In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4431 advisory.

    - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875316] {CVE-2020-14385}
    - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876224] {CVE-2020-14386}
    - [net] packet: make tp_drops atomic (Hangbin Liu) [1876224] {CVE-2020-14386}
    - [kernel] Move to dual-signing to split signing keys up better (Frantisek Hrbata) [1837434]     {CVE-2020-10713}
    - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859472] {CVE-2020-14331}
    - [fs] chardev: Avoid potential use-after-free in chrdev_open() (Vladis Dronov) [1866324] {CVE-2020-0305}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.68-34.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-016 advisory.

    A flaw was found in the Linux kernel's implementation of BTRFS free space management, where the kernel     does not correctly manage the lifetime of internal data structures used. An attacker could use this flaw     to corrupt memory or escalate privileges. (CVE-2019-19448)

    A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a     local attacker with special user (or root) privilege to crash the system at the time of file or directory     removal. This vulnerability can lead to a kernel information leak. The highest threat from this     vulnerability is to system availability. (CVE-2019-19770)

    A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to     directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable     access to the devices' MMIO memory address spaces. If a user attempts to access the read/write devices'     MMIO address space when it is disabled, some h/w devices issue an interrupt to the CPU to indicate a fatal     error condition, crashing the system. This flaw allows a guest user or process to crash the host system     resulting in a denial of service. (CVE-2020-12888)

    A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it     accesses a directory with broken indexing. This flaw allows a local user to crash the system if the     directory exists. The highest threat from this vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel. A failure of the file system metadata validator in XFS can cause an     inode with a valid, user-creatable extended attribute to be flagged as corrupt.  This can lead to the     filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial     of service. The highest threat from this vulnerability is to system availability. (CVE-2020-14385)

    A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur     leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2020-14390)

    A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it     could return specially crafted response allow for local memory corruption and possibly privilege     escalation. (CVE-2020-25212)

    A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel.
    Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add     or remove Rados Block Devices from the system. (CVE-2020-25284)

    A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root     level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on     internal variables leading to a system crash or memory corruption. (CVE-2020-25285)

    A flaw was found in the Linux kernel's implementation of biovecs. A zero-length biovec request issued by     the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This     flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25641)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4431 advisory.

  - In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This     could lead to local information disclosure with System execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9455)

  - In the Android kernel in the video driver there is a use after free due to a race condition. This could     lead to local escalation of privilege with no additional execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9458)

  - An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). (CVE-2019-12614)

  - An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when     hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c. (CVE-2019-15917)

  - An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function     hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.
    (CVE-2019-15925)

  - drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16231)

  - drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16233)

  - A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.
    (CVE-2019-18808)

  - A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux     kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka     CID-2289adbfa559. (CVE-2019-18809)

  - ** DISPUTED ** A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by     triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of     this because an attacker cannot realistically control this failure at probe time. (CVE-2019-19046)

  - A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in     drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-     db8fd2cde932. (CVE-2019-19056)

  - A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_report_alg() failures, aka CID-ffdde5932042. (CVE-2019-19062)

  - Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the     Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka     CID-3f9361695113. (CVE-2019-19063)

  - A memory leak in the rtl8xxxu_submit_int_urb() function in     drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers     to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka     CID-a2cdd07488e6. (CVE-2019-19068)

  - A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
    (CVE-2019-19072)

  - In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a     slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when     a large old_size value is used in a memset call, aka CID-345c0dbf3a30. (CVE-2019-19319)

  - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way     the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of service. (CVE-2019-19332)

  - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and     unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list     in fs/ext4/super.c. (CVE-2019-19447)

  - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. (CVE-2019-19524)

  - In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device     in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464. (CVE-2019-19533)

  - In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB     device in the USB character device driver layer, aka CID-303911cfc5b9. This affects     drivers/usb/core/file.c. (CVE-2019-19537)

  - In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in     drivers/media/rc/serial_ir.c. (CVE-2019-19543)

  - fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is     used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have     unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling     of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
    (CVE-2019-19602)

  - The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors     in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka     CID-4ea99936a163. (CVE-2019-19767)

  - ** DISPUTED ** In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove     function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously     created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel     developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of     debugfs within blktrace. (CVE-2019-19770)

  - In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. (CVE-2019-20054)

  - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode     table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. (CVE-2019-20636)

  - In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to     local escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744 (CVE-2020-0305)

  - In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in     audit_data_to_entry. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-150693166References: Upstream kernel (CVE-2020-0444)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c. (CVE-2020-8647)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common     function in drivers/tty/n_tty.c. (CVE-2020-8648)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region     function in drivers/video/console/vgacon.c. (CVE-2020-8649)

  - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an     attacker with a local account to crash a trivial program and exfiltrate private kernel data.
    (CVE-2020-10732)

  - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it     incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly     only validate the first netlink message in the skb and allow or deny the rest of the messages within the     skb with the granted permission without further processing. (CVE-2020-10751)

  - A stack information leak flaw was found in s390/s390x in the Linux kernel's memory manager functionality,     where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the     kernel data. (CVE-2020-10773)

  - A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl     subsystem when reading the /proc/sys/kernel/rh_features file. This flaw allows a local user to read     uninitialized values from the kernel memory. The highest threat from this vulnerability is to     confidentiality. (CVE-2020-10774)

  - In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family     field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
    (CVE-2020-10942)

  - ** DISPUTED ** An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c     has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing,     aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability     because the issue is a bug in parsing mount options which can only be specified by a privileged user, so     triggering the bug does not grant any powers not already held.. (CVE-2020-11565)

  - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB     driver) mishandles invalid descriptors, aka CID-a246b4d54770. (CVE-2020-11668)

  - An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the     Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can     corrupt memory of adjacent pages. (CVE-2020-12465)

  - An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10.
    Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767. (CVE-2020-12655)

  - An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-     of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.
    (CVE-2020-12659)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
    Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a     do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in     a different security domain. Exploitation limitations include the amount of elapsed time before an integer     overflow occurs, and the lack of scenarios where signals to a parent process present a substantial     operational threat. (CVE-2020-12826)

  - A flaw was found in the Linux kernel's futex implementation. This flaw allows a local attacker to corrupt     system memory or escalate their privileges when creating a futex on a filesystem that is about to be     unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-14381)

  - A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-25641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4431 advisory.

  - kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c     causing denial of service (CVE-2019-12614)

  - kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

  - kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

  - kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

  - kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

  - kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c (CVE-2019-18808)

  - kernel: memory leak in  af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c     (CVE-2019-18809)

  - kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     (CVE-2019-19046)

  - kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows to cause DoS (CVE-2019-19056)

  - kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

  - kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c     allow for a DoS (CVE-2019-19063)

  - kernel: A memory leak in the rtl8xxxu_submit_int_urb() function in     drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows for a DoS (CVE-2019-19068)

  - kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a     DoS (CVE-2019-19072)

  - kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

  - Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

  - kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a     use-after-free in ext4_put_super in fs/ext4/super.c (CVE-2019-19447)

  - kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free (CVE-2019-19524)

  - kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

  - kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

  - kernel: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c (CVE-2019-19543)

  - kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c     and fs/ext4/super.c (CVE-2019-19767)

  - kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c (CVE-2019-19770)

  - kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

  - kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

  - kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure     (CVE-2019-9455)

  - kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

  - kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

  - kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

  - kernel: SELinux netlink permission check bypass (CVE-2020-10751)

  - kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)

  - kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

  - kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

  - kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

  - kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

  - kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c     (CVE-2020-12465)

  - kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

  - kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data     coruption (CVE-2020-12659)

  - kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

  - kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

  - kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

  - kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

  - kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647)

  - kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648)

  - kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c     (CVE-2020-8649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.209-117.337. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1461 advisory.

    A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a     local attacker with special user (or root) privilege to crash the system at the time of file or directory     removal. This vulnerability can lead to a kernel information leak. The highest threat from this     vulnerability is to system availability. (CVE-2019-19770)

    A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges.  The highest threat from this vulnerability is to data confidentiality and integrity as well     as system availability. (CVE-2020-14351)

    A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was     using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of     bounds. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-25656)

    A flaw was found in Linux Kernel because access to the global variable fg_console is not properly     synchronized leading to a use after free in con_font_op. (CVE-2020-25668)

    The function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed.Though the     dangling pointer is set to NULL in sunkbd_disconnect, there is still a alias in sunkbd_reinit so that     causing Use After Free. (CVE-2020-25669)

    A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of     service. (CVE-2020-25704)

    An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
    (CVE-2020-27673)

    An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. (CVE-2020-27675)

    A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

    An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9.
    Local attackers on systems with the speakup driver could cause a local denial of service attack, aka     CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.
    (CVE-2020-28941)

    An out-of-bounds (OOB) SLAB memory access flaw was found in the Linux kernel's fbcon driver module. A     bounds check failure allows a local attacker with special user privileges to gain access to out-of-bounds     memory, leading to a system crash or leaking of internal kernel information. The highest threat from this     vulnerability is to system availability. (CVE-2020-28974)

    A flaw was found in the Linux kernel's implementation of Intel's Running Average Power Limit (RAPL)     implementation. A local attacker could infer secrets by measuring power usage and also infer private data     by observing the power usage of calculations performed on the data. (CVE-2020-8694)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4680-1 advisory.

    It was discovered that debugfs in the Linux kernel as used by blktrace contained a use-after-free in some     situations. A privileged local attacker could possibly use this to cause a denial of service (system     crash). (CVE-2019-19770)

    It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-     connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to     complete authentication without pairing credentials via adjacent access. A physically proximate attacker     could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

    It was discovered that the console keyboard driver in the Linux kernel contained a race condition. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2020-25656)

    Minh Yuan discovered that the tty driver in the Linux kernel contained race conditions when handling     fonts. A local attacker could possibly use this to expose sensitive information (kernel memory).
    (CVE-2020-25668)

    Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in     scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that     depend on source port randomization. (CVE-2020-25705)

    Jinoh Kang discovered that the Xen event channel infrastructure in the Linux kernel contained a race     condition. An attacker in guest could possibly use this to cause a denial of service (dom0 crash).
    (CVE-2020-27675)

    Daniel Axtens discovered that PowerPC RTAS implementation in the Linux kernel did not properly restrict     memory accesses in some situations. A privileged local attacker could use this to arbitrarily modify     kernel memory, potentially bypassing kernel lockdown restrictions. (CVE-2020-27777)

    Minh Yuan discovered that the framebuffer console driver in the Linux kernel did not properly handle fonts     in some conditions. A local attacker could use this to cause a denial of service (system crash) or     possibly expose sensitive information (kernel memory). (CVE-2020-28974)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1462 advisory.

  - ** DISPUTED ** In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove     function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously     created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel     developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of     debugfs within blktrace. (CVE-2019-19770)

  - A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14351)

  - A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was     using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of     bounds. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-25656)

  - A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of     service. (CVE-2020-25704)

  - An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
    (CVE-2020-27673)

  - An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. (CVE-2020-27675)

  - A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

  - An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9.
    Local attackers on systems with the speakup driver could cause a local denial of service attack, aka     CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.
    (CVE-2020-28941)

  - A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to     read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height. (CVE-2020-28974)

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated due to Amazon pulling the previously published advisory.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

CVE-2019-19039

'Team bobfuzzer' reported a bug in Btrfs that could lead to an assertion failure (WARN). A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash) if the panic_on_warn kernel parameter is set.

CVE-2019-19377

'Team bobfuzzer' reported a bug in Btrfs that could lead to a use-after-free. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2019-19770

The syzbot tool discovered a race condition in the block I/O tracer (blktrace) that could lead to a system crash. Since blktrace can only be controlled by privileged users, the security impact of this is unclear.

CVE-2019-19816

'Team bobfuzzer' reported a bug in Btrfs that could lead to an out-of-bounds write. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-0423

A race condition was discovered in the Android binder driver, that could result in a use-after-free. On systems using this driver, a local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-8694

Multiple researchers discovered that the powercap subsystem allowed all users to read CPU energy meters, by default. On systems using Intel CPUs, this provided a side channel that could leak sensitive information between user processes, or from the kernel to user processes. The energy meters are now readable only by root, by default.

This issue can be mitigated by running :

chmod go-r /sys/devices/virtual/powercap/*/*/energy_uj

This needs to be repeated each time the system is booted with an unfixed kernel version.

CVE-2020-14351

A race condition was discovered in the performance events subsystem, which could lead to a use-after-free. A local user permitted to access performance events could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2020-25656

Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with the CAP_SYS_TTY_CONFIG capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25668

Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25669

Bodong Zhao discovered a bug in the Sun keyboard driver (sunkbd) that could lead to a use-after-free. On a system using this driver, a local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25704

kiyin(&#x5C39;&#x4EAE;) discovered a potential memory leak in the performance events subsystem. A local user permitted to access performance events could use this to cause a denial of service (memory exhaustion).

Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2020-25705

Keyu Man reported that strict rate-limiting of ICMP packet transmission provided a side-channel that could help networked attackers to carry out packet spoofing. In particular, this made it practical for off-path networked attackers to 'poison' DNS caches with spoofed responses ('SAD DNS' attack).

This issue has been mitigated by randomising whether packets are counted against the rate limit.

CVE-2020-27673 / XSA-332

Julien Grall from Arm discovered a bug in the Xen event handling code.
Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (excessive CPU usage or hang) in dom0.

CVE-2020-27675 / XSA-331

Jinoh Kang of Theori discovered a race condition in the Xen event handling code. Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (crash) in dom0.

CVE-2020-28941

Shisong Qin and Bodong Zhao discovered a bug in the Speakup screen reader subsystem. Speakup assumed that it would only be bound to one terminal (tty) device at a time, but did not enforce this. A local user could exploit this bug to cause a denial of service (crash or memory exhaustion).

CVE-2020-28974

Yuan Ming discovered a bug in the virtual terminal (vt) driver that could lead to an out-of-bounds read. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could possibly use this to obtain sensitive information from the kernel or to cause a denial of service (crash).

The specific ioctl operation affected by this bug (KD_FONT_OP_COPY) has been disabled, as it is not believed that any programs depended on it.

For Debian 9 stretch, these problems have been fixed in version 4.19.160-2~deb9u1.

We recommend that you upgrade your linux-4.19 packages.

For the detailed security status of linux-4.19 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux-4.19

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of kernel installed on the remote host is prior to 4.14.209-160.335. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1566 advisory.

    A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a     local attacker with special user (or root) privilege to crash the system at the time of file or directory     removal. This vulnerability can lead to a kernel information leak. The highest threat from this     vulnerability is to system availability. (CVE-2019-19770)

    A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges.  The highest threat from this vulnerability is to data confidentiality and integrity as well     as system availability. (CVE-2020-14351)

    A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was     using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of     bounds. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-25656)

    A flaw was found in Linux Kernel because access to the global variable fg_console is not properly     synchronized leading to a use after free in con_font_op. (CVE-2020-25668)

    The function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed.Though the     dangling pointer is set to NULL in sunkbd_disconnect, there is still a alias in sunkbd_reinit so that     causing Use After Free. (CVE-2020-25669)

    A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of     service. (CVE-2020-25704)

    An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
    (CVE-2020-27673)

    An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. (CVE-2020-27675)

    The Linux kernel for powerpc has an issue with the Run-Time Abstraction Services (RTAS) interface,     allowing root (or CAP_SYS_ADMIN users) in a VM to overwrite some parts of memory, including kernel     memory.This issue impacts guests running on top of PowerVM or KVM hypervisors (pseries platform), and does
    *not* impact bare-metal machines (powernv platform). (CVE-2020-27777)

    An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9.
    Local attackers on systems with the speakup driver could cause a local denial of service attack, aka     CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.
    (CVE-2020-28941)

    A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to     read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height. (CVE-2020-28974)

    A flaw was found in the Linux kernel's implementation of Intel's Running Average Power Limit (RAPL)     implementation. A local attacker could infer secrets by measuring power usage and also infer private data     by observing the power usage of calculations performed on the data. (CVE-2020-8694)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4431 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use after free in the video driver leads to local privilege escalation (CVE-2019-9458)

    * kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

    * kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

    * kernel: memory leak in ccp_run_sha_cmd() (CVE-2019-18808)

    * kernel: Denial Of Service in the __ipmi_bmc_register() (CVE-2019-19046)

    * kernel: out-of-bounds write in ext4_xattr_set_entry (CVE-2019-19319)

    * Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

    * kernel: use-after-free in ext4_put_super (CVE-2019-19447)

    * kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free     (CVE-2019-19524)

    * kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

    * kernel: use-after-free in serial_ir_init_module() (CVE-2019-19543)

    * kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry (CVE-2019-19767)

    * kernel: use-after-free in debugfs_remove (CVE-2019-19770)

    * kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

    * kernel: possible use-after-free due to a race condition in cdev_get  (CVE-2020-0305)

    * kernel: out-of-bounds read in in vc_do_resize function (CVE-2020-8647)

    * kernel: use-after-free in n_tty_receive_buf_common function (CVE-2020-8648)

    * kernel: invalid read location in vgacon_invert_region function (CVE-2020-8649)

    * kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

    * kernel: SELinux netlink permission check bypass (CVE-2020-10751)

    * kernel: out-of-bounds write in mpol_parse_str  (CVE-2020-11565)

    * kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

    * kernel: buffer overflow in mt76_add_fragment function (CVE-2020-12465)

    * kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and     data coruption (CVE-2020-12659)

    * kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

    * kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

    * kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

    * kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

    * kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information     disclosure (CVE-2019-9455)

    * kernel: null pointer dereference in dlpar_parse_cc_property  (CVE-2019-12614)

    * kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

    * kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

    * kernel: memory leak in  af9005_identify_state() function (CVE-2019-18809)

    * kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function (CVE-2019-19056)

    * kernel: memory leak in the crypto_report() function (CVE-2019-19062)

    * kernel: Two memory leaks in the rtl_usb_probe() function (CVE-2019-19063)

    * kernel: A memory leak in the rtl8xxxu_submit_int_urb() function (CVE-2019-19068)

    * kernel: A memory leak in the predicate_parse() function (CVE-2019-19072)

    * kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

    * kernel: Null pointer dereference in drop_sysctl_table() (CVE-2019-20054)

    * kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)

    * kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

    * kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

    * kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4609 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

    * kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

    * kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

    * kernel: memory leak in ccp_run_sha_cmd() (CVE-2019-18808)

    * kernel: Denial Of Service in the __ipmi_bmc_register()  (CVE-2019-19046)

    * kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

    * Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

    * kernel: use-after-free in ext4_put_super (CVE-2019-19447)

    * kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free     (CVE-2019-19524)

    * kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

    * kernel: use-after-free in serial_ir_init_module() (CVE-2019-19543)

    * kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry (CVE-2019-19767)

    * kernel: use-after-free in debugfs_remove (CVE-2019-19770)

    * kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

    * kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

    * kernel: out-of-bounds read in in vc_do_resize (CVE-2020-8647)

    * kernel: use-after-free in n_tty_receive_buf_common (CVE-2020-8648)

    * kernel: invalid read location in vgacon_invert_region (CVE-2020-8649)

    * kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

    * kernel: SELinux netlink permission check bypass (CVE-2020-10751)

    * kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

    * kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

    * kernel: out-of-bounds write in xdp_umem_reg (CVE-2020-12659)

    * kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

    * kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

    * kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

    * kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

    * kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information     disclosure (CVE-2019-9455)

    * kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

    * kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

    * kernel: memory leak in  af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c     (CVE-2019-18809)

    * kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() (CVE-2019-19056)

    * kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

    * kernel: Two memory leaks in the rtl_usb_probe() (CVE-2019-19063)

    * kernel: A memory leak in the rtl8xxxu_submit_int_urb() (CVE-2019-19068)

    * kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for     a DoS (CVE-2019-19072)

    * kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

    * kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

    * kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

    * kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

    * kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 kernel was updated receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-9383: Fixed an out-of-bounds read due to improper error condition check of FDC index (bsc#1165111).

CVE-2020-8992: Fixed an issue which could have allowed attackers to cause a soft lockup via a crafted journal size (bsc#1164069).

CVE-2020-8834: Fixed a stack corruption which could have lead to kernel panic (bsc#1168276).

CVE-2020-8649: Fixed a use-after-free in the vgacon_invert_region function in drivers/video/console/vgacon.c (bsc#1162931).

CVE-2020-8648: Fixed a use-after-free in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bsc#1162928).

CVE-2020-8647: Fixed a use-after-free in the vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929).

CVE-2020-8428: Fixed a use-after-free which could have allowed local users to cause a denial of service (bsc#1162109).

CVE-2020-7053: Fixed a use-after-free in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c (bsc#1160966).

CVE-2020-2732: Fixed an issue affecting Intel CPUs where an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources (bsc#1163971).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

CVE-2020-11609: Fixed a NULL pointer dereference due to improper handling of descriptors (bsc#1168854).

CVE-2020-11608: Fixed a NULL pointer dereferences via a crafted USB (bsc#1168829).

CVE-2020-11494: Fixed an issue which could have allowed attackers to read uninitialized can_frame data (bsc#1168424).

CVE-2020-10942: Fixed a kernel stack corruption via crafted system calls (bsc#1167629).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9458: Fixed a use after free due to a race condition which could have led to privilege escalation of privilege (bsc#1168295).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bsc#1120386).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20810: Fixed a memory leak in due to not calling of snd_card_free (bsc#1172458).

CVE-2019-20096: Fixed a memory leak in __feat_register_sp() in net/dccp/feat.c, which could have caused denial of service (bsc#1159908).

CVE-2019-20095: Fixed an improper error-handling cases that did not free allocated hostcmd memory which was causing memory leak (bsc#1159909).

CVE-2019-20054: Fixed a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links (bsc#1159910).

CVE-2019-19966: Fixed a use-after-free in cpia2_exit() which could have caused denial of service (bsc#1159841).

CVE-2019-19965: Fixed a NULL pointer dereference, due to mishandling of port disconnection during discovery (bsc#1159911).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bsc#1159285).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2019-19447: Fixed a user after free via a crafted ext4 filesystem image (bsc#1158819).

CVE-2019-19319: Fixed a user after free when a large old_size value is used in a memset call (bsc#1158021).

CVE-2019-19318: Fixed a use after free via a crafted btrfs image (bsc#1158026).

CVE-2019-19054: Fixed a memory leak in the cx23888_ir_probe() which could have allowed attackers to cause a denial of service (bsc#1161518).

CVE-2019-19045: Fixed a memory leak in which could have allowed attackers to cause a denial of service (bsc#1161522).

CVE-2019-19036: Fixed a NULL pointer dereference in btrfs_root_node (bsc#1157692).

CVE-2019-16994: Fixed a memory leak which might have caused denial of service (bsc#1161523).

CVE-2019-14897: Fixed a stack overflow in Marvell Wifi Driver (bsc#1157155).

CVE-2019-14896: Fixed a heap overflow in Marvell Wifi Driver (bsc#1157157).

CVE-2019-14615: Fixed an improper control flow in certain data structures which could have led to information disclosure (bsc#1160195).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In the Linux kernel 5.0.21, mounting a crafted f2fs     filesystem image can cause a NULL pointer dereference     in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This     is related to F2FS_P_SB in     fs/f2fs/f2fs.h.(CVE-2019-19815)

  - ** DISPUTED ** __btrfs_free_extent in     fs/btrfs/extent-tree.c in the Linux kernel through     5.3.12 calls btrfs_print_leaf in a certain ENOENT case,     which allows local users to obtain potentially     sensitive information about register values via the     dmesg program. NOTE: The BTRFS development team     disputes this issues as not being a vulnerability     because '1) The kernel provide facilities to restrict     access to dmesg - dmesg_restrict=1 sysctl option. So     it's really up to the system administrator to judge     whether dmesg access shall be disallowed or not. 2)     WARN/WARN_ON are widely used macros in the linux     kernel. If this CVE is considered valid this would mean     there are literally thousands CVE lurking in the kernel
    - something which clearly is not the     case.'(CVE-2019-19039)

  - ext4_empty_dir in fs/ext4/namei.c in the Linux kernel     through 5.3.12 allows a NULL pointer dereference     because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be     zero.(CVE-2019-19037)

  - btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel     through 5.3.12 allows a NULL pointer dereference     because rcu_dereference(root->node) can be     zero.(CVE-2019-19036)

  - ** DISPUTED ** In the Linux kernel 4.19.83, there is a     use-after-free (read) in the debugfs_remove function in     fs/debugfs/inode.c (which is used to remove a file or     directory in debugfs that was previously created with a     call to another debugfs function such as     debugfs_create_file). NOTE: Linux kernel developers     dispute this issue as not being an issue with debugfs,     instead this is an issue with misuse of debugfs within     blktrace.(CVE-2019-19770)

  - An issue was discovered in slc_bump in     drivers/net/can/slcan.c in the Linux kernel through     5.6.2. It allows attackers to read uninitialized     can_frame data, potentially containing sensitive     information from kernel stack memory, if the     configuration lacks CONFIG_INIT_STACK_ALL, aka     CID-b9258a2cece4.(CVE-2020-11494)

  - ** DISPUTED ** An issue was discovered in the Linux     kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c     has a stack-based out-of-bounds write because an empty     nodelist is mishandled during mount option parsing, aka     CID-aa9f7d5172fa. NOTE: Someone in the security     community disagrees that this is a vulnerability     because the issue 'is a bug in parsing mount options     which can only be specified by a privileged user, so     triggering the bug does not grant any powers not     already held.'.(CVE-2020-11565)

  - A flaw was found in the Linux kernel's implementation     of some networking protocols in IPsec, such as VXLAN     and GENEVE tunnels over IPv6. When an encrypted tunnel     is created between two hosts, the kernel isn't     correctly routing tunneled data over the encrypted link     rather sending the data unencrypted. This would allow     anyone in between the two endpoints to read the traffic     unencrypted. The main threat from this vulnerability is     to data confidentiality.(CVE-2020-1749)

  - An issue was discovered in the stv06xx subsystem in the     Linux kernel before 5.6.1.
    drivers/media/usb/gspca/stv06xx/stv06xx.c and     drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c     mishandle invalid descriptors, as demonstrated by a     NULL pointer dereference, aka     CID-485b06aadb93.(CVE-2020-11609)

  - An issue was discovered in the Linux kernel before     5.6.1. drivers/media/usb/gspca/ov519.c allows NULL     pointer dereferences in ov511_mode_init_regs and     ov518_mode_init_regs when there are zero endpoints, aka     CID-998912346c0d.(CVE-2020-11608)

  - In the Linux kernel before 5.4.12,     drivers/input/input.c has out-of-bounds writes via a     crafted keycode table, as demonstrated by     input_set_keycode, aka     CID-cb222aed03d7.(CVE-2019-20636)

  - In the Linux kernel before 5.6.1,     drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink     camera USB driver) mishandles invalid descriptors, aka     CID-a246b4d54770.(CVE-2020-11668)

  - In f2fs_xattr_generic_list of xattr.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with System execution privileges needed. User     interaction is not required for exploitation.Product:
    Android. Versions: Android kernel. Android ID:
    A-120551147.(CVE-2020-0067)

  - An issue was discovered in the Linux kernel before 5.2     on the powerpc platform.
    arch/powerpc/kernel/idle_book3s.S does not have     save/restore functionality for PNV_POWERSAVE_AMR,     PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka     CID-53a712bae5dd.(CVE-2020-11669)

  - In the Linux kernel before 5.5.8, get_raw_socket in     drivers/vhost/net.c lacks validation of an sk_family     field, which might allow attackers to trigger kernel     stack corruption via crafted system     calls.(CVE-2020-10942)

  - In the Linux kernel 5.0.21, mounting a crafted btrfs     filesystem image, performing some operations, and     unmounting can lead to a use-after-free in     btrfs_queue_work in     fs/btrfs/async-thread.c.(CVE-2019-19377)

  - relay_open in kernel/relay.c in the Linux kernel     through 5.4.1 allows local users to cause a denial of     service (such as relay blockage) by triggering a NULL     alloc_percpu result.(CVE-2019-19462)

  - An issue was discovered in xfs_agf_verify in     fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through     5.6.10. Attackers may trigger a sync of excessive     duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767.(CVE-2020-12655)

  - The __mptctl_ioctl function in     drivers/message/fusion/mptctl.c in the Linux kernel     before 5.4.14 allows local users to hold an incorrect     lock during the ioctl operation and trigger a race     condition, i.e., a 'double fetch' vulnerability, aka     CID-28d76df18f0a. NOTE: the vendor states 'The security     impact of this bug is not as bad as it could have been     because these operations are all privileged and root     already has enormous destructive     power.'(CVE-2020-12652)

  - A pivot_root race condition in fs/namespace.c in the     Linux kernel 4.4.x before 4.4.221, 4.9.x before     4.9.221, 4.14.x before 4.14.178, 4.19.x before     4.19.119, and 5.x before 5.3 allows local users to     cause a denial of service (panic) by corrupting a     mountpoint reference counter.(CVE-2020-12114)

  - usb_sg_cancel in drivers/usb/core/message.c in the     Linux kernel before 5.6.8 has a use-after-free because     a transfer occurs without a reference, aka     CID-056ad39ee925.(CVE-2020-12464)

  - An issue was found in Linux kernel before 5.5.4.
    mwifiex_ret_wmm_get_status() in     drivers/net/wireless/marvell/mwifiex/wmm.c allows a     remote AP to trigger a heap-based buffer overflow     because of an incorrect memcpy, aka     CID-3a9b153c5591.(CVE-2020-12654)

  - An issue was found in Linux kernel before 5.5.4. The     mwifiex_cmd_append_vsie_tlv() function in     drivers/net/wireless/marvell/mwifiex/scan.c allows     local users to gain privileges or cause a denial of     service because of an incorrect memcpy and buffer     overflow, aka CID-b70261a288ea.(CVE-2020-12653)

  - An array overflow was discovered in mt76_add_fragment     in drivers/net/wireless/mediatek/mt76/dma.c in the     Linux kernel before 5.5.10, aka CID-b102f0c522cf. An     oversized packet with too many rx fragments can corrupt     memory of adjacent pages.(CVE-2020-12465)

  - An issue was discovered in the Linux kernel before     5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an     out-of-bounds write (by a user with the CAP_NET_ADMIN     capability) because of a lack of headroom     validation.(CVE-2020-12659)

  - An issue was discovered in the Linux kernel through     5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c     has a deadlock if a coalescing operation     fails.(CVE-2020-12771)

  - An issue was discovered in the Linux kernel through     5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka     CID-83c6f2390040.(CVE-2020-12770)

  - A signal access-control issue was discovered in the     Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
    Because exec_id in include/linux/sched.h is only 32     bits, an integer overflow can interfere with a     do_notify_parent protection mechanism. A child process     can send an arbitrary signal to a parent process in a     different security domain. Exploitation limitations     include the amount of elapsed time before an integer     overflow occurs, and the lack of scenarios where     signals to a parent process present a substantial     operational threat.(CVE-2020-12826)

  - A NULL pointer dereference flaw was found in the Linux     kernel's SELinux subsystem in versions before 5.7. This     flaw occurs while importing the Commercial IP Security     Option (CIPSO) protocol's category bitmap into the     SELinux extensible bitmap via the'     ebitmap_netlbl_import' routine. While processing the     CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security     attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue     leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This     flaw allows a remote network user to crash the system     kernel, resulting in a denial of     service.(CVE-2020-10711)

  - gadget_dev_desc_UDC_store in     drivers/usb/gadget/configfs.c in the Linux kernel     through 5.6.13 relies on kstrdup without considering     the possibility of an internal '\0' value, which allows     attackers to trigger an out-of-bounds read, aka     CID-15753588bcd4.(CVE-2020-13143)

  - An issue was discovered in the Linux kernel before 5.2.
    There is a NULL pointer dereference in     tw5864_handle_frame() in     drivers/media/pci/tw5864/tw5864-video.c, which may     cause denial of service, aka     CID-2e7682ebfc75.(CVE-2019-20806)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In the Linux kernel     before 5.2.9, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_pro.c driver, aka     CID-ead16e53c2f0.(CVE-2019-19536)In the Linux kernel     before 5.2.9, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_fd.c driver, aka     CID-30a8beeb3042.(CVE-2019-19535)vcs_write in     drivers/tty/vt/vc_screen.c in the Linux kernel through     5.3.13 does not prevent write access to vcsu devices,     aka CID-0c9acb1af77a.(CVE-2019-19252)In the AppleTalk     subsystem in the Linux kernel before 5.1, there is a     potential NULL pointer dereference because     register_snap_client may return NULL. This will lead to     denial of service in net/appletalk/aarp.c and     net/appletalk/ddp.c, as demonstrated by     unregister_snap_client, aka     CID-9804501fa122.(CVE-2019-19227)A memory leak in the     adis_update_scan_mode() function in     drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-ab612b1daf41.(CVE-2019-19060)In the Linux kernel     before 5.3.11, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_core.c driver, aka     CID-f7a1337f0d29.(CVE-2019-19534)In the Linux kernel     before 5.3.11, there is a use-after-free bug that can     be caused by a malicious USB device in the     driverset/can/usb/mcba_usb.c driver, aka     CID-4d6636498c41.(CVE-2019-19529)In the Linux kernel     before 5.3.9, there is a use-after-free bug that can be     caused by a malicious USB device in the     driversfc/pn533/usb.c driver, aka     CID-6af3aa57a098.(CVE-2019-19526)In the Linux kernel     before 5.3.6, there is a use-after-free bug that can be     caused by a malicious USB device in the     driverset/ieee802154/atusb.c driver, aka     CID-7fd25e6fc035.(CVE-2019-19525)In the Linux kernel     before 5.3.9, there are multiple out-of-bounds write     bugs that can be caused by a malicious USB device in     the Linux kernel HID drivers, aka CID-d9d4b1e46d95.
    This affects drivers/hid/hid-axff.c,     drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c,     drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c,     drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c,     drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c,     drivers/hid/hid-tmff.c, and     drivers/hid/hid-zpff.c.(CVE-2019-19532)In the Linux     kernel before 5.2.10, there is a use-after-free bug     that can be caused by a malicious USB device in the     drivers/hid/usbhid/hiddev.c driver, aka     CID-9c09b214f30e.(CVE-2019-19527)** DISPUTED ** The     Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is     enabled and ia32_aout is loaded, allows local users to     bypass ASLR on setuid a.out programs (if any exist)     because install_exec_creds() is called too late in     load_aout_binary() in fs/binfmt_aout.c, and thus the     ptrace_may_access() check has a race condition when     reading /proc/pid/stat. NOTE: the software maintainer     disputes that this is a vulnerability because ASLR for     a.out format executables has never been     supported.(CVE-2019-11191)In the Linux kernel before     5.3.12, there is a use-after-free bug that can be     caused by a malicious USB device in the     drivers/input/ff-memless.c driver, aka     CID-fa3a5a1880c9.(CVE-2019-19524)driverset/wireless/mar     vell/libertas/if_sdio.c in the Linux kernel 5.2.14 does     not check the alloc_workqueue return value, leading to     a NULL pointer     dereference.(CVE-2019-16232)driverset/fjes/fjes_main.c     in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer     dereference.(CVE-2019-16231)** DISPUTED **     drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux     kernel 5.2.14 does not check the alloc_workqueue return     value, leading to a NULL pointer dereference. NOTE: The     security community disputes this issues as not being     serious enough to be deserving a CVE     id.(CVE-2019-16229)Linux kernel CIFS implementation,     version 4.9.0 is vulnerable to a relative paths     injection in directory entry lists.(CVE-2019-10220)A     heap overflow flaw was found in the Linux kernel, all     versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi     chip driver. The vulnerability allows a remote attacker     to cause a system crash, resulting in a denial of     service, or execute arbitrary code. The highest threat     with this vulnerability is with the availability of the     system. If code execution occurs, the code will run     with the permissions of root. This will affect both     confidentiality and integrity of files on the     system.(CVE-2019-14901)The Linux kernel before 5.4.2     mishandles ext4_expand_extra_isize, as demonstrated by     use-after-free errors in __ext4_expand_extra_isize and     ext4_xattr_set_entry, related to fs/ext4/inode.c and     fs/ext4/super.c, aka CID-4ea99936a163.(CVE-2019-19767)A     heap-based buffer overflow was discovered in the Linux     kernel, all versions 3.x.x and 4.x.x before 4.18.0, in     Marvell WiFi chip driver. The flaw could occur when the     station attempts a connection negotiation during the     handling of the remote devices country settings. This     could allow the remote device to cause a denial of     service (system crash) or possibly execute arbitrary     code.(CVE-2019-14895)Linux Kernel could allow a local     authenticated attacker to obtain sensitive information,     caused by a Transaction Asynchronous Abort (TAA) h/w     issue in KVM. By sending a specially-crafted request,     an attacker could exploit this vulnerability to obtain     sensitive information, and use this information to     launch further attacks against the affected     system.(CVE-2019-19338)TSX Asynchronous Abort condition     on some CPUs utilizing speculative execution may allow     an authenticated user to potentially enable information     disclosure via a side channel with local     access.(CVE-2019-11135)An out-of-bounds memory write     issue was found in the Linux Kernel, version 3.13     through 5.4, in the way the Linux kernel's KVM     hypervisor handled the 'KVM_GET_EMULATED_CPUID'     ioctl(2) request to get CPUID features emulated by the     KVM hypervisor. A user or process able to access the     '/dev/kvm' device could use this flaw to crash the     system, resulting in a denial of     service.(CVE-2019-19332)kernel/sched/fair.c in the     Linux kernel before 5.3.9, when cpu.cfs_quota_us is     used (e.g., with Kubernetes), allows attackers to cause     a denial of service against non-cpu-bound applications     by generating a workload that triggers unwanted slice     expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen     with benign workloads, it is possible that an attacker     could calculate how many stray requests are required to     force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and     ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of     the kernel it only causes mismanagement of application     execution.)(CVE-2019-19922)A stack-based buffer     overflow was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. An attacker     is able to cause a denial of service (system crash) or,     possibly execute arbitrary code, when a STA works in     IBSS mode (allows connecting stations together without     the use of an AP) and connects to another     STA.(CVE-2019-14897)A heap-based buffer overflow     vulnerability was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. A remote     attacker could cause a denial of service (system crash)     or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)In the Linux kernel     through 5.4.6, there are information leaks of     uninitialized memory to a USB device in the     driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,     aka CID-da2311a6385c.(CVE-2019-19947)In the Linux     kernel before 5.1, there is a memory leak in
    __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)mwifiex_tm_cmd in     driverset/wireless/marvell/mwifiex/cfg80211.c in the     Linux kernel before 5.1.6 has some error-handling cases     that did not free allocated hostcmd memory, aka     CID-003b686ace82. This will cause a memory leak and     denial of service.(CVE-2019-20095)An exploitable     denial-of-service vulnerability exists in the Linux     kernel prior to mainline 5.3. An attacker could exploit     this vulnerability by triggering AP to send IAPP     location updates for stations before the required     authentication process has completed. This could lead     to different denial-of-service scenarios, either by     causing CAM table attacks, or by leading to traffic     flapping if faking already existing clients in other     nearby APs of the same wireless infrastructure. An     attacker can forge Authentication and Association     Request packets to trigger this     vulnerability.(CVE-2019-5108)In a Linux KVM guest that     has PV TLB enabled, a process in the guest kernel may     be able to read memory locations from another process     in the same guest. This problem is limit to the host     running linux kernel 4.10 with a guest running linux     kernel 4.16 or later. The problem mainly affects AMD     processors but Intel CPUs cannot be ruled     out.(CVE-2019-3016)fsamei.c in the Linux kernel before     5.5 has a may_create_in_sticky use-after-free, which     allows local users to cause a denial of service (OOPS)     or possibly obtain sensitive information from kernel     memory, aka CID-d0cb50185ae9. One attack vector may be     an open system call for a UNIX domain socket, if the     socket is being moved to a new parent directory and its     old parent directory is being     removed.(CVE-2020-8428)There is a use-after-free     vulnerability in the Linux kernel through 5.5.2 in the     n_tty_receive_buf_common function in     drivers/tty_tty.c.(CVE-2020-8648)An issue was     discovered in the Linux kernel through 5.5.6. set_fdc     in drivers/block/floppy.c leads to a wait_til_ready     out-of-bounds read because the FDC index is not checked     for errors before assigning it, aka     CID-2e90ca68b0d2.(CVE-2020-9383)There is a     use-after-free vulnerability in the Linux kernel     through 5.5.2 in the vgacon_invert_region function in     drivers/video/console/vgacon.c.(CVE-2020-8649)There is     a use-after-free vulnerability in the Linux kernel     through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c.(CVE-2020-8647)In the Linux kernel     5.0.21, mounting a crafted ext4 filesystem image,     performing some operations, and unmounting can lead to     a use-after-free in ext4_put_super in fs/ext4/super.c,     related to dump_orphan_list in     fs/ext4/super.c.(CVE-2019-19447)A flaw was discovered     in the way that the KVM hypervisor handled instruction     emulation for an L2 guest when nested virtualisation is     enabled. Under some circumstances, an L2 guest may     trick the L0 guest into accessing sensitive L1     resources that should be inaccessible to the L2     guest.(CVE-2020-2732)In the Linux kernel before 5.3.11,     sound/core/timer.c has a use-after-free caused by     erroneous code refactoring, aka CID-e7af6307a8a5. This     is related to snd_timer_open and     snd_timer_close_locked. The timeri variable was     originally intended to be for a newly created timer     instance, but was used for a different purpose after     refactoring.(CVE-2019-19807)In the Linux kernel     5.4.0-rc2, there is a use-after-free (read) in the
    __blk_add_trace function in kernel/trace/blktrace.c     (which is used to fill out a blk_io_trace structure and     place it in a per-cpu sub-buffer).(CVE-2019-19768)In     the Linux kernel 5.0.21, mounting a crafted f2fs     filesystem image can cause a NULL pointer dereference     in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This     is related to F2FS_P_SB in     fs/f2fs/f2fs.h.(CVE-2019-19815)** DISPUTED **
    __btrfs_free_extent in fs/btrfs/extent-tree.c in the     Linux kernel through 5.3.12 calls btrfs_print_leaf in a     certain ENOENT case, which allows local users to obtain     potentially sensitive information about register values     via the dmesg program. NOTE: The BTRFS development team     disputes this issues as not being a vulnerability     because '1) The kernel provide facilities to restrict     access to dmesg - dmesg_restrict=1 sysctl option. So     it's really up to the system administrator to judge     whether dmesg access shall be disallowed or not. 2)     WARN/WARN_ON are widely used macros in the linux     kernel. If this CVE is considered valid this would mean     there are literally thousands CVE lurking in the kernel
    - something which clearly is not the     case.'(CVE-2019-19039)ext4_empty_dir in fs/ext4amei.c     in the Linux kernel through 5.3.12 allows a NULL     pointer dereference because     ext4_read_dirblock(inode,0,DIRENT_HTREE) can be     zero.(CVE-2019-19037)btrfs_root_node in     fs/btrfs/ctree.c in the Linux kernel through 5.3.12     allows a NULL pointer dereference because     rcu_dereference(root->node) can be     zero.(CVE-2019-19036)In the Linux kernel 4.19.83, there     is a use-after-free (read) in the debugfs_remove     function in fs/debugfs/inode.c (which is used to remove     a file or directory in debugfs that was previously     created with a call to another debugfs function such as     debugfs_create_file).(CVE-2019-19770)An issue was     discovered in slc_bump in driverset/can/slcan.c in the     Linux kernel through 5.6.2. It allows attackers to read     uninitialized can_frame data, potentially containing     sensitive information from kernel stack memory, if the     configuration lacks CONFIG_INIT_STACK_ALL, aka     CID-b9258a2cece4.(CVE-2020-11494)An issue was     discovered in the Linux kernel through 5.6.2.
    mpol_parse_str in mm/mempolicy.c has a stack-based     out-of-bounds write because an empty nodelist is     mishandled during mount option parsing, aka     CID-aa9f7d5172fa.(CVE-2020-11565)A flaw was found in     the Linux kernel's implementation of some networking     protocols in IPsec, such as VXLAN and GENEVE tunnels     over IPv6. When an encrypted tunnel is created between     two hosts, the kernel isn't correctly routing tunneled     data over the encrypted link rather sending the data     unencrypted. This would allow anyone in between the two     endpoints to read the traffic unencrypted. The main     threat from this vulnerability is to data     confidentiality.(CVE-2020-1749)An issue was discovered     in the stv06xx subsystem in the Linux kernel before     5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and     drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c     mishandle invalid descriptors, as demonstrated by a     NULL pointer dereference, aka     CID-485b06aadb93.(CVE-2020-11609)An issue was     discovered in the Linux kernel before 5.6.1.
    drivers/media/usb/gspca/ov519.c allows NULL pointer     dereferences in ov511_mode_init_regs and     ov518_mode_init_regs when there are zero endpoints, aka     CID-998912346c0d.(CVE-2020-11608)In the Linux kernel     before 5.4.12, drivers/input/input.c has out-of-bounds     writes via a crafted keycode table, as demonstrated by     input_set_keycode, aka     CID-cb222aed03d7.(CVE-2019-20636)In the Linux kernel     before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c     (aka the Xirlink camera USB driver) mishandles invalid     descriptors, aka CID-a246b4d54770.(CVE-2020-11668)An     issue was discovered in the Linux kernel through 5.6.2.
    mpol_parse_str in mm/mempolicy.c has a stack-based     out-of-bounds write because an empty nodelist is     mishandled during mount option parsing, aka     CID-aa9f7d5172fa.(CVE-2020-0067)An issue was discovered     in the Linux kernel before 5.2 on the powerpc platform.
    arch/powerpc/kernel/idle_book3s.S does not have     save/restore functionality for PNV_POWERSAVE_AMR,     PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka     CID-53a712bae5dd.(CVE-2020-11669)A flaw was found in     the Linux kernelaEUR?s implementation of GRO. This flaw     allows an attacker with local access to crash the     system.(CVE-2020-10720)A flaw was found in the Linux     kernel's implementation of the invert video code on VGA     consoles when a local attacker attempts to resize the     console, calling an ioctl VT_RESIZE, which causes an     out-of-bounds write to occur. This flaw allows a local     user with access to the VGA console to crash the     system, potentially escalating their privileges on the     system. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system     availability.(CVE-2020-14331)An out-of-bounds (OOB)     memory access flaw was found in ttm_put_pages in     drivers/gpu/drm/ttm/ttm_page_alloc.c in the Linux     kernel's graphics module. Incrementing the page pointer     for huge pages was not in sync with the reference     counter, and this could lead to an out-of-bounds access     or a denial of service. This flaw allows a local     attacker with special user privileges (or root) to     cause memory exploitation.(CVE-2019-19927)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).

CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).

CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).

CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).

CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).

CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).

CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

CVE-2020-2732: Fixed an issue where under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest (bnc#1163971).

CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929 1164078).

CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162929 1162931).

CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).

CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

CVE-2018-20836: Fixed an issue where a race condition in smp_task_timedout() and smp_task_done() cloud lead to a use-after-free (bnc#1134395).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).

CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).

CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).

CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).

CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).

CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).

CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).

CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).

CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).

CVE-2020-8647: Fixed a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).

CVE-2020-8649: Fixed a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).

CVE-2020-9383: Fixed an issue in set_fdc in drivers/block/floppy.c, which leads to a wait_til_ready out-of-bounds read (bnc#1165111).

CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).

CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).

CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).

CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).

CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).

CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).

CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).

CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP5 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).

CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).

CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).

CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).

CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).

CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).

CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).

CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).

CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

CVE-2018-20836: Fixed an issue where a race condition in smp_task_timedout() and smp_task_done() could lead to a use-after-free (bnc#1134395).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In the Linux kernel     4.19.83, there is a use-after-free (read) in the     debugfs_remove function in fs/debugfs/inode.c (which is     used to remove a file or directory in debugfs that was     previously created with a call to another debugfs     function such as     debugfs_create_file).(CVE-2019-19770)mwifiex_tm_cmd in     driverset/wireless/marvell/mwifiex/cfg80211.c in the     Linux kernel before 5.1.6 has some error-handling cases     that did not free allocated hostcmd memory, aka     CID-003b686ace82. This will cause a memory leak and     denial of service.(CVE-2019-20095)TSX Asynchronous     Abort condition on some CPUs utilizing speculative     execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access.(CVE-2019-11135)A memory leak     in the crypto_report() function in     crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service     (memory consumption) by triggering crypto_report_alg()     failures, aka CID-ffdde5932042.(CVE-2019-19062)In the     Linux kernel before 5.1.6, there is a use-after-free in     serial_ir_init_module() in     drivers/media/rc/serial_ir.c.(CVE-2019-19543)In the     Linux kernel through 5.4.6, there is a NULL pointer     dereference in drivers/scsi/libsas/sas_discover.c     because of mishandling of port disconnection during     discovery, related to a PHY down race condition, aka     CID-f70267f379b5.(CVE-2019-19965)In the Linux kernel     before 5.1.6, there is a use-after-free in cpia2_exit()     in drivers/media/usb/cpia2/cpia2_v4l.c that will cause     denial of service, aka     CID-dea37a972655.(CVE-2019-19966)An issue was     discovered in drivers/xen/balloon.c in the Linux kernel     before 5.2.3, as used in Xen through 4.12.x, allowing     guest OS users to cause a denial of service because of     unrestricted resource consumption during the mapping of     guest memory, aka CID-6ef36ab967c7.(CVE-2019-17351)A     memory leak in the crypto_reportstat() function in     drivers/virt/vboxguest/vboxguest_utils.c in the Linux     kernel before 5.3.9 allows attackers to cause a denial     of service (memory consumption) by triggering     copy_form_user() failures, aka     CID-e0b0cb938864.(CVE-2019-19048)kernel/sched/fair.c in     the Linux kernel before 5.3.9, when cpu.cfs_quota_us is     used (e.g., with Kubernetes), allows attackers to cause     a denial of service against non-cpu-bound applications     by generating a workload that triggers unwanted slice     expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen     with benign workloads, it is possible that an attacker     could calculate how many stray requests are required to     force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and     ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of     the kernel it only causes mismanagement of application     execution.)(CVE-2019-19922)An out-of-bounds memory     write issue was found in the Linux Kernel, version 3.13     through 5.4, in the way the Linux kernel's KVM     hypervisor handled the 'KVM_GET_EMULATED_CPUID'     ioctl(2) request to get CPUID features emulated by the     KVM hypervisor. A user or process able to access the     '/dev/kvm' device could use this flaw to crash the     system, resulting in a denial of     service.(CVE-2019-19332)A flaw was found in the fix for     CVE-2019-11135, the way Intel CPUs handle speculative     execution of instructions when a TSX Asynchronous Abort     (TAA) error occurs. When a guest is running on a host     CPU affected by the TAA flaw (TAA_NO=0), but is not     affected by the MDS issue (MDS_NO=1), the guest was to     clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to     the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects     guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the     highest threat associated with this     vulnerability.(CVE-2019-19338)In the Linux kernel     5.0.0-rc7 (as distributed in ubuntu/linux.git on     kernel.ubuntu.com), mounting a crafted f2fs filesystem     image and performing some operations can lead to     slab-out-of-bounds read access in ttm_put_pages in     drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related     to the vmwgfx or ttm module.(CVE-2019-19927)In the     Linux kernel 4.14 longterm through 4.14.165 and 4.19     longterm through 4.19.96 (and 5.x before 5.2), there is     a use-after-free (write) in the i915_ppgtt_close     function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka     CID-7dc40713618c. This is related to     i915_gem_context_destroy_ioctl in     drivers/gpu/drm/i915/i915_gem_context.c.(CVE-2020-7053)     In the Linux kernel through 5.4.6, there are     information leaks of uninitialized memory to a USB     device in the     driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,     aka CID-da2311a6385c.(CVE-2019-19947)In the Linux     kernel before 5.0.6, there is a NULL pointer     dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka     CID-23da9588037e.(CVE-2019-20054)In the Linux kernel     before 5.1, there is a memory leak in
    __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)A heap-based buffer     overflow vulnerability was found in the Linux kernel,     version kernel-2.6.32, in Marvell WiFi chip driver. A     remote attacker could cause a denial of service (system     crash) or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)A heap-based buffer     overflow was discovered in the Linux kernel, all     versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi     chip driver. The flaw could occur when the station     attempts a connection negotiation during the handling     of the remote devices country settings. This could     allow the remote device to cause a denial of service     (system crash) or possibly execute arbitrary     code.(CVE-2019-14895)A stack-based buffer overflow was     found in the Linux kernel, version kernel-2.6.32, in     Marvell WiFi chip driver. An attacker is able to cause     a denial of service (system crash) or, possibly execute     arbitrary code, when a STA works in IBSS mode (allows     connecting stations together without the use of an AP)     and connects to another STA.(CVE-2019-14897)An     exploitable denial-of-service vulnerability exists in     the Linux kernel prior to mainline 5.3. An attacker     could exploit this vulnerability by triggering AP to     send IAPP location updates for stations before the     required authentication process has completed. This     could lead to different denial-of-service scenarios,     either by causing CAM table attacks, or by leading to     traffic flapping if faking already existing clients in     other nearby APs of the same wireless infrastructure.
    An attacker can forge Authentication and Association     Request packets to trigger this     vulnerability.(CVE-2019-5108)drivers/gpu/drm/radeon/rad     eon_display.c in the Linux kernel 5.2.14 does not check     the alloc_workqueue return value, leading to a NULL     pointer dereference.(CVE-2019-16230)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
180891	Oracle Linux 8 : kernel (ELSA-2020-4431)	Nessus	Oracle Linux Local Security Checks	high
160437	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-016)	Nessus	Amazon Linux Local Security Checks	high
157698	AlmaLinux 8 : kernel (ALSA-2020:4431)	Nessus	Alma Linux Local Security Checks	high
145806	CentOS 8 : kernel (CESA-2020:4431)	Nessus	CentOS Local Security Checks	high
145005	Amazon Linux AMI : kernel (ALAS-2021-1461)	Nessus	Amazon Linux Local Security Checks	high
144749	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4680-1)	Nessus	Ubuntu Local Security Checks	high
144514	Photon OS 3.0: Linux PHSA-2020-3.0-0177	Nessus	PhotonOS Local Security Checks	high
144464	Amazon Linux AMI : kernel (ALAS-2020-1462) (deprecated)	Nessus	Amazon Linux Local Security Checks	high
144097	Debian DLA-2483-1 : linux-4.19 security update	Nessus	Debian Local Security Checks	high
143589	Amazon Linux 2 : kernel (ALAS-2020-1566)	Nessus	Amazon Linux Local Security Checks	high
142430	RHEL 8 : kernel (RHSA-2020:4431)	Nessus	Red Hat Local Security Checks	high
142382	RHEL 8 : kernel-rt (RHSA-2020:4609)	Nessus	Red Hat Local Security Checks	high
138272	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:1663-1)	Nessus	SuSE Local Security Checks	critical
137805	EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1698)	Nessus	Huawei Local Security Checks	high
136239	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2020-1536)	Nessus	Huawei Local Security Checks	critical
136168	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:1146-1)	Nessus	SuSE Local Security Checks	high
136166	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1142-1)	Nessus	SuSE Local Security Checks	high
136165	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1141-1)	Nessus	SuSE Local Security Checks	high
136075	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:1123-1)	Nessus	SuSE Local Security Checks	high
136026	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1119-1)	Nessus	SuSE Local Security Checks	high
136025	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1118-1)	Nessus	SuSE Local Security Checks	high
136006	openSUSE Security Update : the Linux Kernel (openSUSE-2020-543)	Nessus	SuSE Local Security Checks	high
133992	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1158)	Nessus	Huawei Local Security Checks	critical

Detections

Analytics

CVE-2019-19770

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

critical

high

high

high

high

high

high

high

critical