kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.

The version of kernel installed on the remote host is prior to 4.14.231-173.360. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1627 advisory.

  - A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.
    (CVE-2019-19060)

  - kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on     pointer arithmetic in various cases, including cases of different branches with different state or limits     to sanitize, leading to side-channel attacks. (CVE-2019-7308)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error     (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to     side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory,     aka CID-10d2bb2e6b1d. (CVE-2020-27171)

  - rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6     allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases,     CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may     have situations in which a drivers/staging issue is relevant to their own customer base. (CVE-2021-28660)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer     before a cloning operation, aka CID-dbcc7d57bffc. (CVE-2021-28964)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in     drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up     sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
    (CVE-2021-29265)

  - An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows     attackers to obtain sensitive information from kernel memory because of a partially uninitialized data     structure, aka CID-50535249f624. (CVE-2021-29647)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5755 advisory.

    - p54usb: Fix race between disconnect and firmware loading (Alan Stern)  [Orabug: 31351863]     {CVE-2019-15220}
    - media: rc: prevent memory leak in cx23888_ir_probe (Navid Emamdoost)  [Orabug: 31351671]     {CVE-2019-19054}
    - mm: Fix mremap not considering huge pmd devmap (Fan Yang)  [Orabug: 31452398]  {CVE-2020-10757}     {CVE-2020-10757}
    - bpf: fix sanitation of alu op with pointer / scalar type from different paths (Daniel Borkmann)     [Orabug: 31350800]  {CVE-2019-7308}
    - bpf: prevent out of bounds speculation on pointer arithmetic (Daniel Borkmann)  [Orabug: 31350800]     {CVE-2019-7308}
    - bpf: restrict unknown scalars of mixed signed bounds for unprivileged (Daniel Borkmann)  [Orabug:
    31350800]  {CVE-2019-7308}
    - bpf: move {prev_,}insn_idx into verifier env (Daniel Borkmann)  [Orabug: 31350800]  {CVE-2019-7308}
    - bpf: reduce verifier memory consumption (Alexei Starovoitov)  [Orabug: 31350800]  {CVE-2019-7308}
    - bpf: Prevent memory disambiguation attack (Alexei Starovoitov)  [Orabug: 31350800]  {CVE-2019-7308}
    - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() (Tomas Bortoli)  [Orabug: 31351117]     {CVE-2019-19533}
    - ALSA: core: Fix card races between register and disconnect (Takashi Iwai)  [Orabug: 31351890]     {CVE-2019-15214}
    - ALSA: info: Fix racy addition/deletion of nodes (Takashi Iwai)  [Orabug: 31351890]  {CVE-2019-15214}
    - x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross)  [Orabug: 31352781]     {CVE-2020-0543}
    - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross)  [Orabug:
    31352781]  {CVE-2020-0543}
    - x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross)  [Orabug: 31352781]  {CVE-2020-0543}
    - x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross)  [Orabug: 31352781]  {CVE-2020-0543}
    - can: peak_usb: fix slab info leak (Johan Hovold)  [Orabug: 31351139]  {CVE-2019-19534}
    - can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices (Tomas Bortoli)  [Orabug: 31351248]     {CVE-2019-19536}
    - netlabel: cope with NULL catmap (Paolo Abeni)  [Orabug: 31350492]  {CVE-2020-10711}
    - mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() (Qing Xu)  [Orabug: 31350516]     {CVE-2020-12654}
    - scsi: sg: add sg_remove_request in sg_write (Wu Bo)  [Orabug: 31350698]  {CVE-2020-12770}
    - block, bfq: fix use-after-free in bfq_idle_slice_timer_body (Zhiqiang Liu)  [Orabug: 31350912]     {CVE-2020-12657}
    - mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() (Qing Xu)  [Orabug: 31350931]     {CVE-2020-12653}
    - USB: core: Fix free-while-in-use bug in the USB S-Glibrary (Alan Stern)  [Orabug: 31350965]     {CVE-2020-12464}
    - xfs: add agf freeblocks verify in xfs_agf_verify (Zheng Bin)  [Orabug: 31350922]  {CVE-2020-12655}
    - mwifiex: Abort at too short BSS descriptor element (Takashi Iwai)  [Orabug: 31351915]  {CVE-2019-3846}
    - mwifiex: Fix possible buffer overflows at parsing bss descriptor (Takashi Iwai)  [Orabug: 31351915]     {CVE-2019-3846} {CVE-2019-3846}
    - scsi: mptfusion: Fix double fetch bug in ioctl (Dan Carpenter)  [Orabug: 31350940]  {CVE-2020-12652}
    - ptp: fix the race between the release of ptp_clock and cdev (Vladis Dronov)  [Orabug: 31350706]     {CVE-2020-10690}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Mounting a crafted EXT4 image read-only leads to an     attacker controlled memory corruption and     SLAB-Out-of-Bounds reads.(CVE-2016-10208i1/4%0

  - An issue was discovered in the hwpoison implementation     in mm/memory-failure.c in the Linux kernel before     5.0.4. When soft_offline_in_use_page() runs on a thp     tail page after pmd is split, an attacker can cause a     denial of service (BUG).(CVE-2019-10124i1/4%0

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666i1/4%0

  - A flaw was found in the way the Linux kernel's     networking subsystem handled offloaded packets with     multiple layers of encapsulation in the GRO (Generic     Receive Offload) code path. A remote attacker could use     this flaw to trigger unbounded recursion in the kernel     that could lead to stack corruption, resulting in a     system crash.(CVE-2016-8666i1/4%0

  - The ethtool_get_wol function in net/core/ethtool.c in     the Linux kernel through 4.7, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     initialize a certain data structure, which allows local     users to obtain sensitive information via a crafted     application, aka Android internal bug 28803952 and     Qualcomm internal bug CR570754.(CVE-2014-9900i1/4%0

  - A vulnerability was found in crypto/ahash.c in the     Linux kernel which allows attackers to cause a denial     of service (API operation calling its own callback, and     infinite recursion) by triggering EBUSY on a full     queue.(CVE-2017-7618i1/4%0

  - drivers/misc/qseecom.c in the QSEECOM driver for the     Linux kernel 3.x, as used in Qualcomm Innovation Center     (QuIC) Android contributions for MSM devices and other     products, does not validate certain offset, length, and     base values within an ioctl call, which allows     attackers to gain privileges or cause a denial of     service (memory corruption) via a crafted     application.(CVE-2014-4322i1/4%0

  - An integer overflow vulnerability was found in the     Linux kernel in xt_alloc_table_info, which on 32-bit     systems can lead to small structure allocation and a     copy_from_user based heap corruption.(CVE-2016-3135i1/4%0

  - Stack-based buffer overflow in the     supply_lm_input_write function in     drivers/thermal/supply_lm_core.c in the MSM Thermal     driver for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted application that sends a large     amount of data through the debugfs     interface.(CVE-2016-2063i1/4%0

  - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in     the Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7264i1/4%0

  - A bypass was found for the Spectre v1 hardening in the     eBPF engine of the Linux kernel. The code in the     kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic in     various cases, including cases of different branches     with different state or limits to sanitize, leading to     side-channel attacks.(CVE-2019-7308i1/4%0

  - The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandles     inheritance, which allows local users to cause a denial     of service or possibly have unspecified other impact     via crafted system calls, a related issue to     CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9077i1/4%0

  - The cgroup offline implementation in the Linux kernel     through 4.8.11 mishandles certain drain operations,     which allows local users to cause a denial of service     (system hang) by leveraging access to a container     environment for executing a crafted application, as     demonstrated by trinity.(CVE-2016-9191i1/4%0

  - The KVM implementation in the Linux kernel through     4.20.5 has a Use-after-Free.(CVE-2019-7221i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's network subsystem handled socket     creation with an invalid protocol identifier. A local     user could use this flaw to crash the     system.(CVE-2015-8543i1/4%0

  - The drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel, through 4.13.11, allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4653i1/4%0

  - A vulnerability leading to a local privilege escalation     was found in apparmor in the Linux kernel. When     proc_pid_attr_write() was changed to use memdup_user     apparmor's (interface violating) assumption that the     setprocattr buffer was always a single page was     violated.(CVE-2016-6187i1/4%0

  - A vulnerability was found in the Linux kernel in     'tmpfs' file system. When file permissions are modified     via 'chmod' and the user is not in the owning group or     capable of CAP_FSETID, the setgid bit is cleared in     inode_change_ok(). Setting a POSIX ACL via 'setxattr'     sets the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way this     allows to bypass the check in 'chmod'.(CVE-2017-5551i1/4%0

  - A flaw was found in the Linux Kernel in the     ucma_leave_multicast() function in     drivers/infiniband/core/ucma.c which allows access to a     certain data structure after freeing it in     ucma_process_join(). This allows an attacker to cause a     use-after-free bug and to induce kernel memory     corruption, leading to a system crash or other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-14734i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_parse_conf_rsp and l2cap_parse_conf_req functions. An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack. (CVE-2019-3460)

A bypass was found for the Spectre v1 hardening in the eBPF engine of the Linux kernel. The code in the kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks. (CVE-2019-7308)

A flaw was found in the Linux kernels implementation of Logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack.
An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack. (CVE-2019-3459)

A flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_parse_conf_rsp and l2cap_parse_conf_req functions. An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.(CVE-2019-3460)

A flaw was found in the Linux kernels implementation of Logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack.
An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.(CVE-2019-3459)

A bypass was found for the Spectre v1 hardening in the eBPF engine of the Linux kernel. The code in the kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.(CVE-2019-7308)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3931-2 advisory.

    USN-3931-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu     16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04 LTS.

    M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not properly set up all arguments to an     error handler callback used when running as a paravirtualized guest. An unprivileged attacker in a     paravirtualized guest VM could use this to cause a denial of service (guest VM crash). (CVE-2018-14678)

    It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly     handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to     cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021)

    Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound     Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2018-19824)

    Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth     implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive     information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

    Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free     vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of     service (guest VM crash). (CVE-2019-6974)

    Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux     kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a     denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

    Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux     kernel, when nested virtualization is used. A local attacker could use this to expose sensitive     information (host system memory to a guest VM). (CVE-2019-7222)

    Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against     Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

    It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg)     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-8912)

    It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors     while reading files. A local attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2019-8980)

    Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap     minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL     pointer dereference vulnerability. (CVE-2019-9213)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3931-1 advisory.

    M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not properly set up all arguments to an     error handler callback used when running as a paravirtualized guest. An unprivileged attacker in a     paravirtualized guest VM could use this to cause a denial of service (guest VM crash). (CVE-2018-14678)

    It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly     handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to     cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021)

    Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound     Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2018-19824)

    Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth     implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive     information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

    Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free     vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of     service (guest VM crash). (CVE-2019-6974)

    Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux     kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a     denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

    Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux     kernel, when nested virtualization is used. A local attacker could use this to expose sensitive     information (host system memory to a guest VM). (CVE-2019-7222)

    Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against     Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

    It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg)     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-8912)

    It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors     while reading files. A local attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2019-8980)

    Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap     minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL     pointer dereference vulnerability. (CVE-2019-9213)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3930-2 advisory.

    USN-3930-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04     LTS.

    Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound     Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2018-19824)

    Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth     implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive     information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

    Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free     vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of     service (guest VM crash). (CVE-2019-6974)

    Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux     kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a     denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

    Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux     kernel, when nested virtualization is used. A local attacker could use this to expose sensitive     information (host system memory to a guest VM). (CVE-2019-7222)

    Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against     Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

    It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg)     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-8912)

    Jakub Jirasek discovered a use-after-free vulnerability in the SCTP implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2019-8956)

    It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors     while reading files. A local attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2019-8980)

    It was discovered that a use-after-free vulnerability existed in the IPMI implementation in the Linux     kernel. A local attacker with access to the IPMI character device files could use this to cause a denial     of service (system crash). (CVE-2019-9003)

    Jann Horn discovered that the SNMP NAT implementation in the Linux kernel performed insufficient ASN.1     length checks. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-9162)

    Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap     minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL     pointer dereference vulnerability. (CVE-2019-9213)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel.
An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM).
(CVE-2019-7222)

Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against Spectre V1 attacks. A local attacker could use this to expose sensitive information.
(CVE-2019-7308)

It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8912)

Jakub Jirasek discovered a use-after-free vulnerability in the SCTP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8956)

It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors while reading files. A local attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2019-8980)

It was discovered that a use-after-free vulnerability existed in the IPMI implementation in the Linux kernel. A local attacker with access to the IPMI character device files could use this to cause a denial of service (system crash). (CVE-2019-9003)

Jann Horn discovered that the SNMP NAT implementation in the Linux kernel performed insufficient ASN.1 length checks. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-9162)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728 ).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.20.6 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
148919	Amazon Linux 2 : kernel (ALAS-2021-1627)	Nessus	Amazon Linux Local Security Checks	high
138418	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5755)	Nessus	Oracle Linux Local Security Checks	high
124978	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1525)	Nessus	Huawei Local Security Checks	high
124654	Amazon Linux AMI : kernel (ALAS-2019-1201)	Nessus	Amazon Linux Local Security Checks	medium
124592	Amazon Linux 2 : kernel (ALAS-2019-1201)	Nessus	Amazon Linux Local Security Checks	medium
124050	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1193)	Nessus	SuSE Local Security Checks	high
123679	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3931-2)	Nessus	Ubuntu Local Security Checks	high
123678	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3931-1)	Nessus	Ubuntu Local Security Checks	high
123677	Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3930-2)	Nessus	Ubuntu Local Security Checks	high
123676	Ubuntu 18.10 : linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-raspi2 (USN-3930-1)	Nessus	Ubuntu Local Security Checks	high
123496	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0784-1)	Nessus	SuSE Local Security Checks	high
123445	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)	Nessus	SuSE Local Security Checks	high
123413	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0765-1) (Spectre)	Nessus	SuSE Local Security Checks	high
121580	Fedora 29 : kernel / kernel-headers (2019-96b31a9602)	Nessus	Fedora Local Security Checks	medium
121578	Fedora 28 : kernel / kernel-headers (2019-7d3500d712)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2019-7308

medium

Tenable Plugins

high

high

high

medium

medium

high

high

high

high

high

high

high

high

medium

medium