According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through     crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected     versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)

  - An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations     often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success     or failure of each one is reported to the backend driver, and the backend driver then loops over the     results, performing follow-up actions based on the success or failure of each operation. Unfortunately,     when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively     implying their success from the success of related batch elements. In other cases, errors resulting from     one batch element lead to further batch elements not being inspected, and hence successful ones to not be     possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are     vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and     drivers/xen/gntdev.c. (CVE-2021-26932)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel     through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to     element -2 of an array, aka CID-298a58e165e4. (CVE-2021-32078)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an     incorrect flag check. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-210292376References: Upstream kernel (CVE-2021-39685)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network     protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more     buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2022-1607)

high Nessus Plugin ID 160617

Version 1.5

Version 1.4

Version 1.3

Version 1.5 Oct 30, 2023, 2:59 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202310301459
Version 1.4 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.3 Feb 1, 2023, 2:09 PM Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202302011409