In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5913 advisory.

    - powercap: restrict energy meter to root access (Kanth Ghatraju)  [Orabug: 32040805]  {CVE-2020-8694}     {CVE-2020-8695}
    - hdlc_ppp: add range checks in ppp_cp_parse_cr() (Dan Carpenter)  [Orabug: 31989189]  {CVE-2020-25643}
    - geneve: add transport ports in route lookup for geneve (Mark Gray)  [Orabug: 32014099]  {CVE-2020-25645}
    - certs: Add EFI_CERT_X509_GUID support for dbx entries (Eric Snowberg)  [Orabug: 31961118]     {CVE-2020-26541}
    - btrfs: Don't submit any btree write bio if the fs has errors (Qu Wenruo)  [Orabug: 31265337]     {CVE-2019-19377} {CVE-2019-19377} {CVE-2019-19377}
    - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik)     [Orabug: 31351023]  {CVE-2019-19448} {CVE-2019-19448}
    - xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen)  [Orabug: 31895824]  {CVE-2020-14385}
    - nbd_genl_status: null check for nla_nest_start (Navid Emamdoost)  [Orabug: 31351789]  {CVE-2019-16089}
    - efi/x86/Add missing error handling to old_memmap 1:1 mapping code (Gen Zhang)  [Orabug: 31351924]     {CVE-2019-12380}
    - cgroup: fix cgroup_sk_alloc() for sk_clone_lock() (Cong Wang)  [Orabug: 31779798]  {CVE-2020-14356}
    - netfilter: ctnetlink: add a range check for l3/l4 protonum (Will McVicker)  [Orabug: 31872862]     {CVE-2020-25211}
    - vgacon: remove software scrollback support (Linus Torvalds)  [Orabug: 31914690]  {CVE-2020-14390}
    - fbcon: remove soft scrollback code (Linus Torvalds)  [Orabug: 31914690]  {CVE-2020-14390}
    - block: allow for_each_bvec to support zero len bvec (Ming Lei)  [Orabug: 31955141]  {CVE-2020-25641}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.68-34.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-016 advisory.

    A flaw was found in the Linux kernel's implementation of BTRFS free space management, where the kernel     does not correctly manage the lifetime of internal data structures used. An attacker could use this flaw     to corrupt memory or escalate privileges. (CVE-2019-19448)

    A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a     local attacker with special user (or root) privilege to crash the system at the time of file or directory     removal. This vulnerability can lead to a kernel information leak. The highest threat from this     vulnerability is to system availability. (CVE-2019-19770)

    A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to     directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable     access to the devices' MMIO memory address spaces. If a user attempts to access the read/write devices'     MMIO address space when it is disabled, some h/w devices issue an interrupt to the CPU to indicate a fatal     error condition, crashing the system. This flaw allows a guest user or process to crash the host system     resulting in a denial of service. (CVE-2020-12888)

    A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it     accesses a directory with broken indexing. This flaw allows a local user to crash the system if the     directory exists. The highest threat from this vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel. A failure of the file system metadata validator in XFS can cause an     inode with a valid, user-creatable extended attribute to be flagged as corrupt.  This can lead to the     filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial     of service. The highest threat from this vulnerability is to system availability. (CVE-2020-14385)

    A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur     leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2020-14390)

    A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it     could return specially crafted response allow for local memory corruption and possibly privilege     escalation. (CVE-2020-25212)

    A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel.
    Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add     or remove Rados Block Devices from the system. (CVE-2020-25284)

    A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root     level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on     internal variables leading to a system crash or memory corruption. (CVE-2020-25285)

    A flaw was found in the Linux kernel's implementation of biovecs. A zero-length biovec request issued by     the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This     flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25641)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

  - In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of     service (NULL pointer dereference and BUG) because a required mutex is not used. (CVE-2017-18216)

  - In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local     escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. (CVE-2018-9517)

  - Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory     entry lists. (CVE-2019-10220)

  - Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the     Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka     CID-3f9361695113. (CVE-2019-19063)

  - A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     bfa_port_get_stats() failures, aka CID-0e62395da2bd. (CVE-2019-19066)

  - A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
    (CVE-2019-19074)

  - A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs.
    As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it     is possible for the specified target task to perform an execve() syscall with setuid execution before     perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check     and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged     execve() calls. This issue affects kernel versions before 4.8. (CVE-2019-3901)

  - An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c     has a deadlock if a coalescing operation fails. (CVE-2020-12771)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure. (CVE-2019-19448)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before     4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a     denial of service (panic) by corrupting a mountpoint reference counter. (CVE-2020-12114)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat     fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets,     independent of the network configuration. (CVE-2020-26142)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9459 advisory.

    - fs/namespace.c: fix mountpoint reference counter race (Piotr Krysiuk)  [Orabug: 33369433]     {CVE-2020-12114} {CVE-2020-12114}
    - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik)     [Orabug: 33369414]  {CVE-2019-19448} {CVE-2019-19448}
    - cfg80211: wext: avoid copying malformed SSIDs (Will Deacon)  [Orabug: 33369390]  {CVE-2019-17133}
    - vhost_net: fix possible infinite loop (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900} {CVE-2019-3900}
    - vhost: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost_net: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost_net: use packet weight for rx handler, too (Paolo Abeni)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost-net: set packet weight of tx polling to 2 * vq size (haibinzhang)  [Orabug: 33369374]     {CVE-2019-3900}
    - mac80211: extend protection against mixed key and fragment cache attacks (Wen Gong)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147} {CVE-2020-24586} {CVE-2020-24587}
    - mac80211: do not accept/forward invalid EAPOL frames (Johannes Berg)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147}
    - mac80211: prevent attacks on TKIP/WEP as well (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: check defrag PN against current frame (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: add fragment cache to sta_info (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: drop A-MSDUs on old ciphers (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-24588}
    - cfg80211: mitigate A-MSDU aggregation attacks (Mathy Vanhoef)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-24588}
    - mac80211: properly handle A-MSDUs that start with an RFC 1042 header (Mathy Vanhoef)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147}
    - mac80211: prevent mixed key and fragment cache attacks (Mathy Vanhoef)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147} {CVE-2020-24587} {CVE-2020-24586}
    - mac80211: assure all fragments are encrypted (Mathy Vanhoef)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-26147}
    - sctp: validate from_addr_param return (Marcelo Ricardo Leitner)  [Orabug: 33369303]  {CVE-2021-3655}
    - virtio_console: Assure used length from device is limited (Xie Yongji)  [Orabug: 33369276]     {CVE-2021-38160}
    - net_sched: cls_route: remove the right filter from hashtable (Cong Wang)  [Orabug: 33369231]     {CVE-2021-3715}
    - HID: make arrays usage and value to be the same (Will McVicker)  [Orabug: 33369121]  {CVE-2021-0512}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update corrects a regression in some Xen virtual machine environments. For reference the original advisory text follows.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

CVE-2019-9445

A potential out-of-bounds read was discovered in the F2FS implementation. A user permitted to mount and access arbitrary filesystems could potentially use this to cause a denial of service (crash) or to read sensitive information.

CVE-2019-19073, CVE-2019-19074

Navid Emamdoost discovered potential memory leaks in the ath9k and ath9k_htc drivers. The security impact of these is unclear.

CVE-2019-19448

'Team bobfuzzer' reported a bug in Btrfs that could lead to a use-after-free, and could be triggered by crafted filesystem images. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-12351

Andy Nguyen discovered a flaw in the Bluetooth implementation in the way L2CAP packets with A2MP CID are handled. A remote attacker within a short distance, knowing the victim's Bluetooth device address, can send a malicious l2cap packet and cause a denial of service or possibly arbitrary code execution with kernel privileges.

CVE-2020-12352

Andy Nguyen discovered a flaw in the Bluetooth implementation. Stack memory is not properly initialised when handling certain AMP packets.
A remote attacker within a short distance, knowing the victim's Bluetooth device address address, can retrieve kernel stack information.

CVE-2020-12655

Zheng Bin reported that crafted XFS volumes could trigger a system hang. An attacker able to mount such a volume could use this to cause a denial of service.

CVE-2020-12771

Zhiqiang Liu reported a bug in the bcache block driver that could lead to a system hang. The security impact of this is unclear.

CVE-2020-12888

It was discovered that the PCIe Virtual Function I/O (vfio-pci) driver allowed users to disable a device's memory space while it was still mapped into a process. On some hardware platforms, local users or guest virtual machines permitted to access PCIe Virtual Functions could use this to cause a denial of service (hardware error and crash).

CVE-2020-14305

Vasily Averin of Virtuozzo discovered a potential heap buffer overflow in the netfilter nf_contrack_h323 module. When this module is used to perform connection tracking for TCP/IPv6, a remote attacker could use this to cause a denial of service (crash or memory corruption) or possibly for remote code execution with kernel privilege.

CVE-2020-14314

A bug was discovered in the ext4 filesystem that could lead to an out-of-bound read. A local user permitted to mount and access arbitrary filesystem images could use this to cause a denial of service (crash).

CVE-2020-14331

A bug was discovered in the VGA console driver's soft-scrollback feature that could lead to a heap buffer overflow. On a system with a custom kernel that has CONFIG_VGACON_SOFT_SCROLLBACK enabled, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14356, CVE-2020-25220

A bug was discovered in the cgroup subsystem's handling of socket references to cgroups. In some cgroup configurations, this could lead to a use-after-free. A local user might be able to use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

The original fix for this bug introudced a new security issue, which is also addressed in this update.

CVE-2020-14386

Or Cohen discovered a bug in the packet socket (AF_PACKET) implementation which could lead to a heap buffer overflow. A local user with the CAP_NET_RAW capability (in any user namespace) could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14390

Minh Yuan discovered a bug in the framebuffer console driver's scrollback feature that could lead to a heap buffer overflow. On a system using framebuffer consoles, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

The scrollback feature has been disabled for now, as no other fix was available for this issue.

CVE-2020-15393

Kyungtae Kim reported a memory leak in the usbtest driver. The security impact of this is unclear.

CVE-2020-16166

Amit Klein reported that the random number generator used by the network stack might not be re-seeded for long periods of time, making e.g. client port number allocations more predictable. This made it easier for remote attackers to carry out some network- based attacks such as DNS cache poisoning or device tracking.

CVE-2020-24490

Andy Nguyen discovered a flaw in the Bluetooth implementation that can lead to a heap buffer overflow. On systems with a Bluetooth 5 hardware interface, a remote attacker within a short distance can use this to cause a denial of service (crash or memory corruption) or possibly for remote code execution with kernel privilege.

CVE-2020-25211

A flaw was discovered in netfilter subsystem. A local attacker able to inject conntrack Netlink configuration can cause a denial of service.

CVE-2020-25212

A bug was discovered in the NFSv4 client implementation that could lead to a heap buffer overflow. A malicious NFS server could use this to cause a denial of service (crash or memory corruption) or possibly to execute arbitrary code on the client.

CVE-2020-25284

It was discovered that the Rados block device (rbd) driver allowed tasks running as uid 0 to add and remove rbd devices, even if they dropped capabilities. On a system with the rbd driver loaded, this might allow privilege escalation from a container with a task running as root.

CVE-2020-25285

A race condition was discovered in the hugetlb filesystem's sysctl handlers, that could lead to stack corruption. A local user permitted to write to hugepages sysctls could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. By default only the root user can do this.

CVE-2020-25641

The syzbot tool found a bug in the block layer that could lead to an infinite loop. A local user with access to a raw block device could use this to cause a denial of service (unbounded CPU use and possible system hang).

CVE-2020-25643

ChenNan Of Chaitin Security Research Lab discovered a flaw in the hdlc_ppp module. Improper input validation in the ppp_cp_parse_cr() function may lead to memory corruption and information disclosure.

CVE-2020-26088

It was discovered that the NFC (Near Field Communication) socket implementation allowed any user to create raw sockets. On a system with an NFC interface, this allowed local users to evade local network security policy.

For Debian 9 stretch, these problems have been fixed in version 4.9.240-1. This update additionally includes many more bug fixes from stable updates 4.9.229-4.9.240 inclusive.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of kernel installed on the remote host is prior to 4.14.200-116.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1437 advisory.

    In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure. (CVE-2019-19448)

    A flaw was found in the Linux kernel's implementation of BTRFS free space management, where the kernel     does not correctly manage the lifetime of internal data structures used. An attacker could use this flaw     to corrupt memory or escalate privileges. (CVE-2020-12888)

    A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to     directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable     access to the devices' MMIO memory address spaces. If a user attempts to access the read/write devices'     MMIO address space when it is disabled, some h/w devices issue an interrupt to the CPU to indicate a fatal     error condition, crashing the system. This flaw allows a guest user or process to crash the host system     resulting in a denial of service. A memory out-of-bounds read flaw was found in the Linux kernel before     5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw     allows a local user to crash the system if the directory exists. The highest threat from this     vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14331)

    A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14390)

    A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur     leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. A flaw was found in the NFSv4 implementation where when mounting a remote     attacker controlled server it could return specially crafted response allow for local memory corruption     and possibly privilege escalation. A TOCTOU mismatch in the NFS client code in the Linux kernel before     5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because     a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. (CVE-2020-25212)

    A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel.
    Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add     or remove Rados Block Devices from the system. (CVE-2020-25284)

    A flaw was found in the Linux kernels sysctl handling code for hugepages managment. When multiple root     level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on     internal variables leading to a system crash or memory corruption. A race condition between hugetlb sysctl     handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt     memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
    (CVE-2020-25285)

    A flaw was found in the Linux kernel's implementation of biovecs. A zero-length biovec request issued by     the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This     flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25641)

    A flaw was found in the HDLC_PPP module of the Linux kernel.  Memory corruption and a read overflow is     caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or     cause a denial of service.  The highest threat from this vulnerability is to data confidentiality and     integrity as well as system availability. (CVE-2020-25643)

    A flaw was found in the Linux kernel. Traffic between two Geneve endpoints may be unencrypted when IPsec     is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone in     between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to     data confidentiality. (CVE-2020-25645)

    A missing capabilities check when creating NFC raw sockets could be used by local attackers to create raw     sockets, bypassing security mechanisms allowing them to create or listen to NFC communication frames.
    (CVE-2020-26088)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New kernel packages are available for Slackware 14.2 to fix security issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4578-1 advisory.

    Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket     reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2020-16119)

    Wen Xu discovered that the XFS file system in the Linux kernel did not properly validate inode metadata in     some situations. An attacker could use this to construct a malicious XFS image that, when mounted, could     cause a denial of service (system crash). (CVE-2018-10322)

    It was discovered that the btrfs file system in the Linux kernel contained a use-after-free vulnerability     when merging free space. An attacker could use this to construct a malicious btrfs image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2019-19448)

    Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle     directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2020-14314)

    Giuseppe Scrivano discovered that the overlay file system in the Linux kernel did not properly perform     permission checks in some situations. A local attacker could possibly use this to bypass intended     restrictions and gain read access to restricted files. (CVE-2020-16120)

    It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds     checking before copying security labels in some situations. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

    It was discovered that the NFC implementation in the Linux kernel did not properly perform permissions     checks when opening raw sockets. A local attacker could use this to create or listen to NFC traffic.
    (CVE-2020-26088)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.198-152.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1495 advisory.

    In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure.A flaw was found in the Linux kernel's implementation of BTRFS free space     management, where the kernel does not correctly manage the lifetime of internal data structures used. An     attacker could use this flaw to corrupt memory or escalate privileges. (CVE-2019-19448)

    A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file     system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash     the system if the directory exists. The highest threat from this vulnerability is to system availability.A     memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it     accesses a directory with broken indexing. This flaw allows a local user to crash the system if the     directory exists. The highest threat from this vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability.A flaw was found in the Linux kernel's     implementation of the invert video code on VGA consoles when a local attacker attempts to resize the     console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a     local user with access to the VGA console to crash the system, potentially escalating their privileges on     the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14331)

    In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.A flaw was     found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could     overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25211)

    A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers     to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.A flaw was found in the NFSv4 implementation where when     mounting a remote attacker controlled server it could return specially crafted response allow for local     memory corruption and possibly privilege escalation. (CVE-2020-25212)

    A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified     other impact, aka CID-17743798d812. (CVE-2020-25285)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak.

CVE-2019-3874

Kernel buffers allocated by the SCTP network protocol were not limited by the memory cgroup controller. A local user could potentially use this to evade container memory limits and to cause a denial of service (excessive memory use).

CVE-2019-19448, CVE-2019-19813, CVE-2019-19816

'Team bobfuzzer' reported bugs in Btrfs that could lead to a use-after-free or heap buffer overflow, and could be triggered by crafted filesystem images. A user permitted to mount and access arbitrary filesystems could use these to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-10781

Luca Bruno of Red Hat discovered that the zram control file /sys/class/zram-control/hot_add was readable by all users. On a system with zram enabled, a local user could use this to cause a denial of service (memory exhaustion).

CVE-2020-12888

It was discovered that the PCIe Virtual Function I/O (vfio-pci) driver allowed users to disable a device's memory space while it was still mapped into a process. On some hardware platforms, local users or guest virtual machines permitted to access PCIe Virtual Functions could use this to cause a denial of service (hardware error and crash).

CVE-2020-14314

A bug was discovered in the ext4 filesystem that could lead to an out-of-bound read. A local user permitted to mount and access arbitrary filesystem images could use this to cause a denial of service (crash).

CVE-2020-14331

A bug was discovered in the VGA console driver's soft-scrollback feature that could lead to a heap buffer overflow. On a system with a custom kernel that has CONFIG_VGACON_SOFT_SCROLLBACK enabled, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14356

A bug was discovered in the cgroup subsystem's handling of socket references to cgroups. In some cgroup configurations, this could lead to a use-after-free. A local user might be able to use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14385

A bug was discovered in XFS, which could lead to an extended attribute (xattr) wrongly being detected as invalid. A local user with access to an XFS filesystem could use this to cause a denial of service (filesystem shutdown).

CVE-2020-14386

Or Cohen discovered a bug in the packet socket (AF_PACKET) implementation which could lead to a heap buffer overflow. A local user with the CAP_NET_RAW capability (in any user namespace) could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14390

Minh Yuan discovered a bug in the framebuffer console driver's scrollback feature that could lead to a heap buffer overflow. On a system using framebuffer consoles, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

The scrollback feature has been disabled for now, as no other fix was available for this issue.

CVE-2020-16166

Amit Klein reported that the random number generator used by the network stack might not be re-seeded for long periods of time, making e.g. client port number allocations more predictable. This made it easier for remote attackers to carry out some network- based attacks such as DNS cache poisoning or device tracking.

CVE-2020-25212

A bug was discovered in the NFSv4 client implementation that could lead to a heap buffer overflow. A malicious NFS server could use this to cause a denial of service (crash or memory corruption) or possibly to execute arbitrary code on the client.

CVE-2020-25284

It was discovered that the Rados block device (rbd) driver allowed tasks running as uid 0 to add and remove rbd devices, even if they dropped capabilities. On a system with the rbd driver loaded, this might allow privilege escalation from a container with a task running as root.

CVE-2020-25285

A race condition was discovered in the hugetlb filesystem's sysctl handlers, that could lead to stack corruption. A local user permitted to write to hugepages sysctls could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. By default only the root user can do this.

CVE-2020-25641

The syzbot tool found a bug in the block layer that could lead to an infinite loop. A local user with access to a raw block device could use this to cause a denial of service (unbounded CPU use and possible system hang).

CVE-2020-26088

It was discovered that the NFC (Near Field Communication) socket implementation allowed any user to create raw sockets. On a system with an NFC interface, this allowed local users to evade local network security policy.

For Debian 9 stretch, these problems have been fixed in version 4.19.146-1~deb9u1. This update additionally fixes Debian bugs #966846, #966917, and #968567; and includes many more bug fixes from stable updates 4.19.133-4.19.146 inclusive.

We recommend that you upgrade your linux-4.19 packages.

For the detailed security status of linux-4.19 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux-4.19

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
180881	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5913)	Nessus	Oracle Linux Local Security Checks	high
160437	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-016)	Nessus	Amazon Linux Local Security Checks	high
154016	OracleVM 3.4 : kernel-uek (OVMSA-2021-0035)	Nessus	OracleVM Local Security Checks	critical
153582	OracleVM 3.4 : kernel-uek (OVMSA-2021-0031)	Nessus	OracleVM Local Security Checks	critical
153557	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9459)	Nessus	Oracle Linux Local Security Checks	critical
142176	Debian DLA-2420-2 : linux regression update	Nessus	Debian Local Security Checks	high
141961	Amazon Linux AMI : kernel (ALAS-2020-1437)	Nessus	Amazon Linux Local Security Checks	high
141789	Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-295-01)	Nessus	Slackware Local Security Checks	high
141448	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4578-1)	Nessus	Ubuntu Local Security Checks	high
141106	Amazon Linux 2 : kernel (ALAS-2020-1495)	Nessus	Amazon Linux Local Security Checks	high
140933	Debian DLA-2385-1 : linux-4.19 security update	Nessus	Debian Local Security Checks	high
140708	Photon OS 3.0: Linux PHSA-2020-3.0-0142	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2019-19448

high

Tenable Plugins

critical

high

high

critical

critical

critical

high

high

high

high

high

high

high