kernel did not     properly take data references in some situations, leading to a use-after-free. A physically proximate     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2020-12464)

    It was discovered that the DesignWare SPI controller driver in the Linux kernel contained a race     condition. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2020-12769)

    It was discovered that the exit signaling implementation in the Linux kernel contained an integer     overflow. A local attacker could use this to cause a denial of service (arbitrary application crash).
    (CVE-2020-12826)

    Xiumei Mu discovered that the IPSec implementation in the Linux kernel did not properly encrypt IPv6     traffic in some situations. An attacker could use this to expose sensitive information. (CVE-2020-1749)

    Dmitry Vyukov discovered that the SELinux netlink security hook in the Linux kernel did not validate     messages in some situations. A privileged attacker could use this to bypass SELinux netlink restrictions.
    (CVE-2020-10751)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12768: Fixed a memory leak in svm_cpu_uninit in arch/x86/kvm/svm.c (bsc#1171736).

CVE-2020-12659: Fixed an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) due to improper headroom validation (bsc#1171214).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20806: Fixed a NULL pointer dereference which may had lead to denial of service (bsc#1172199).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12768: Fixed a memory leak in svm_cpu_uninit in arch/x86/kvm/svm.c (bsc#1171736).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20806: Fixed a NULL pointer dereference which may had lead to denial of service (bsc#1172199).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9459 advisory.

    - fs/namespace.c: fix mountpoint reference counter race (Piotr Krysiuk)  [Orabug: 33369433]     {CVE-2020-12114} {CVE-2020-12114}
    - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik)     [Orabug: 33369414]  {CVE-2019-19448} {CVE-2019-19448}
    - cfg80211: wext: avoid copying malformed SSIDs (Will Deacon)  [Orabug: 33369390]  {CVE-2019-17133}
    - vhost_net: fix possible infinite loop (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900} {CVE-2019-3900}
    - vhost: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost_net: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost_net: use packet weight for rx handler, too (Paolo Abeni)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost-net: set packet weight of tx polling to 2 * vq size (haibinzhang)  [Orabug: 33369374]     {CVE-2019-3900}
    - mac80211: extend protection against mixed key and fragment cache attacks (Wen Gong)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147} {CVE-2020-24586} {CVE-2020-24587}
    - mac80211: do not accept/forward invalid EAPOL frames (Johannes Berg)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147}
    - mac80211: prevent attacks on TKIP/WEP as well (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: check defrag PN against current frame (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: add fragment cache to sta_info (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: drop A-MSDUs on old ciphers (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-24588}
    - cfg80211: mitigate A-MSDU aggregation attacks (Mathy Vanhoef)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-24588}
    - mac80211: properly handle A-MSDUs that start with an RFC 1042 header (Mathy Vanhoef)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147}
    - mac80211: prevent mixed key and fragment cache attacks (Mathy Vanhoef)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147} {CVE-2020-24587} {CVE-2020-24586}
    - mac80211: assure all fragments are encrypted (Mathy Vanhoef)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-26147}
    - sctp: validate from_addr_param return (Marcelo Ricardo Leitner)  [Orabug: 33369303]  {CVE-2021-3655}
    - virtio_console: Assure used length from device is limited (Xie Yongji)  [Orabug: 33369276]     {CVE-2021-38160}
    - net_sched: cls_route: remove the right filter from hashtable (Cong Wang)  [Orabug: 33369231]     {CVE-2021-3715}
    - HID: make arrays usage and value to be the same (Will McVicker)  [Orabug: 33369121]  {CVE-2021-0512}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1578 advisory.

    - drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935281] {CVE-2020-12362}
    - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930833] {CVE-2021-27365}
    - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930856] {CVE-2021-27363}
    - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930809]     {CVE-2021-27364}
    - vt: Disable KD_FONT_OP_COPY (Dave Airlie) [1903937] {CVE-2020-28974}
    - fix regression in 'epoll: Keep a reference on files added to the check list' (Carlos Maiolino) [1920776]     {CVE-2020-0466}
    - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920776] {CVE-2020-0466}
    - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920776] {CVE-2020-0466}
    - net/vmw_vsock: fix NULL pointer dereference (Jon Maloy) [1925600] {CVE-2021-26708}
    - net/vmw_vsock: improve locking in vsock_connect_timeout() (Jon Maloy) [1925600] {CVE-2021-26708}
    - vsock: fix locking in vsock_shutdown() (Jon Maloy) [1925600] {CVE-2021-26708}
    - vsock: fix the race conditions in multi-transport support (Jon Maloy) [1925600] {CVE-2021-26708}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
157595	AlmaLinux 8カーネルALSA-2021:1578	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	high
137611	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1596-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	high
137340	Debian DSA-4698-1 : linux - security update	Nessus	Debian Local Security Checks	2020/6/11	2024/3/7	high
145201	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2021-1079)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	high
137339	Debian DLA-2242-1 : linux-4.9 security update	Nessus	Debian Local Security Checks	2020/6/11	2024/3/7	high
136870	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1592)	Nessus	Huawei Local Security Checks	2020/5/26	2024/3/8	high
137301	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4391-1)	Nessus	Ubuntu Local Security Checks	2020/6/10	2024/8/27	high
137613	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:1599-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	high
137617	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1605-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	high
138679	openSUSE Security Update : the Linux Kernel (openSUSE-2020-801)	Nessus	SuSE Local Security Checks	2020/7/20	2024/2/29	high
153557	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9459)	Nessus	Oracle Linux Local Security Checks	2021/9/22	2024/10/22	critical
149914	Oracle Linux 8 : kernel (ELSA-2021-1578)	Nessus	Oracle Linux Local Security Checks	2021/5/26	2024/11/1	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

critical

high