A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9220 advisory.

    - Revert 'x86/vmlinux: Use INT3 instead of NOP for linker fill bytes' (John Donnelly)  [Orabug: 32576398]     {CVE-2021-3411}
    - netfilter: x_tables: Use correct memory barriers. (Mark Tomlinson)  [Orabug: 32709120]  {CVE-2021-29650}
    - perf/x86/intel: Fix a crash caused by zero PEBS status (Kan Liang)  [Orabug: 32669468]  {CVE-2021-28971}
    - btrfs: fix race when cloning extent buffer during rewind of an old root (Filipe Manana)  [Orabug:
    32669450]  {CVE-2021-28964}
    - vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails (Stefano Garzarella)  [Orabug:
    32696005]  {CVE-2021-29266}
    - vhost-vdpa: fix use-after-free of v->config_ctx (Stefano Garzarella)  [Orabug: 32696005]     {CVE-2021-29266}
    - fuse: fix live lock in fuse_iget() (Amir Goldstein)  [Orabug: 32669269]  {CVE-2021-28950}
    - fuse: fix bad inode (Miklos Szeredi)  [Orabug: 32669269]  {CVE-2021-28950}
    - Xen/gnttab: handle p2m update errors on a per-slot basis (Jan Beulich)  [Orabug: 32651473]     {CVE-2021-28038}
    - xen-blkback: don't leak persistent grants from xen_blkbk_map() (Jan Beulich)  [Orabug: 32697850]     {CVE-2021-28688}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9221 advisory.

    - Revert 'x86/vmlinux: Use INT3 instead of NOP for linker fill bytes' (John Donnelly)  [Orabug: 32576398]     {CVE-2021-3411}
    - netfilter: x_tables: Use correct memory barriers. (Mark Tomlinson)  [Orabug: 32709120]  {CVE-2021-29650}
    - perf/x86/intel: Fix a crash caused by zero PEBS status (Kan Liang)  [Orabug: 32669468]  {CVE-2021-28971}
    - btrfs: fix race when cloning extent buffer during rewind of an old root (Filipe Manana)  [Orabug:
    32669450]  {CVE-2021-28964}
    - vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails (Stefano Garzarella)  [Orabug:
    32696005]  {CVE-2021-29266}
    - vhost-vdpa: fix use-after-free of v->config_ctx (Stefano Garzarella)  [Orabug: 32696005]     {CVE-2021-29266}
    - fuse: fix live lock in fuse_iget() (Amir Goldstein)  [Orabug: 32669269]  {CVE-2021-28950}
    - fuse: fix bad inode (Miklos Szeredi)  [Orabug: 32669269]  {CVE-2021-28950}
    - Xen/gnttab: handle p2m update errors on a per-slot basis (Jan Beulich)  [Orabug: 32651473]     {CVE-2021-28038}
    - xen-blkback: don't leak persistent grants from xen_blkbk_map() (Jan Beulich)  [Orabug: 32697850]     {CVE-2021-28688}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4912-1 advisory.

    Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux kernel did not properly validate     computation of branch displacements in some situations. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)

    It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

    It was discovered that the HID multitouch implementation within the Linux kernel did not properly validate     input events in some situations. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2020-0465)

    It was discovered that the eventpoll (aka epoll) implementation in the Linux kernel contained a logic     error that could lead to a use after free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2020-0466)

    It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a     use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

    It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some     edge cases in software scrollback. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2020-14390)

    It was discovered that a race condition existed in the hugetlb sysctl implementation in the Linux kernel.
    A privileged attacker could use this to cause a denial of service (system crash). (CVE-2020-25285)

    It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did     not properly select IP routes in some situations. An attacker could use this to expose sensitive     information (unencrypted network traffic). (CVE-2020-25645)

    Bodong Zhao discovered a use-after-free in the Sun keyboard driver implementation in the Linux kernel. A     local attacker could use this to cause a denial of service or possibly execute arbitrary code.
    (CVE-2020-25669)

    Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in the Linux kernel did not     correctly handle setting line discipline in some situations. A local attacker could use this to cause a     denial of service (system crash). (CVE-2020-27830)

    It was discovered that the Marvell WiFi-Ex device driver in the Linux kernel did not properly validate ad-     hoc SSIDs. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2020-36158)

    Loris Reiff discovered that the BPF implementation in the Linux kernel did not properly validate     attributes in the getsockopt BPF hook. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2021-20194)

    Adam Zabrocki discovered that the kprobes subsystem in the Linux kernel did not properly detect linker     padding in some situations. A privileged attacker could use this to cause a denial of service (system     crash) or possibly expose sensitive information. (CVE-2021-3411)

     discovered that the NFS implementation in the Linux kernel did not properly prevent access outside     of an NFS export that is a subdirectory of a file system. An attacker could possibly use this to bypass     NFS access restrictions. (CVE-2021-3178)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195652	RHEL 7 : kernel (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
149357	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9220)	Nessus	Oracle Linux Local Security Checks	high
149356	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9221)	Nessus	Oracle Linux Local Security Checks	high
148494	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-4912-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-3411

medium

Tenable Plugins

critical

high

high

high