A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3.

New kernel packages are available for Slackware 14.2 to fix a security issue.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4904-1 advisory.

    Ben Harris discovered that the Linux kernel would strip extended privilege attributes of files when     performing a failed unprivileged system call. A local attacker could use this to cause a denial of     service. (CVE-2015-1350)

    Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PVR USB devices in the Linux     kernel did not properly handle some error conditions. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16644)

    It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real     PID value while inside a PID namespace. A local attacker could use this to expose sensitive information.
    (CVE-2017-5967)

    Wen Xu discovered that the xfs file system implementation in the Linux kernel did not properly validate     the number of extents in an inode. An attacker could use this to construct a malicious xfs image that,     when mounted, could cause a denial of service (system crash). (CVE-2018-13095)

    It was discovered that the Fujitsu ES network device driver for the Linux kernel did not properly check     for errors in some situations, leading to a NULL pointer dereference. A local attacker could use this to     cause a denial of service. (CVE-2019-16231)

    It was discovered that the Marvell 8xxx Libertas WLAN device driver in the Linux kernel did not properly     check for errors in certain situations, leading to a NULL pointer dereference. A local attacker could     possibly use this to cause a denial of service. (CVE-2019-16232)

    It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19061)

    It was discovered that a race condition existed in the floppy device driver in the Linux kernel. An     attacker with access to the floppy device could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-20261)

    Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schnherr discovered that the Xen     paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in     some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host     domain crash). (CVE-2021-26930)

    Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain     error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a     denial of service (host domain crash). (CVE-2021-26931)

    Jan Beulich discovered that the Xen netback backend in the Linux kernel did not properly handle certain     error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a     denial of service (host domain crash). (CVE-2021-28038)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4526-1 advisory.

    It was discovered that the AMD Cryptographic Coprocessor device driver in the Linux kernel did not     properly deallocate memory in some situations. A local attacker could use this to cause a denial of     service (memory exhaustion). (CVE-2019-18808)

    It was discovered that the Conexant 23885 TV card device driver for the Linux kernel did not properly     deallocate memory in some error conditions. A local attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2019-19054)

    It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19061)

    It was discovered that the AMD Audio Coprocessor driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker with the ability to load modules could use this to     cause a denial of service (memory exhaustion). (CVE-2019-19067)

    It was discovered that the Atheros HTC based wireless driver in the Linux kernel did not properly     deallocate in certain error conditions. A local attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2019-19073, CVE-2019-19074)

    It was discovered that the F2FS file system in the Linux kernel did not properly perform bounds checking     in some situations, leading to an out-of- bounds read. A local attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2019-9445)

    It was discovered that the VFIO PCI driver in the Linux kernel did not properly handle attempts to access     disabled memory spaces. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2020-12888)

    It was discovered that the cgroup v2 subsystem in the Linux kernel did not properly perform reference     counting in some situations, leading to a NULL pointer dereference. A local attacker could use this to     cause a denial of service or possibly gain administrative privileges. (CVE-2020-14356)

    It was discovered that the state of network RNG in the Linux kernel was potentially observable. A remote     attacker could use this to expose sensitive information. (CVE-2020-16166)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.192-147.314. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1480 advisory.

    2024-06-19: CVE-2020-14356 was added to this advisory.

    The Serial Attached SCSI (SAS) implementation in the Linux kernel mishandles a mutex within libsas. This     allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.
    (CVE-2017-18232)

    The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel can cause a NULL     pointer dereference in xfs_bmapi_write function. An attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted xfs filesystem image to cause a kernel panic and thus a     denial of service. (CVE-2018-10323)

    The Linux kernel was found vulnerable to a NULL pointer dereference in the drivers/net/phy/mdio-bcm-     unimac.c:unimac_mdio_probe() function caused by an unchecked return value from the platform_get_resource()     function. A successful flaw exploitation can cause a system panic and a denial of service. This flaw is     believed not to be an attacker triggerable as bad return value can be caused by hardware misconfiguration.
    (CVE-2018-8043)

    A flaw was found in the AMD Cryptographic Co-processor driver in the Linux kernel. An attacker, able to     send invalid SHA type commands, could cause the system to crash. The highest threat from this     vulnerability is to system availability. (CVE-2019-18808)

    A flaw was found in the Linux kernel. The CX23888 Integrated Consumer Infrared Controller probe code     handles resource cleanup low memory conditions. A local attacker able to induce low memory conditions     could use this flaw to crash the system. The highest threat from this vulnerability is to system     availability. (CVE-2019-19054)

    A memory leak flaw was found in the adis_update_scan_mode_burst() function in     drivers/iio/imu/adis_buffer.c in the Linux kernel. This flaw allows attackers to cause a denial of     service. (CVE-2019-19061)

    Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow     attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout()     failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the     htc_connect_service() function, aka CID-853acf7caf10. (CVE-2019-19073)

    A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
    (CVE-2019-19074)

    A flaw was found in the way Linux kernel's KVM hypervisor handled deferred TLB flush requests from guest.
    A race condition may occur between the guest issuing a deferred TLB flush request to KVM, and then KVM     handling and acknowledging it. This may result in invalid address translations from TLB being used to     access guest memory, leading to a potential information leakage issue. An attacker may use this flaw to     access guest memory locations that it should not have access to. (CVE-2019-3016)

    In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check.
    This could lead to local information disclosure with system execution privileges needed. User interaction     is not needed for exploitation. (CVE-2019-9445)

    A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device.
    With this vulnerability, continually reading the device may consume a large amount of system memory and     cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making     the system inoperable. (CVE-2020-10781)

    A flaw was discovered in the XFS source in the Linux kernel. This flaw allows an attacker with the ability     to mount an XFS filesystem, to trigger a denial of service while attempting to sync a file located on an     XFS v5 image with crafted metadata. (CVE-2020-12655)

    A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could use this flaw to crash the system or escalate their     privileges on the system. (CVE-2020-14356)

    In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak,     aka CID-28ebeb8db770. (CVE-2020-15393)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2186)

  - The snd_compr_tstamp function in     sound/core/compress_offload.c in the Linux kernel     through 4.7, as used in Android before 2016-08-05 on     Nexus 5 and 7 (2013) devices, does not properly     initialize a timestamp data structure, which allows     attackers to obtain sensitive information via a crafted     application, aka Android internal bug 28770164 and     Qualcomm internal bug CR568717.(CVE-2014-9892)

  - A memory leak in the cx23888_ir_probe() function in     drivers/media/pci/cx23885/cx23888-ir.c in the Linux     kernel through 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering     kfifo_alloc() failures, aka     CID-a7b2df76b42b.(CVE-2019-19054)

  - A memory leak in the adis_update_scan_mode() function     in drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-ab612b1daf41.(CVE-2019-19060)

  - A memory leak in the adis_update_scan_mode_burst()     function in drivers/iio/imu/adis_buffer.c in the Linux     kernel before 5.3.9 allows attackers to cause a denial     of service (memory consumption), aka     CID-9c0530e898f3.(CVE-2019-19061)

  - A memory leak in the crypto_report() function in     crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service     (memory consumption) by triggering crypto_report_alg()     failures, aka CID-ffdde5932042.(CVE-2019-19062)

  - A memory leak in the ccp_run_sha_cmd() function in     drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-128c66429247.(CVE-2019-18808)

  - In ashmem_ioctl of ashmem.c, there is an out-of-bounds     write due to insufficient locking when accessing asma.
    This could lead to a local elevation of privilege     enabling code execution as a privileged process with no     additional execution privileges needed. User     interaction is not needed for exploitation. Product:
    Android. Versions: Android kernel. Android ID:
    A-66954097.(CVE-2017-13216)

  - A certain backport in the TCP Fast Open implementation     for the Linux kernel before 3.18 does not properly     maintain a count value, which allow local users to     cause a denial of service (system crash) via the Fast     Open feature, as demonstrated by visiting the     chrome://flags/#enable-tcp-fast-open URL when using     certain 3.10.x through 3.16.x kernel builds, including     longterm-maintenance releases and ckt (aka Canonical     Kernel Team) builds.(CVE-2015-3332)

  - The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel before 4.5.5     does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel stack memory by reading a Netlink     message.(CVE-2016-4486)

  - The ip6gre_err function in net/ipv6/ip6_gre.c in the     Linux kernel allows remote attackers to have     unspecified impact via vectors involving GRE flags in     an IPv6 packet, which trigger an out-of-bounds     access.(CVE-2017-5897)

  - In the Linux kernel before version 4.12, Kerberos 5     tickets decoded when using the RXRPC keys incorrectly     assumes the size of a field. This could lead to the     size-remaining variable wrapping and the data pointer     going over the end of the buffer. This could possibly     lead to memory corruption and possible privilege     escalation.(CVE-2017-7482)

  - A flaw was found in the Linux Kernel where an attacker     may be able to have an uncontrolled read to     kernel-memory from within a vm guest. A race condition     between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte     information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other     clients.(CVE-2018-14625)

  - drivers/net/usb/asix_devices.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16647)

  - A memory leak in the ql_alloc_large_buffers() function     in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux     kernel before 5.3.5 allows local users to cause a     denial of service (memory consumption) by triggering     pci_dma_mapping_error() failures, aka     CID-1acb8f2a7a9f.(CVE-2019-18806)

  - An issue was discovered in the fd_locked_ioctl function     in drivers/block/floppy.c in the Linux kernel through     4.15.7. The floppy driver will copy a kernel pointer to     user memory in response to the FDGETPRM ioctl. An     attacker can send the FDGETPRM ioctl and use the     obtained kernel pointer to discover the location of     kernel code and data and bypass kernel security     protections such as KASLR.(CVE-2018-7755)

  - The usbvision driver in the Linux kernel package     3.10.0-123.20.1.el7 through 3.10.0-229.14.1.el7 in Red     Hat Enterprise Linux (RHEL) 7.1 allows physically     proximate attackers to cause a denial of service     (panic) via a nonzero bInterfaceNumber value in a USB     device descriptor.(CVE-2015-7833)

  - A flaw that allowed an attacker to corrupt memory and     possibly escalate privileges was found in the mwifiex     kernel module while connecting to a malicious wireless     network.(CVE-2019-3846)

  - drivers/net/wireless/marvell/libertas/if_sdio.c in the     Linux kernel 5.2.14 does not check the alloc_workqueue     return value, leading to a NULL pointer     dereference.(CVE-2019-16232)

  - drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the     Linux kernel 5.2.14 does not check the alloc_workqueue     return value, leading to a NULL pointer     dereference.(CVE-2019-16234)

  - drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14     does not check the alloc_workqueue return value,     leading to a NULL pointer dereference.(CVE-2019-16231)

  - Insufficient access control in the Intel(R)     PROSet/Wireless WiFi Software driver before version     21.10 may allow an unauthenticated user to potentially     enable denial of service via adjacent     access.(CVE-2019-0136)

  - A flaw was found in the Linux kernel. A heap based     buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead     to memory corruption and possibly other     consequences.(CVE-2019-10126)

  - The Bluetooth BR/EDR specification up to and including     version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from     influencing the key length negotiation. This allows     practical brute-force attacks (aka 'KNOB') that can     decrypt traffic and inject arbitrary ciphertext without     the victim noticing.(CVE-2019-9506)

  - An issue was discovered in net/wireless/nl80211.c in     the Linux kernel through 5.2.17. It does not check the     length of variable elements in a beacon head, leading     to a buffer overflow.(CVE-2019-16746)

  - In the hidp_process_report in bluetooth, there is an     integer overflow. This could lead to an out of bounds     write with no additional execution privileges needed.
    User interaction is not needed for exploitation.
    Product: Android Versions: Android kernel Android ID:
    A-65853588 References: Upstream kernel.(CVE-2018-9363)

  - An issue was discovered in write_tpt_entry in     drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel     through 5.3.2. The cxgb4 driver is directly calling     dma_map_single (a DMA function) from a stack variable.
    This could allow an attacker to trigger a Denial of     Service, exploitable if this driver is used on an     architecture for which this stack/DMA interaction has     security relevance.(CVE-2019-17075)

  - rtl_p2p_noa_ie in     drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux     kernel through 5.3.6 lacks a certain upper-bound check,     leading to a buffer overflow.(CVE-2019-17666)

  - arch/arm/mm/dma-mapping.c in the Linux kernel before     3.13 on ARM platforms, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     prevent executable DMA mappings, which might allow     local users to gain privileges via a crafted     application, aka Android internal bug 28803642 and     Qualcomm internal bug CR642735.(CVE-2014-9888)

  - An issue was discovered in drivers/i2c/i2c-core-smbus.c     in the Linux kernel before 4.14.15. There is an out of     bounds write in the function     i2c_smbus_xfer_emulated.(CVE-2017-18551)

  - The rds_ib_xmit function in net/rds/ib_send.c in the     Reliable Datagram Sockets (RDS) protocol implementation     in the Linux kernel 3.7.4 and earlier allows local     users to cause a denial of service (BUG_ON and kernel     panic) by establishing an RDS connection with the     source IP address equal to the IPoIB interface's own IP     address, as demonstrated by rds-ping.(CVE-2012-2372)

  - In the Linux kernel through 5.3.2,     cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c     does not reject a long SSID IE, leading to a Buffer     Overflow.(CVE-2019-17133)

  - A memory leak in the bfad_im_get_stats() function in     drivers/scsi/bfa/bfad_attr.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of     service (memory consumption) by triggering     bfa_port_get_stats() failures, aka     CID-0e62395da2bd.(CVE-2019-19066)

  - The kernel in Android before 2016-08-05 on Nexus 7     (2013) devices allows attackers to gain privileges via     a crafted application, aka internal bug     28522518.(CVE-2016-3857)

  - arch/arm64/kernel/sys.c in the Linux kernel before 4.0     allows local users to bypass the 'strict page     permissions' protection mechanism and modify the     system-call table, and consequently gain privileges, by     leveraging write access.(CVE-2015-8967)

  - arch/arm64/kernel/perf_event.c in the Linux kernel     before 4.1 on arm64 platforms allows local users to     gain privileges or cause a denial of service (invalid     pointer dereference) via vectors involving events that     are mishandled during a span of multiple HW     PMUs.(CVE-2015-8955)

  - The __clear_user function in     arch/arm64/lib/clear_user.S in the Linux kernel before     3.17.4 on the ARM64 platform allows local users to     cause a denial of service (system crash) by reading one     byte beyond a /dev/zero page boundary.(CVE-2014-7843)

  - The x86/fpu (Floating Point Unit) subsystem in the     Linux kernel before 4.13.5, when a processor supports     the xsave feature but not the xsaves feature, does not     correctly handle attempts to set reserved bits in the     xstate header via the ptrace() or rt_sigreturn() system     call, allowing local users to read the FPU registers of     other processes on the system, related to     arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c.(CVE-2017-15537)

  - The Linux kernel before 3.11 on ARM platforms, as used     in Android before 2016-08-05 on Nexus 5 and 7 (2013)     devices, does not properly consider user-space access     to the TPIDRURW register, which allows local users to     gain privileges via a crafted application, aka Android     internal bug 28749743 and Qualcomm internal bug     CR561044.(CVE-2014-9870)

  - ** DISPUTED ** Race condition in the     store_int_with_restart() function in     arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel     through 4.15.7 allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck     directory. NOTE: a third party has indicated that this     report is not security relevant.(CVE-2018-7995)

  - arch/x86/kernel/entry_32.S in the Linux kernel through     3.15.1 on 32-bit x86 platforms, when syscall auditing     is enabled and the sep CPU feature flag is set, allows     local users to cause a denial of service (OOPS and     system crash) via an invalid syscall number, as     demonstrated by number 1000.(CVE-2014-4508)

  - arch/x86/kernel/tls.c in the Thread Local Storage (TLS)     implementation in the Linux kernel through 3.18.1     allows local users to bypass the espfix protection     mechanism, and consequently makes it easier for local     users to bypass the ASLR protection mechanism, via a     crafted application that makes a set_thread_area system     call and later reads a 16-bit value.(CVE-2014-8133)

  - arch/mips/include/asm/thread_info.h in the Linux kernel     before 3.14.8 on the MIPS platform does not configure
    _TIF_SECCOMP checks on the fast system-call path, which     allows local users to bypass intended PR_SET_SECCOMP     restrictions by executing a crafted application without     invoking a trace or audit subsystem.(CVE-2014-4157)

  - Integer signedness error in the oz_hcd_get_desc_cnf     function in drivers/staging/ozwpan/ozhcd.c in the     OZWPAN driver in the Linux kernel through 4.0.5 allows     remote attackers to cause a denial of service (system     crash) or possibly execute arbitrary code via a crafted     packet.(CVE-2015-4001)

  - drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 does not ensure that     certain length values are sufficiently large, which     allows remote attackers to cause a denial of service     (system crash or large loop) or possibly execute     arbitrary code via a crafted packet, related to the (1)     oz_usb_rx and (2) oz_usb_handle_ep_data     functions.(CVE-2015-4002)

  - The oz_usb_handle_ep_data function in     drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 allows remote     attackers to cause a denial of service (divide-by-zero     error and system crash) via a crafted     packet.(CVE-2015-4003)

  - The OZWPAN driver in the Linux kernel through 4.0.5     relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash)     via a crafted packet.(CVE-2015-4004)

  - Race condition in the sclp_ctl_ioctl_sccb function in     drivers/s390/char/sclp_ctl.c in the Linux kernel before     4.6 allows local users to obtain sensitive information     from kernel memory by changing a certain length value,     aka a 'double fetch' vulnerability.(CVE-2016-6130)

  - The print_binder_transaction_ilocked function in     drivers/android/binder.c in the Linux kernel 4.14.90     allows local users to obtain sensitive address     information by reading '*from *code *flags' lines in a     debugfs file.(CVE-2018-20510)

  - In the Linux kernel before 4.1.4, a buffer overflow     occurs when checking userspace params in     drivers/media/dvb-frontends/cx24116.c. The maximum size     for a DiSEqC command is 6, according to the userspace     API. However, the code allows larger values such as     23.(CVE-2015-9289)

  - The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel through 4.11.5 allows local users to cause a     denial of service (out-of-bounds array access) or     possibly have unspecified other impact by changing a     certain sequence-number value, aka a 'double fetch'     vulnerability.(CVE-2017-8831)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4208-1 advisory.

    Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux kernel did not properly handle     reference counting during memory mapping operations when used in conjunction with AUFS. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2019-15794)

    Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel did not properly validate SSID     lengths. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-17133)

    It was discovered that the ARM Komeda display driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2019-18810)

    It was discovered that the VirtualBox guest driver implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. A local attacker could use this to cause a denial of     service (memory exhaustion). (CVE-2019-19048)

    It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19060, CVE-2019-19061)

    It was discovered that the Intel OPA Gen1 Infiniband Driver for the Linux kernel did not properly     deallocate memory in certain error conditions. A local attacker could use this to cause a denial of     service (memory exhaustion). (CVE-2019-19065)

    It was discovered that the AMD Audio Coprocessor driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker with the ability to load modules could use this to     cause a denial of service (memory exhaustion). (CVE-2019-19067)

    It was discovered in the Qualcomm FastRPC Driver for the Linux kernel did not properly deallocate memory     in certain error conditions. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19069)

    It was discovered that the Cascoda CA8210 SPI 802.15.4 wireless controller driver for the Linux kernel did     not properly deallocate memory in certain error conditions. A local attacker could use this to cause a     denial of service (memory exhaustion). (CVE-2019-19075)

    It was discovered that the AMD Display Engine Driver in the Linux kernel did not properly deallocate     memory in certain error conditions. A local attack could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19083)

    Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux kernel performed DMA from a     kernel stack. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-17075)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
151897	Slackware 14.2 : Slackware 14.2 kernel (SSA:2021-202-01)	Nessus	Slackware Local Security Checks	high
148498	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4904-1)	Nessus	Ubuntu Local Security Checks	high
140722	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4526-1)	Nessus	Ubuntu Local Security Checks	high
139858	Amazon Linux 2 : kernel (ALAS-2020-1480)	Nessus	Amazon Linux Local Security Checks	high
132605	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1012)	Nessus	Huawei Local Security Checks	critical
131805	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-2531)	Nessus	Huawei Local Security Checks	critical
131562	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4208-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2019-19061

high

Tenable Plugins

high

high

high

high

critical

critical

critical