kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1493 advisory.

  - A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before     4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection     negotiation during the handling of the remote devices country settings. This could allow the remote device     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14895)

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of     other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction     (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some     point, the vector registers will be corrupted with the values from a different local Linux process,     because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c. (CVE-2019-15031)

  - drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via     an incomplete address in an endpoint descriptor. (CVE-2019-15099)

  - An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in
    __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in     net/xfrm/xfrm_user.c mishandles directory validation. (CVE-2019-15666)

  - kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with     Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by     generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen with benign workloads, it is possible that an     attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of the kernel; it only causes mismanagement of     application execution.) (CVE-2019-19922)

  - In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. (CVE-2019-20054)

  - mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has     some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will     cause a memory leak and denial of service. (CVE-2019-20095)

  - An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An     attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations     before the required authentication process has completed. This could lead to different denial-of-service     scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already     existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge     Authentication and Association Request packets to trigger this vulnerability. (CVE-2019-5108)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1769 advisory.

    [4.18.0-193.el8.OL8]
    - Oracle Linux certificates (Alexey Petrenko)
    - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list      (olkmod_signing_key.pem) [Orabug: 29539237]
    - Update x509.genkey [Orabug: 24817676]

    [4.18.0-193.el8]
    - [kvm] KVM: PPC: Book3S HV: Use __gfn_to_pfn_memslot in HPT page fault handler     (Sam Bobroff) [1815491]
    - [net] tcp: also NULL skb->dev when copy was needed (Florian Westphal) [1775961     ]
    - [net] tcp: ensure skb->dev is NULL before leaving TCP stack (Florian Westphal)      [1775961]

    [4.18.0-192.el8]
    - [drm] drm/bochs: downgrade pci_request_region failure from error to warning (D     ave Airlie) [1804735]
    - [drm] drm/bochs: deinit bugfix (Dave Airlie) [1804735]
    - [fs] gfs2: fix O_EXCL|O_CREAT handling on cold dcache (Andrew Price) [1811787]
    - [net] esp: remove the skb from the chain when its enqueued in cryptd_wq (Xin     Long) [1807909]
    - [powerpc] powerpc/nvdimm: set target_node properly (Diego Domingos) [1815038]

    [4.18.0-191.el8]
    - [netdrv] net/mlx5e: Dont clear the whole vf config when switching modes (moha     mad meib) [1814350]
    - [fs] fuse: fix stack use after return (Miklos Szeredi) [1814666]

    [4.18.0-190.el8]
    - [powerpc] powerpc/pseries: Avoid NULL pointer dereference when drmem is unavai     lable (David Hildenbrand) [1812874]
    - [x86] kvm/svm: PKU not currently supported (Wei Huang) [1789159]
    - [x86] Remove the unsupported check for Cooper Lake (David Arcari) [1813921]

    [4.18.0-189.el8]
    - [netdrv] net/mlx5e: Show/set Rx network flow classification rules on ul rep (A     laa Hleihel) [1795156 1794280]
    - [netdrv] net/mlx5e: Init ethtool steering for representors (Alaa Hleihel) [179     5156 1794280]
    - [netdrv] net/mlx5e: Show/set Rx flow indir table and RSS hash key on ul rep (A     laa Hleihel) [1795156 1794280]
    - [netdrv] net/mlx5e: Introduce root ft concept for representors netdevs (Alaa H     leihel) [1795156 1794280]
    - [netdrv] net/mlx5: E-Switch, Use vport metadata matching only when mandatory (     Alaa Hleihel) [1795156]
    - [nvme] nvme: log additional message for controller status (David Milburn) [175     2952]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1769 advisory.

  - kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)

  - Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR (CVE-2019-10639)

  - kernel: use-after-free in function __mdiobus_register() in drivers/net/phy/mdio_bus.c (CVE-2019-12819)

  - kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure     (CVE-2019-15090)

  - kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

  - kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)

  - kernel: Null pointer dereference in the sound/usb/line6/driver.c (CVE-2019-15223)

  - kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c (CVE-2019-16234)

  - kernel: unprivileged users able to create RAW sockets in AF_IEEE802154 network protocol (CVE-2019-17053)

  - kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol (CVE-2019-17055)

  - kernel: The flow_dissector feature allows device tracking (CVE-2019-18282)

  - kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)

  - kernel: dos in mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c     (CVE-2019-19045)

  - kernel: dos in mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c     (CVE-2019-19047)

  - kernel: memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c allows DoS     (CVE-2019-19055)

  - kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)

  - kernel: A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c     allows for a DoS (CVE-2019-19058)

  - kernel: Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in     drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c allows for a DoS (CVE-2019-19059)

  - kernel: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c allows for a DoS     (CVE-2019-19065)

  - kernel: Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c allow     for a DoS (CVE-2019-19067)

  - kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS)     (CVE-2019-19073)

  - kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)

  - kernel: memory leak in bnxt_re_create_srq function in drivers/infiniband/hw/bnxt_re/ib_verbs.c     (CVE-2019-19077)

  - kernel: malicious USB devices can lead to multiple out-of-bounds write (CVE-2019-19532)

  - kernel: information leak bug caused by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)

  - kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

  - kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound     applications (CVE-2019-19922)

  - kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service     (CVE-2019-8980)

  - kernel: use-after-free in cdev_put() when a PTP device is removed while it's chardev is open     (CVE-2020-10690)

  - kernel: some ipv6 protocols not encrypted over ipsec tunnel (CVE-2020-1749)

  - kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c (CVE-2020-7053)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5845 advisory.

    - sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Dave     Chiluk)  [Orabug: 31350999]  {CVE-2019-19922}
    - sched/fair: Fix throttle_list starvation with low CFS quota (Phil Auld)  [Orabug: 31350999]     {CVE-2019-19922}
    - sched/fair: Fix bandwidth timer clock drift condition (Xunlei Pang)  [Orabug: 31350999]     {CVE-2019-19922}
    - btrfs: tree-checker: Verify block_group_item (Qu Wenruo)  [Orabug: 31351986]  {CVE-2018-14613}
    - btrfs: tree-check: reduce stack consumption in check_dir_item (David Sterba)  [Orabug: 31351986]     {CVE-2018-14613}
    - btrfs: tree-checker: use %zu format string for size_t (Arnd Bergmann)  [Orabug: 31351986]     {CVE-2018-14613}
    - btrfs: tree-checker: Add checker for dir item (Qu Wenruo)  [Orabug: 31351986]  {CVE-2018-14613}
    - btrfs: tree-checker: Fix false panic for sanity test (Qu Wenruo)  [Orabug: 31351986]  {CVE-2018-14613}
    - btrfs: tree-checker: Enhance btrfs_check_node output (Qu Wenruo)  [Orabug: 31351986]  {CVE-2018-14613}
    - btrfs: Move leaf and node validation checker to tree-checker.c (Qu Wenruo)  [Orabug: 31351986]     {CVE-2018-14613}
    - btrfs: Add checker for EXTENT_CSUM (Qu Wenruo)  [Orabug: 31351986]  {CVE-2018-14613}
    - btrfs: Add sanity check for EXTENT_DATA when reading out leaf (Qu Wenruo)  [Orabug: 31351986]     {CVE-2018-14613}
    - btrfs: Check if item pointer overlaps with the item itself (Qu Wenruo)  [Orabug: 31351986]     {CVE-2018-14613}
    - btrfs: Refactor check_leaf function for later expansion (Qu Wenruo)  [Orabug: 31351986]     {CVE-2018-14613}
    - nfsd: apply umask on fs without ACL support (J. Bruce Fields)  [Orabug: 31779888]  {CVE-2020-24394}
    - sctp: implement memory accounting on tx path (Xin Long)  [Orabug: 31351959]  {CVE-2019-3874}
    - vhost_net: fix possible infinite loop (Jason Wang)  [Orabug: 31351949]  {CVE-2019-3900} {CVE-2019-3900}
    - vhost: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 31351949]  {CVE-2019-3900}
    - vhost_net: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 31351949]  {CVE-2019-3900}
    - vhost_net: use packet weight for rx handler, too (Paolo Abeni)  [Orabug: 31351949]  {CVE-2019-3900}
    - vhost-net: set packet weight of tx polling to 2 * vq size (haibinzhang()  [Orabug: 31351949]     {CVE-2019-3900}
    - repair kABI breakage from 'fs: prevent page refcount overflow in pipe_buf_get' (Dan Duval)  [Orabug:
    31351940]  {CVE-2019-11487}
    - fs: prevent page refcount overflow in pipe_buf_get (Matthew Wilcox)  [Orabug: 31351940]     {CVE-2019-11487}
    - mm: add 'try_get_page()' helper function (Linus Torvalds)  [Orabug: 31351940]  {CVE-2019-11487}
    - mm: prevent get_user_pages() from overflowing page refcount (Linus Torvalds)  [Orabug: 31351940]     {CVE-2019-11487}
    - mm: make page ref count overflow check tighter and more explicit (Linus Torvalds)  [Orabug: 31351940]     {CVE-2019-11487}
    - tracing: Fix buffer_ref pipe ops (Jann Horn)  [Orabug: 31351940]  {CVE-2019-11487}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In the Linux kernel     before 5.2.9, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_pro.c driver, aka     CID-ead16e53c2f0.(CVE-2019-19536)In the Linux kernel     before 5.2.9, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_fd.c driver, aka     CID-30a8beeb3042.(CVE-2019-19535)vcs_write in     drivers/tty/vt/vc_screen.c in the Linux kernel through     5.3.13 does not prevent write access to vcsu devices,     aka CID-0c9acb1af77a.(CVE-2019-19252)In the AppleTalk     subsystem in the Linux kernel before 5.1, there is a     potential NULL pointer dereference because     register_snap_client may return NULL. This will lead to     denial of service in net/appletalk/aarp.c and     net/appletalk/ddp.c, as demonstrated by     unregister_snap_client, aka     CID-9804501fa122.(CVE-2019-19227)A memory leak in the     adis_update_scan_mode() function in     drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-ab612b1daf41.(CVE-2019-19060)In the Linux kernel     before 5.3.11, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_core.c driver, aka     CID-f7a1337f0d29.(CVE-2019-19534)In the Linux kernel     before 5.3.11, there is a use-after-free bug that can     be caused by a malicious USB device in the     driverset/can/usb/mcba_usb.c driver, aka     CID-4d6636498c41.(CVE-2019-19529)In the Linux kernel     before 5.3.9, there is a use-after-free bug that can be     caused by a malicious USB device in the     driversfc/pn533/usb.c driver, aka     CID-6af3aa57a098.(CVE-2019-19526)In the Linux kernel     before 5.3.6, there is a use-after-free bug that can be     caused by a malicious USB device in the     driverset/ieee802154/atusb.c driver, aka     CID-7fd25e6fc035.(CVE-2019-19525)In the Linux kernel     before 5.3.9, there are multiple out-of-bounds write     bugs that can be caused by a malicious USB device in     the Linux kernel HID drivers, aka CID-d9d4b1e46d95.
    This affects drivers/hid/hid-axff.c,     drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c,     drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c,     drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c,     drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c,     drivers/hid/hid-tmff.c, and     drivers/hid/hid-zpff.c.(CVE-2019-19532)In the Linux     kernel before 5.2.10, there is a use-after-free bug     that can be caused by a malicious USB device in the     drivers/hid/usbhid/hiddev.c driver, aka     CID-9c09b214f30e.(CVE-2019-19527)** DISPUTED ** The     Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is     enabled and ia32_aout is loaded, allows local users to     bypass ASLR on setuid a.out programs (if any exist)     because install_exec_creds() is called too late in     load_aout_binary() in fs/binfmt_aout.c, and thus the     ptrace_may_access() check has a race condition when     reading /proc/pid/stat. NOTE: the software maintainer     disputes that this is a vulnerability because ASLR for     a.out format executables has never been     supported.(CVE-2019-11191)In the Linux kernel before     5.3.12, there is a use-after-free bug that can be     caused by a malicious USB device in the     drivers/input/ff-memless.c driver, aka     CID-fa3a5a1880c9.(CVE-2019-19524)driverset/wireless/mar     vell/libertas/if_sdio.c in the Linux kernel 5.2.14 does     not check the alloc_workqueue return value, leading to     a NULL pointer     dereference.(CVE-2019-16232)driverset/fjes/fjes_main.c     in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer     dereference.(CVE-2019-16231)** DISPUTED **     drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux     kernel 5.2.14 does not check the alloc_workqueue return     value, leading to a NULL pointer dereference. NOTE: The     security community disputes this issues as not being     serious enough to be deserving a CVE     id.(CVE-2019-16229)Linux kernel CIFS implementation,     version 4.9.0 is vulnerable to a relative paths     injection in directory entry lists.(CVE-2019-10220)A     heap overflow flaw was found in the Linux kernel, all     versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi     chip driver. The vulnerability allows a remote attacker     to cause a system crash, resulting in a denial of     service, or execute arbitrary code. The highest threat     with this vulnerability is with the availability of the     system. If code execution occurs, the code will run     with the permissions of root. This will affect both     confidentiality and integrity of files on the     system.(CVE-2019-14901)The Linux kernel before 5.4.2     mishandles ext4_expand_extra_isize, as demonstrated by     use-after-free errors in __ext4_expand_extra_isize and     ext4_xattr_set_entry, related to fs/ext4/inode.c and     fs/ext4/super.c, aka CID-4ea99936a163.(CVE-2019-19767)A     heap-based buffer overflow was discovered in the Linux     kernel, all versions 3.x.x and 4.x.x before 4.18.0, in     Marvell WiFi chip driver. The flaw could occur when the     station attempts a connection negotiation during the     handling of the remote devices country settings. This     could allow the remote device to cause a denial of     service (system crash) or possibly execute arbitrary     code.(CVE-2019-14895)Linux Kernel could allow a local     authenticated attacker to obtain sensitive information,     caused by a Transaction Asynchronous Abort (TAA) h/w     issue in KVM. By sending a specially-crafted request,     an attacker could exploit this vulnerability to obtain     sensitive information, and use this information to     launch further attacks against the affected     system.(CVE-2019-19338)TSX Asynchronous Abort condition     on some CPUs utilizing speculative execution may allow     an authenticated user to potentially enable information     disclosure via a side channel with local     access.(CVE-2019-11135)An out-of-bounds memory write     issue was found in the Linux Kernel, version 3.13     through 5.4, in the way the Linux kernel's KVM     hypervisor handled the 'KVM_GET_EMULATED_CPUID'     ioctl(2) request to get CPUID features emulated by the     KVM hypervisor. A user or process able to access the     '/dev/kvm' device could use this flaw to crash the     system, resulting in a denial of     service.(CVE-2019-19332)kernel/sched/fair.c in the     Linux kernel before 5.3.9, when cpu.cfs_quota_us is     used (e.g., with Kubernetes), allows attackers to cause     a denial of service against non-cpu-bound applications     by generating a workload that triggers unwanted slice     expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen     with benign workloads, it is possible that an attacker     could calculate how many stray requests are required to     force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and     ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of     the kernel it only causes mismanagement of application     execution.)(CVE-2019-19922)A stack-based buffer     overflow was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. An attacker     is able to cause a denial of service (system crash) or,     possibly execute arbitrary code, when a STA works in     IBSS mode (allows connecting stations together without     the use of an AP) and connects to another     STA.(CVE-2019-14897)A heap-based buffer overflow     vulnerability was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. A remote     attacker could cause a denial of service (system crash)     or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)In the Linux kernel     through 5.4.6, there are information leaks of     uninitialized memory to a USB device in the     driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,     aka CID-da2311a6385c.(CVE-2019-19947)In the Linux     kernel before 5.1, there is a memory leak in
    __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)mwifiex_tm_cmd in     driverset/wireless/marvell/mwifiex/cfg80211.c in the     Linux kernel before 5.1.6 has some error-handling cases     that did not free allocated hostcmd memory, aka     CID-003b686ace82. This will cause a memory leak and     denial of service.(CVE-2019-20095)An exploitable     denial-of-service vulnerability exists in the Linux     kernel prior to mainline 5.3. An attacker could exploit     this vulnerability by triggering AP to send IAPP     location updates for stations before the required     authentication process has completed. This could lead     to different denial-of-service scenarios, either by     causing CAM table attacks, or by leading to traffic     flapping if faking already existing clients in other     nearby APs of the same wireless infrastructure. An     attacker can forge Authentication and Association     Request packets to trigger this     vulnerability.(CVE-2019-5108)In a Linux KVM guest that     has PV TLB enabled, a process in the guest kernel may     be able to read memory locations from another process     in the same guest. This problem is limit to the host     running linux kernel 4.10 with a guest running linux     kernel 4.16 or later. The problem mainly affects AMD     processors but Intel CPUs cannot be ruled     out.(CVE-2019-3016)fsamei.c in the Linux kernel before     5.5 has a may_create_in_sticky use-after-free, which     allows local users to cause a denial of service (OOPS)     or possibly obtain sensitive information from kernel     memory, aka CID-d0cb50185ae9. One attack vector may be     an open system call for a UNIX domain socket, if the     socket is being moved to a new parent directory and its     old parent directory is being     removed.(CVE-2020-8428)There is a use-after-free     vulnerability in the Linux kernel through 5.5.2 in the     n_tty_receive_buf_common function in     drivers/tty_tty.c.(CVE-2020-8648)An issue was     discovered in the Linux kernel through 5.5.6. set_fdc     in drivers/block/floppy.c leads to a wait_til_ready     out-of-bounds read because the FDC index is not checked     for errors before assigning it, aka     CID-2e90ca68b0d2.(CVE-2020-9383)There is a     use-after-free vulnerability in the Linux kernel     through 5.5.2 in the vgacon_invert_region function in     drivers/video/console/vgacon.c.(CVE-2020-8649)There is     a use-after-free vulnerability in the Linux kernel     through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c.(CVE-2020-8647)In the Linux kernel     5.0.21, mounting a crafted ext4 filesystem image,     performing some operations, and unmounting can lead to     a use-after-free in ext4_put_super in fs/ext4/super.c,     related to dump_orphan_list in     fs/ext4/super.c.(CVE-2019-19447)A flaw was discovered     in the way that the KVM hypervisor handled instruction     emulation for an L2 guest when nested virtualisation is     enabled. Under some circumstances, an L2 guest may     trick the L0 guest into accessing sensitive L1     resources that should be inaccessible to the L2     guest.(CVE-2020-2732)In the Linux kernel before 5.3.11,     sound/core/timer.c has a use-after-free caused by     erroneous code refactoring, aka CID-e7af6307a8a5. This     is related to snd_timer_open and     snd_timer_close_locked. The timeri variable was     originally intended to be for a newly created timer     instance, but was used for a different purpose after     refactoring.(CVE-2019-19807)In the Linux kernel     5.4.0-rc2, there is a use-after-free (read) in the
    __blk_add_trace function in kernel/trace/blktrace.c     (which is used to fill out a blk_io_trace structure and     place it in a per-cpu sub-buffer).(CVE-2019-19768)In     the Linux kernel 5.0.21, mounting a crafted f2fs     filesystem image can cause a NULL pointer dereference     in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This     is related to F2FS_P_SB in     fs/f2fs/f2fs.h.(CVE-2019-19815)** DISPUTED **
    __btrfs_free_extent in fs/btrfs/extent-tree.c in the     Linux kernel through 5.3.12 calls btrfs_print_leaf in a     certain ENOENT case, which allows local users to obtain     potentially sensitive information about register values     via the dmesg program. NOTE: The BTRFS development team     disputes this issues as not being a vulnerability     because '1) The kernel provide facilities to restrict     access to dmesg - dmesg_restrict=1 sysctl option. So     it's really up to the system administrator to judge     whether dmesg access shall be disallowed or not. 2)     WARN/WARN_ON are widely used macros in the linux     kernel. If this CVE is considered valid this would mean     there are literally thousands CVE lurking in the kernel
    - something which clearly is not the     case.'(CVE-2019-19039)ext4_empty_dir in fs/ext4amei.c     in the Linux kernel through 5.3.12 allows a NULL     pointer dereference because     ext4_read_dirblock(inode,0,DIRENT_HTREE) can be     zero.(CVE-2019-19037)btrfs_root_node in     fs/btrfs/ctree.c in the Linux kernel through 5.3.12     allows a NULL pointer dereference because     rcu_dereference(root->node) can be     zero.(CVE-2019-19036)In the Linux kernel 4.19.83, there     is a use-after-free (read) in the debugfs_remove     function in fs/debugfs/inode.c (which is used to remove     a file or directory in debugfs that was previously     created with a call to another debugfs function such as     debugfs_create_file).(CVE-2019-19770)An issue was     discovered in slc_bump in driverset/can/slcan.c in the     Linux kernel through 5.6.2. It allows attackers to read     uninitialized can_frame data, potentially containing     sensitive information from kernel stack memory, if the     configuration lacks CONFIG_INIT_STACK_ALL, aka     CID-b9258a2cece4.(CVE-2020-11494)An issue was     discovered in the Linux kernel through 5.6.2.
    mpol_parse_str in mm/mempolicy.c has a stack-based     out-of-bounds write because an empty nodelist is     mishandled during mount option parsing, aka     CID-aa9f7d5172fa.(CVE-2020-11565)A flaw was found in     the Linux kernel's implementation of some networking     protocols in IPsec, such as VXLAN and GENEVE tunnels     over IPv6. When an encrypted tunnel is created between     two hosts, the kernel isn't correctly routing tunneled     data over the encrypted link rather sending the data     unencrypted. This would allow anyone in between the two     endpoints to read the traffic unencrypted. The main     threat from this vulnerability is to data     confidentiality.(CVE-2020-1749)An issue was discovered     in the stv06xx subsystem in the Linux kernel before     5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and     drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c     mishandle invalid descriptors, as demonstrated by a     NULL pointer dereference, aka     CID-485b06aadb93.(CVE-2020-11609)An issue was     discovered in the Linux kernel before 5.6.1.
    drivers/media/usb/gspca/ov519.c allows NULL pointer     dereferences in ov511_mode_init_regs and     ov518_mode_init_regs when there are zero endpoints, aka     CID-998912346c0d.(CVE-2020-11608)In the Linux kernel     before 5.4.12, drivers/input/input.c has out-of-bounds     writes via a crafted keycode table, as demonstrated by     input_set_keycode, aka     CID-cb222aed03d7.(CVE-2019-20636)In the Linux kernel     before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c     (aka the Xirlink camera USB driver) mishandles invalid     descriptors, aka CID-a246b4d54770.(CVE-2020-11668)An     issue was discovered in the Linux kernel through 5.6.2.
    mpol_parse_str in mm/mempolicy.c has a stack-based     out-of-bounds write because an empty nodelist is     mishandled during mount option parsing, aka     CID-aa9f7d5172fa.(CVE-2020-0067)An issue was discovered     in the Linux kernel before 5.2 on the powerpc platform.
    arch/powerpc/kernel/idle_book3s.S does not have     save/restore functionality for PNV_POWERSAVE_AMR,     PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka     CID-53a712bae5dd.(CVE-2020-11669)A flaw was found in     the Linux kernelaEUR?s implementation of GRO. This flaw     allows an attacker with local access to crash the     system.(CVE-2020-10720)A flaw was found in the Linux     kernel's implementation of the invert video code on VGA     consoles when a local attacker attempts to resize the     console, calling an ioctl VT_RESIZE, which causes an     out-of-bounds write to occur. This flaw allows a local     user with access to the VGA console to crash the     system, potentially escalating their privileges on the     system. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system     availability.(CVE-2020-14331)An out-of-bounds (OOB)     memory access flaw was found in ttm_put_pages in     drivers/gpu/drm/ttm/ttm_page_alloc.c in the Linux     kernel's graphics module. Incrementing the page pointer     for huge pages was not in sync with the reference     counter, and this could lead to an out-of-bounds access     or a denial of service. This flaw allows a local     attacker with special user privileges (or root) to     cause memory exploitation.(CVE-2019-19927)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1567 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)

    * kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service     (CVE-2019-8980)

    * kernel: unprivileged users able to create RAW sockets  in AF_IEEE802154 network protocol.
    (CVE-2019-17053)

    * kernel: unprivileged users able to create RAW sockets in AF_ISDN  network protocol. (CVE-2019-17055)

    * kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)

    * kernel: information leak bug caused  by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)

    * kernel: some ipv6 protocols not encrypted over ipsec tunnel. (CVE-2020-1749)

    * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR     (CVE-2019-10639)

    * kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure     (CVE-2019-15090)

    * kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

    * kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)

    * kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)

    * kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS)     (CVE-2019-19073)

    * kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)

    * kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-     bound applications (CVE-2019-19922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RT: update RT source tree to the RHEL-8.2 tree (BZ#1708716)

    * KVM-RT guest fails boot with emulatorsched (BZ#1712781)

    * 8 vCPU guest need max latency < 20 us with stress [RT-8.2] (BZ#1757165)

    * Request nx_huge_pages=N as default value to avoid kvm-rt guest large latency spike [rt-8] (BZ#1788352)

    * RT: Add rpm Provide of 'kernel' to indicate that this is a kernel package (BZ#1796284)

    * [RHEL8] RT kernel signed by test certificate and not Red Hat Secure Boot (BZ#1806871)

    Enhancement(s):

    * update to the upstream 5.x RT patchset (BZ#1680161)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1769 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)

    * kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service     (CVE-2019-8980)

    * kernel: unprivileged users able to create RAW sockets  in AF_IEEE802154 network protocol.
    (CVE-2019-17053)

    * kernel: unprivileged users able to create RAW sockets in AF_ISDN  network protocol. (CVE-2019-17055)

    * kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)

    * kernel: information leak bug caused  by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)

    * kernel: some ipv6 protocols not encrypted over ipsec tunnel. (CVE-2020-1749)

    * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR     (CVE-2019-10639)

    * kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure     (CVE-2019-15090)

    * kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

    * kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)

    * kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)

    * kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS)     (CVE-2019-19073)

    * kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)

    * kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-     bound applications (CVE-2019-19922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update also fixes several bugs and adds various enhancements. Documentation for these changes is     available from the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1493 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * kernel: heap-based buffer overflow in mwifiex_process_country_ie() function in     drivers/net/wireless/marvell/mwifiex/sta_ioctl.c (CVE-2019-14895)

    * kernel: heap overflow in marvell/mwifiex/tdls.c (CVE-2019-14901)

    * kernel: triggering AP to send IAPP location updates for stations before the required authentication     process has completed can lead to DoS (CVE-2019-5108)

    * kernel: powerpc: local user can read vector registers of other users' processes via an interrupt     (CVE-2019-15031)

    * kernel: out-of-bounds array access in __xfrm_policy_unlink (CVE-2019-15666)

    * kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

    * kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-     bound applications (CVE-2019-19922)

    * kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

    * kernel: memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c     (CVE-2019-20095)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rhel-alt-76z bsd process accounting(acct(2)) does not work (BZ#1763618)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow was discovered in the     Linux kernel's Marvell WiFi chip driver. The flaw could     occur when the station attempts a connection     negotiation during the handling of the remote devices     country settings. This could allow the remote device to     cause a denial of service (system crash) or possibly     execute arbitrary code.(CVE-2019-14895)

  - A flaw was found in the fix for CVE-2019-11135, the way     Intel CPUs handle speculative execution of instructions     when a TSX Asynchronous Abort (TAA) error occurs. When     a guest is running on a host CPU affected by the TAA     flaw (TAA_NO=0), but is not affected by the MDS issue     (MDS_NO=1), the guest was to clear the affected buffers     by using a VERW instruction mechanism. But when the     MDS_NO=1 bit was exported to the guests, the guests did     not use the VERW mechanism to clear the affected     buffers. This issue affects guests running on Cascade     Lake CPUs and requires that host has 'TSX' enabled.
    Confidentiality of data is the highest threat     associated with this vulnerability.(CVE-2019-19338)

  - A flaw was found in the way Intel CPUs handle     speculative execution of instructions when the TSX     Asynchronous Abort (TAA) error occurs. A local     authenticated attacker with the ability to monitor     execution times could infer the TSX memory state by     comparing abort execution times. This could allow     information disclosure via this observed side-channel     for any TSX transaction being executed while an     attacker is able to observe abort timing. Intel's     Transactional Synchronisation Extensions (TSX) are set     of instructions which enable transactional memory     support to improve performance of the multi-threaded     applications, in the lock-protected critical sections.
    The CPU executes instructions in the critical-sections     as transactions, while ensuring their atomic state.
    When such transaction execution is unsuccessful, the     processor cannot ensure atomic updates to the     transaction memory, so the processor rolls back or     aborts such transaction execution. While TSX     Asynchronous Abort (TAA) is pending, CPU may continue     to read data from architectural buffers and pass it to     the dependent speculative operations. This may cause     information leakage via speculative side-channel means,     which is quite similar to the Microarchitectural Data     Sampling (MDS) issue.(CVE-2019-11135)

  - An out-of-bounds memory write issue was found in the     way the Linux kernel's KVM hypervisor handled the     'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or     process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of     service.(CVE-2019-19332)

  - A flaw was found in the Linux kernel's scheduler, where     it can allow attackers to cause a denial of service     against non-CPU-bound applications by generating a     workload that triggers unwanted scheduling slice     expiration. A local attacker who can trigger a specific     workload type could abuse this technique to trigger a     system to be seen as degraded, and possibly trigger     workload-rebalance in systems that use the     slice-expiration metric as a measure of system     health.(CVE-2019-19922)

  - A stack-based buffer overflow was found in the Linux     kernel's Marvell WiFi chip driver. An attacker is able     to cause a denial of service (system crash) or,     possibly execute arbitrary code, when a STA works in     IBSS mode (allows connecting stations together without     the use of an AP) and connects to another     STA.(CVE-2019-14897)

  - A heap-based buffer overflow vulnerability was found in     the Linux kernel's Marvell WiFi chip driver. A remote     attacker could cause a denial of service (system crash)     or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)

  - A flaw was found in the Linux kernel in versions     through 5.4.6, containing information leaks of     uninitialized memory to a USB device. The latest     findings show that the uninitialized memory allocation     was not leading to an information leak, but was     allocating the memory assigned with data on the next     line and hence causing no violation..(CVE-2019-19947)

  - A flaw was found in the Linux kernel's implementation     of the Datagram Congestion Control Protocol (DCCP). A     local attacker with access to the system can create     DCCP sockets to cause a memory leak and repeat this     operation to exhaust all memory and panic the     system.(CVE-2019-20096)

  - A flaw was found in the Linux kernel's mwifiex driver     implementation when connecting to other WiFi devices in     'Test Mode.' A kernel memory leak can occur if an error     condition is met during the parameter negotiation. This     issue can lead to a denial of service if multiple error     conditions meeting the repeated connection attempts are     attempted.(CVE-2019-20095)

  - A flaw was found in the Linux kernel's implementation     of the WiFi station handoff code. An attacker within     the radio range could use this flaw to deny a valid     device from joining the access point.(CVE-2019-5108)

  - A flaw was found in the way Linux kernel's KVM     hypervisor handled deferred TLB flush requests from     guest. A race condition may occur between the guest     issuing a deferred TLB flush request to KVM, and then     KVM handling and acknowledging it. This may result in     invalid address translations from TLB being used to     access guest memory, leading to a potential information     leakage issue. An attacker may use this flaw to access     guest memory locations that it should not have access     to.(CVE-2019-3016)

  - fs/namei.c in the Linux kernel before 5.5 has a     may_create_in_sticky use-after-free, which allows local     users to cause a denial of service (OOPS) or possibly     obtain sensitive information from kernel memory, aka     CID-d0cb50185ae9. One attack vector may be an open     system call for a UNIX domain socket, if the socket is     being moved to a new parent directory and its old     parent directory is being removed.(CVE-2020-8428)

  - There is a use-after-free vulnerability in the Linux     kernel through 5.5.2 in the n_tty_receive_buf_common     function in drivers/tty/n_tty.c.(CVE-2020-8648)

  - An issue was discovered in the Linux kernel through     5.5.6. set_fdc in drivers/block/floppy.c leads to a     wait_til_ready out-of-bounds read because the FDC index     is not checked for errors before assigning it, aka     CID-2e90ca68b0d2.(CVE-2020-9383)

  - There is a use-after-free vulnerability in the Linux     kernel through 5.5.2 in the vgacon_invert_region     function in     drivers/video/console/vgacon.c.(CVE-2020-8649)

  - There is a use-after-free vulnerability in the Linux     kernel through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c.(CVE-2020-8647)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In the Linux kernel     4.19.83, there is a use-after-free (read) in the     debugfs_remove function in fs/debugfs/inode.c (which is     used to remove a file or directory in debugfs that was     previously created with a call to another debugfs     function such as     debugfs_create_file).(CVE-2019-19770)mwifiex_tm_cmd in     driverset/wireless/marvell/mwifiex/cfg80211.c in the     Linux kernel before 5.1.6 has some error-handling cases     that did not free allocated hostcmd memory, aka     CID-003b686ace82. This will cause a memory leak and     denial of service.(CVE-2019-20095)TSX Asynchronous     Abort condition on some CPUs utilizing speculative     execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access.(CVE-2019-11135)A memory leak     in the crypto_report() function in     crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service     (memory consumption) by triggering crypto_report_alg()     failures, aka CID-ffdde5932042.(CVE-2019-19062)In the     Linux kernel before 5.1.6, there is a use-after-free in     serial_ir_init_module() in     drivers/media/rc/serial_ir.c.(CVE-2019-19543)In the     Linux kernel through 5.4.6, there is a NULL pointer     dereference in drivers/scsi/libsas/sas_discover.c     because of mishandling of port disconnection during     discovery, related to a PHY down race condition, aka     CID-f70267f379b5.(CVE-2019-19965)In the Linux kernel     before 5.1.6, there is a use-after-free in cpia2_exit()     in drivers/media/usb/cpia2/cpia2_v4l.c that will cause     denial of service, aka     CID-dea37a972655.(CVE-2019-19966)An issue was     discovered in drivers/xen/balloon.c in the Linux kernel     before 5.2.3, as used in Xen through 4.12.x, allowing     guest OS users to cause a denial of service because of     unrestricted resource consumption during the mapping of     guest memory, aka CID-6ef36ab967c7.(CVE-2019-17351)A     memory leak in the crypto_reportstat() function in     drivers/virt/vboxguest/vboxguest_utils.c in the Linux     kernel before 5.3.9 allows attackers to cause a denial     of service (memory consumption) by triggering     copy_form_user() failures, aka     CID-e0b0cb938864.(CVE-2019-19048)kernel/sched/fair.c in     the Linux kernel before 5.3.9, when cpu.cfs_quota_us is     used (e.g., with Kubernetes), allows attackers to cause     a denial of service against non-cpu-bound applications     by generating a workload that triggers unwanted slice     expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen     with benign workloads, it is possible that an attacker     could calculate how many stray requests are required to     force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and     ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of     the kernel it only causes mismanagement of application     execution.)(CVE-2019-19922)An out-of-bounds memory     write issue was found in the Linux Kernel, version 3.13     through 5.4, in the way the Linux kernel's KVM     hypervisor handled the 'KVM_GET_EMULATED_CPUID'     ioctl(2) request to get CPUID features emulated by the     KVM hypervisor. A user or process able to access the     '/dev/kvm' device could use this flaw to crash the     system, resulting in a denial of     service.(CVE-2019-19332)A flaw was found in the fix for     CVE-2019-11135, the way Intel CPUs handle speculative     execution of instructions when a TSX Asynchronous Abort     (TAA) error occurs. When a guest is running on a host     CPU affected by the TAA flaw (TAA_NO=0), but is not     affected by the MDS issue (MDS_NO=1), the guest was to     clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to     the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects     guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the     highest threat associated with this     vulnerability.(CVE-2019-19338)In the Linux kernel     5.0.0-rc7 (as distributed in ubuntu/linux.git on     kernel.ubuntu.com), mounting a crafted f2fs filesystem     image and performing some operations can lead to     slab-out-of-bounds read access in ttm_put_pages in     drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related     to the vmwgfx or ttm module.(CVE-2019-19927)In the     Linux kernel 4.14 longterm through 4.14.165 and 4.19     longterm through 4.19.96 (and 5.x before 5.2), there is     a use-after-free (write) in the i915_ppgtt_close     function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka     CID-7dc40713618c. This is related to     i915_gem_context_destroy_ioctl in     drivers/gpu/drm/i915/i915_gem_context.c.(CVE-2020-7053)     In the Linux kernel through 5.4.6, there are     information leaks of uninitialized memory to a USB     device in the     driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,     aka CID-da2311a6385c.(CVE-2019-19947)In the Linux     kernel before 5.0.6, there is a NULL pointer     dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka     CID-23da9588037e.(CVE-2019-20054)In the Linux kernel     before 5.1, there is a memory leak in
    __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)A heap-based buffer     overflow vulnerability was found in the Linux kernel,     version kernel-2.6.32, in Marvell WiFi chip driver. A     remote attacker could cause a denial of service (system     crash) or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)A heap-based buffer     overflow was discovered in the Linux kernel, all     versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi     chip driver. The flaw could occur when the station     attempts a connection negotiation during the handling     of the remote devices country settings. This could     allow the remote device to cause a denial of service     (system crash) or possibly execute arbitrary     code.(CVE-2019-14895)A stack-based buffer overflow was     found in the Linux kernel, version kernel-2.6.32, in     Marvell WiFi chip driver. An attacker is able to cause     a denial of service (system crash) or, possibly execute     arbitrary code, when a STA works in IBSS mode (allows     connecting stations together without the use of an AP)     and connects to another STA.(CVE-2019-14897)An     exploitable denial-of-service vulnerability exists in     the Linux kernel prior to mainline 5.3. An attacker     could exploit this vulnerability by triggering AP to     send IAPP location updates for stations before the     required authentication process has completed. This     could lead to different denial-of-service scenarios,     either by causing CAM table attacks, or by leading to     traffic flapping if faking already existing clients in     other nearby APs of the same wireless infrastructure.
    An attacker can forge Authentication and Association     Request packets to trigger this     vulnerability.(CVE-2019-5108)drivers/gpu/drm/radeon/rad     eon_display.c in the Linux kernel 5.2.14 does not check     the alloc_workqueue return value, leading to a NULL     pointer dereference.(CVE-2019-16230)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):** DISPUTED ** In     kernel/compat.c in the Linux kernel before 3.17, as     used in Google Chrome OS and other products, there is a     possible out-of-bounds read. restart_syscall uses     uninitialized data when restarting     compat_sys_nanosleep. NOTE: this is disputed because     the code path is unreachable.(CVE-2014-3180)A heap     overflow flaw was found in the Linux kernel, all     versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi     chip driver. The vulnerability allows a remote attacker     to cause a system crash, resulting in a denial of     service, or execute arbitrary code. The highest threat     with this vulnerability is with the availability of the     system. If code execution occurs, the code will run     with the permissions of root. This will affect both     confidentiality and integrity of files on the     system.(CVE-2019-14901)A heap-based buffer overflow     vulnerability was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. A remote     attacker could cause a denial of service (system crash)     or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)A memory leak in the     ath10k_usb_hif_tx_sg() function in drivers/     net/wireless/ath/ath10k/usb.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of     service (memory consumption) by triggering     usb_submit_urb() failures, aka     CID-b8d17e7d93d2.(CVE-2019-19078)A memory leak in the     mlx5_fpga_conn_create_cq() function in drivers/     net/ethernet/mellanox/mlx5/core/fpga/conn.c in the     Linux kernel before 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering     mlx5_vector2eqn() failures, aka     CID-c8c2a057fdc7.(CVE-2019-19045)A stack-based buffer     overflow was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. An attacker     is able to cause a denial of service (system crash) or,     possibly execute arbitrary code, when a STA works in     IBSS mode (allows connecting stations together without     the use of an AP) and connects to another     STA.(CVE-2019-14897)An out-of-bounds memory write issue     was found in the Linux Kernel, version 3.13 through     5.4, in the way the Linux kernel's KVM hypervisor     handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request     to get CPUID features emulated by the KVM hypervisor. A     user or process able to access the '/dev/kvm' device     could use this flaw to crash the system, resulting in a     denial of service.(CVE-2019-19332)Improper invalidation     for page table updates by a virtual guest operating     system for multiple Intel(R) Processors may allow an     authenticated user to potentially enable denial of     service of the host system via local     access.(CVE-2018-12207)In the Android kernel in the     video driver there is a use after free due to a race     condition. This could lead to local escalation of     privilege with no additional execution privileges     needed. User interaction is not needed for     exploitation.(CVE-2019-9458)In the AppleTalk subsystem     in the Linux kernel before 5.1, there is a potential     NULL pointer dereference because register_snap_client     may return NULL. This will lead to denial of service in     net/appletalk/aarp.c and net/appletalk/ddp.c, as     demonstrated by unregister_snap_client, aka     CID-9804501fa122.(CVE-2019-19227)In the Linux kernel     5.0.21, mounting a crafted btrfs filesystem image,     performing some operations, and then making a syncfs     system call can lead to a use-after-free in
    __mutex_lock in kernel/locking/mutex.c. This is related     to mutex_can_spin_on_owner in kernel/locking/mutex.c,
    __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and     btrfs_insert_delayed_items in     fs/btrfs/delayed-inode.c.(CVE-2019-19813)In the Linux     kernel 5.4.0-rc2, there is a use-after-free (read) in     the __blk_add_trace function in kernel/trace/blktrace.c     (which is used to fill out a blk_io_trace structure and     place it in a per-cpu sub-buffer).(CVE-2019-19768)In     the Linux kernel before 5.0.6, there is a NULL pointer     dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka     CID-23da9588037e.(CVE-2019-20054)In the Linux kernel     before 5.2.9, there is an info-leak bug that can be     caused by a malicious USB device in the drivers/     net/can/usb/peak_usb/pcan_usb_pro.c driver, aka     CID-ead16e53c2f0.(CVE-2019-19536)In the Linux kernel     before 5.3.11, there is an info-leak bug that can be     caused by a malicious USB device in the drivers/     net/can/usb/peak_usb/pcan_usb_core.c driver, aka     CID-f7a1337f0d29.(CVE-2019-19534)In the Linux kernel     before 5.3.6, there is a use-after-free bug that can be     caused by a malicious USB device in the drivers/     net/ieee802154/atusb.c driver, aka     CID-7fd25e6fc035.(CVE-2019-19525)Insufficient access     control in a subsystem for Intel (R) processor graphics     in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM)     Processor Families Intel(R) Pentium(R) Processor J, N,     Silver and Gold Series Intel(R) Celeron(R) Processor J,     N, G3900 and G4900 Series Intel(R) Atom(R) Processor A     and E3900 Series Intel(R) Xeon(R) Processor E3-1500 v5     and v6, E-2100 and E-2200 Processor Families Intel(R)     Graphics Driver for Windows before 26.20.100.6813 (DCH)     or 26.20.100.6812 and before 21.20.x.5077     (aka15.45.5077), i915 Linux Driver for Intel(R)     Processor Graphics before versions 5.4-rc7, 5.3.11,     4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an     authenticated user to potentially enable escalation of     privilege via local access.(CVE-2019-0155)Insufficient     input validation in Kernel Mode Driver in Intel(R) i915     Graphics for Linux before version 5.0 may allow an     authenticated user to potentially enable escalation of     privilege via local     access.(CVE-2019-11085)kernel/sched/fair.c in the Linux     kernel before 5.3.9, when cpu.cfs_quota_us is used     (e.g., with Kubernetes), allows attackers to cause a     denial of service against non-cpu-bound applications by     generating a workload that triggers unwanted slice     expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen     with benign workloads, it is possible that an attacker     could calculate how many stray requests are required to     force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and     ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of     the kernel it only causes mismanagement of application     execution.)(CVE-2019-19922)The evm_verify_hmac function     in security/integrity/evm/evm_main.c in the Linux     kernel before 4.5 does not properly copy data, which     makes it easier for local users to forge MAC values via     a timing side-channel attack.(CVE-2016-2085)The     pcpu_embed_first_chunk function in mm/percpu.c in the     Linux kernel through 4.14.14 allows local users to     obtain sensitive address information by reading dmesg     data from a 'pages/cpu' printk call.(CVE-2018-5995)TSX     Asynchronous Abort condition on some CPUs utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access.(CVE-2019-11135)An issue was     discovered in drivers/scsi/aacraid/commctrl.c in the     Linux kernel before 4.13. There is potential exposure     of kernel stack memory because aac_send_raw_srb does     not initialize the reply structure.(CVE-2017-18549)An     issue was discovered in drivers/scsi/aacraid/commctrl.c     in the Linux kernel before 4.13. There is potential     exposure of kernel stack memory because     aac_get_hba_info does not initialize the hbainfo     structure.(CVE-2017-18550)In the Linux kernel through     4.15.4, the floppy driver reveals the addresses of     kernel functions and global variables using printk     calls within the function show_floppy in     drivers/block/floppy.c. An attacker can read this     information from dmesg and use the addresses to find     the locations of kernel code and data and bypass kernel     security protections such as KASLR.(CVE-2018-7273)A     heap-based buffer overflow was discovered in the Linux     kernel, all versions 3.x.x and 4.x.x before 4.18.0, in     Marvell WiFi chip driver. The flaw could occur when the     station attempts a connection negotiation during the     handling of the remote devices country settings. This     could allow the remote device to cause a denial of     service (system crash) or possibly execute arbitrary     code.(CVE-2019-14895)The Linux kernel before 5.4.1 on     powerpc allows Information Exposure because the     Spectre-RSB mitigation is not in place for all     applicable CPUs, aka CID-39e72bf96f58. This is related     to arch/powerpc/kernel/entry_64.S and     arch/powerpc/kernel/security.c.(CVE-2019-18660)In the     Linux kernel 5.0.21, mounting a crafted ext4 filesystem     image, performing some operations, and unmounting can     lead to a use-after-free in ext4_put_super in     fs/ext4/super.c, related to dump_orphan_list in     fs/ext4/super.c.(CVE-2019-19447)In the Linux kernel     through 5.4.6, there is a NULL pointer dereference in     drivers/scsi/libsas/sas_discover.c because of     mishandling of port disconnection during discovery,     related to a PHY down race condition, aka     CID-f70267f379b5.(CVE-2019-19965)In the Linux kernel     before 5.1.6, there is a use-after-free in cpia2_exit()     in drivers/media/usb/cpia2/cpia2_v4l.c that will cause     denial of service, aka     CID-dea37a972655.(CVE-2019-19966)An exploitable     denial-of-service vulnerability exists in the Linux     kernel prior to mainline 5.3. An attacker could exploit     this vulnerability by triggering AP to send IAPP     location updates for stations before the required     authentication process has completed. This could lead     to different denial-of-service scenarios, either by     causing CAM table attacks, or by leading to traffic     flapping if faking already existing clients in other     nearby APs of the same wireless infrastructure. An     attacker can forge Authentication and Association     Request packets to trigger this     vulnerability.(CVE-2019-5108)mwifiex_tm_cmd in drivers/     net/wireless/marvell/mwifiex/cfg80211.c in the Linux     kernel before 5.1.6 has some error-handling cases that     did not free allocated hostcmd memory, aka     CID-003b686ace82. This will cause a memory leak and     denial of service.(CVE-2019-20095)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak.

CVE-2019-2215

The syzkaller tool discovered a use-after-free vulnerability in the Android binder driver. A local user on a system with this driver enabled could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation. However, this driver is not enabled on Debian packaged kernels.

CVE-2019-10220

Various developers and researchers found that if a crafted file- system or malicious file server presented a directory with filenames including a '/' character, this could confuse and possibly defeat security checks in applications that read the directory.

The kernel will now return an error when reading such a directory, rather than passing the invalid filenames on to user-space.

CVE-2019-14895, CVE-2019-14901

ADLab of Venustech discovered potential heap buffer overflows in the mwifiex wifi driver. On systems using this driver, a malicious Wireless Access Point or adhoc/P2P peer could use these to cause a denial of service (memory corruption or crash) or possibly for remote code execution.

CVE-2019-14896, CVE-2019-14897

ADLab of Venustech discovered potential heap and stack buffer overflows in the libertas wifi driver. On systems using this driver, a malicious Wireless Access Point or adhoc/P2P peer could use these to cause a denial of service (memory corruption or crash) or possibly for remote code execution.

CVE-2019-15098

Hui Peng and Mathias Payer reported that the ath6kl wifi driver did not properly validate USB descriptors, which could lead to a NULL pointer derefernce. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops).

CVE-2019-15217

The syzkaller tool discovered that the zr364xx mdia driver did not correctly handle devices without a product name string, which could lead to a NULL pointer dereference. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops).

CVE-2019-15291

The syzkaller tool discovered that the b2c2-flexcop-usb media driver did not properly validate USB descriptors, which could lead to a NULL pointer dereference. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops).

CVE-2019-15505

The syzkaller tool discovered that the technisat-usb2 media driver did not properly validate incoming IR packets, which could lead to a heap buffer over-read. An attacker able to add USB devices could use this to cause a denial of service (BUG/oops) or to read sensitive information from kernel memory.

CVE-2019-16746

It was discovered that the wifi stack did not validate the content of beacon heads provided by user-space for use on a wifi interface in Access Point mode, which could lead to a heap buffer overflow. A local user permitted to configure a wifi interface could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-17052, CVE-2019-17053, CVE-2019-17054, CVE-2019-17055, CVE-2019-17056

Ori Nimron reported that various network protocol implementations

  - AX.25, IEEE 802.15.4, Appletalk, ISDN, and NFC - allowed     all users to create raw sockets. A local user could use     this to send arbitrary packets on networks using those     protocols.

CVE-2019-17133

Nicholas Waisman reported that the wifi stack did not valdiate received SSID information before copying it, which could lead to a buffer overflow if it is not validated by the driver or firmware. A malicious Wireless Access Point might be able to use this to cause a denial of service (memory corruption or crash) or for remote code execution.

CVE-2019-17666

Nicholas Waisman reported that the rtlwifi wifi drivers did not properly validate received P2P information, leading to a buffer overflow. A malicious P2P peer could use this to cause a denial of service (memory corruption or crash) or for remote code execution.

CVE-2019-19051

Navid Emamdoost discovered a potential memory leak in the i2400m wimax driver if the software rfkill operation fails. The security impact of this is unclear.

CVE-2019-19052

Navid Emamdoost discovered a potential memory leak in the gs_usb CAN driver if the open (interface-up) operation fails. The security impact of this is unclear.

CVE-2019-19056, CVE-2019-19057

Navid Emamdoost discovered potential memory leaks in the mwifiex wifi driver if the probe operation fails. The security impact of this is unclear.

CVE-2019-19062

Navid Emamdoost discovered a potential memory leak in the AF_ALG subsystem if the CRYPTO_MSG_GETALG operation fails. A local user could possibly use this to cause a denial of service (memory exhaustion).

CVE-2019-19066

Navid Emamdoost discovered a potential memory leak in the bfa SCSI driver if the get_fc_host_stats operation fails. The security impact of this is unclear.

CVE-2019-19227

Dan Carpenter reported missing error checks in the Appletalk protocol implementation that could lead to a NULL pointer dereference. The security impact of this is unclear.

CVE-2019-19332

The syzkaller tool discovered a missing bounds check in the KVM implementation for x86, which could lead to a heap buffer overflow. A local user permitted to use KVM could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19523

The syzkaller tool discovered a use-after-free bug in the adutux USB driver. An attacker able to add and remove USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19524

The syzkaller tool discovered a race condition in the ff-memless library used by input drivers. An attacker able to add and remove USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19527

The syzkaller tool discovered that the hiddev driver did not correctly handle races between a task opening the device and disconnection of the underlying hardware. A local user permitted to access hiddev devices, and able to add and remove USB devices, could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19530

The syzkaller tool discovered a potential use-after-free in the cdc-acm network driver. An attacker able to add USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19531

The syzkaller tool discovered a use-after-free bug in the yurex USB driver. An attacker able to add and remove USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19532

The syzkaller tool discovered a potential heap buffer overflow in the hid-gaff input driver, which was also found to exist in many other input drivers. An attacker able to add USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19533

The syzkaller tool discovered that the ttusb-dec media driver was missing initialisation of a structure, which could leak sensitive information from kernel memory.

CVE-2019-19534, CVE-2019-19536

The syzkaller tool discovered that the peak_usb CAN driver was missing initialisation of some structures, which could leak sensitive information from kernel memory.

CVE-2019-19537

The syzkaller tool discovered race conditions in the USB stack, involving character device registration. An attacker able to add USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19767

The syzkaller tool discovered that crafted ext4 volumes could trigger a buffer overflow in the ext4 filesystem driver. An attacker able to mount such a volume could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19922

It was discovered that a change in Linux 3.16.61, 'sched/fair: Fix bandwidth timer clock drift condition', could lead to tasks being throttled before using their full quota of CPU time. A local user could use this bug to slow down other users' tasks. This change has been reverted.

CVE-2019-19947

It was discovered that the kvaser_usb CAN driver was missing initialisation of some structures, which could leak sensitive information from kernel memory.

CVE-2019-19965

Gao Chuan reported a race condition in the libsas library used by SCSI host drivers, which could lead to a NULL pointer dereference. An attacker able to add and remove SCSI devices could use this to cause a denial of service (BUG/oops).

CVE-2019-19966

The syzkaller tool discovered a missing error check in the cpia2 media driver, which could lead to a use-after-free. An attacker able to add USB devices could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 3.16.81-1.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4226-1 advisory.

    Michael Hanselmann discovered that the CIFS implementation in the Linux kernel did not sanitize paths     returned by an SMB server. An attacker controlling an SMB server could use this to overwrite arbitrary     files. (CVE-2019-10220)

    It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2019-14895, CVE-2019-14901)

    It was discovered that a heap-based buffer overflow existed in the Marvell Libertas WLAN Driver for the     Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2019-14896, CVE-2019-14897)

    It was discovered that the Fujitsu ES network device driver for the Linux kernel did not properly check     for errors in some situations, leading to a NULL pointer dereference. A local attacker could use this to     cause a denial of service. (CVE-2019-16231)

    It was discovered that the QLogic Fibre Channel driver in the Linux kernel did not properly check for     error, leading to a NULL pointer dereference. A local attacker could possibly use this to cause a denial     of service (system crash). (CVE-2019-16233)

    Nicolas Waisman discovered that the WiFi driver stack in the Linux kernel did not properly validate SSID     lengths. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-17133)

    Anthony Steinhauser discovered that the Linux kernel did not properly perform Spectre_RSB mitigations to     all processors for PowerPC architecture systems in some situations. A local attacker could use this to     expose sensitive information. (CVE-2019-18660)

    It was discovered that the Mellanox Technologies Innova driver in the Linux kernel did not properly     deallocate memory in certain failure conditions. A local attacker could use this to cause a denial of     service (kernel memory exhaustion). (CVE-2019-19045)

    It was discovered that the VirtualBox guest driver implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. A local attacker could use this to cause a denial of     service (memory exhaustion). (CVE-2019-19048)

    It was discovered that Geschwister Schneider USB CAN interface driver in the Linux kernel did not properly     deallocate memory in certain failure conditions. A physically proximate attacker could use this to cause a     denial of service (kernel memory exhaustion). (CVE-2019-19052)

    It was discovered that the netlink-based 802.11 configuration interface in the Linux kernel did not     deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial     of service (kernel memory exhaustion). (CVE-2019-19055)

    It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19060)

    It was discovered that the Intel OPA Gen1 Infiniband Driver for the Linux kernel did not properly     deallocate memory in certain error conditions. A local attacker could use this to cause a denial of     service (memory exhaustion). (CVE-2019-19065)

    It was discovered that the AMD Audio Coprocessor driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker with the ability to load modules could use this to     cause a denial of service (memory exhaustion). (CVE-2019-19067)

    It was discovered that the event tracing subsystem of the Linux kernel did not properly deallocate memory     in certain error conditions. A local attacker could use this to cause a denial of service (kernel memory     exhaustion). (CVE-2019-19072)

    It was discovered that the Cascoda CA8210 SPI 802.15.4 wireless controller driver for the Linux kernel did     not properly deallocate memory in certain error conditions. A local attacker could use this to cause a     denial of service (memory exhaustion). (CVE-2019-19075)

    It was discovered that the AMD Display Engine Driver in the Linux kernel did not properly deallocate     memory in certain error conditions. A local attack could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19083)

    It was discovered that the driver for memoryless force-feedback input devices in the Linux kernel     contained a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause     a denial of service (system crash) or execute arbitrary code. (CVE-2019-19524)

    It was discovered that the NXP PN533 NFC USB driver in the Linux kernel did not properly free resources     after a late probe error, leading to a use- after-free vulnerability. A physically proximate attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2019-19526)

    It was discovered that the Microchip CAN BUS Analyzer driver in the Linux kernel contained a use-after-     free vulnerability on device disconnect. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2019-19529)

    It was discovered that multiple USB HID device drivers in the Linux kernel did not properly validate     device metadata on attachment, leading to out-of- bounds writes. A physically proximate attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-19532)

    It was discovered that the PEAK-System Technik USB driver in the Linux kernel did not properly sanitize     memory before sending it to the device. A physically proximate attacker could use this to expose sensitive     information (kernel memory). (CVE-2019-19534)

    It was discovered that in some situations the fair scheduler in the Linux kernel did not permit a process     to use its full quota time slice. A local attacker could use this to cause a denial of service.
    (CVE-2019-19922)

    It was discovered that the binder IPC implementation in the Linux kernel did not properly perform bounds     checking in some situations, leading to an out-of-bounds write. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-2214)

    Nicolas Waisman discovered that the Chelsio T4/T5 RDMA Driver for the Linux kernel performed DMA from a     kernel stack. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-17075)

    It was discovered that the DesignWare USB3 controller driver in the Linux kernel did not properly     deallocate memory in some error conditions. A local attacker could possibly use this to cause a denial of     service (memory exhaustion). (CVE-2019-18813)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
208557	CentOS 7 : kernel-alt (RHSA-2020:1493)	Nessus	CentOS Local Security Checks	critical
181001	Oracle Linux 8 : kernel (ELSA-2020-1769)	Nessus	Oracle Linux Local Security Checks	critical
145850	CentOS 8 : kernel (CESA-2020:1769)	Nessus	CentOS Local Security Checks	critical
140499	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5845)	Nessus	Oracle Linux Local Security Checks	critical
137516	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2020-1674)	Nessus	Huawei Local Security Checks	critical
136239	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2020-1536)	Nessus	Huawei Local Security Checks	critical
136116	RHEL 8 : kernel-rt (RHSA-2020:1567)	Nessus	Red Hat Local Security Checks	critical
136115	RHEL 8 : kernel (RHSA-2020:1769)	Nessus	Red Hat Local Security Checks	critical
135685	RHEL 7 : kernel-alt (RHSA-2020:1493)	Nessus	Red Hat Local Security Checks	critical
135525	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2020-1396)	Nessus	Huawei Local Security Checks	critical
135129	EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1342)	Nessus	Huawei Local Security Checks	critical
133992	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1158)	Nessus	Huawei Local Security Checks	critical
133913	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-1112)	Nessus	Huawei Local Security Checks	critical
133101	Debian DLA-2068-1 : linux security update	Nessus	Debian Local Security Checks	critical
132690	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4226-1)	Nessus	Ubuntu Local Security Checks	critical
132530	Photon OS 3.0: Linux PHSA-2019-3.0-0041	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2019-19922

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical