The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4592-1 advisory.

  - Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of     privilege via adjacent access. (CVE-2020-12351)

  - Improper access control in BlueZ may allow an unauthenticated user to potentially enable information     disclosure via adjacent access. (CVE-2020-12352)

  - Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of     service via adjacent access. This affects all Linux kernel versions that support BlueZ. (CVE-2020-24490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4279 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * kernel: net: bluetooth: type confusion while processing AMP packets (CVE-2020-12351)

    * kernel: net: bluetooth: information leak when processing certain AMP packets (CVE-2020-12352)

    * kernel: information exposure in drivers/char/random.c and kernel/time/timer.c (CVE-2020-16166)

    * kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4277 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net: bluetooth: type confusion while processing AMP packets (CVE-2020-12351)

    * kernel: net: bluetooth: information leak when processing certain AMP packets (CVE-2020-12352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4281 advisory.

  - kernel: net: bluetooth: type confusion while processing AMP packets (CVE-2020-12351)

  - kernel: net: bluetooth: information leak when processing certain AMP packets (CVE-2020-12352)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

  - CVE-2020-12351     Andy Nguyen discovered a flaw in the Bluetooth     implementation in the way L2CAP packets with A2MP CID     are handled. A remote attacker in short distance knowing     the victim's Bluetooth device address can send a     malicious l2cap packet and cause a denial of service or     possibly arbitrary code execution with kernel     privileges.

  - CVE-2020-12352     Andy Nguyen discovered a flaw in the Bluetooth     implementation. Stack memory is not properly initialised     when handling certain AMP packets. A remote attacker in     short distance knowing the victim's Bluetooth device     address can retrieve kernel stack information.

  - CVE-2020-25211     A flaw was discovered in netfilter subsystem. A local     attacker able to inject conntrack Netlink configuration     can cause a denial of service.

  - CVE-2020-25643     ChenNan Of Chaitin Security Research Lab discovered a     flaw in the hdlc_ppp module. Improper input validation     in the ppp_cp_parse_cr() function may lead to memory     corruption and information disclosure.

  - CVE-2020-25645     A flaw was discovered in the interface driver for GENEVE     encapsulated traffic when combined with IPsec. If IPsec     is configured to encrypt traffic for the specific UDP     port used by the GENEVE tunnel, tunneled data isn't     correctly routed over the encrypted link and sent     unencrypted instead.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4287 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net: bluetooth: type confusion while processing AMP packets (CVE-2020-12351)

    * kernel: net: bluetooth: information leak when processing certain AMP packets (CVE-2020-12352)

    * kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to     be flagged as corrupt (CVE-2020-14385)

    * kernel: memory corruption in net/packet/af_packet.c leads to elevation of privilege (CVE-2020-14386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * NFS client autodisconnect timer may fire immediately after TCP connection setup and may cause DoS type     reconnect problem in complex network environments (BZ#1873571)

    * hang on full fs from trace_cmd (BZ#1875789)

    * Secure boot key is not loaded with kernel-4.18.0-232.el8.x86_64 / shim-x64-15-15 (BZ#1877527)

    * [RHEL-8.3] Kdump failed to start when secure boot enabled:  kexec_file_load failed: Required key not     available (BZ#1877529)

    * [RHEL-8.3] Kdump/kexec kernel panicked on EFI boot: general protection fault: 0000 [#1] SMP PTI     (BZ#1879987)

    * [conntrack] udp packet reverse NAT occasionally fail when race condition request combination with the     DNAT load balancing rules (BZ#1882096)

    * [Regression] RHEL8.3 Beta - Do not initiate shutdown for EPOW_SHUTDOWN_ON_UPS event (BZ#1882244)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4276 advisory.

  - kernel: net: bluetooth: type confusion while processing AMP packets (CVE-2020-12351)

  - kernel: net: bluetooth: information leak when processing certain AMP packets (CVE-2020-12352)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update corrects a regression in some Xen virtual machine environments. For reference the original advisory text follows.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

CVE-2019-9445

A potential out-of-bounds read was discovered in the F2FS implementation. A user permitted to mount and access arbitrary filesystems could potentially use this to cause a denial of service (crash) or to read sensitive information.

CVE-2019-19073, CVE-2019-19074

Navid Emamdoost discovered potential memory leaks in the ath9k and ath9k_htc drivers. The security impact of these is unclear.

CVE-2019-19448

'Team bobfuzzer' reported a bug in Btrfs that could lead to a use-after-free, and could be triggered by crafted filesystem images. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-12351

Andy Nguyen discovered a flaw in the Bluetooth implementation in the way L2CAP packets with A2MP CID are handled. A remote attacker within a short distance, knowing the victim's Bluetooth device address, can send a malicious l2cap packet and cause a denial of service or possibly arbitrary code execution with kernel privileges.

CVE-2020-12352

Andy Nguyen discovered a flaw in the Bluetooth implementation. Stack memory is not properly initialised when handling certain AMP packets.
A remote attacker within a short distance, knowing the victim's Bluetooth device address address, can retrieve kernel stack information.

CVE-2020-12655

Zheng Bin reported that crafted XFS volumes could trigger a system hang. An attacker able to mount such a volume could use this to cause a denial of service.

CVE-2020-12771

Zhiqiang Liu reported a bug in the bcache block driver that could lead to a system hang. The security impact of this is unclear.

CVE-2020-12888

It was discovered that the PCIe Virtual Function I/O (vfio-pci) driver allowed users to disable a device's memory space while it was still mapped into a process. On some hardware platforms, local users or guest virtual machines permitted to access PCIe Virtual Functions could use this to cause a denial of service (hardware error and crash).

CVE-2020-14305

Vasily Averin of Virtuozzo discovered a potential heap buffer overflow in the netfilter nf_contrack_h323 module. When this module is used to perform connection tracking for TCP/IPv6, a remote attacker could use this to cause a denial of service (crash or memory corruption) or possibly for remote code execution with kernel privilege.

CVE-2020-14314

A bug was discovered in the ext4 filesystem that could lead to an out-of-bound read. A local user permitted to mount and access arbitrary filesystem images could use this to cause a denial of service (crash).

CVE-2020-14331

A bug was discovered in the VGA console driver's soft-scrollback feature that could lead to a heap buffer overflow. On a system with a custom kernel that has CONFIG_VGACON_SOFT_SCROLLBACK enabled, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14356, CVE-2020-25220

A bug was discovered in the cgroup subsystem's handling of socket references to cgroups. In some cgroup configurations, this could lead to a use-after-free. A local user might be able to use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

The original fix for this bug introudced a new security issue, which is also addressed in this update.

CVE-2020-14386

Or Cohen discovered a bug in the packet socket (AF_PACKET) implementation which could lead to a heap buffer overflow. A local user with the CAP_NET_RAW capability (in any user namespace) could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14390

Minh Yuan discovered a bug in the framebuffer console driver's scrollback feature that could lead to a heap buffer overflow. On a system using framebuffer consoles, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

The scrollback feature has been disabled for now, as no other fix was available for this issue.

CVE-2020-15393

Kyungtae Kim reported a memory leak in the usbtest driver. The security impact of this is unclear.

CVE-2020-16166

Amit Klein reported that the random number generator used by the network stack might not be re-seeded for long periods of time, making e.g. client port number allocations more predictable. This made it easier for remote attackers to carry out some network- based attacks such as DNS cache poisoning or device tracking.

CVE-2020-24490

Andy Nguyen discovered a flaw in the Bluetooth implementation that can lead to a heap buffer overflow. On systems with a Bluetooth 5 hardware interface, a remote attacker within a short distance can use this to cause a denial of service (crash or memory corruption) or possibly for remote code execution with kernel privilege.

CVE-2020-25211

A flaw was discovered in netfilter subsystem. A local attacker able to inject conntrack Netlink configuration can cause a denial of service.

CVE-2020-25212

A bug was discovered in the NFSv4 client implementation that could lead to a heap buffer overflow. A malicious NFS server could use this to cause a denial of service (crash or memory corruption) or possibly to execute arbitrary code on the client.

CVE-2020-25284

It was discovered that the Rados block device (rbd) driver allowed tasks running as uid 0 to add and remove rbd devices, even if they dropped capabilities. On a system with the rbd driver loaded, this might allow privilege escalation from a container with a task running as root.

CVE-2020-25285

A race condition was discovered in the hugetlb filesystem's sysctl handlers, that could lead to stack corruption. A local user permitted to write to hugepages sysctls could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. By default only the root user can do this.

CVE-2020-25641

The syzbot tool found a bug in the block layer that could lead to an infinite loop. A local user with access to a raw block device could use this to cause a denial of service (unbounded CPU use and possible system hang).

CVE-2020-25643

ChenNan Of Chaitin Security Research Lab discovered a flaw in the hdlc_ppp module. Improper input validation in the ppp_cp_parse_cr() function may lead to memory corruption and information disclosure.

CVE-2020-26088

It was discovered that the NFC (Near Field Communication) socket implementation allowed any user to create raw sockets. On a system with an NFC interface, this allowed local users to evade local network security policy.

For Debian 9 stretch, these problems have been fixed in version 4.9.240-1. This update additionally includes many more bug fixes from stable updates 4.9.229-4.9.240 inclusive.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

CVE-2020-12351

Andy Nguyen discovered a flaw in the Bluetooth implementation in the way L2CAP packets with A2MP CID are handled. A remote attacker in short distance knowing the victim's Bluetooth device address can send a malicious l2cap packet and cause a denial of service or possibly arbitrary code execution with kernel privileges.

CVE-2020-12352

Andy Nguyen discovered a flaw in the Bluetooth implementation. Stack memory is not properly initialised when handling certain AMP packets.
A remote attacker in short distance knowing the victim's Bluetooth device address address can retrieve kernel stack information.

CVE-2020-25211

A flaw was discovered in netfilter subsystem. A local attacker able to inject conntrack Netlink configuration can cause a denial of service.

CVE-2020-25643

ChenNan Of Chaitin Security Research Lab discovered a flaw in the hdlc_ppp module. Improper input validation in the ppp_cp_parse_cr() function may lead to memory corruption and information disclosure.

CVE-2020-25645

A flaw was discovered in the interface driver for GENEVE encapsulated traffic when combined with IPsec. If IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel, tunneled data isn't correctly routed over the encrypted link and sent unencrypted instead.

For Debian 9 stretch, these problems have been fixed in version 4.19.152-1~deb9u1.

We recommend that you upgrade your linux-4.19 packages.

For the detailed security status of linux-4.19 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux-4.19

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
141544	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4592-1)	Nessus	Ubuntu Local Security Checks	10/20/2020	1/9/2024	high
141546	RHEL 7 : kernel-alt (RHSA-2020:4279)	Nessus	Red Hat Local Security Checks	10/20/2020	6/4/2024	high
141547	RHEL 7 : kernel (RHSA-2020:4277)	Nessus	Red Hat Local Security Checks	10/20/2020	6/3/2024	high
141548	RHEL 7 : kernel (RHSA-2020:4281)	Nessus	Red Hat Local Security Checks	10/20/2020	4/28/2024	high
141552	Debian DSA-4774-1 : linux - security update	Nessus	Debian Local Security Checks	10/20/2020	3/27/2024	high
141559	openSUSE Security Update : the Linux Kernel (openSUSE-2020-1698)	Nessus	SuSE Local Security Checks	10/20/2020	2/15/2024	high
141580	RHEL 8 : kernel (RHSA-2020:4287)	Nessus	Red Hat Local Security Checks	10/20/2020	6/4/2024	high
141628	RHEL 7 : kernel (RHSA-2020:4276)	Nessus	Red Hat Local Security Checks	10/20/2020	4/28/2024	high
142176	Debian DLA-2420-2 : linux regression update	Nessus	Debian Local Security Checks	11/2/2020	2/13/2024	high
142052	Debian DLA-2417-1 : linux-4.19 security update	Nessus	Debian Local Security Checks	10/29/2020	2/13/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high