A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to crash the system or escalate their privileges on the system.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:2168 advisory.

  - A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API,     is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-     of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
    (CVE-2021-3501)

  - A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs     forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to     crash the system or escalate their privileges on the system. (CVE-2021-3543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2168 advisory.

  - A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API,     is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-     of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
    (CVE-2021-3501)

  - A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs     forces closures on the enclave file descriptor. A local user of a host machine could use this flaw to     crash the system or escalate their privileges on the system. (CVE-2021-3543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4997-2 advisory.

    USN-4997-1 fixed vulnerabilities in the Linux kernel for Ubuntu 21.04. This update provides the     corresponding updates for the Linux KVM kernel for Ubuntu 21.04.

    Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel     leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute     arbitrary code. (CVE-2021-3609)

    Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel did not properly enforce limits     for pointer operations. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-33200)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly clear received     fragments from memory in some situations. A physically proximate attacker could possibly use this issue to     inject packets or expose sensitive information. (CVE-2020-24586)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled encrypted     fragments. A physically proximate attacker could possibly use this issue to decrypt fragments.
    (CVE-2020-24587)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled certain     malformed frames. If a user were tricked into connecting to a malicious server, a physically proximate     attacker could use this issue to inject packets. (CVE-2020-24588)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled EAPOL frames     from unauthenticated senders. A physically proximate attacker could inject malicious packets to cause a     denial of service (system crash). (CVE-2020-26139)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly verify certain     fragmented frames. A physically proximate attacker could possibly use this issue to inject or decrypt     packets. (CVE-2020-26141)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation accepted plaintext fragments in     certain situations. A physically proximate attacker could use this issue to inject packets.
    (CVE-2020-26145)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation could reassemble mixed encrypted     and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets     or exfiltrate selected fragments. (CVE-2020-26147)

    Or Cohen discovered that the SCTP implementation in the Linux kernel contained a race condition in some     situations, leading to a use-after-free condition. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2021-23133)

    Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the nfc implementation in the Linux     kernel. A privileged local attacker could use this issue to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-23134)

    Manfred Paul discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     contained an out-of-bounds vulnerability. A local attacker could use this issue to execute arbitrary code.
    (CVE-2021-31440)

    Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel did not properly prevent     speculative loads in certain situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2021-31829)

    It was discovered that a race condition in the kernel Bluetooth subsystem could lead to use-after-free of     slab objects. An attacker could use this issue to possibly execute arbitrary code. (CVE-2021-32399)

    It was discovered that a use-after-free existed in the Bluetooth HCI driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-33034)

    It was discovered that an out-of-bounds (OOB) memory access flaw existed in the f2fs module of the Linux     kernel. A local attacker could use this issue to cause a denial of service (system crash). (CVE-2021-3506)

    Mathias Krause discovered that a null pointer dereference existed in the Nitro Enclaves kernel driver of     the Linux kernel. A local attacker could use this issue to cause a denial of service or possibly execute     arbitrary code. (CVE-2021-3543)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5001-1 advisory.

    Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel     leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute     arbitrary code. (CVE-2021-3609)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly clear received     fragments from memory in some situations. A physically proximate attacker could possibly use this issue to     inject packets or expose sensitive information. (CVE-2020-24586)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled encrypted     fragments. A physically proximate attacker could possibly use this issue to decrypt fragments.
    (CVE-2020-24587)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled certain     malformed frames. If a user were tricked into connecting to a malicious server, a physically proximate     attacker could use this issue to inject packets. (CVE-2020-24588)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled EAPOL frames     from unauthenticated senders. A physically proximate attacker could inject malicious packets to cause a     denial of service (system crash). (CVE-2020-26139)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly verify certain     fragmented frames. A physically proximate attacker could possibly use this issue to inject or decrypt     packets. (CVE-2020-26141)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation accepted plaintext fragments in     certain situations. A physically proximate attacker could use this issue to inject packets.
    (CVE-2020-26145)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation could reassemble mixed encrypted     and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets     or exfiltrate selected fragments. (CVE-2020-26147)

    Or Cohen discovered that the SCTP implementation in the Linux kernel contained a race condition in some     situations, leading to a use-after-free condition. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2021-23133)

    Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the nfc implementation in the Linux     kernel. A privileged local attacker could use this issue to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-23134)

    Manfred Paul discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     contained an out-of-bounds vulnerability. A local attacker could use this issue to execute arbitrary code.
    (CVE-2021-31440)

    It was discovered that a race condition in the kernel Bluetooth subsystem could lead to use-after-free of     slab objects. An attacker could use this issue to possibly execute arbitrary code. (CVE-2021-32399)

    It was discovered that a use-after-free existed in the Bluetooth HCI driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-33034)

    It was discovered that an out-of-bounds (OOB) memory access flaw existed in the f2fs module of the Linux     kernel. A local attacker could use this issue to cause a denial of service (system crash). (CVE-2021-3506)

    Mathias Krause discovered that a null pointer dereference existed in the Nitro Enclaves kernel driver of     the Linux kernel. A local attacker could use this issue to cause a denial of service or possibly execute     arbitrary code. (CVE-2021-3543)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4997-1 advisory.

    Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel     leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute     arbitrary code. (CVE-2021-3609)

    Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel did not properly enforce limits     for pointer operations. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-33200)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly clear received     fragments from memory in some situations. A physically proximate attacker could possibly use this issue to     inject packets or expose sensitive information. (CVE-2020-24586)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled encrypted     fragments. A physically proximate attacker could possibly use this issue to decrypt fragments.
    (CVE-2020-24587)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled certain     malformed frames. If a user were tricked into connecting to a malicious server, a physically proximate     attacker could use this issue to inject packets. (CVE-2020-24588)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled EAPOL frames     from unauthenticated senders. A physically proximate attacker could inject malicious packets to cause a     denial of service (system crash). (CVE-2020-26139)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly verify certain     fragmented frames. A physically proximate attacker could possibly use this issue to inject or decrypt     packets. (CVE-2020-26141)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation accepted plaintext fragments in     certain situations. A physically proximate attacker could use this issue to inject packets.
    (CVE-2020-26145)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation could reassemble mixed encrypted     and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets     or exfiltrate selected fragments. (CVE-2020-26147)

    Or Cohen discovered that the SCTP implementation in the Linux kernel contained a race condition in some     situations, leading to a use-after-free condition. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2021-23133)

    Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the nfc implementation in the Linux     kernel. A privileged local attacker could use this issue to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-23134)

    Manfred Paul discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     contained an out-of-bounds vulnerability. A local attacker could use this issue to execute arbitrary code.
    (CVE-2021-31440)

    Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel did not properly prevent     speculative loads in certain situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2021-31829)

    It was discovered that a race condition in the kernel Bluetooth subsystem could lead to use-after-free of     slab objects. An attacker could use this issue to possibly execute arbitrary code. (CVE-2021-32399)

    It was discovered that a use-after-free existed in the Bluetooth HCI driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-33034)

    It was discovered that an out-of-bounds (OOB) memory access flaw existed in the f2fs module of the Linux     kernel. A local attacker could use this issue to cause a denial of service (system crash). (CVE-2021-3506)

    Mathias Krause discovered that a null pointer dereference existed in the Nitro Enclaves kernel driver of     the Linux kernel. A local attacker could use this issue to cause a denial of service or possibly execute     arbitrary code. (CVE-2021-3543)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2168 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32     GB from vcpu->run (CVE-2021-3501)

    * kernel: nitro_enclaves stale file descriptors on failed usercopy (CVE-2021-3543)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * OVS mistakenly using local IP as tun_dst for VXLAN packets (?) (BZ#1944667)

    * Selinux: The task calling security_set_bools() deadlocks with itself when it later calls     selinux_audit_rule_match(). (BZ#1945123)

    * [mlx5] tc flower mpls match options does not work (BZ#1952061)

    * mlx5: missing patches for ct.rel (BZ#1952062)

    * CT HWOL: with OVN/OVS, intermittently, load balancer hairpin TCP packets get dropped for seconds in a     row (BZ#1952065)

    * [Lenovo 8.3 bug] Blackscreen after clicking on Settings icon from top-right corner. (BZ#1952900)

    * RHEL 8.x missing uio upstream fix. (BZ#1952952)

    * Turbostat doesn't show any measured data on AMD Milan (BZ#1952987)

    * P620 no sound from front headset jack (BZ#1954545)

    * RHEL kernel 8.2 and higher are affected by data corruption bug in raid1 arrays using bitmaps.
    (BZ#1955188)

    * [net/sched] connection failed with DNAT + SNAT by tc action ct (BZ#1956458)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2169 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32     GB from vcpu->run (CVE-2021-3501)

    * kernel: nitro_enclaves stale file descriptors on failed usercopy (CVE-2021-3543)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the RHEL-8.4.z0 source tree (BZ#1957489)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2168 advisory.

    [4.18.0-305.3.1_4.OL8]
    - Update Oracle Linux certificates (Kevin Lyons)
    - Disable signing for aarch64 (Ilya Okomin)
    - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem)     [Orabug: 29539237]
    - Update x509.genkey [Orabug: 24817676]
    - Conflict with shim-ia32 and shim-x64 <= 15-11.0.5

    [4.18.0-305.3.1_4]
    - Revert 'uio: use request_threaded_irq instead' (Vitaly Kuznetsov) [1952952 1946644]
    - drm/ast: Set format registers in primary plane's update (Lyude Paul) [1952900 1923857]
    - net/sched: act_ct: clear post_ct if doing ct_clear (Marcelo Ricardo Leitner) [1956458 1941889]
    - md/raid1: properly indicate failure when ending a failed write request (Nigel Croxon) [1955188 1954588]
    - nitro_enclaves: Fix stale file descriptors on failed usercopy (Vitaly Kuznetsov) [1956379 1953717]

    [4.18.0-305.2.1_4]
    - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP (Alaa Hleihel) [1952061 1936742]
    - net/mlx5e: Reject tc rules which redirect from a VF to itself (Alaa Hleihel) [1952065 1932839]
    - net/mlx5: CT: Add support for matching on ct_state inv and rel flags (Alaa Hleihel) [1952062 1942681]
    - KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (Jon Maloy) [1954221 1954219]
    - tools/power turbostat: Revert '[tools] tools/power turbostat: Enable accumulate RAPL display' (Prarit     Bhargava) [1952987 1944699]

    [4.18.0-305.1.1_4]
    - ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe (Jaroslav Kysela) [1954545 1870724]
    - ALSA: usb-audio: fix use after free in usb_audio_disconnect (Jaroslav Kysela) [1954545 1870724]
    - ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() (Jaroslav Kysela)     [1954545 1870724]
    - selinux: fix deadlock in security_set_bools() (Ondrej Mosnacek) [1945123 1924230]
    - geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667     1941753]
    - vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667     1941753]
    - redhat: switch to zstream (Jan Stancek)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
160459	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	high
157742	Rocky Linux 8 : kernel (RLSA-2021:2168)	Nessus	Rocky Linux Local Security Checks	high
157610	AlmaLinux 8 : kernel (ALSA-2021:2168)	Nessus	Alma Linux Local Security Checks	high
153127	Ubuntu 21.04 : Linux kernel (KVM) vulnerabilities (USN-4997-2)	Nessus	Ubuntu Local Security Checks	high
150955	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5001-1)	Nessus	Ubuntu Local Security Checks	high
150953	Ubuntu 21.04 : Linux kernel vulnerabilities (USN-4997-1)	Nessus	Ubuntu Local Security Checks	high
150921	Photon OS 4.0: Linux PHSA-2021-4.0-0047	Nessus	PhotonOS Local Security Checks	high
150295	RHEL 8 : kernel (RHSA-2021:2168)	Nessus	Red Hat Local Security Checks	high
150289	RHEL 8 : kernel-rt (RHSA-2021:2169)	Nessus	Red Hat Local Security Checks	high
150145	Oracle Linux 8 : kernel (ELSA-2021-2168)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2021-3543

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high