In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0174 advisory.

  - Kernel: speculative bounds check bypass store (CVE-2018-3693)

  - kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

  - kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c     (CVE-2019-3846)

  - kernel: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member,     which leads to a use-after-free in sockfs_setattr (CVE-2019-8912)

  - kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c     (CVE-2019-10126)

  - kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)

  - kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS     (CVE-2019-14814)

  - kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS     (CVE-2019-14815)

  - kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver (CVE-2019-14816)

  - kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c (CVE-2019-17133)

  - kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.24 or 8.0.x prior to 8.0.18 or 8.1.x prior to 8.1.9 or 9.0.x prior to 9.0.3. It is, therefore, affected by a vulnerability.

- A privilege escalation vulnerability exists in the Linux kernel's sockfs_setattr. An unauthenticated, local attacker   can exploit this to gain privileged access to the system.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):The walk_hugetlb_range()     function in 'mm/pagewalk.c' file in the Linux kernel     from v4.0-rc1 through v4.15-rc1 mishandles holes in     hugetlb ranges. This allows local users to obtain     sensitive information from uninitialized kernel memory     via crafted use of the mincore() system     call.(CVE-2017-16994)In the Linux kernel before 4.7,     the amd_gpio_remove function in     drivers/pinctrl/pinctrl-amd.c calls the     pinctrl_unregister function, leading to a double     free.(CVE-2017-18174)In the Linux kernel through     4.20.11, af_alg_release() in crypto/af_alg.c neglects     to set a NULL value for a certain structure member,     which leads to a use-after-free in     sockfs_setattr.(CVE-2019-8912)A security flaw was found     in the Linux kernel that an attempt to move page mapped     by AIO ring buffer to the other node triggers NULL     pointer dereference at trace_writeback_dirty_page(),     because aio_fs_backing_dev_info.dev is     0.(CVE-2016-3070)The NFSv4 implementation in the Linux     kernel through 4.11.1 allows local users to cause a     denial of service (resource consumption) by leveraging     improper channel callback shutdown when unmounting an     NFSv4 filesystem, aka a 'module reference and kernel     daemon' leak.(CVE-2017-9059)When creating audit records     for parameters to executed children processes, an     attacker can convince the Linux kernel audit subsystem     can create corrupt records which may allow an attacker     to misrepresent or evade logging of executing     commands.(CVE-2016-6136)A use-after-free vulnerability     was found in a network namespaces code affecting the     Linux kernel since v4.0-rc1 through v4.15-rc5. The     function get_net_ns_by_id() does not check for the     net::count value after it has found a peer network in     netns_ids idr which could lead to double free and     memory corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out, although it is thought to be     unlikely.(CVE-2017-15129)A NULL pointer dereference     flaw was found in the rds_ib_laddr_check() function in     the Linux kernel's implementation of Reliable Datagram     Sockets (RDS). A local, unprivileged user could use     this flaw to crash the system.(CVE-2013-7339)A flaw was     found in the Linux kernel key management subsystem in     which a local attacker could crash the kernel or     corrupt the stack and additional memory (denial of     service) by supplying a specially crafted RSA key. This     flaw panics the machine during the verification of the     RSA key.(CVE-2016-8650)The uio_mmap_physical function     in drivers/uio/uio.c in the Linux kernel before 3.12     does not validate the size of a memory block, which     allows local users to cause a denial of service (memory     corruption) or possibly gain privileges via crafted     mmap operations, a different vulnerability than     CVE-2013-4511.(CVE-2013-6763)In the Linux kernel before     4.20.5, attackers can trigger a     drivers/char/ipmi/ipmi_msghandler.c use-after-free and     OOPS by arranging for certain simultaneous execution of     the code, as demonstrated by a 'service ipmievd     restart' loop.(CVE-2019-9003)An integer overflow flaw     was found in the way the Linux kernel randomized the     stack for processes on certain 64-bit architecture     systems, such as x86-64, causing the stack entropy to     be reduced by four.(CVE-2015-1593)The     compat_sys_recvmmsg function in net/compat.c in the     Linux kernel before 3.13.2, when CONFIG_X86_X32 is     enabled, allows local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter.(CVE-2014-0038)The kill_something_info     function in kernel/signal.c in the Linux kernel before     4.13, when an unspecified architecture and compiler is     used, might allow local users to cause a denial of     service via an INT_MIN     argument.(CVE-2018-10124)arch/s390/kernel/head64.S in     the Linux kernel before 3.13.5 on the s390 platform     does not properly handle attempted use of the linkage     stack, which allows local users to cause a denial of     service (system crash) by executing a crafted     instruction.(CVE-2014-2039)A flaw was found in the     Linux kernel in that the aoedisk_debugfs_show()     function in drivers/block/aoe/aoeblk.c allows local     users to obtain some kernel address information by     reading a debugfs file. This address is not useful to     commit a further attack.(CVE-2018-7754)ALSA sequencer     core initializes the event pool on demand by invoking     snd_seq_pool_init() when the first write happens and     the pool is empty. A user can reset the pool size     manually via ioctl concurrently, and this may lead to     UAF or out-of-bound access.(CVE-2018-7566)In the     function wmi_set_ie(), the length validation code does     not handle unsigned integer overflow properly. As a     result, a large value of the 'ie_len' argument can     cause a buffer overflow in all Android releases from     CAF (Android for MSM, Firefox OS for MSM, QRD Android)     using the Linux Kernel.(CVE-2018-5848)The Linux kernel     does not properly initialize memory in messages passed     between virtual guests and the host operating system in     the vhost/vhost.c:vhost_new_msg() function. This can     allow local privileged users to read some kernel memory     contents when reading from the /dev/vhost-net device     file.(CVE-2018-1118)Systems with microprocessors     utilizing speculative execution and speculative     execution of memory reads before the addresses of all     prior memory writes are known may allow unauthorized     disclosure of information to an attacker with local     user access via a side-channel analysis, aka     Speculative Store Bypass (SSB), Variant     4.(CVE-2018-3639)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4612 advisory.

  - An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN     frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field.
    The privileged user root with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data     length code a higher value than the available CAN frame data size. In combination with a configured     checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel)     the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a     system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data     registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.
    (CVE-2019-3701)

  - In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference     counting because of a race condition, leading to a use-after-free. (CVE-2019-6974)

  - The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (CVE-2019-7221)

  - The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (CVE-2019-7222)

  - A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows     attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
    (CVE-2019-8980)

  - In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum     address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP     platforms. This is related to a capability check for the wrong task. (CVE-2019-9213)

  - In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for     a certain structure member, which leads to a use-after-free in sockfs_setattr. (CVE-2019-8912)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3931-2 advisory.

  - An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The     xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which     allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen,     64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
    (CVE-2018-14678)

  - arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the     KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can     arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also     cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of     insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation     does not prevent unintended execution modes. (CVE-2018-18021)

  - In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by     supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in     sound/usb/card.c. (CVE-2018-19824)

  - A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before     5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference     counting because of a race condition, leading to a use-after-free. (CVE-2019-6974)

  - The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (CVE-2019-7221)

  - The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (CVE-2019-7222)

  - kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on     pointer arithmetic in various cases, including cases of different branches with different state or limits     to sanitize, leading to side-channel attacks. (CVE-2019-7308)

  - In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for     a certain structure member, which leads to a use-after-free in sockfs_setattr. (CVE-2019-8912)

  - A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows     attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
    (CVE-2019-8980)

  - In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum     address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP     platforms. This is related to a capability check for the wrong task. (CVE-2019-9213)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3931-1 advisory.

  - An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The     xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which     allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen,     64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
    (CVE-2018-14678)

  - arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the     KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can     arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also     cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of     insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation     does not prevent unintended execution modes. (CVE-2018-18021)

  - In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by     supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in     sound/usb/card.c. (CVE-2018-19824)

  - A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before     5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference     counting because of a race condition, leading to a use-after-free. (CVE-2019-6974)

  - The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (CVE-2019-7221)

  - The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (CVE-2019-7222)

  - kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on     pointer arithmetic in various cases, including cases of different branches with different state or limits     to sanitize, leading to side-channel attacks. (CVE-2019-7308)

  - In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for     a certain structure member, which leads to a use-after-free in sockfs_setattr. (CVE-2019-8912)

  - A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows     attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
    (CVE-2019-8980)

  - In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum     address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP     platforms. This is related to a capability check for the wrong task. (CVE-2019-9213)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3930-2 advisory.

  - In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by     supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in     sound/usb/card.c. (CVE-2018-19824)

  - A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before     5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference     counting because of a race condition, leading to a use-after-free. (CVE-2019-6974)

  - The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (CVE-2019-7221)

  - The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (CVE-2019-7222)

  - kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on     pointer arithmetic in various cases, including cases of different branches with different state or limits     to sanitize, leading to side-channel attacks. (CVE-2019-7308)

  - In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for     a certain structure member, which leads to a use-after-free in sockfs_setattr. (CVE-2019-8912)

  - In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the sctp_sendmsg()     function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.
    (CVE-2019-8956)

  - A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows     attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
    (CVE-2019-8980)

  - In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-     free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a service     ipmievd restart loop. (CVE-2019-9003)

  - In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has     insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write     operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and     snmp_helper. (CVE-2019-9162)

  - In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum     address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP     platforms. This is related to a capability check for the wrong task. (CVE-2019-9213)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel.
An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM).
(CVE-2019-7222)

Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against Spectre V1 attacks. A local attacker could use this to expose sensitive information.
(CVE-2019-7308)

It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8912)

Jakub Jirasek discovered a use-after-free vulnerability in the SCTP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8956)

It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors while reading files. A local attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2019-8980)

It was discovered that a use-after-free vulnerability existed in the IPMI implementation in the Linux kernel. A local attacker with access to the IPMI character device files could use this to cause a denial of service (system crash). (CVE-2019-9003)

Jann Horn discovered that the SNMP NAT implementation in the Linux kernel performed insufficient ASN.1 length checks. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-9162)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728 ).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

In the Linux kernel af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free (UAF) in sockfs_setattr. A local attacker can use this flaw to escalate privileges and take control of the system.
(CVE-2019-8912)

In the Linux kernel af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free (UAF) in sockfs_setattr. A local attacker can use this flaw to escalate privileges and take control of the system.(CVE-2019-8912)

The 4.20.11 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.20.11 stable kernel update contains a number of important fixes across the tree.

----

The 4.20.10 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
133162	RHEL 7 : kernel-alt (RHSA-2020:0174)	Nessus	Red Hat Local Security Checks	critical
129502	Palo Alto Networks PAN-OS 7.1.x < 7.1.24 / 8.0.x < 8.0.18 / 8.1.x < 8.1.9 / 9.0.x < 9.0.3 Vulnerability	Nessus	Palo Alto Local Security Checks	high
124991	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1538)	Nessus	Huawei Local Security Checks	critical
124050	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1193)	Nessus	SuSE Local Security Checks	high
124048	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4612)	Nessus	Oracle Linux Local Security Checks	high
123679	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3931-2)	Nessus	Ubuntu Local Security Checks	high
123678	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3931-1)	Nessus	Ubuntu Local Security Checks	high
123677	Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3930-2)	Nessus	Ubuntu Local Security Checks	high
123676	Ubuntu 18.10 : linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-raspi2 (USN-3930-1)	Nessus	Ubuntu Local Security Checks	high
123496	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0784-1)	Nessus	SuSE Local Security Checks	high
123445	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)	Nessus	SuSE Local Security Checks	high
123413	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0765-1) (Spectre)	Nessus	SuSE Local Security Checks	high
122917	Photon OS 2.0: Linux PHSA-2019-2.0-0134	Nessus	PhotonOS Local Security Checks	high
122759	Amazon Linux AMI : kernel (ALAS-2019-1167)	Nessus	Amazon Linux Local Security Checks	high
122673	Amazon Linux 2 : kernel (ALAS-2019-1167)	Nessus	Amazon Linux Local Security Checks	high
122440	Fedora 29 : kernel / kernel-headers / kernel-tools (2019-7bdeed7fc5)	Nessus	Fedora Local Security Checks	high
122436	Fedora 28 : kernel / kernel-headers / kernel-tools (2019-16de0047d4)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-8912

high

Tenable Plugins

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high