A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out-of-bounds write in __btrfs_map_block in fs/btrfs/volumes.c (CVE-2019-19816)

  - Kernel: use-after-free in btf_dump_name_dups in tools/lib/bpf/btf_dump.c (CVE-2022-3534)

  - drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial     of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the     relevance of this report because the failure can only occur for physically proximate attackers who unplug     SAS Host Bus Adapter cables (CVE-2018-10021)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: local privileges escalation in kernel/bpf/verifier.c (CVE-2022-23222)

  - Kernel: use-after-free in btf_dump_name_dups in tools/lib/bpf/btf_dump.c (CVE-2022-3534)

  - An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does     not check the nla_nest_start_noflag return value. (CVE-2019-16089)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-9410 advisory.

    - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen)  [Orabug: 33135633]     {CVE-2021-33909}
    - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk)  [Orabug: 31895299]  {CVE-2020-14304}
    - nfc: fix memory leak in llcp_sock_connect() (Xiaoming Ni)   {CVE-2020-25672}
    - nfc: fix refcount leak in llcp_sock_connect() (Xiaoming Ni)   {CVE-2020-25671}
    - nfc: fix refcount leak in llcp_sock_bind() (Xiaoming Ni)   {CVE-2020-25670}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9407 advisory.

    - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen)  [Orabug: 33135633]     {CVE-2021-33909}
    - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk)  [Orabug: 31895299]  {CVE-2020-14304}
    - nfc: fix memory leak in llcp_sock_connect() (Xiaoming Ni)   {CVE-2020-25672}
    - nfc: fix refcount leak in llcp_sock_connect() (Xiaoming Ni)   {CVE-2020-25671}
    - nfc: fix refcount leak in llcp_sock_bind() (Xiaoming Ni)   {CVE-2020-25670}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

  - A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from     the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel     memory. The highest threat from this vulnerability is to confidentiality. (CVE-2020-14304)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9406 advisory.

    - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen)  [Orabug: 33135632]     {CVE-2021-33909}
    - Bluetooth: fix the erroneous flush_work() order (Lin Ma)   {CVE-2021-3564}
    - ath10k: Fix TKIP Michael MIC verification for PCIe (Wen Gong)   {CVE-2020-26141}
    - ath10k: drop MPDU which has discard flag set by firmware for SDIO (Wen Gong)   {CVE-2020-24588}
    - ath10k: drop fragments with multicast DA for SDIO (Wen Gong)   {CVE-2020-26145}
    - ath10k: drop fragments with multicast DA for PCIe (Wen Gong)   {CVE-2020-26145}
    - mac80211: extend protection against mixed key and fragment cache attacks (Wen Gong)   {CVE-2020-24586}     {CVE-2020-24587}
    - mac80211: drop A-MSDUs on old ciphers (Johannes Berg)   {CVE-2020-24588}
    - cfg80211: mitigate A-MSDU aggregation attacks (Mathy Vanhoef)   {CVE-2020-24588}
    - mac80211: prevent mixed key and fragment cache attacks (Mathy Vanhoef)   {CVE-2020-24587}     {CVE-2020-24586}
    - mac80211: assure all fragments are encrypted (Mathy Vanhoef)   {CVE-2020-26147}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9404 advisory.

    - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen)  [Orabug: 33135632]     {CVE-2021-33909}
    - Bluetooth: fix the erroneous flush_work() order (Lin Ma)   {CVE-2021-3564}
    - ath10k: Fix TKIP Michael MIC verification for PCIe (Wen Gong)   {CVE-2020-26141}
    - ath10k: drop MPDU which has discard flag set by firmware for SDIO (Wen Gong)   {CVE-2020-24588}
    - ath10k: drop fragments with multicast DA for SDIO (Wen Gong)   {CVE-2020-26145}
    - ath10k: drop fragments with multicast DA for PCIe (Wen Gong)   {CVE-2020-26145}
    - mac80211: extend protection against mixed key and fragment cache attacks (Wen Gong)   {CVE-2020-24586}     {CVE-2020-24587}
    - mac80211: drop A-MSDUs on old ciphers (Johannes Berg)   {CVE-2020-24588}
    - cfg80211: mitigate A-MSDU aggregation attacks (Mathy Vanhoef)   {CVE-2020-24588}
    - mac80211: prevent mixed key and fragment cache attacks (Mathy Vanhoef)   {CVE-2020-24587}     {CVE-2020-24586}
    - mac80211: assure all fragments are encrypted (Mathy Vanhoef)   {CVE-2020-26147}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9395 advisory.

    - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen)  [Orabug: 33143006]     {CVE-2021-33909}
    - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk)  [Orabug: 31895301]  {CVE-2020-14304}
    - net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query (Erez Alfasi)  [Orabug: 31895301]     {CVE-2020-14304}
    - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal)  [Orabug:
    33093028]  {CVE-2021-22555}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199272	RHEL 8 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199265	RHEL 9 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
152465	Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2021-9410)	Nessus	Oracle Linux Local Security Checks	high
152464	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2021-9407)	Nessus	Oracle Linux Local Security Checks	high
152398	OracleVM 3.4 : kernel-uek (OVMSA-2021-0025)	Nessus	OracleVM Local Security Checks	high
152389	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9406)	Nessus	Oracle Linux Local Security Checks	high
152382	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9404)	Nessus	Oracle Linux Local Security Checks	high
152195	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9395)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2020-14304

medium

Tenable Plugins

critical

high

high

high

high

high

high

high

high