遠端 CentOS Linux 7 主機上安裝的套件受到 CESA-2020: 5437 公告中提及的多個弱點影響。

  - 核心：flow_dissector 功能允許裝置追踪 (CVE-2019-18282)

  - 核心：當長於 4 個位元組的承載未對齊時，crypto_authenc_extractkeys() 中存在緩衝區過度讀取。(CVE-2020-10769)

  - 核心：ext3/4 檔案系統中緩衝區的使用超出索引範圍 (CVE-2020-14314)

  - 核心：XFS 中的中繼資料驗證器可造成具有使用者可建立的有效延伸屬性的 inode 被標示為損毀 (CVE-2020-14385)

  - 核心：umask 未套用至沒有 ACL 支援的檔案系統 (CVE-2020-24394)

  - 核心：NFS 用戶端程式碼中存在 TOCTOU 不相符問題 (CVE-2020-25212)

  - 核心：ppp_cp_parse_cr() 函式中的不當輸入驗證可導致記憶體損毀和讀取溢位 (CVE-2020-25643)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Oracle Linux 7 主機中安裝的套件受到 ELSA-2020-5913 公告中提及的多個弱點影響。

  - 在 Linux 核心 5.0.21中，掛載特製的 btrfs 檔案系統影像、執行部分作業及卸載皆可導致 fs/btrfs/async-thread.c 中的 btrfs_queue_work 發生釋放後使用。(CVE-2019-19377)

  - 在 5.7.10 之前版本的 Linux 核心內， 重新啟動系統時，cgroupv2 子系統中有一個 null 指標解除參照的瑕疵。本機使用者可利用此瑕疵來損毀系統或提高自己的系統權限。(CVE-2020-14356)

  - 在 Linux 核心 5.9-rc4 之前版本中發現一個缺陷。XFS 中的檔案系統中繼資料驗證器失敗，可造成具有使用者可建立的有效延伸屬性的 inode 被標示為損毀。這可導致檔案系統被關閉，或者在重新掛載前無法存取，進而導致拒絕服務。此弱點對系統可用性威脅最大。
    (CVE-2020-14385)

  - 在 5.8.7 之前版本的 Linux 核心中，能夠插入 conntrack netlink 組態的本機攻擊者可造成本機緩衝區溢位，進而導致當機或觸發使用 net/netfilter/nf_conntrack_netlink.c 的ctnetlink_parse_tuple_filter 中錯誤的通訊協定數字，即 CID-1cc5ef91d2ff。
    (CVE-2020-25211)

  - 在 Linux 核心 5.9-rc7 之前版本的 HDLC_PPP 模組中發現一個瑕疵。ppp_cp_parse_cr 函式中的不當輸入驗證問題會造成記憶體損毀以及讀取溢位，進而導致系統當機或拒絕服務。此弱點對於資料的機密性和完整性以及系統可用性威脅最大。(CVE-2020-25643)

  - 5.8.13 及之前版本的 Linux 核心不會正確強制執行安全開機禁止簽章資料庫 (即 dbx) 保護機制。這會影響 certs/blacklist.c 和 certs/system_keyring.c。
    (CVE-2020-26541)

  - 某些 Intel(R) 處理器的 Linux 核心驅動程式中存在存取控制不足問題，經驗證的使用者或可利用此問題，透過本機存取造成資訊洩漏。(CVE-2020-8694)

  - 某些 Intel(R) 處理器的 RAPL 介面中存在可觀察差異，有權限的使用者或可利用此差異，透過本機存取造成資訊洩漏。(CVE-2020-8695)

  - 在 Linux 核心 5.2.13 及之前版本中發現一個問題。drivers/block/nbd.c 中的 nbd_genl_status 未檢查 nla_nest_start_noflag 傳回值。(CVE-2019-16089)

  - 在 Linux 核心 5.9-rc6 之前版本中發現一個瑕疵。變更畫面大小時，可能會發生超出邊界記憶體寫入，進而導致記憶體損毀或拒絕服務。由於缺陷的本質，無法完全排除權限提升狀況。(CVE-2020-14390)

  - 在 Linux 核心 5.9-rc7 之前版本中發現一個瑕疵。當 IPsec 設定為針對 GENEVE 通道所使用的特定 UDP 連接埠加密流量時，兩個 Geneve 端點之間的流量可能未加密，進而允許兩個端點之間的任何人讀取未加密的流量。此弱點主要威脅資料的機密性。(CVE-2020-25645)

  - ** 有爭議 ** 在 Linux 核心 5.1.5 及其之前版本的 efi 子系統中發現一個問題。
    arch/x86/platform/efi/efi.c 中的 phys_efi_set_virtual_address_map 和 arch/x86/platform/efi/efi_64.c 中的 efi_call_phys_prolog 未正確處理記憶體配置失敗。注意：有觀點認為此 ID 並非問題，因為提及的認可中涉及的所有程式碼只會在開機時且任何使用者處理程序啟動之前執行。因此，無權限的使用者無法控制它。
    (CVE-2019-12380)

  - 在 Linux 核心 5.0.21 和 5.3.11 中，掛載特製的 btrfs 檔案系統影像，執行某些作業，然後進行 syncfs 系統呼叫，可導致 fs / btrfs / free-space-cache.c 中的 try_merge_free_space 發生釋放後使用問題，這是因為左側資料結構的指標可能與右側資料結構的指標相同。(CVE-2019-19448)

  - 在 Linux 核心 5.9-rc7 之前版本的 GRO 實作中發現一個瑕疵。區塊子系統發出的零長度 biovec 要求可造成核心進入無限迴圈，進而造成拒絕服務。此瑕疵允許具有基本權限的本機攻擊者向區塊裝置發出要求，進而導致拒絕服務。此弱點對系統可用性威脅最大。(CVE-2020-25641)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):Buffer overflow in i40e     driver for Intel(R) Ethernet 700 Series Controllers     versions before 7.0 may allow an authenticated user to     potentially enable an escalation of privilege via local     access.(CVE-2019-0145)Insufficient input validation in     i40e driver for Intel(R) Ethernet 700 Series     Controllers versions before 7.0 may allow an     authenticated user to potentially enable a denial of     service via local access.(CVE-2019-0147)In the Linux     kernel through 5.8.7, local attackers able to inject     conntrack netlink configuration could overflow a local     buffer, causing crashes or triggering use of incorrect     protocol numbers in ctnetlink_parse_tuple_filter in     net/ netfilter/ nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)In the Linux kernel     before 5.7.8, fs/ nfsd/vfs.c (in the NFS server) can     set incorrect permissions on new filesystem objects     when the filesystem lacks ACL support, aka     CID-22cf8419f131. This occurs because the current umask     is not considered.(CVE-2020-24394)A flaw was found in     the Linux kernel before 5.9-rc4. A failure of the file     system metadata validator in XFS can cause an inode     with a valid, user-creatable extended attribute to be     flagged as corrupt. This can lead to the filesystem     being shutdown, or otherwise rendered inaccessible     until it is remounted, leading to a denial of service.
    The highest threat from this vulnerability is to system     availability.(CVE-2020-14385)The rbd block device     driver in drivers/block/rbd.c in the Linux kernel     through 5.8.9 used incomplete permission checking for     access to rbd devices, which could be leveraged by     local attackers to map or unmap rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)In     uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel(CVE-2020-0404)A TOCTOU mismatch in the NFS     client code in the Linux kernel before 5.8.3 could be     used by local attackers to corrupt memory or possibly     have unspecified other impact because a size check is     in fs/ nfs/ nfs4proc.c instead of fs/ nfs/ nfs4xdr.c,     aka CID-b4487b935452.(CVE-2020-25212)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The Linux kernel through 5.7.11 allows remote attackers     to make observations that help to obtain sensitive     information about the internal state of the network     RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)

  - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the     NFS server) can set incorrect permissions on new     filesystem objects when the filesystem lacks ACL     support, aka CID-22cf8419f131. This occurs because the     current umask is not considered.(CVE-2020-24394)

  - In uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel(CVE-2020-0404)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)

  - A flaw was found in the Linux kernel before 5.9-rc4. A     failure of the file system metadata validator in XFS     can cause an inode with a valid, user-creatable     extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise     rendered inaccessible until it is remounted, leading to     a denial of service. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14385)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - A flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4331 advisory.

  - kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be     flagged as corrupt (CVE-2020-14385)

  - kernel: memory corruption in net/packet/af_packet.c leads to elevation of privilege (CVE-2020-14386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

CVE-2020-14385: Fixed a failure of the file system metadata validator in XFS which could have caused an inode with a valid, user-creatable extended attribute to be flagged as corrupt (bsc#1176137).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K84900646 advisory.

  - A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in     XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading     to a denial of service. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14385)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:5437-1 advisory.

  - kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be     flagged as corrupt (CVE-2020-14385)

  - kernel: The flow_dissector feature allows device tracking (CVE-2019-18282)

  - kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not     aligned. (CVE-2020-10769)

  - kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

  - kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

  - kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

  - kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow     (CVE-2020-25643)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4287 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net: bluetooth: type confusion while processing AMP packets (CVE-2020-12351)

    * kernel: net: bluetooth: information leak when processing certain AMP packets (CVE-2020-12352)

    * kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to     be flagged as corrupt (CVE-2020-14385)

    * kernel: memory corruption in net/packet/af_packet.c leads to elevation of privilege (CVE-2020-14386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * NFS client autodisconnect timer may fire immediately after TCP connection setup and may cause DoS type     reconnect problem in complex network environments (BZ#1873571)

    * hang on full fs from trace_cmd (BZ#1875789)

    * Secure boot key is not loaded with kernel-4.18.0-232.el8.x86_64 / shim-x64-15-15 (BZ#1877527)

    * [RHEL-8.3] Kdump failed to start when secure boot enabled:  kexec_file_load failed: Required key not     available (BZ#1877529)

    * [RHEL-8.3] Kdump/kexec kernel panicked on EFI boot: general protection fault: 0000 [#1] SMP PTI     (BZ#1879987)

    * [conntrack] udp packet reverse NAT occasionally fail when race condition request combination with the     DNAT load balancing rules (BZ#1882096)

    * [Regression] RHEL8.3 Beta - Do not initiate shutdown for EPOW_SHUTDOWN_ON_UPS event (BZ#1882244)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4576-1 advisory.

    Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket     reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2020-16119)

    Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle     directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2020-14314)

    David Alan Gilbert discovered that the XFS file system implementation in the Linux kernel did not properly     perform metadata validation in some circumstances. A local attacker could use this to cause a denial of     service. (CVE-2020-14385)

    Giuseppe Scrivano discovered that the overlay file system in the Linux kernel did not properly perform     permission checks in some situations. A local attacker could possibly use this to bypass intended     restrictions and gain read access to restricted files. (CVE-2020-16120)

    It was discovered that a race condition existed in the hugetlb sysctl implementation in the Linux kernel.
    A privileged attacker could use this to cause a denial of service (system crash). (CVE-2020-25285)

    It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length     requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In uvc_scan_chain_forward     of uvc_driver.c, there is a possible linked list     corruption due to an unusual root cause. This could     lead to local escalation of privilege in the kernel     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-111893654References: Upstream kernel.(CVE-2020-0404)A     flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)A TOCTOU mismatch in the     NFS client code in the Linux kernel before 5.8.3 could     be used by local attackers to corrupt memory or     possibly have unspecified other impact because a size     check is in fs4proc.c instead of fsfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)A flaw was found in     the Linux kernel before 5.9-rc4. A failure of the file     system metadata validator in XFS can cause an inode     with a valid, user-creatable extended attribute to be     flagged as corrupt. This can lead to the filesystem     being shutdown, or otherwise rendered inaccessible     until it is remounted, leading to a denial of service.
    The highest threat from this vulnerability is to system     availability.(CVE-2020-14385)In the Linux kernel before     5.7.8, fsfsd/vfs.c (in the NFS server) can set     incorrect permissions on new filesystem objects when     the filesystem lacks ACL support, aka CID-22cf8419f131.
    This occurs because the current umask is not     considered.(CVE-2020-24394)The rbd block device driver     in drivers/block/rbd.c in the Linux kernel through     5.8.9 used incomplete permission checking for access to     rbd devices, which could be leveraged by local     attackers to map or unmap rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)An issue was     discovered in net/ipv4/sysctl_net_ipv4.c in the Linux     kernel before 5.0.11. There is a net/ipv4/tcp_input.c     signed integer overflow in tcp_ack_update_rtt() when     userspace writes a very large integer to /proc/sys     et/ipv4/tcp_min_rtt_wlen, leading to a denial of     service or possibly unspecified other impact, aka     CID-19fad20d15a6.(CVE-2019-18805)Insufficient input     validation in i40e driver for Intel(R) Ethernet 700     Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable a denial of     service via local access.(CVE-2019-0147)Buffer overflow     in i40e driver for Intel(R) Ethernet 700 Series     Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2020-0145)A race     condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)A memory     out-of-bounds read flaw was found in the Linux kernel     before 5.9-rc2 with the ext3/ext4 file system, in the     way it accesses a directory with broken indexing. This     flaw allows a local user to crash the system if the     directory exists. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14314)A missing CAP_NET_RAW     check in NFC socket creation in net fc/rawsock.c in the     Linux kernel before 5.8.2 could be used by local     attackers to create raw sockets, bypassing security     mechanisms, aka CID-26896f01467a.(CVE-2020-26088)A flaw     was found in the HDLC_PPP module of the Linux kernel in     versions before 5.9-rc7. Memory corruption and a read     overflow is caused by improper input validation in the     ppp_cp_parse_cr function which can cause the system to     crash or cause a denial of service. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-25643)The Linux kernel, as used     in Red Hat Enterprise Linux 7, kernel-rt, and     Enterprise MRG 2 and when booted with UEFI Secure Boot     enabled, allows local users to bypass intended     securelevel/secureboot restrictions by leveraging     improper handling of secure_boot flag across kexec     reboot.(CVE-2015-7837)A flaw was found in the Linux     kernel's implementation of biovecs in versions before     5.9-rc7. A zero-length biovec request issued by the     block subsystem could cause the kernel to enter an     infinite loop, causing a denial of service. This flaw     allows a local attacker with basic privileges to issue     requests to a block device, resulting in a denial of     service. The highest threat from this vulnerability is     to system availability.(CVE-2020-25641)A flaw was found     in the Linux kernel before 5.9-rc4. Memory corruption     can be exploited to gain root privileges from     unprivileged processes. The highest threat from this     vulnerability is to data confidentiality and     integrity.(CVE-2020-14386)A flaw was found in the Linux     kernel in versions before 5.9-rc7. Traffic between two     Geneve endpoints may be unencrypted when IPsec is     configured to encrypt traffic for the specific UDP port     used by the GENEVE tunnel allowing anyone between the     two endpoints to read the traffic unencrypted. The main     threat from this vulnerability is to data     confidentiality.(CVE-2020-25645)perf: Fix race in     perf_mmap_close function.(CVE-2020-14351)An information     leak flaw was found in the way the Linux kernel's     Bluetooth stack implementation handled initialization     of stack memory when handling certain AMP packets. A     remote attacker in adjacent range could use this flaw     to leak small portions of stack memory on the system by     sending a specially crafted AMP packets. The highest     threat from this vulnerability is to data     confidentiality.(CVE-2020-12352)A flaw was found in the     way the Linux kernel Bluetooth implementation handled     L2CAP packets with A2MP CID. A remote attacker in     adjacent range could use this flaw to crash the system     causing denial of service or potentially execute     arbitrary code on the system by sending a specially     crafted L2CAP packet. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-12351)A heap     buffer overflow flaw was found in the way the Linux     kernel's Bluetooth implementation processed extended     advertising report events. This flaw allows a remote     attacker in an adjacent range to crash the system,     causing a denial of service or to potentially execute     arbitrary code on the system by sending a specially     crafted Bluetooth packet. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-24490)** RESERVED **     This candidate has been reserved by an organization or     individual that will use it when announcing a new     security problem. When the candidate has been     publicized, the details for this candidate will be     provided.(CVE-2020-25656)In skb_to_mamac of     networking.c, there is a possible out of bounds write     due to an integer overflow. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-143560807(CVE-2020-0432)A     slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)A     flaw memory leak in the Linux kernel performance     monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this     flaw to starve the resources causing denial of     service.(CVE-2020-25704)A buffer over-read (at the     framebuffer layer) in the fbcon code in the Linux     kernel before 5.8.15 could be used by local attackers     to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)There is a     use-after-free problem seen due to a race condition     between the release of ptp_clock and cdev while     resource deallocation. When a (high privileged) process     allocates a ptp device file (like /dev/ptpX) and     voluntarily goes to sleep. During this time if the     underlying device is removed, it can cause an     exploitable condition as the process wakes up to     terminate and clean all attached files. The system     crashes due to the cdev structure being invalid (as     already freed) which is pointed to by the     inode.(CVE-2020-10690)A device tracking vulnerability     was found in the flow_dissector feature in the Linux     kernel. This flaw occurs because the auto flowlabel of     the UDP IPv6 packet relies on a 32-bit hashmd value as     a secret, and jhash (instead of siphash) is used. The     hashmd value remains the same starting from boot time     and can be inferred by an     attacker.(CVE-2019-18282)Use-after-free vulnerability     in fs/block_dev.c in the Linux kernel before 5.8 allows     local users to gain privileges or cause a denial of     service by leveraging improper access to a certain     error field.(CVE-2020-15436)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)An issue was discovered     in kmem_cache_alloc_bulk in mm/slub.c in the Linux     kernel before 5.5.11. The slowpath lacks the required     TID increment, aka CID-fd4d9c7d0c71.(CVE-2020-29370)An     issue was discovered in the Linux kernel before 5.2.6.
    On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)An issue was     discovered in the Linux kernel before 5.7.3, related to     mm/gup.c and mm/huge_memory.c. The get_user_pages (aka     gup) implementation, when used for a copy-on-write     page, does not properly consider the semantics of read     operations and therefore can grant unintended write     access, aka CID-17839856fd58.(CVE-2020-29374)A flaw was     found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)In kbd_keycode of keyboard.c,     there is a possible out of bounds write due to a     missing bounds check. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-144161459(CVE-2020-0431)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c,     there is a possible use after free due to a logic     error. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel(CVE-2020-0466)

  - In the l2tp subsystem, there is a possible use after     free due to a race condition. This could lead to local     escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-152409173(CVE-2020-27067)

  - In the nl80211_policy policy of nl80211.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with System execution privileges needed. User     interaction is not required for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-119770583(CVE-2020-27068)

  - In audit_free_lsm_field of auditfilter.c, there is a     possible bad kfree due to a logic error in     audit_data_to_entry. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-150693166References: Upstream     kernel(CVE-2020-0444)

  - In various methods of hid-multitouch.c, there is a     possible out of bounds write due to a missing bounds     check. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-162844689References: Upstream kernel(CVE-2020-0465)

  - Use-after-free vulnerability in fs/block_dev.c in the     Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging     improper access to a certain error     field.(CVE-2020-15436)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

  - A flaw was found in the Linux kernels implementation of     MIDI, where an attacker with a local account and the     permissions to issue an ioctl commands to midi devices,     could trigger a use-after-free. A write to this     specific memory while freed and before use could cause     the flow of execution to change and possibly allow for     memory corruption or privilege     escalation.(CVE-2020-27786)

  - No description is available for this     CVE.(CVE-2020-27815)

  - NULL-ptr deref in the spk_ttyio_receive_buf2() function     in spk_ttyio.c(CVE-2020-27830)

  - An issue was discovered in __split_huge_pmd in     mm/huge_memory.c in the Linux kernel before 5.7.5. The     copy-on-write implementation can grant unintended write     access because of a race condition in a THP mapcount     check, aka CID-c444eb564fb1.(CVE-2020-29368)

  - An issue was discovered in kmem_cache_alloc_bulk in     mm/slub.c in the Linux kernel before 5.5.11. The     slowpath lacks the required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - A locking issue was discovered in the tty subsystem of     the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free     attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high     rate of events to dom0, aka     CID-e99502f76271.(CVE-2020-27673)

  - An issue was discovered in     drivers/accessibility/speakup/spk_ttyio.c in the Linux     kernel through 5.9.9. Local attackers on systems with     the speakup driver could cause a local denial of     service attack, aka CID-d41227544427. This occurs     because of an invalid free when the line discipline is     used more than once.(CVE-2020-28941)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - A flaw was found in the Linux kernel. A use-after-free     memory flaw was found in the perf subsystem allowing a     local attacker with permission to monitor perf events     to corrupt memory and possibly escalate privileges. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)

  - A flaw in the way reply ICMP packets are limited in the     Linux kernel functionality was found that allows to     quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypassing source     port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)

  - No description is available for this     CVE.(CVE-2020-25668)

  - No description is available for this     CVE.(CVE-2020-25669)

  - A flaw was found in the way RTAS handled memory     accesses in userspace to kernel communication. On a     locked down (usually due to Secure Boot) guest system     running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to     further increase their privileges to that of a running     kernel.(CVE-2020-27777)

  - kernel: perf_event_parse_addr_filter     memory(CVE-2020-25704)

  - Insufficient access control in the Linux kernel driver     for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via     local access.(CVE-2020-8694)

  - A flaw was found in the Linux kernel. A use-after-free     was found in the way the console subsystem was using     ioctls KDGKBSENT and KDSKBSENT. A local user could use     this flaw to get read memory access out of bounds. The     highest threat from this vulnerability is to data     confidentiality.(CVE-2020-25656)

  - In kbd_keycode of keyboard.c, there is a possible out     of bounds write due to a missing bounds check. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-144161459(CVE-2020-0431)

  - A flaw was found in the HDLC_PPP module of the Linux     kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input     validation in the ppp_cp_parse_cr function which can     cause the system to crash or cause a denial of service.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25643)

  - A flaw was found in the Linux kernel in versions before     5.9-rc7. Traffic between two Geneve endpoints may be     unencrypted when IPsec is configured to encrypt traffic     for the specific UDP port used by the GENEVE tunnel     allowing anyone between the two endpoints to read the     traffic unencrypted. The main threat from this     vulnerability is to data     confidentiality.(CVE-2020-25645)

  - Vulnerability Summary for     CVE-2020-12351(CVE-2020-12351)

  - Vulnerability Summary for     CVE-2020-12352(CVE-2020-12352)

  - Vulnerability Summary for     CVE-2020-24490(CVE-2020-24490)

  - A missing CAP_NET_RAW check in NFC socket creation in     net/nfc/rawsock.c in the Linux kernel before 5.8.2     could be used by local attackers to create raw sockets,     bypassing security mechanisms, aka     CID-26896f01467a.(CVE-2020-26088)

  - A flaw was found in the Linux kernel's implementation     of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could     cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker     with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest     threat from this vulnerability is to system     availability.(CVE-2020-25641)

  - In skb_to_mamac of networking.c, there is a possible     out of bounds write due to an integer overflow. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-143560807(CVE-2020-0432)

  - A race condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)

  - A flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)

  - A flaw was found in the Linux kernel before 5.9-rc4.
    Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest     threat from this vulnerability is to data     confidentiality and integrity.(CVE-2020-14386)

  - Insufficient input validation in i40e driver for     Intel(R) Ethernet 700 Series Controllers versions     before 7.0 may allow an authenticated user to     potentially enable a denial of service via local     access.(CVE-2019-0147)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)

  - A flaw was found in the Linux kernel before 5.9-rc4. A     failure of the file system metadata validator in XFS     can cause an inode with a valid, user-creatable     extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise     rendered inaccessible until it is remounted, leading to     a denial of service. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14385)

  - In uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel(CVE-2020-0404)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - A memory out-of-bounds read flaw was found in the Linux     kernel before 5.9-rc2 with the ext3/ext4 file system,     in the way it accesses a directory with broken     indexing. This flaw allows a local user to crash the     system if the directory exists. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14314)

  - A flaw null pointer dereference in the Linux kernel     cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could     use this flaw to crash the system or escalate their     privileges on the system.(CVE-2020-24394)

  - A flaw was found in the Linux kernel's implementation     of the invert video code on VGA consoles when a local     attacker attempts to resize the console, calling an     ioctl VT_RESIZE, which causes an out-of-bounds write to     occur. This flaw allows a local user with access to the     VGA console to crash the system, potentially escalating     their privileges on the system. The highest threat from     this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-14331)

  - The Linux kernel, as used in Red Hat Enterprise Linux     7, kernel-rt, and Enterprise MRG 2 and when booted with     UEFI Secure Boot enabled, allows local users to bypass     intended securelevel/secureboot restrictions by     leveraging improper handling of secure_boot flag across     kexec reboot.(CVE-2015-7837)

  - In the Linux kernel through 5.8.7, local attackers able     to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering     use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in     net/netfilter/nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)

  - A flaw null pointer dereference in the Linux kernel     cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could     use this flaw to crash the system or escalate their     privileges on the system.(CVE-2020-14356)

  - Buffer overflow in i40e driver for Intel(R) Ethernet     700 Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2019-0145)

  - The Linux kernel through 5.7.11 allows remote attackers     to make observations that help to obtain sensitive     information about the internal state of the network     RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)

  - The VFIO PCI driver in the Linux kernel through 5.6.13     mishandles attempts to access disabled memory     space.(CVE-2020-12888)

  - In the Linux kernel through 5.7.6, usbtest_disconnect     in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)

  - A logic bug was found in the Linux kernels     implementation of SSBD. A bug in the logic handling can     allow an attacker with a local account to disable SSBD     protection during a context switch when additional     speculative execution mitigations are in     place.(CVE-2020-10766)

  - The prctl() function can be used to enable indirect     branch speculation even after it has been disabled.
    This same call will incorrectly report it being 'force     disabled' when it is not.(CVE-2020-10768)

  - A flaw was found in the Linux kernel's implementation     of the Enhanced IBPB (Indirect Branch Prediction     Barrier). The IBPB mitigation will be disabled when     STIBP is not available or when the Enhanced Indirect     Branch Restricted Speculation (IBRS) is available. This     flaw allows a local attacker to perform a Spectre V2     style attack when this configuration is active. The     highest threat from this vulnerability is to     confidentiality.(CVE-2020-10767)

  - A flaw was found in the ZRAM kernel module, where a     user with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)

  - A flaw was found in the Linux kernel. An index buffer     overflow during Direct IO write leading to the NFS     client to crash. In some cases, a reach out of the     index after one memory allocation by kmalloc will cause     a kernel panic. The highest threat from this     vulnerability is to data confidentiality and system     availability.(CVE-2020-10742)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5050 advisory.

  - A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in     XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading     to a denial of service. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14385)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
164599	Nutanix AOS：多個弱點 (NXSA-AOS-5.15.5)	Nessus	Misc.	2022/9/1	2024/4/8	critical
144549	CentOS 7：核心 (CESA-2020: 5437)	Nessus	CentOS Local Security Checks	2020/12/22	2024/10/9	high
180881	Oracle Linux 7：Unbreakable Enterprise 核心 (ELSA-2020-5913)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2023/9/7	high
140999	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-2151)	Nessus	Huawei Local Security Checks	2020/9/29	2024/2/16	high
140959	EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-2011)	Nessus	Huawei Local Security Checks	2020/9/29	2022/5/12	high
170291	RHEL 8 : kpatch-patch (RHSA-2020:4331)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/4/28	high
143671	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:2879-1)	Nessus	SuSE Local Security Checks	2020/12/9	2022/5/11	high
140708	Photon OS 3.0: Linux PHSA-2020-3.0-0142	Nessus	PhotonOS Local Security Checks	2020/9/21	2024/7/24	high
154694	F5 Networks BIG-IP : Linux kernel vulnerability (K84900646)	Nessus	F5 Networks Local Security Checks	2021/10/28	2024/5/7	medium
144295	Scientific Linux Security Update : kernel on SL7.x x86_64 (2020:5437)	Nessus	Scientific Linux Local Security Checks	2020/12/15	2024/2/1	high
141580	RHEL 8 : kernel (RHSA-2020:4287)	Nessus	Red Hat Local Security Checks	2020/10/20	2024/6/4	high
141451	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4576-1)	Nessus	Ubuntu Local Security Checks	2020/10/14	2024/8/27	high
164567	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.6)	Nessus	Misc.	2022/9/1	2024/3/19	critical
144731	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2021-1039)	Nessus	Huawei Local Security Checks	2021/1/5	2022/5/11	critical
147512	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2021-1604)	Nessus	Huawei Local Security Checks	2021/3/10	2023/2/9	critical
208497	CentOS 7 : kpatch-patch (RHSA-2020:5050)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	medium

偵測

搜尋 Plugin

critical

high

high

high

high

high

high

high

medium

high

high

high

critical

critical

critical

medium