The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of AOS installed on the remote host is prior to 5.19.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.2 advisory.

  - Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

  - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which     allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single     backslash character. (CVE-2021-3156)

  - A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is     exploitable by any local user who can execute the sudo command without authentication. Successful     exploitation of this flaw could lead to privilege escalation.  (CVE-2021-3156)

  - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch (CVE-2020-8625)

  - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on     a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be inferred by an attacker. This affects     net/core/flow_dissector.c and related code. (CVE-2019-18282)

  - A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in     crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4     bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat,     leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of     service. (CVE-2020-10769)

  - A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file     system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash     the system if the directory exists. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14314)

  - A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in     XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading     to a denial of service. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14385)

  - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new     filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the     current umask is not considered. (CVE-2020-24394)

  - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers     to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. (CVE-2020-25212)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
    (CVE-2020-29573)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14782, CVE-2020-14797)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2020-14796)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2020-14803)

  - Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging improper access to a certain error field.
    (CVE-2020-15436)

  - A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system)     functionality was found in the way user create and delete object using NFSv4.2 or newer if both     simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to     the NFS could use this flaw to starve the resources causing denial of service. (CVE-2020-35513)

  - When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to     9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one     request to another meaning user A and user B could both see the results of user A's request.
    (CVE-2021-25122)

  - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to     9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to     this issue. (CVE-2021-25329)

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of     recursive S_study_chunk calls. (CVE-2020-12723)

  - The X.509 GeneralName type is a generic type for representing different types of names. One of those name     types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a     possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp     authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then that attacker could trigger a crash. For example if     the attacker can trick a client or server into checking a malicious certificate against a malicious CRL     then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a     certificate. This checking happens prior to the signatures on the certificate and CRL being verified.
    OpenSSL's s_server, s_client and verify tools have support for the -crl_download option which implements     automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an     unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of     EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will     accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue.
    Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected     1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). (CVE-2020-1971)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K32380005 advisory.

  - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on     a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be inferred by an attacker. This affects     net/core/flow_dissector.c and related code. (CVE-2019-18282)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1769 advisory.

  - kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)

  - Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR (CVE-2019-10639)

  - kernel: use-after-free in function __mdiobus_register() in drivers/net/phy/mdio_bus.c (CVE-2019-12819)

  - kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure     (CVE-2019-15090)

  - kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

  - kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)

  - kernel: Null pointer dereference in the sound/usb/line6/driver.c (CVE-2019-15223)

  - kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c (CVE-2019-16234)

  - kernel: unprivileged users able to create RAW sockets in AF_IEEE802154 network protocol (CVE-2019-17053)

  - kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol (CVE-2019-17055)

  - kernel: The flow_dissector feature allows device tracking (CVE-2019-18282)

  - kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)

  - kernel: dos in mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c     (CVE-2019-19045)

  - kernel: dos in mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c     (CVE-2019-19047)

  - kernel: memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c allows DoS     (CVE-2019-19055)

  - kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)

  - kernel: A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c     allows for a DoS (CVE-2019-19058)

  - kernel: Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in     drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c allows for a DoS (CVE-2019-19059)

  - kernel: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c allows for a DoS     (CVE-2019-19065)

  - kernel: Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c allow     for a DoS (CVE-2019-19067)

  - kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS)     (CVE-2019-19073)

  - kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)

  - kernel: memory leak in bnxt_re_create_srq function in drivers/infiniband/hw/bnxt_re/ib_verbs.c     (CVE-2019-19077)

  - kernel: malicious USB devices can lead to multiple out-of-bounds write (CVE-2019-19532)

  - kernel: information leak bug caused by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)

  - kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

  - kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound     applications (CVE-2019-19922)

  - kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service     (CVE-2019-8980)

  - kernel: use-after-free in cdev_put() when a PTP device is removed while it's chardev is open     (CVE-2020-10690)

  - kernel: some ipv6 protocols not encrypted over ipsec tunnel (CVE-2020-1749)

  - kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c (CVE-2020-7053)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In uvc_scan_chain_forward     of uvc_driver.c, there is a possible linked list     corruption due to an unusual root cause. This could     lead to local escalation of privilege in the kernel     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-111893654References: Upstream kernel.(CVE-2020-0404)A     flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)A TOCTOU mismatch in the     NFS client code in the Linux kernel before 5.8.3 could     be used by local attackers to corrupt memory or     possibly have unspecified other impact because a size     check is in fs4proc.c instead of fsfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)A flaw was found in     the Linux kernel before 5.9-rc4. A failure of the file     system metadata validator in XFS can cause an inode     with a valid, user-creatable extended attribute to be     flagged as corrupt. This can lead to the filesystem     being shutdown, or otherwise rendered inaccessible     until it is remounted, leading to a denial of service.
    The highest threat from this vulnerability is to system     availability.(CVE-2020-14385)In the Linux kernel before     5.7.8, fsfsd/vfs.c (in the NFS server) can set     incorrect permissions on new filesystem objects when     the filesystem lacks ACL support, aka CID-22cf8419f131.
    This occurs because the current umask is not     considered.(CVE-2020-24394)The rbd block device driver     in drivers/block/rbd.c in the Linux kernel through     5.8.9 used incomplete permission checking for access to     rbd devices, which could be leveraged by local     attackers to map or unmap rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)An issue was     discovered in net/ipv4/sysctl_net_ipv4.c in the Linux     kernel before 5.0.11. There is a net/ipv4/tcp_input.c     signed integer overflow in tcp_ack_update_rtt() when     userspace writes a very large integer to /proc/sys     et/ipv4/tcp_min_rtt_wlen, leading to a denial of     service or possibly unspecified other impact, aka     CID-19fad20d15a6.(CVE-2019-18805)Insufficient input     validation in i40e driver for Intel(R) Ethernet 700     Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable a denial of     service via local access.(CVE-2019-0147)Buffer overflow     in i40e driver for Intel(R) Ethernet 700 Series     Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2020-0145)A race     condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)A memory     out-of-bounds read flaw was found in the Linux kernel     before 5.9-rc2 with the ext3/ext4 file system, in the     way it accesses a directory with broken indexing. This     flaw allows a local user to crash the system if the     directory exists. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14314)A missing CAP_NET_RAW     check in NFC socket creation in net fc/rawsock.c in the     Linux kernel before 5.8.2 could be used by local     attackers to create raw sockets, bypassing security     mechanisms, aka CID-26896f01467a.(CVE-2020-26088)A flaw     was found in the HDLC_PPP module of the Linux kernel in     versions before 5.9-rc7. Memory corruption and a read     overflow is caused by improper input validation in the     ppp_cp_parse_cr function which can cause the system to     crash or cause a denial of service. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-25643)The Linux kernel, as used     in Red Hat Enterprise Linux 7, kernel-rt, and     Enterprise MRG 2 and when booted with UEFI Secure Boot     enabled, allows local users to bypass intended     securelevel/secureboot restrictions by leveraging     improper handling of secure_boot flag across kexec     reboot.(CVE-2015-7837)A flaw was found in the Linux     kernel's implementation of biovecs in versions before     5.9-rc7. A zero-length biovec request issued by the     block subsystem could cause the kernel to enter an     infinite loop, causing a denial of service. This flaw     allows a local attacker with basic privileges to issue     requests to a block device, resulting in a denial of     service. The highest threat from this vulnerability is     to system availability.(CVE-2020-25641)A flaw was found     in the Linux kernel before 5.9-rc4. Memory corruption     can be exploited to gain root privileges from     unprivileged processes. The highest threat from this     vulnerability is to data confidentiality and     integrity.(CVE-2020-14386)A flaw was found in the Linux     kernel in versions before 5.9-rc7. Traffic between two     Geneve endpoints may be unencrypted when IPsec is     configured to encrypt traffic for the specific UDP port     used by the GENEVE tunnel allowing anyone between the     two endpoints to read the traffic unencrypted. The main     threat from this vulnerability is to data     confidentiality.(CVE-2020-25645)perf: Fix race in     perf_mmap_close function.(CVE-2020-14351)An information     leak flaw was found in the way the Linux kernel's     Bluetooth stack implementation handled initialization     of stack memory when handling certain AMP packets. A     remote attacker in adjacent range could use this flaw     to leak small portions of stack memory on the system by     sending a specially crafted AMP packets. The highest     threat from this vulnerability is to data     confidentiality.(CVE-2020-12352)A flaw was found in the     way the Linux kernel Bluetooth implementation handled     L2CAP packets with A2MP CID. A remote attacker in     adjacent range could use this flaw to crash the system     causing denial of service or potentially execute     arbitrary code on the system by sending a specially     crafted L2CAP packet. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-12351)A heap     buffer overflow flaw was found in the way the Linux     kernel's Bluetooth implementation processed extended     advertising report events. This flaw allows a remote     attacker in an adjacent range to crash the system,     causing a denial of service or to potentially execute     arbitrary code on the system by sending a specially     crafted Bluetooth packet. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-24490)** RESERVED **     This candidate has been reserved by an organization or     individual that will use it when announcing a new     security problem. When the candidate has been     publicized, the details for this candidate will be     provided.(CVE-2020-25656)In skb_to_mamac of     networking.c, there is a possible out of bounds write     due to an integer overflow. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-143560807(CVE-2020-0432)A     slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)A     flaw memory leak in the Linux kernel performance     monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this     flaw to starve the resources causing denial of     service.(CVE-2020-25704)A buffer over-read (at the     framebuffer layer) in the fbcon code in the Linux     kernel before 5.8.15 could be used by local attackers     to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)There is a     use-after-free problem seen due to a race condition     between the release of ptp_clock and cdev while     resource deallocation. When a (high privileged) process     allocates a ptp device file (like /dev/ptpX) and     voluntarily goes to sleep. During this time if the     underlying device is removed, it can cause an     exploitable condition as the process wakes up to     terminate and clean all attached files. The system     crashes due to the cdev structure being invalid (as     already freed) which is pointed to by the     inode.(CVE-2020-10690)A device tracking vulnerability     was found in the flow_dissector feature in the Linux     kernel. This flaw occurs because the auto flowlabel of     the UDP IPv6 packet relies on a 32-bit hashmd value as     a secret, and jhash (instead of siphash) is used. The     hashmd value remains the same starting from boot time     and can be inferred by an     attacker.(CVE-2019-18282)Use-after-free vulnerability     in fs/block_dev.c in the Linux kernel before 5.8 allows     local users to gain privileges or cause a denial of     service by leveraging improper access to a certain     error field.(CVE-2020-15436)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)An issue was discovered     in kmem_cache_alloc_bulk in mm/slub.c in the Linux     kernel before 5.5.11. The slowpath lacks the required     TID increment, aka CID-fd4d9c7d0c71.(CVE-2020-29370)An     issue was discovered in the Linux kernel before 5.2.6.
    On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)An issue was     discovered in the Linux kernel before 5.7.3, related to     mm/gup.c and mm/huge_memory.c. The get_user_pages (aka     gup) implementation, when used for a copy-on-write     page, does not properly consider the semantics of read     operations and therefore can grant unintended write     access, aka CID-17839856fd58.(CVE-2020-29374)A flaw was     found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)In kbd_keycode of keyboard.c,     there is a possible out of bounds write due to a     missing bounds check. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-144161459(CVE-2020-0431)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5437 advisory.

  - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on     a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be inferred by an attacker. This affects     net/core/flow_dissector.c and related code. (CVE-2019-18282)

  - A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in     crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4     bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat,     leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of     service. (CVE-2020-10769)

  - A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file     system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash     the system if the directory exists. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14314)

  - A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in     XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading     to a denial of service. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14385)

  - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new     filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the     current umask is not considered. (CVE-2020-24394)

  - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers     to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. (CVE-2020-25212)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5437 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to     be flagged as corrupt (CVE-2020-14385)

    * kernel: The flow_dissector feature allows device tracking (CVE-2019-18282)

    * kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not     aligned. (CVE-2020-10769)

    * kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

    * kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

    * kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

    * kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read     overflow (CVE-2020-25643)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * WARNING in set_restore_sigmask  at ./arch/x86/include/asm/thread_info.h:298 sigsuspend+0x6d/0x70     (BZ#1704650)

    * [i40e] VFs see other VF's outgoing traffic (BZ#1845677)

    * [Hyper-V][RHEL7] Two fixes for kdump over network (BZ#1846667)

    * Loop in __run_timers() because base->timer_jiffies is very far behind causes a lockup condition.
    (BZ#1849716)

    * XFS transaction overrun when running docker on VMWARE  (overlay fs) (BZ#1857203)

    * RHEL 7.9 NVMe/IB - Host crash encountered during array upgrade (BZ#1857397)

    * False positive hard lockup detected while disabling the hard lockup detector via sysctl -w     kernel.watchdog=0 (BZ#1860661)

    * [Hyper-V][RHEL-7] Only notify Hyper-V for die events that are oops (BZ#1868130)

    * Linux kernel crash due to openvswitch module (BZ#1869190)

    * 'nodfs' option not working when using SMB2+ (BZ#1873033)

    * RHEL7.7 zstream - ESS - kernel panic triggered by freelist pointer corruption (BZ#1873189)

    * destroy_cfs_bandwidth() is called by free_fair_sched_group() without calling init_cfs_bandwidth()     (BZ#1878000)

    * NULL pointer at nvme_rdma_setup_ctrl+0x1c2/0x8d0 [nvme_rdma] when discover E5700 (BZ#1878950)

    * IB Infiniband RDMA mlx5_ib is freeing a kmalloc-512 cache that it does not own causing memory     corruption. (BZ#1880184)

    * [Azure][RHEL7] Two Patches Needed To Enable Azure Host Time-syncing in VMs (BZ#1884735)

    * connect AF_UNSPEC on a connecting AF_INET6 socket returns an error (BZ#1886305)

    * Rebuilding the grub with the CPU flag 'avx' disabled (clearcpuid=156) triggers kernel panic in     xor_avx_2() (BZ#1886792)

    * nf_conntrack_sctp.h is not usable due to a missing commit (BZ#1887975)

    * Starting pvmove on top of physical volumes on MD devices causes IO error on ongoing IO (BZ#1890059)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5441 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to     be flagged as corrupt (CVE-2020-14385)

    * kernel: The flow_dissector feature allows device tracking (CVE-2019-18282)

    * kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not     aligned. (CVE-2020-10769)

    * kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

    * kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

    * kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

    * kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read     overflow (CVE-2020-25643)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update to the latest RHEL7.9.z2 source tree (BZ#1873318)

    * deadlock between handle_mm_fault() and ptep_clear_flush() (BZ#1888872)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5437 advisory.

    - [netdrv] hdlc_ppp: add range checks in ppp_cp_parse_cr() (Guillaume Nault) [1882078] {CVE-2020-25643}
    - [fs] ext4: fix potential negative array index in do_split() (Pavel Reichl) [1846164] {CVE-2020-14314}
    - [fs] nfsd: apply umask on fs without ACL support ('J. Bruce Fields') [1870215] {CVE-2020-24394}
    - [fs] nfs: Fix getxattr kernel panic and memory overflow (Benjamin Coddington) [1880893] {CVE-2020-25212}
    - [net] flow_dissector: switch to siphash (Davide Caratti) [1835614] {CVE-2019-18282}
    - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875317] {CVE-2020-14385}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:5437-1 advisory.

  - kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be     flagged as corrupt (CVE-2020-14385)

  - kernel: The flow_dissector feature allows device tracking (CVE-2019-18282)

  - kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not     aligned. (CVE-2020-10769)

  - kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

  - kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

  - kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

  - kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow     (CVE-2020-25643)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In calc_vm_may_flags of ashmem.c, there is a possible     arbitrary write to shared memory due to a permissions     bypass. This could lead to local escalation of     privilege by corrupting memory shared between     processes, with no additional execution privileges     needed. User interaction is not needed for     exploitation. Product: Android Versions: Android kernel     Android ID: A-142938932(CVE-2020-0009)

  - A flaw was found in the Linux Kernel in versions after     4.5-rc1 in the way mremap handled DAX Huge Pages. This     flaw allows a local attacker with access to a DAX     enabled storage to escalate their privileges on the     system.(CVE-2020-10757)

  - go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)

  - In the Android kernel in F2FS driver there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with system execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2019-9445)

  - A flaw was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further processing.(CVE-2020-10751)

  - An issue was discovered in the Linux kernel before     5.4.7. The prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)

  - ** DISPUTED ** An issue was discovered in the Linux     kernel through 5.7.1. drivers/tty/vt/keyboard.c has an     integer overflow if k_ascii is called several times in     a row, aka CID-b86dab054059. NOTE: Members in the     community argue that the integer overflow does not lead     to a security issue in this case.(CVE-2020-13974)

  - An issue was discovered in the Linux kernel before     5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a     reference count is mishandled, aka     CID-a3e23f719f5c.(CVE-2019-20811)

  - A flaw was found in the prctl() function, where it can     be used to enable indirect branch speculation after it     has been disabled. This call incorrectly reports it as     being 'force disabled' when it is not and opens the     system to Spectre v2 attacks. The highest threat from     this vulnerability is to     confidentiality.(CVE-2020-10768)

  - A flaw was found in the Linux kernel's implementation     of the Enhanced IBPB (Indirect Branch Prediction     Barrier). The IBPB mitigation will be disabled when     STIBP is not available or when the Enhanced Indirect     Branch Restricted Speculation (IBRS) is available. This     flaw allows a local attacker to perform a Spectre V2     style attack when this configuration is active. The     highest threat from this vulnerability is to     confidentiality.(CVE-2020-10767)

  - A logic bug flaw was found in the Linux kernel's     implementation of SSBD. A bug in the logic handling     allows an attacker with a local account to disable SSBD     protection during a context switch when additional     speculative execution mitigations are in place. This     issue was introduced when the per task/process     conditional STIPB switching was added on top of the     existing SSBD switching. The highest threat from this     vulnerability is to confidentiality.(CVE-2020-10766)

  - A new domain bypass transient execution attack known as     Special Register Buffer Data Sampling (SRBDS) has been     found. This flaw allows data values from special     internal registers to be leaked by an attacker able to     execute code on any core of the CPU. An unprivileged,     local attacker can use this flaw to infer values     returned by affected instructions known to be commonly     used during cryptographic operations that rely on     uniqueness, secrecy, or both.(CVE-2020-0543)

  - In the Linux kernel before 5.4.16, a race condition in     tty->disc_data handling in the slip and slcan line     discipline could lead to a use-after-free, aka     CID-0ace17d56824. This affects drivers/net/slip/slip.c     and drivers/net/can/slcan.c.(CVE-2020-14416)

  - The flow_dissector feature in the Linux kernel 4.3     through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs     because the auto flowlabel of a UDP IPv6 packet relies     on a 32-bit hashrnd value as a secret, and because     jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be     inferred by an attacker. This affects     net/core/flow_dissector.c and related     code.(CVE-2019-18282)

  - The VFIO PCI driver in the Linux kernel through 5.6.13     mishandles attempts to access disabled memory     space.(CVE-2020-12888)

  - In the Linux kernel through 5.7.6, usbtest_disconnect     in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)

  - A flaw was found in the ZRAM kernel module, where a     user with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):An issue was discovered in     the Linux kernel before 5.2. There is a NULL pointer     dereference in tw5864_handle_frame() in     drivers/media/pci/tw5864/tw5864-video.c, which may     cause denial of service, aka     CID-2e7682ebfc75.(CVE-2019-20806)A flaw was found in     the ZRAM kernel module, where a user with a local     account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)In the Linux kernel before     5.4.16, a race condition in tty->disc_data handling in     the slip and slcan line discipline could lead to a     use-after-free, aka CID-0ace17d56824. This affects     drivers/ net/slip/slip.c and drivers/     net/can/slcan.c.(CVE-2020-14416)The VFIO PCI driver in     the Linux kernel through 5.6.13 mishandles attempts to     access disabled memory space.(CVE-2020-12888)The     flow_dissector feature in the Linux kernel 4.3 through     5.x before 5.3.10 has a device tracking vulnerability,     aka CID-55667441c84f. This occurs because the auto     flowlabel of a UDP IPv6 packet relies on a 32-bit     hashrnd value as a secret, and because jhash (instead     of siphash) is used. The hashrnd value remains the same     starting from boot time, and can be inferred by an     attacker. This affects net/core/flow_dissector.c and     related code.(CVE-2019-18282)In the Linux kernel     through 5.7.6, usbtest_disconnect in     drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)An issue was     discovered in the Linux kernel before 5.0.6. In     rx_queue_add_kobject() and netdev_queue_add_kobject()     in net/core/ net-sysfs.c, a reference count is     mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)A flaw     was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further     processing.(CVE-2020-10751)In the Android kernel in     F2FS driver there is a possible out of bounds read due     to a missing bounds check. This could lead to local     information disclosure with system execution privileges     needed. User interaction is not needed for     exploitation.(CVE-2019-9445)A flaw was found in the     Linux kernel's implementation of Userspace core dumps.
    This flaw allows an attacker with a local account to     crash a trivial program and exfiltrate private kernel     data.(CVE-2020-10732)go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)Legacy pairing and     secure-connections pairing authentication in Bluetooth(r)     BR/EDR Core Specification v5.2 and earlier may allow an     unauthenticated user to complete authentication without     pairing credentials via adjacent access. An     unauthenticated, adjacent attacker could impersonate a     Bluetooth BR/EDR master or slave to pair with a     previously paired remote device to successfully     complete the authentication procedure without knowing     the link key.(CVE-2020-10135)An issue was discovered in     the Linux kernel before 5.4.7. The     prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)An issue was     discovered in the Linux kernel through 5.7.1.
    drivers/tty/vt/keyboard.c has an integer overflow if     k_ascii is called several times in a row, aka     CID-b86dab054059. NOTE: Members in the community argue     that the integer overflow does not lead to a security     issue in this case.(CVE-2020-13974)In calc_vm_may_flags     of ashmem.c, there is a possible arbitrary write to     shared memory due to a permissions bypass. This could     lead to local escalation of privilege by corrupting     memory shared between processes, with no additional     execution privileges needed. User interaction is not     needed for exploitation. Product: Android Versions:
    Android kernel Android ID: A-142938932(CVE-2020-0009)A     flaw was found in the Linux Kernel in versions after     4.5-rc1 in the way mremap handled DAX Huge Pages. This     flaw allows a local attacker with access to a DAX     enabled storage to escalate their privileges on the     system.(CVE-2020-10757)gadget_dev_desc_UDC_store in     drivers/usb/gadget/configfs.c in the Linux kernel     through 5.6.13 relies on kstrdup without considering     the possibility of an internal '\0' value, which allows     attackers to trigger an out-of-bounds read, aka     CID-15753588bcd4.(CVE-2020-13143)Incomplete cleanup     from specific special register read operations in some     Intel(R) Processors may allow an authenticated user to     potentially enable information disclosure via local     access.(CVE-2020-0543)A flaw was found in the prctl()     function, where it can be used to enable indirect     branch speculation after it has been disabled. This     call incorrectly reports it as being 'force disabled'     when it is not and opens the system to Spectre v2     attacks. The highest threat from this vulnerability is     to confidentiality.(CVE-2020-10768)A flaw was found in     the Linux kernel's implementation of the Enhanced IBPB     (Indirect Branch Prediction Barrier). The IBPB     mitigation will be disabled when STIBP is not available     or when the Enhanced Indirect Branch Restricted     Speculation (IBRS) is available. This flaw allows a     local attacker to perform a Spectre V2 style attack     when this configuration is active. The highest threat     from this vulnerability is to     confidentiality.(CVE-2020-10767)A logic bug flaw was     found in the Linux kernel's implementation of SSBD. A     bug in the logic handling allows an attacker with a     local account to disable SSBD protection during a     context switch when additional speculative execution     mitigations are in place. This issue was introduced     when the per task/process conditional STIPB switching     was added on top of the existing SSBD switching. The     highest threat from this vulnerability is to     confidentiality.(CVE-2020-10766)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.01, has kernel packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Linux kernel's NFS     implementation, all versions 3.x and all versions 4.x up     to 4.20. An attacker, who is able to mount an exported     NFS filesystem, is able to trigger a null pointer     dereference by using an invalid NFS sequence. This can     panic the machine and deny access to the NFS server. Any     outstanding disk writes to the NFS server will be lost.
    (CVE-2018-16871)

  - ieee802154_create in net/ieee802154/socket.c in the     AF_IEEE802154 network module in the Linux kernel through     5.3.2 does not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-e69dbd4619e7. (CVE-2019-17053)

  - base_sock_create in drivers/isdn/mISDN/socket.c in the     AF_ISDN network module in the Linux kernel through 5.3.2     does not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21. (CVE-2019-17055)

  - The flow_dissector feature in the Linux kernel 4.3     through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because     the auto flowlabel of a UDP IPv6 packet relies on a     32-bit hashrnd value as a secret, and because jhash     (instead of siphash) is used. The hashrnd value remains     the same starting from boot time, and can be inferred by     an attacker. This affects net/core/flow_dissector.c and     related code. (CVE-2019-18282)

  - An issue was discovered in net/ipv4/sysctl_net_ipv4.c in     the Linux kernel before 5.0.11. There is a     net/ipv4/tcp_input.c signed integer overflow in     tcp_ack_update_rtt() when userspace writes a very large     integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading     to a denial of service or possibly unspecified other     impact, aka CID-19fad20d15a6. (CVE-2019-18805)

  - A memory leak in the mlx5_fpga_conn_create_cq() function     in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c     in the Linux kernel before 5.3.11 allows attackers to     cause a denial of service (memory consumption) by     triggering mlx5_vector2eqn() failures, aka     CID-c8c2a057fdc7. (CVE-2019-19045)

  - ** DISPUTED ** A memory leak in the     nl80211_get_ftm_responder_stats() function in     net/wireless/nl80211.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service     (memory consumption) by triggering nl80211hdr_put()     failures, aka CID-1399c59fa929. NOTE: third parties     dispute the relevance of this because it occurs on a     code path where a successful allocation has already     occurred. (CVE-2019-19055)

  - A memory leak in the bnxt_re_create_srq() function in     drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial     of service (memory consumption) by triggering copy to     udata failures, aka CID-4a9d46a9fe14. (CVE-2019-19077)

  - In the Linux kernel before 5.3.9, there are multiple     out-of-bounds write bugs that can be caused by a     malicious USB device in the Linux kernel HID drivers,     aka CID-d9d4b1e46d95. This affects drivers/hid/hid-     axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c,     drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c,     drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-     microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-     tmff.c, and drivers/hid/hid-zpff.c. (CVE-2019-19532)

  - In the Linux kernel before 5.3.11, there is an info-leak     bug that can be caused by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka     CID-f7a1337f0d29. (CVE-2019-19534)

  - In the Linux kernel 5.4.0-rc2, there is a use-after-free     (read) in the __blk_add_trace function in     kernel/trace/blktrace.c (which is used to fill out a     blk_io_trace structure and place it in a per-cpu sub-     buffer). (CVE-2019-19768)

  - A memory leak in the kernel_read_file function in     fs/exec.c in the Linux kernel through 4.20.11 allows     attackers to cause a denial of service (memory     consumption) by triggering vfs_read failures.
    (CVE-2019-8980)

  - A NULL pointer dereference flaw was found in the Linux     kernel's SELinux subsystem in versions before 5.7. This     flaw occurs while importing the Commercial IP Security     Option (CIPSO) protocol's category bitmap into the     SELinux extensible bitmap via the'     ebitmap_netlbl_import' routine. While processing the     CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security     attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue     leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This     flaw allows a remote network user to crash the system     kernel, resulting in a denial of service.
    (CVE-2020-10711)

  - In the Linux kernel through 5.6.7 on the s390 platform,     code execution may occur because of a race condition, as     demonstrated by code in enable_sacf_uaccess in     arch/s390/lib/uaccess.c that fails to protect against a     concurrent page table upgrade, aka CID-3f777e19d171. A     crash could also occur. (CVE-2020-11884)

  - An issue was discovered in the Linux kernel before     5.6.5. There is a use-after-free in block/bfq-iosched.c     related to bfq_idle_slice_timer_body. (CVE-2020-12657)

  - A flaw was discovered in the way that the KVM hypervisor     handled instruction emulation for an L2 guest when     nested virtualisation is enabled. Under some     circumstances, an L2 guest may trick the L0 guest into     accessing sensitive L1 resources that should be     inaccessible to the L2 guest. (CVE-2020-2732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5715 advisory.

    - x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross)  [Orabug: 31422209]     {CVE-2020-0543}
    - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross)  [Orabug:
    31422209]  {CVE-2020-0543}
    - x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross)  [Orabug: 31422209]  {CVE-2020-0543}
    - x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross)  [Orabug: 31422209]  {CVE-2020-0543}
    - libertas: Fix two buffer overflows at parsing bss descriptor (Wen Huang)  [Orabug: 31351306]     {CVE-2019-14896} {CVE-2019-14897} {CVE-2019-14897}
    - KVM: SVM: Fix potential memory leak in svm_cpu_init() (Miaohe Lin)  [Orabug: 31350457]  {CVE-2020-12768}
    - net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq (Navid Emamdoost)  [Orabug: 31301340]     {CVE-2019-19045}
    - mdio_bus: Fix use-after-free on device_register fails (YueHaibing)  [Orabug: 31222291]  {CVE-2019-12819}
    - USB: core: Fix races in character device registration and deregistraion (Alan Stern)  [Orabug: 31317666]     {CVE-2019-19537}
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring (Navid Emamdoost)  [Orabug: 31263146]     {CVE-2019-19057}
    - mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf (Navid Emamdoost)  [Orabug: 31246301]     {CVE-2019-19056}
    - media: technisat-usb2: break out of loop at end of buffer (Sean Young)  [Orabug: 31224553]     {CVE-2019-15505}
    - Input: ff-memless - kill timer in destroy() (Oliver Neukum)  [Orabug: 31213690]  {CVE-2019-19524}
    - Input: add safety guards to input_set_keycode() (Dmitry Torokhov)  [Orabug: 31200557]  {CVE-2019-20636}
    - brcmfmac: add subtype check for event handling in data path (Arend van Spriel)  [Orabug: 31234675]     {CVE-2019-9503}
    - iwlwifi: dbg_ini: fix memory leak in alloc_sgtable (Navid Emamdoost)  [Orabug: 31233656]     {CVE-2019-19058}
    - coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (Andrea Arcangeli)     [Orabug: 31222107]  {CVE-2019-11599}
    - ext4: add more paranoia checking in ext4_expand_extra_isize handling (Theodore Tso)  [Orabug: 31218807]     {CVE-2019-19767}
    - ext4: fix use-after-free race with debug_want_extra_isize (Barret Rhoden)  [Orabug: 31218807]     {CVE-2019-19767}
    - media: xirlink_cit: add missing descriptor sanity checks (Johan Hovold)  [Orabug: 31213766]     {CVE-2020-11668}
    - media: ov519: add missing endpoint sanity checks (Johan Hovold)  [Orabug: 31213757]  {CVE-2020-11608}
    - media: stv06xx: add missing descriptor sanity checks (Johan Hovold)  [Orabug: 31200578]     {CVE-2020-11609}
    - net/flow_dissector: switch to siphash (Eric Dumazet)  [Orabug: 30872863]  {CVE-2019-18282}
    - brcmfmac: assure SSID length from firmware is limited (Arend van Spriel)  [Orabug: 30872843]     {CVE-2019-9500}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1567 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)

    * kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service     (CVE-2019-8980)

    * kernel: unprivileged users able to create RAW sockets  in AF_IEEE802154 network protocol.
    (CVE-2019-17053)

    * kernel: unprivileged users able to create RAW sockets in AF_ISDN  network protocol. (CVE-2019-17055)

    * kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)

    * kernel: information leak bug caused  by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)

    * kernel: some ipv6 protocols not encrypted over ipsec tunnel. (CVE-2020-1749)

    * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR     (CVE-2019-10639)

    * kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure     (CVE-2019-15090)

    * kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

    * kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)

    * kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)

    * kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS)     (CVE-2019-19073)

    * kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)

    * kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-     bound applications (CVE-2019-19922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RT: update RT source tree to the RHEL-8.2 tree (BZ#1708716)

    * KVM-RT guest fails boot with emulatorsched (BZ#1712781)

    * 8 vCPU guest need max latency < 20 us with stress [RT-8.2] (BZ#1757165)

    * Request nx_huge_pages=N as default value to avoid kvm-rt guest large latency spike [rt-8] (BZ#1788352)

    * RT: Add rpm Provide of 'kernel' to indicate that this is a kernel package (BZ#1796284)

    * [RHEL8] RT kernel signed by test certificate and not Red Hat Secure Boot (BZ#1806871)

    Enhancement(s):

    * update to the upstream 5.x RT patchset (BZ#1680161)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1769 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)

    * kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service     (CVE-2019-8980)

    * kernel: unprivileged users able to create RAW sockets  in AF_IEEE802154 network protocol.
    (CVE-2019-17053)

    * kernel: unprivileged users able to create RAW sockets in AF_ISDN  network protocol. (CVE-2019-17055)

    * kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)

    * kernel: information leak bug caused  by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)

    * kernel: some ipv6 protocols not encrypted over ipsec tunnel. (CVE-2020-1749)

    * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR     (CVE-2019-10639)

    * kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure     (CVE-2019-15090)

    * kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

    * kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)

    * kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)

    * kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS)     (CVE-2019-19073)

    * kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)

    * kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-     bound applications (CVE-2019-19922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update also fixes several bugs and adds various enhancements. Documentation for these changes is     available from the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2018-13093, CVE-2018-13094

Wen Xu from SSLab at Gatech reported several NULL pointer dereference flaws that may be triggered when mounting and operating a crafted XFS volume. An attacker able to mount arbitrary XFS volumes could use this to cause a denial of service (crash).

CVE-2018-20976

It was discovered that the XFS file-system implementation did not correctly handle some mount failure conditions, which could lead to a use-after-free. The security impact of this is unclear.

CVE-2018-21008

It was discovered that the rsi wifi driver did not correctly handle some failure conditions, which could lead to a use-after- free. The security impact of this is unclear.

CVE-2019-0136

It was discovered that the wifi soft-MAC implementation (mac80211) did not properly authenticate Tunneled Direct Link Setup (TDLS) messages.
A nearby attacker could use this for denial of service (loss of wifi connectivity).

CVE-2019-2215

The syzkaller tool discovered a use-after-free vulnerability in the Android binder driver. A local user on a system with this driver enabled could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation. However, this driver is not enabled on Debian packaged kernels.

CVE-2019-10220

Various developers and researchers found that if a crafted file- system or malicious file server presented a directory with filenames including a '/' character, this could confuse and possibly defeat security checks in applications that read the directory.

The kernel will now return an error when reading such a directory, rather than passing the invalid filenames on to user-space.

CVE-2019-14615

It was discovered that Intel 9th and 10th generation GPUs did not clear user-visible state during a context switch, which resulted in information leaks between GPU tasks. This has been mitigated in the i915 driver.

The affected chips (gen9 and gen10) are listed at <https://en.wikipedia.org/wiki/List_of_Intel_graphics_proces sing_units#Gen9>.

CVE-2019-14814, CVE-2019-14815, CVE-2019-14816

Multiple bugs were discovered in the mwifiex wifi driver, which could lead to heap buffer overflows. A local user permitted to configure a device handled by this driver could probably use this for privilege escalation.

CVE-2019-14895, CVE-2019-14901

ADLab of Venustech discovered potential heap buffer overflows in the mwifiex wifi driver. On systems using this driver, a malicious Wireless Access Point or adhoc/P2P peer could use these to cause a denial of service (memory corruption or crash) or possibly for remote code execution.

CVE-2019-14896, CVE-2019-14897

ADLab of Venustech discovered potential heap and stack buffer overflows in the libertas wifi driver. On systems using this driver, a malicious Wireless Access Point or adhoc/P2P peer could use these to cause a denial of service (memory corruption or crash) or possibly for remote code execution.

CVE-2019-15098

Hui Peng and Mathias Payer reported that the ath6kl wifi driver did not properly validate USB descriptors, which could lead to a NULL pointer derefernce. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops).

CVE-2019-15217

The syzkaller tool discovered that the zr364xx mdia driver did not correctly handle devices without a product name string, which could lead to a NULL pointer dereference. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops).

CVE-2019-15291

The syzkaller tool discovered that the b2c2-flexcop-usb media driver did not properly validate USB descriptors, which could lead to a NULL pointer dereference. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops).

CVE-2019-15505

The syzkaller tool discovered that the technisat-usb2 media driver did not properly validate incoming IR packets, which could lead to a heap buffer over-read. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops) or to read sensitive information from kernel memory.

CVE-2019-15917

The syzkaller tool found a race condition in code supporting UART-attached Bluetooth adapters, which could lead to a use- after-free. A local user with access to a pty device or other suitable tty device could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-16746

It was discovered that the wifi stack did not validate the content of beacon heads provided by user-space for use on a wifi interface in Access Point mode, which could lead to a heap buffer overflow. A local user permitted to configure a wifi interface could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-17052, CVE-2019-17053, CVE-2019-17054, CVE-2019-17055, CVE-2019-17056

Ori Nimron reported that various network protocol implementations

  - AX.25, IEEE 802.15.4, Appletalk, ISDN, and NFC - allowed     all users to create raw sockets. A local user could use     this to send arbitrary packets on networks using those     protocols.

CVE-2019-17075

It was found that the cxgb4 Infiniband driver requested DMA (Direct Memory Access) to a stack-allocated buffer, which is not supported and on some systems can result in memory corruption of the stack. A local user might be able to use this for denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-17133

Nicholas Waisman reported that the wifi stack did not valdiate received SSID information before copying it, which could lead to a buffer overflow if it is not validated by the driver or firmware. A malicious Wireless Access Point might be able to use this to cause a denial of service (memory corruption or crash) or for remote code execution.

CVE-2019-17666

Nicholas Waisman reported that the rtlwifi wifi drivers did not properly validate received P2P information, leading to a buffer overflow. A malicious P2P peer could use this to cause a denial of service (memory corruption or crash) or for remote code execution.

CVE-2019-18282

Jonathan Berger, Amit Klein, and Benny Pinkas discovered that the generation of UDP/IPv6 flow labels used a weak hash function, 'jhash'.
This could enable tracking individual computers as they communicate with different remote servers and from different networks. The 'siphash' function is now used instead.

CVE-2019-18683

Multiple race conditions were discovered in the vivid media driver, used for testing Video4Linux2 (V4L2) applications, These race conditions could result in a use-after-free. On a system where this driver is loaded, a user with permission to access media devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-18809

Navid Emamdoost discovered a potential memory leak in the af9005 media driver if the device fails to respond to a command. The security impact of this is unclear.

CVE-2019-19037

It was discovered that the ext4 filesystem driver did not correctly handle directories with holes (unallocated regions) in them. An attacker able to mount arbitrary ext4 volumes could use this to cause a denial of service (crash).

CVE-2019-19051

Navid Emamdoost discovered a potential memory leak in the i2400m wimax driver if the software rfkill operation fails. The security impact of this is unclear.

CVE-2019-19052

Navid Emamdoost discovered a potential memory leak in the gs_usb CAN driver if the open (interface-up) operation fails. The security impact of this is unclear.

CVE-2019-19056, CVE-2019-19057

Navid Emamdoost discovered potential memory leaks in the mwifiex wifi driver if the probe operation fails. The security impact of this is unclear.

CVE-2019-19062

Navid Emamdoost discovered a potential memory leak in the AF_ALG subsystem if the CRYPTO_MSG_GETALG operation fails. A local user could possibly use this to cause a denial of service (memory exhaustion).

CVE-2019-19066

Navid Emamdoost discovered a potential memory leak in the bfa SCSI driver if the get_fc_host_stats operation fails. The security impact of this is unclear.

CVE-2019-19068

Navid Emamdoost discovered a potential memory leak in the rtl8xxxu wifi driver, in case it fails to submit an interrupt buffer to the device. The security impact of this is unclear.

CVE-2019-19227

Dan Carpenter reported missing error checks in the Appletalk protocol implementation that could lead to a NULL pointer dereference. The security impact of this is unclear.

CVE-2019-19332

The syzkaller tool discovered a missing bounds check in the KVM implementation for x86, which could lead to a heap buffer overflow. A local user permitted to use KVM could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19447

It was discovered that the ext4 filesystem driver did not safely handle unlinking of an inode that, due to filesystem corruption, already has a link count of 0. An attacker able to mount arbitrary ext4 volumes could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19523

The syzkaller tool discovered a use-after-free bug in the adutux USB driver. An attacker able to add and remove USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19524

The syzkaller tool discovered a race condition in the ff-memless library used by input drivers. An attacker able to add and remove USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19525

The syzkaller tool discovered a use-after-free bug in the atusb driver for IEEE 802.15.4 networking. An attacker able to add and remove USB devices could possibly use this to cause a denial of service (memory corruption or crash) or for privilege escalation.

CVE-2019-19527

The syzkaller tool discovered that the hiddev driver did not correctly handle races between a task opening the device and disconnection of the underlying hardware. A local user permitted to access hiddev devices, and able to add and remove USB devices, could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19530

The syzkaller tool discovered a potential use-after-free in the cdc-acm network driver. An attacker able to add USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19531

The syzkaller tool discovered a use-after-free bug in the yurex USB driver. An attacker able to add and remove USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19532

The syzkaller tool discovered a potential heap buffer overflow in the hid-gaff input driver, which was also found to exist in many other input drivers. An attacker able to add USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19533

The syzkaller tool discovered that the ttusb-dec media driver was missing initialisation of a structure, which could leak sensitive information from kernel memory.

CVE-2019-19534, CVE-2019-19535, CVE-2019-19536

The syzkaller tool discovered that the peak_usb CAN driver was missing initialisation of some structures, which could leak sensitive information from kernel memory.

CVE-2019-19537

The syzkaller tool discovered race conditions in the USB stack, involving character device registration. An attacker able to add USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19767

The syzkaller tool discovered that crafted ext4 volumes could trigger a buffer overflow in the ext4 filesystem driver. An attacker able to mount such a volume could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19947

It was discovered that the kvaser_usb CAN driver was missing initialisation of some structures, which could leak sensitive information from kernel memory.

CVE-2019-19965

Gao Chuan reported a race condition in the libsas library used by SCSI host drivers, which could lead to a NULL pointer dereference. An attacker able to add and remove SCSI devices could use this to cause a denial of service (BUG/oops).

CVE-2019-20096

The Hulk Robot tool discovered a potential memory leak in the DCCP protocol implementation. This may be exploitable by local users, or by remote attackers if the system uses DCCP, to cause a denial of service (out of memory).

For Debian 8 'Jessie', these problems have been fixed in version 4.9.210-1~deb8u1. This update additionally fixes Debian bugs #869511 and 945023; and includes many more bug fixes from stable updates 4.9.190-4.9.210 inclusive.

We recommend that you upgrade your linux-4.9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	critical
164578	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.2)	Nessus	Misc.	high
164567	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.6)	Nessus	Misc.	medium
154699	F5 Networks BIG-IP : Linux kernel vulnerability (K32380005)	Nessus	F5 Networks Local Security Checks	medium
145850	CentOS 8 : kernel (CESA-2020:1769)	Nessus	CentOS Local Security Checks	critical
144731	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2021-1039)	Nessus	Huawei Local Security Checks	critical
144549	CentOS 7 : kernel (RHSA-2020:5437)	Nessus	CentOS Local Security Checks	high
144404	RHEL 7 : kernel (RHSA-2020:5437)	Nessus	Red Hat Local Security Checks	high
144402	RHEL 7 : kernel-rt (RHSA-2020:5441)	Nessus	Red Hat Local Security Checks	high
144333	Oracle Linux 7 : kernel (ELSA-2020-5437)	Nessus	Oracle Linux Local Security Checks	high
144295	Scientific Linux Security Update : kernel on SL7.x x86_64 (2020:5437)	Nessus	Scientific Linux Local Security Checks	high
139995	EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1892)	Nessus	Huawei Local Security Checks	high
139137	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1807)	Nessus	Huawei Local Security Checks	high
138766	NewStart CGSL MAIN 6.01 : kernel Multiple Vulnerabilities (NS-SA-2020-0030)	Nessus	NewStart CGSL Local Security Checks	critical
137291	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5715)	Nessus	Oracle Linux Local Security Checks	critical
136116	RHEL 8 : kernel-rt (RHSA-2020:1567)	Nessus	Red Hat Local Security Checks	critical
136115	RHEL 8 : kernel (RHSA-2020:1769)	Nessus	Red Hat Local Security Checks	critical
134240	Debian DLA-2114-1 : linux-4.9 security update	Nessus	Debian Local Security Checks	critical
132530	Photon OS 3.0: Linux PHSA-2019-3.0-0041	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2019-18282

medium

Tenable Plugins

critical

critical

critical

high

medium

medium

critical

critical

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical