In driver_override_store and driver_override_show of bus.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-69129004 References: Upstream kernel.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0044 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5866 advisory.

    - kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn)  [Orabug: 29434845]     {CVE-2019-6974}
    - KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier)     [Orabug: 29434898]  {CVE-2019-7221}
    - KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini)  [Orabug:
    29434924]  {CVE-2019-7222}
    - net: arc_emac: fix koops caused by sk_buff free (Alexander Kochetkov)  [Orabug: 30254239]     {CVE-2016-10906}
    - GFS2: don't set rgrp gl_object until it's inserted into rgrp tree (Bob Peterson)  [Orabug: 30254251]     {CVE-2016-10905}
    - GFS2: Fix rgrp end rounding problem for bsize < page size (Bob Peterson)  [Orabug: 30254251]     {CVE-2016-10905}
    - net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup (Sabrina Dubroca)  [Orabug: 31872821]     {CVE-2020-1749}
    - nfs: Fix getxattr kernel panic and memory overflow (Jeffrey Mitchell)  [Orabug: 31872910]     {CVE-2020-25212}
    - rbd: require global CAP_SYS_ADMIN for mapping and unmapping (Ilya Dryomov)  [Orabug: 31884169]     {CVE-2020-25284}
    - mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song)  [Orabug: 31884239]     {CVE-2020-25285}
    - ext4: fix potential negative array index in do_split() (Eric Sandeen)  [Orabug: 31895331]     {CVE-2020-14314}
    - ARM: amba: Fix race condition with driver_override (Geert Uytterhoeven)  [Orabug: 29671212]     {CVE-2018-9415}
    - block: blk_init_allocated_queue() set q->fq as NULL in the fail case (xiao jin)  [Orabug: 30120513]     {CVE-2018-20856}
    - USB: serial: omninet: fix reference leaks at open (Johan Hovold)  [Orabug: 30484761]  {CVE-2017-8925}
    - nl80211: validate beacon head (Johannes Berg)  [Orabug: 30556264]  {CVE-2019-16746}
    - cfg80211: Use const more consistently in for_each_element macros (Jouni Malinen)  [Orabug: 30556264]     {CVE-2019-16746}
    - cfg80211: add and use strongly typed element iteration macros (Johannes Berg)  [Orabug: 30556264]     {CVE-2019-16746}
    - cfg80211: add helper to find an IE that matches a byte-array (Luca Coelho)  [Orabug: 30556264]     {CVE-2019-16746}
    - cfg80211: allow finding vendor with OUI without specifying the OUI type (Emmanuel Grumbach)  [Orabug:
    30556264]  {CVE-2019-16746}
    - dccp: Fix memleak in __feat_register_sp (YueHaibing)  [Orabug: 30732821]  {CVE-2019-20096}
    - fs/proc/proc_sysctl.c: Fix a NULL pointer dereference (YueHaibing)  [Orabug: 30732938]  {CVE-2019-20054}
    - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links (YueHaibing)  [Orabug: 30732938]     {CVE-2019-20054}
    - scsi: libsas: stop discovering if oob mode is disconnected (Jason Yan)  [Orabug: 30770913]     {CVE-2019-19965}
    - kernel/sysctl.c: fix out-of-bounds access when setting file-max (Will Deacon)  [Orabug: 31350720]     {CVE-2019-14898}
    - sysctl: handle overflow for file-max (Christian Brauner)  [Orabug: 31350720]  {CVE-2019-14898}
    - ath9k_htc: release allocated buffer if timed out (Navid Emamdoost)  [Orabug: 31351572]  {CVE-2019-19073}
    - can: gs_usb: gs_can_open(): prevent memory leak (Navid Emamdoost)  [Orabug: 31351682]  {CVE-2019-19052}
    - ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() (Takashi Iwai)  [Orabug:
    31351837]  {CVE-2019-15927}
    - media: usb: siano: Fix general protection fault in smsusb (Alan Stern)  [Orabug: 31351875]     {CVE-2019-15218}
    - net-gro: fix use-after-free read in napi_gro_frags() (Eric Dumazet)  [Orabug: 31856195]     {CVE-2020-10720}
    - ALSA: seq: Cancel pending autoload work at unbinding device (Takashi Iwai)  [Orabug: 31352045]     {CVE-2017-16528}
    - USB: serial: io_ti: fix information leak in completion handler (Johan Hovold)  [Orabug: 31352084]     {CVE-2017-8924}
    - blktrace: Protect q->blk_trace with RCU (Jan Kara)  [Orabug: 31123576]  {CVE-2019-19768}
    - media: technisat-usb2: break out of loop at end of buffer (Sean Young)  [Orabug: 31224554]     {CVE-2019-15505}
    - btrfs: merge btrfs_find_device and find_device (Anand Jain)  [Orabug: 31351746]  {CVE-2019-18885}
    - RDMA/cxgb4: Do not dma memory off of the stack (Greg KH)  [Orabug: 31351783]  {CVE-2019-17075}
    - mwifiex: Abort at too short BSS descriptor element (Takashi Iwai)  [Orabug: 31351916]  {CVE-2019-3846}
    - mwifiex: Fix possible buffer overflows at parsing bss descriptor (Takashi Iwai)  [Orabug: 31351916]     {CVE-2019-3846} {CVE-2019-3846}
    - repair kABI breakage from 'fs: prevent page refcount overflow in pipe_buf_get' (Dan Duval)  [Orabug:
    31351941]  {CVE-2019-11487}
    - mm: prevent get_user_pages() from overflowing page refcount (Linus Torvalds)  [Orabug: 31351941]     {CVE-2019-11487}
    - mm: add 'try_get_page()' helper function (Linus Torvalds)  [Orabug: 31351941]  {CVE-2019-11487}
    - fs: prevent page refcount overflow in pipe_buf_get (Matthew Wilcox)  [Orabug: 31351941]     {CVE-2019-11487}
    - mm: make page ref count overflow check tighter and more explicit (Linus Torvalds)  [Orabug: 31351941]     {CVE-2019-11487}
    - sctp: implement memory accounting on tx path (Xin Long)  [Orabug: 31351960]  {CVE-2019-3874}
    - sunrpc: use SVC_NET() in svcauth_gss_* functions (Vasily Averin)  [Orabug: 31351995]  {CVE-2018-16884}
    - sunrpc: use-after-free in svc_process_common() (Vasily Averin)  [Orabug: 31351995]  {CVE-2018-16884}
    - af_packet: set defaule value for tmo (Mao Wenan)  [Orabug: 31439107]  {CVE-2019-20812}
    - selinux: properly handle multiple messages in selinux_netlink_send() (Paul Moore)  [Orabug: 31439369]     {CVE-2020-10751}
    - selinux: Print 'sclass' as string when unrecognized netlink message occurs (Marek Milkovic)  [Orabug:
    31439369]  {CVE-2020-10751}
    - mac80211: Do not send Layer 2 Update frame before authorization (Jouni Malinen)  [Orabug: 31473652]     {CVE-2019-5108}
    - cfg80211/mac80211: make ieee80211_send_layer2_update a public function (Dedy Lansky)  [Orabug: 31473652]     {CVE-2019-5108}
    - crypto: authenc - fix parsing key with misaligned rta_len (Eric Biggers)  [Orabug: 31535529]     {CVE-2020-10769}
    - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang)  [Orabug: 31705121]     {CVE-2020-14331} {CVE-2020-14331}
    - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices (Tomas Bortoli)  [Orabug: 31351221]     {CVE-2019-19535}
    - media: hdpvr: Fix an error handling path in hdpvr_probe() (Arvind Yadav)  [Orabug: 31352053]     {CVE-2017-16644}
    - fix kABI breakage from 'netns: provide pure entropy for net_hash_mix()' (Dan Duval)  [Orabug: 31351904]     {CVE-2019-10638} {CVE-2019-10639}
    - netns: provide pure entropy for net_hash_mix() (Eric Dumazet)  [Orabug: 31351904]  {CVE-2019-10638}     {CVE-2019-10639}
    - fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (Alexander Potapenko)  [Orabug:
    31350639]  {CVE-2020-10732}
    - crypto: user - fix memory leak in crypto_report (Navid Emamdoost)  [Orabug: 31351640]  {CVE-2019-19062}
    - of: unittest: fix memory leak in unittest_data_add (Navid Emamdoost)  [Orabug: 31351702]     {CVE-2019-19049}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-3 advisory.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-2 advisory.

    USN-3752-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu     16.04 LTS.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-1 advisory.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
141374	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0044)	Nessus	OracleVM Local Security Checks	critical
141207	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5866)	Nessus	Oracle Linux Local Security Checks	critical
112189	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (Azure, GCP, OEM) vulnerabilities (USN-3752-3)	Nessus	Ubuntu Local Security Checks	high
112110	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3752-2)	Nessus	Ubuntu Local Security Checks	high
112109	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3752-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-9415

high

Tenable Plugins

critical

critical

high

high

high