According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In do_epoll_ctl and     ep_loop_check_proc of eventpoll.c, there is a possible     use after free due to a logic error. This could lead to     local escalation of privilege with no additional     execution privileges needed.(CVE-2020-0466)In the l2tp     subsystem, there is a possible use after free due to a     race condition. This could lead to local escalation of     privilege with System execution privileges     needed.(CVE-2020-27067)In the nl80211_policy policy of     nl80211.c, there is a possible out of bounds read due     to a missing bounds check. This could lead to local     information disclosure with System execution privileges     needed.(CVE-2020-27068)In audit_free_lsm_field of     auditfilter.c, there is a possible bad kfree due to a     logic error in audit_data_to_entry. This could lead to     local escalation of privilege with no additional     execution privileges needed.(CVE-2020-0444)In various     methods of hid-multitouch.c, there is a possible out of     bounds write due to a missing bounds check. This could     lead to local escalation of privilege with no     additional execution privileges     needed.(CVE-2020-0465)Use-after-free vulnerability in     fs/block_dev.c in the Linux kernel before 5.8 allows     local users to gain privileges or cause a denial of     service by leveraging improper access to a certain     error field.(CVE-2020-15436)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)A flaw was found in the     Linux kernels implementation of MIDI, where an attacker     with a local account and the permissions to issue an     ioctl commands to midi devices, could trigger a     use-after-free. A write to this specific memory while     freed and before use could cause the flow of execution     to change and possibly allow for memory corruption or     privilege escalation.(CVE-2020-27786)Array index out of     bounds access when setting extended attributes on     journaling filesystems.(CVE-2020-27815)NULL-ptr deref     in the spk_ttyio_receive_buf2() function in     spk_ttyio.c(CVE-2020-27830)An issue was discovered in
    __split_huge_pmd in mm/huge_memory.c in the Linux     kernel before 5.7.5. The copy-on-write implementation     can grant unintended write access because of a race     condition in a THP mapcount check, aka     CID-c444eb564fb1.(CVE-2020-29368)An issue was     discovered in kmem_cache_alloc_bulk in mm/slub.c in the     Linux kernel before 5.5.11. The slowpath lacks the     required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)A locking     inconsistency issue was discovered in the tty subsystem     of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)A locking issue was     discovered in the tty subsystem of the Linux kernel     through 5.9.13. drivers/tty/tty_jobctrl.c allows a     use-after-free attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)A slab-out-of-bounds     read in fbcon in the Linux kernel before 5.9.7 could be     used by local attackers to read privileged information     or potentially crash the kernel, aka CID-3c4e0dff2095.
    This occurs because KD_FONT_OP_COPY in     drivers/tty/vt/vt.c can be used for manipulations such     as font height.(CVE-2020-28974) An issue was discovered     in the Linux kernel through 5.9.1, as used with Xen     through 4.14.x. Guest OS users can cause a denial of     service (host OS hang) via a high rate of events to     dom0, aka CID-e99502f76271.(CVE-2020-27673)An issue was     discovered in drivers/accessibility/speakup/spk_ttyio.c     in the Linux kernel through 5.9.9. Local attackers on     systems with the speakup driver could cause a local     denial of service attack, aka CID-d41227544427. This     occurs because of an invalid free when the line     discipline is used more than once.(CVE-2020-28941)An     issue was discovered in the Linux kernel through 5.9.1,     as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)A buffer     over-read (at the framebuffer layer) in the fbcon code     in the Linux kernel before 5.8.15 could be used by     local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)A flaw was found in     the Linux kernel. A use-after-free memory flaw was     found in the perf subsystem allowing a local attacker     with permission to monitor perf events to corrupt     memory and possibly escalate privileges. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)A flaw in the way reply     ICMP packets are limited in the Linux kernel     functionality was found that allows to quickly scan     open UDP ports. This flaw allows an off-path remote     user to effectively bypassing source port UDP     randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)race condition in fg_console can     lead to use-after-free in     con_font_op.(CVE-2020-25668)use-after-free read in     sunkbd_reinit in     drivers/input/keyboard/sunkbd.c.(CVE-2020-25669)A flaw     was found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-1028)

critical Nessus Plugin ID 144693

Version 1.5

Version 1.4

Version 1.5 Feb 9, 2023, 1:59 PM CVSS metrics ("CVSSv2 score" changed from "7.2" to "7.5") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P") CVSS metrics ("CVSSv3 score" changed from "7.8" to "9.8") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2020-29661" to "CVE-2020-27068") CVSSv3 score source (set to "CVE-2020-27068") Plugin Feed: 202302091359
Version 1.4 Dec 7, 2022, 4:47 PM Reference Plugin Feed: 202212071647