In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of ptrace. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-119769499

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out-of-bounds write in __btrfs_map_block in fs/btrfs/volumes.c (CVE-2019-19816)

  - Kernel: use-after-free in btf_dump_name_dups in tools/lib/bpf/btf_dump.c (CVE-2022-3534)

  - drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial     of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the     relevance of this report because the failure can only occur for physically proximate attackers who unplug     SAS Host Bus Adapter cables (CVE-2018-10021)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4076-1 advisory.

    It was discovered that a race condition existed in the Serial Attached SCSI (SAS) implementation in the     Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or     execute arbitrary code. (CVE-2018-20836)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly zero out     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2019-11833)

    It was discovered that the Bluetooth Human Interface Device Protocol (HIDP) implementation in the Linux     kernel did not properly verify strings were NULL terminated in certain situations. A local attacker could     use this to expose sensitive information (kernel memory). (CVE-2019-11884)

    It was discovered that the Linux kernel on ARM processors allowed a tracing process to modify a syscall     after a seccomp decision had been made on that syscall. A local attacker could possibly use this to bypass     seccomp restrictions. (CVE-2019-2054)

    Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel did not properly prevent     remote firmware events from being processed for USB Wifi devices. A physically proximate attacker could     use this to send firmware events to the device. (CVE-2019-9503)

    It was discovered that an integer overflow existed in the Freescale (PowerPC) hypervisor manager in the     Linux kernel. A local attacker with write access to /dev/fsl-hv could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-10142)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199272	RHEL 8 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
127097	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4076-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-2054

high

Tenable Plugins

critical

high

high