net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and     unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list     in fs/ext4/super.c. (CVE-2019-19447)

  - A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could use this flaw to crash the system or escalate their     privileges on the system. (CVE-2020-14356)

  - A flaw was found in the Linux kernel's futex implementation. This flaw allows a local attacker to corrupt     system memory or escalate their privileges when creating a futex on a filesystem that is about to be     unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-14381)

  - The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive     information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and kernel/time/timer.c. (CVE-2020-16166)

  - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
    (CVE-2020-25211)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-     free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a     certain point during device setup, aka CID-b98e762e3d71. (CVE-2021-3348)

  - .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse     a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race     condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
    (CVE-2021-3609)

  - An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions     before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the     system or possibly escalate their privileges on the system. The highest threat from this vulnerability is     to confidentiality, integrity, as well as system availability. (CVE-2021-3612)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service     (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
    (CVE-2021-38201)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Linux kernel's futex implementation. This flaw allows a local attacker to corrupt     system memory or escalate their privileges when creating a futex on a filesystem that is about to be     unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-14381)

  - The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive     information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and kernel/time/timer.c. (CVE-2020-16166)

  - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
    (CVE-2020-25211)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking     in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal     in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker     has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are     proxied via an attacker-selected backstore. (CVE-2020-28374)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
    (CVE-2021-3347)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API,     is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-     of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
    (CVE-2021-3501)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service     (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
    (CVE-2021-38201)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and     unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list     in fs/ext4/super.c. (CVE-2019-19447)

  - A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could use this flaw to crash the system or escalate their     privileges on the system. (CVE-2020-14356)

  - A flaw was found in the Linux kernel's futex implementation. This flaw allows a local attacker to corrupt     system memory or escalate their privileges when creating a futex on a filesystem that is about to be     unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-14381)

  - The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive     information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and kernel/time/timer.c. (CVE-2020-16166)

  - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
    (CVE-2020-25211)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-     free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a     certain point during device setup, aka CID-b98e762e3d71. (CVE-2021-3348)

  - .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse     a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race     condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
    (CVE-2021-3609)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service     (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
    (CVE-2021-38201)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could use this flaw to crash the system or escalate their     privileges on the system. (CVE-2020-14356)

  - A flaw was found in the Linux kernel's futex implementation. This flaw allows a local attacker to corrupt     system memory or escalate their privileges when creating a futex on a filesystem that is about to be     unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-14381)

  - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
    (CVE-2020-25211)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-     free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a     certain point during device setup, aka CID-b98e762e3d71. (CVE-2021-3348)

  - An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions     before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the     system or possibly escalate their privileges on the system. The highest threat from this vulnerability is     to confidentiality, integrity, as well as system availability. (CVE-2021-3612)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service     (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
    (CVE-2021-38201)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:3440 advisory.

  - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service     (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
    (CVE-2021-38201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:3447 advisory.

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service     (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
    (CVE-2021-38201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:3447 advisory.

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service     (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
    (CVE-2021-38201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5092-2 advisory.

    Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free     adjacent memory. A local attacker could use this to execute arbitrary code. (CVE-2021-41073)

    Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the     Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack.
    An attacker could use this to expose sensitive information. (CVE-2021-33624)

    Benedict Schlueter discovered that the BPF subsystem in the Linux kernel did not properly protect against     Speculative Store Bypass (SSB) side- channel attacks in some situations. A local attacker could possibly     use this to expose sensitive information. (CVE-2021-34556)

    Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly protect against     Speculative Store Bypass (SSB) side-channel attacks in some situations. A local attacker could possibly     use this to expose sensitive information. (CVE-2021-35477)

    It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu     ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

    It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly     handle error conditions. A physically proximate attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

    Alexey Kardashevskiy discovered that the KVM implementation for PowerPC systems in the Linux kernel did     not properly validate RTAS arguments in some situations. An attacker in a guest vm could use this to cause     a denial of service (host OS crash) or possibly execute arbitrary code. (CVE-2021-37576)

    It was discovered that the Virtio console implementation in the Linux kernel did not properly validate     input lengths in some situations. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2021-38160)

    Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly     order connection setup operations. An attacker controlling a remote NFS server could use this to cause a     denial of service on the client. (CVE-2021-38199)

    It was discovered that the Sun RPC implementation in the Linux kernel contained an out-of-bounds access     error. A remote attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2021-38201)

    It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle     device removal events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2021-38204)

    It was discovered that the Xilinx 10/100 Ethernet Lite device driver in the Linux kernel could report     pointer addresses in some situations. An attacker could use this information to ease the exploitation of     another vulnerability. (CVE-2021-38205)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5096-1 advisory.

    Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free     adjacent memory. A local attacker could use this to execute arbitrary code. (CVE-2021-41073)

    Benedict Schlueter discovered that the BPF subsystem in the Linux kernel did not properly protect against     Speculative Store Bypass (SSB) side- channel attacks in some situations. A local attacker could possibly     use this to expose sensitive information. (CVE-2021-34556)

    Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly protect against     Speculative Store Bypass (SSB) side-channel attacks in some situations. A local attacker could possibly     use this to expose sensitive information. (CVE-2021-35477)

    Murray McAllister discovered that the joystick device interface in the Linux kernel did not properly     validate data passed via an ioctl(). A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code on systems with a joystick device registered. (CVE-2021-3612)

    It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu     ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

    It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly     handle error conditions. A physically proximate attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

    Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private     clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

    It was discovered that the Virtio console implementation in the Linux kernel did not properly validate     input lengths in some situations. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2021-38160)

    It was discovered that the BPF subsystem in the Linux kernel contained an integer overflow in its hash     table implementation. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-38166)

    Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly     order connection setup operations. An attacker controlling a remote NFS server could use this to cause a     denial of service on the client. (CVE-2021-38199)

    It was discovered that the Sun RPC implementation in the Linux kernel contained an out-of-bounds access     error. A remote attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2021-38201)

    It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds read     when the trace even framework is being used for nfsd. A remote attacker could possibly use this to cause a     denial of service (system crash). (CVE-2021-38202)

    Naohiro Aota discovered that the btrfs file system in the Linux kernel contained a race condition in     situations that triggered allocations of new system chunks. A local attacker could possibly use this to     cause a denial of service (deadlock). (CVE-2021-38203)

    It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle     device removal events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2021-38204)

    It was discovered that the Xilinx 10/100 Ethernet Lite device driver in the Linux kernel could report     pointer addresses in some situations. An attacker could use this information to ease the exploitation of     another vulnerability. (CVE-2021-38205)

    It was discovered that the ext4 file system in the Linux kernel contained a race condition when writing     xattrs to an inode. A local attacker could use this to cause a denial of service or possibly gain     administrative privileges. (CVE-2021-40490)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5092-1 advisory.

    Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free     adjacent memory. A local attacker could use this to execute arbitrary code. (CVE-2021-41073)

    Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the     Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack.
    An attacker could use this to expose sensitive information. (CVE-2021-33624)

    Benedict Schlueter discovered that the BPF subsystem in the Linux kernel did not properly protect against     Speculative Store Bypass (SSB) side- channel attacks in some situations. A local attacker could possibly     use this to expose sensitive information. (CVE-2021-34556)

    Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly protect against     Speculative Store Bypass (SSB) side-channel attacks in some situations. A local attacker could possibly     use this to expose sensitive information. (CVE-2021-35477)

    It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu     ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

    It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly     handle error conditions. A physically proximate attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

    Alexey Kardashevskiy discovered that the KVM implementation for PowerPC systems in the Linux kernel did     not properly validate RTAS arguments in some situations. An attacker in a guest vm could use this to cause     a denial of service (host OS crash) or possibly execute arbitrary code. (CVE-2021-37576)

    It was discovered that the Virtio console implementation in the Linux kernel did not properly validate     input lengths in some situations. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2021-38160)

    Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly     order connection setup operations. An attacker controlling a remote NFS server could use this to cause a     denial of service on the client. (CVE-2021-38199)

    It was discovered that the Sun RPC implementation in the Linux kernel contained an out-of-bounds access     error. A remote attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2021-38201)

    It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle     device removal events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2021-38204)

    It was discovered that the Xilinx 10/100 Ethernet Lite device driver in the Linux kernel could report     pointer addresses in some situations. An attacker could use this information to ease the exploitation of     another vulnerability. (CVE-2021-38205)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3447 advisory.

  - kernel: powerpc: KVM guest OS users can cause host OS memory corruption (CVE-2021-37576)

  - kernel: slab-out-of-bounds access in xdr_set_page_base() in net/sunrpc/xdr.c (CVE-2021-38201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3447 advisory.

    - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988225 1988226] {CVE-2021-37576}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3447 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: powerpc: KVM guest OS users can cause host OS memory corruption (CVE-2021-37576)

    * kernel: slab-out-of-bounds access in xdr_set_page_base() in net/sunrpc/xdr.c (CVE-2021-38201)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Update Broadcom Emulex lpfc driver for RHEL8.5 with bug fixes (BZ#1948608)

    * cyclictest shows >50us latency when guest enters idle (RT guest with 18 RT vCPUs) (BZ#1981336)

    * xfrm: backports from upstream (BZ#1981840)

    * A task is stuck waiting for the completion of the vmci_resouce releasing upon the balloon reset.
    (BZ#1982042)

    * [mlx5] backport driver bits of  net: zero-initialize tc skb extension on allocation (BZ#1982220)

    * Kernel cannot kill a process doing compaction for hugepage allocation (BZ#1984085)

    * RHEL8.4 Nightly[0108] - [P10] [Regression] Kdump failed on RHEL8.4 on SAN disk via flavafish adapter     (qla2xxx/HPT/Radix) (BZ#1986156)

    * [RHEL8.5] scheduler updates and fixes (BZ#1987296)

    * RHEL 8.3 using FCOE via a FastLinQ QL45000 card will not manually scan in LUN from Target_id's over 8     (BZ#1989097)

    * fixes for oopses in security mitigation runtime code patching (BZ#1989174)

    * act mirred doesn't scrub packets when sending them to ingress (BZ#1992226)

    * HPE: Cannot install 8.4 using the DVD presented to the iLO (BZ#1993894)

    * NFS client hangs on share listing when server side readdir verifiers are implemented (BZ#1993895)

    * SNO: The load is extremely high (~870) when pao is added and a profile is applied. (BZ#1994879)

    * timeout value of conntrack entry with TCP ESTABLISHED status is too short (BZ#1995554)

    * Increase the default value for flowtable offload timeouts (BZ#1995555)

    * ice/iavf driver stop responding (BZ#1997534)

    * [FJ8.4 Bug]: [REG] Some files in /proc/sys/user show wrong data (BZ#1998002)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3440 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: slab-out-of-bounds access in xdr_set_page_base() in net/sunrpc/xdr.c (CVE-2021-38201)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * OSLAT spikes on subset of cpus (BZ#1986063)

    * kernel-rt: update RT source tree to the RHEL-8.4.z source tree (BZ#1990013)

    * Failure to enter full_nohz due to needless SCHED softirqs (BZ#1990272)

    * kernel-rt: Make rcu_normal_after_boot writable (BZ#1995431)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
187325	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2023-0060)	Nessus	NewStart CGSL Local Security Checks	high
187320	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2023-0061)	Nessus	NewStart CGSL Local Security Checks	high
167480	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2022-0089)	Nessus	NewStart CGSL Local Security Checks	high
160769	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2022-0073)	Nessus	NewStart CGSL Local Security Checks	high
157818	Rocky Linux 8 : kernel-rt (RLSA-2021:3440)	Nessus	Rocky Linux Local Security Checks	high
157758	Rocky Linux 8 : kernel (RLSA-2021:3447)	Nessus	Rocky Linux Local Security Checks	high
157544	AlmaLinux 8 : kernel (ALSA-2021:3447)	Nessus	Alma Linux Local Security Checks	high
153799	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5092-2)	Nessus	Ubuntu Local Security Checks	high
153789	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5096-1)	Nessus	Ubuntu Local Security Checks	high
153770	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5092-1)	Nessus	Ubuntu Local Security Checks	high
153155	CentOS 8 : kernel (CESA-2021:3447)	Nessus	CentOS Local Security Checks	high
153109	Oracle Linux 8 : kernel (ELSA-2021-3447)	Nessus	Oracle Linux Local Security Checks	high
153104	RHEL 8 : kernel (RHSA-2021:3447)	Nessus	Red Hat Local Security Checks	high
153095	RHEL 8 : kernel-rt (RHSA-2021:3440)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-38201

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high