The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2678-1 advisory.

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - A NULL pointer dereference flaw was found in the Linux kernel's IEEE 802.15.4 wireless networking     subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the     system. The highest threat from this vulnerability is to system availability. (CVE-2021-3659)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15 Security Update : kernel (SUSE-SU-2021:2678-1)

high Nessus Plugin ID 152545

Version 1.7

Version 1.6

Version 1.5

Version 1.7 Jul 14, 2023, 2:18 AM Exploit attributes ("Exploited by malware" set to "True") Plugin metadata Plugin Feed: 202307140218
Version 1.6 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737
Version 1.5 Mar 21, 2023, 7:30 PM Plugin metadata Plugin Feed: 202303211930