The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2020-28915: A buffer over-read (at the framebuffer     layer) in the fbcon code could be used by local     attackers to read kernel memory, aka CID-6735b4632def     (bnc#1178886).

  - CVE-2020-25669: A use-after-free in teardown paths of     sunkbd was fixed (bsc#1178182).

  - CVE-2020-25705: A flaw in the way reply ICMP packets are     limited in the Linux kernel functionality was found that     allowed to quickly scan open UDP ports. This flaw     allowed an off-path remote user to effectively bypassing     source port UDP randomization. The highest threat from     this vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions may be vulnerable to this issue     (bnc#1175721 bnc#1178782).

  - CVE-2020-25704: A a memory leak in     perf_event_parse_addr_filter() was foxed (bsc#1178393,     CVE-2020-25704).

The following non-security bugs were fixed :

  - ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).

  - bpf: Zero-fill re-used per-cpu map element (git-fixes).

  - can: af_can: prevent potential access of uninitialized     member in canfd_rcv() (git-fixes).

  - can: af_can: prevent potential access of uninitialized     member in can_rcv() (git-fixes).

  - can: dev: can_restart(): post buffer from the right     context (git-fixes).

  - can: m_can: m_can_handle_state_change(): fix state     change (git-fixes).

  - can: m_can: m_can_stop(): set device to software init     mode before closing (git-fixes).

  - can: mcba_usb: mcba_usb_start_xmit(): first fill skb,     then pass to can_put_echo_skb() (git-fixes).

  - can: peak_usb: fix potential integer overflow on shift     of a int (git-fixes).

  - docs: ABI: sysfs-c2port: remove a duplicated entry     (git-fixes).

  - drbd: code cleanup by using sendpage_ok() to check page     for kernel_sendpage() (bsc#1172873).

  - drm/i915: Break up error capture compression loops with     cond_resched() (git-fixes).

  - drm/vc4: drv: Add error handding for bind (git-fixes).

  - Drop sysctl files for dropped archs, add ppc64le and     arm64 (bsc#1178838). Also fix the ppc64 page size.

  - fs/proc/array.c: allow reporting eip/esp for all     coredumping threads (bsc#1050549).

  - ftrace: Fix recursion check for NMI test (git-fixes).

  - ftrace: Handle tracing when switching between context     (git-fixes).

  - futex: Do not enable IRQs unconditionally in     put_pi_state() (bsc#1067665).

  - futex: Handle transient 'ownerless' rtmutex state     correctly (bsc#1067665).

  - hv_netvsc: Add XDP support (bsc#1177819, bsc#1177820).

  - hv_netvsc: deal with bpf API differences in 4.12     (bsc#1177819, bsc#1177820).

  - hv_netvsc: Fix XDP refcnt for synthetic and VF NICs     (bsc#1177819, bsc#1177820).

  - hv_netvsc: make recording RSS hash depend on feature     flag (bsc#1178853, bsc#1178854).

  - hv_netvsc: record hardware hash in skb (bsc#1178853,     bsc#1178854).

  - hyperv_fb: Update screen_info after removing old     framebuffer (bsc#1175306).

  - inet_diag: Fix error path to cancel the meseage in     inet_req_diag_fill() (git-fixes).

  - Input: adxl34x - clean up a data type in adxl34x_probe()     (git-fixes).

  - kthread_worker: prevent queuing delayed work from     timer_fn when it is being canceled (git-fixes).

  - libceph: use sendpage_ok() in ceph_tcp_sendpage()     (bsc#1172873).

  - locking/lockdep: Add debug_locks check in
    __lock_downgrade() (bsc#1050549).

  - locking/percpu-rwsem: Use this_cpu_(inc,dec)() for     read_count (bsc#1050549).

  - locktorture: Print ratio of acquisitions, not failures     (bsc#1050549).

  - mac80211: minstrel: fix tx status processing corner case     (git-fixes).

  - mac80211: minstrel: remove deferred sampling code     (git-fixes).

  - memcg: fix NULL pointer dereference in
    __mem_cgroup_usage_unregister_event (bsc#1177703).

  - mmc: sdhci-of-esdhc: Handle pulse width detection     erratum for more SoCs (git-fixes).

  - mm/memcg: fix refcount error while moving and swapping     (bsc#1178686).

  - net: add WARN_ONCE in kernel_sendpage() for improper     zero-copy send (bsc#1172873).

  - net: ena: Capitalize all log strings and improve code     readability (bsc#1177397).

  - net: ena: Change license into format to SPDX in all     files (bsc#1177397).

  - net: ena: Change log message to netif/dev function     (bsc#1177397).

  - net: ena: Change RSS related macros and variables names     (bsc#1177397).

  - net: ena: ethtool: Add new device statistics     (bsc#1177397).

  - net: ena: ethtool: add stats printing to XDP queues     (bsc#1177397).

  - net: ena: ethtool: convert stat_offset to 64 bit     resolution (bsc#1177397).

  - net: ena: Fix all static chekers' warnings     (bsc#1177397).

  - net: ena: Remove redundant print of placement policy     (bsc#1177397).

  - net: ena: xdp: add queue counters for xdp actions     (bsc#1177397).

  - netfilter: nat: can't use dst_hold on noref dst     (bsc#1178878).

  - net: introduce helper sendpage_ok() in     include/linux/net.h (bsc#1172873). kABI workaround for     including mm.h in include/linux/net.h (bsc#1172873).

  - net/mlx4_core: Fix init_hca fields offset (git-fixes).

  - net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition     (git-fixes).

  - NFSv4.1: fix handling of backchannel binding in     BIND_CONN_TO_SESSION (bsc#1170630).

  - nvme-tcp: check page by sendpage_ok() before calling     kernel_sendpage() (bsc#1172873).

  - pinctrl: intel: Set default bias in case no particular     value given (git-fixes).

  - powerpc/pseries/cpuidle: add polling idle for shared     processor guests (bsc#1178765 ltc#188968).

  - powerpc/vnic: Extend 'failover pending' window     (bsc#1176855 ltc#187293).

  - powerpc/vnic: Extend 'failover pending' window     (bsc#1176855 ltc#187293).

  - regulator: avoid resolve_supply() infinite recursion     (git-fixes).

  - regulator: fix memory leak with repeated     set_machine_constraints() (git-fixes).

  - regulator: ti-abb: Fix array out of bound read access on     the first transition (git-fixes).

  - regulator: workaround self-referent regulators     (git-fixes).

  - Revert 'cdc-acm: hardening against malicious devices'     (git-fixes).

  - ring-buffer: Fix recursion protection transitions     between interrupt context (git-fixes).

  - scsi: libiscsi: use sendpage_ok() in     iscsi_tcp_segment_map() (bsc#1172873).

  - scsi: lpfc: Fix initial FLOGI failure due to BBSCN not     supported (git-fixes).

  - thunderbolt: Add the missed ida_simple_remove() in     ring_request_msix() (git-fixes).

  - time: Prevent undefined behaviour in timespec64_to_ns()     (git-fixes).

  - USB: Add NO_LPM quirk for Kingston flash drive     (git-fixes).

  - usb: core: driver: fix stray tabs in error messages     (git-fixes).

  - usb: host: ehci-tegra: Fix error handling in     tegra_ehci_probe() (git-fixes).

  - USB: serial: cyberjack: fix write-URB completion race     (git-fixes).

  - USB: serial: ftdi_sio: add support for FreeCalypso     JTAG+UART adapters (git-fixes).

  - USB: serial: option: add Cellient MPL200 card     (git-fixes).

  - USB: serial: option: add LE910Cx compositions 0x1203,     0x1230, 0x1231 (git-fixes).

  - USB: serial: option: add Quectel EC200T module support     (git-fixes).

  - USB: serial: option: add Telit FN980 composition 0x1055     (git-fixes).

  - USB: serial: option: Add Telit FT980-KS composition     (git-fixes).

  - USB: serial: pl2303: add device-id for HP GC device     (git-fixes).

  - video: hyperv: hyperv_fb: Obtain screen resolution from     Hyper-V host (bsc#1175306).

  - video: hyperv: hyperv_fb: Support deferred IO for     Hyper-V frame buffer driver (bsc#1175306).

  - video: hyperv: hyperv_fb: Use physical memory for fb on     HyperV Gen 1 VMs (bsc#1175306).

  - vt: Disable KD_FONT_OP_COPY (bsc#1178589).

  - x86/kexec: Use up-to-dated screen_info copy to fill boot     params (bsc#1175306).

  - xfs: fix a missing unlock on error in xfs_fs_map_blocks     (git-fixes).

  - xfs: fix flags argument to rmap lookup when converting     shared file rmaps (git-fixes).

  - xfs: fix rmap key and record comparison functions     (git-fixes).

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9007 advisory.

    - xen-blkback: set ring->xenblkd to NULL after kthread_stop() (Pawel Wieczorkiewicz)  [Orabug: 32260252]     {CVE-2020-29569}
    - xenbus/xenbus_backend: Disallow pending watch messages (SeongJae Park)  [Orabug: 32253409]     {CVE-2020-29568}
    - xen/xenbus: Count pending messages for each watch (SeongJae Park)  [Orabug: 32253409]  {CVE-2020-29568}
    - xen/xenbus/xen_bus_type: Support will_handle watch callback (SeongJae Park)  [Orabug: 32253409]     {CVE-2020-29568}
    - xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() (SeongJae Park)  [Orabug:
    32253409]  {CVE-2020-29568}
    - xen/xenbus: Allow watches discard events before queueing (SeongJae Park)  [Orabug: 32253409]     {CVE-2020-29568}
    - target: fix XCOPY NAA identifier lookup (David Disseldorp)  [Orabug: 32248035]  {CVE-2020-28374}
    - futex: Fix inode life-time issue (Peter Zijlstra)  [Orabug: 32233515]  {CVE-2020-14381}
    - perf/core: Fix race in the perf_mmap_close() function (Jiri Olsa)  [Orabug: 32233352]  {CVE-2020-14351}
    - icmp: randomize the global rate limiter (Eric Dumazet)  [Orabug: 32227958]  {CVE-2020-25705}
    - vt: Disable KD_FONT_OP_COPY (Daniel Vetter)  [Orabug: 32187738]  {CVE-2020-28974}
    - Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts (Peilin Ye)  [Orabug: 32176254]     {CVE-2020-28915}
    - fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h (Peilin Ye)  [Orabug: 32176254]     {CVE-2020-28915}
    - xen/events: block rogue events for some time (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/events: defer eoi in case of excessive number of events (Juergen Gross)  [Orabug: 32177535]     {CVE-2020-27673}
    - xen/events: use a common cpu hotplug hook for event channels (Juergen Gross)  [Orabug: 32177535]     {CVE-2020-27673}
    - xen/events: switch user event channels to lateeoi model (Juergen Gross)  [Orabug: 32177535]     {CVE-2020-27673}
    - xen/pciback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/pvcallsback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/scsiback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/netback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/blkback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/events: add a new 'late EOI' evtchn framework (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/events: fix race in evtchn_fifo_unmask() (Juergen Gross)  [Orabug: 32177535]  {CVE-2020-27673}
    - xen/events: add a proper barrier to 2-level uevent unmasking (Juergen Gross)  [Orabug: 32177535]     {CVE-2020-27673}
    - perf/core: Fix a memory leak in perf_event_parse_addr_filter() (kiyin())  [Orabug: 32131172]     {CVE-2020-25704}
    - vt: keyboard, extend func_buf_lock to readers (Jiri Slaby)  [Orabug: 32122948]  {CVE-2020-25656}
    - vt: keyboard, simplify vt_kdgkbsent (Jiri Slaby)  [Orabug: 32122948]  {CVE-2020-25656}
    - tty: make FONTX ioctl use the tty pointer they were actually passed (Linus Torvalds)  [Orabug: 32122725]     {CVE-2020-25668}
    - Bluetooth: A2MP: Fix not initializing all members (Luiz Augusto von Dentz)  [Orabug: 32021285]     {CVE-2020-12352}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0686 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bad kfree in auditfilter.c may lead to escalation of privilege (CVE-2020-0444)

    * kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661)

    * kernel: performance counters race condition use-after-free (CVE-2020-14351)

    * kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [Hyper-V][RHEL-8] Request to included a commit that adds a timeout to vmbus_wait_for_unload (BZ#1913530)

    * [CKI kernel builds]: x86 binaries in non-x86 kernel rpms breaks systemtap (BZ#1929908)

    * rpmbuild cannot build the userspace RPMs in the kernel package when the kernel itself is not built     (BZ#1929912)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2355 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362)

    * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c     (CVE-2020-25211)

    * kernel: malicious USB devices can lead to multiple out-of-bounds write (CVE-2019-19532)

    * kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * memcg: mem_cgroup_idr can be updated in an uncoordinated manner which can lead to corruption     (BZ#1931901)

    * Kernel experiences panic in update_group_power() due to division error even with Bug 1701115 fix     (BZ#1961624)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw     allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that     relies on UDP source port randomization are indirectly affected as well on the Linux Based Products     (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4,     SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE     W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All     versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7     LTE EU: Version (CVE-2020-25705)

Note that Nessus relies on the presence of the package as reported by the vendor.

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2017-18204: Fixed a denial of service in the ocfs2_setattr function of fs/ocfs2/file.c (bnc#1083244).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).

CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c,     there is a possible use after free due to a logic     error. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel(CVE-2020-0466)

  - In the l2tp subsystem, there is a possible use after     free due to a race condition. This could lead to local     escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-152409173(CVE-2020-27067)

  - In the nl80211_policy policy of nl80211.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with System execution privileges needed. User     interaction is not required for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-119770583(CVE-2020-27068)

  - In audit_free_lsm_field of auditfilter.c, there is a     possible bad kfree due to a logic error in     audit_data_to_entry. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-150693166References: Upstream     kernel(CVE-2020-0444)

  - In various methods of hid-multitouch.c, there is a     possible out of bounds write due to a missing bounds     check. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-162844689References: Upstream kernel(CVE-2020-0465)

  - Use-after-free vulnerability in fs/block_dev.c in the     Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging     improper access to a certain error     field.(CVE-2020-15436)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

  - A flaw was found in the Linux kernels implementation of     MIDI, where an attacker with a local account and the     permissions to issue an ioctl commands to midi devices,     could trigger a use-after-free. A write to this     specific memory while freed and before use could cause     the flow of execution to change and possibly allow for     memory corruption or privilege     escalation.(CVE-2020-27786)

  - No description is available for this     CVE.(CVE-2020-27815)

  - NULL-ptr deref in the spk_ttyio_receive_buf2() function     in spk_ttyio.c(CVE-2020-27830)

  - An issue was discovered in __split_huge_pmd in     mm/huge_memory.c in the Linux kernel before 5.7.5. The     copy-on-write implementation can grant unintended write     access because of a race condition in a THP mapcount     check, aka CID-c444eb564fb1.(CVE-2020-29368)

  - An issue was discovered in kmem_cache_alloc_bulk in     mm/slub.c in the Linux kernel before 5.5.11. The     slowpath lacks the required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - A locking issue was discovered in the tty subsystem of     the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free     attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high     rate of events to dom0, aka     CID-e99502f76271.(CVE-2020-27673)

  - An issue was discovered in     drivers/accessibility/speakup/spk_ttyio.c in the Linux     kernel through 5.9.9. Local attackers on systems with     the speakup driver could cause a local denial of     service attack, aka CID-d41227544427. This occurs     because of an invalid free when the line discipline is     used more than once.(CVE-2020-28941)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - A flaw was found in the Linux kernel. A use-after-free     memory flaw was found in the perf subsystem allowing a     local attacker with permission to monitor perf events     to corrupt memory and possibly escalate privileges. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)

  - A flaw in the way reply ICMP packets are limited in the     Linux kernel functionality was found that allows to     quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypassing source     port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)

  - No description is available for this     CVE.(CVE-2020-25668)

  - No description is available for this     CVE.(CVE-2020-25669)

  - A flaw was found in the way RTAS handled memory     accesses in userspace to kernel communication. On a     locked down (usually due to Secure Boot) guest system     running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to     further increase their privileges to that of a running     kernel.(CVE-2020-27777)

  - kernel: perf_event_parse_addr_filter     memory(CVE-2020-25704)

  - Insufficient access control in the Linux kernel driver     for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via     local access.(CVE-2020-8694)

  - A flaw was found in the Linux kernel. A use-after-free     was found in the way the console subsystem was using     ioctls KDGKBSENT and KDSKBSENT. A local user could use     this flaw to get read memory access out of bounds. The     highest threat from this vulnerability is to data     confidentiality.(CVE-2020-25656)

  - In kbd_keycode of keyboard.c, there is a possible out     of bounds write due to a missing bounds check. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-144161459(CVE-2020-0431)

  - A flaw was found in the HDLC_PPP module of the Linux     kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input     validation in the ppp_cp_parse_cr function which can     cause the system to crash or cause a denial of service.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25643)

  - A flaw was found in the Linux kernel in versions before     5.9-rc7. Traffic between two Geneve endpoints may be     unencrypted when IPsec is configured to encrypt traffic     for the specific UDP port used by the GENEVE tunnel     allowing anyone between the two endpoints to read the     traffic unencrypted. The main threat from this     vulnerability is to data     confidentiality.(CVE-2020-25645)

  - Vulnerability Summary for     CVE-2020-12351(CVE-2020-12351)

  - Vulnerability Summary for     CVE-2020-12352(CVE-2020-12352)

  - Vulnerability Summary for     CVE-2020-24490(CVE-2020-24490)

  - A missing CAP_NET_RAW check in NFC socket creation in     net/nfc/rawsock.c in the Linux kernel before 5.8.2     could be used by local attackers to create raw sockets,     bypassing security mechanisms, aka     CID-26896f01467a.(CVE-2020-26088)

  - A flaw was found in the Linux kernel's implementation     of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could     cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker     with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest     threat from this vulnerability is to system     availability.(CVE-2020-25641)

  - In skb_to_mamac of networking.c, there is a possible     out of bounds write due to an integer overflow. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-143560807(CVE-2020-0432)

  - A race condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)

  - A flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)

  - A flaw was found in the Linux kernel before 5.9-rc4.
    Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest     threat from this vulnerability is to data     confidentiality and integrity.(CVE-2020-14386)

  - Insufficient input validation in i40e driver for     Intel(R) Ethernet 700 Series Controllers versions     before 7.0 may allow an authenticated user to     potentially enable a denial of service via local     access.(CVE-2019-0147)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)

  - A flaw was found in the Linux kernel before 5.9-rc4. A     failure of the file system metadata validator in XFS     can cause an inode with a valid, user-creatable     extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise     rendered inaccessible until it is remounted, leading to     a denial of service. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14385)

  - In uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel(CVE-2020-0404)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - A memory out-of-bounds read flaw was found in the Linux     kernel before 5.9-rc2 with the ext3/ext4 file system,     in the way it accesses a directory with broken     indexing. This flaw allows a local user to crash the     system if the directory exists. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14314)

  - A flaw null pointer dereference in the Linux kernel     cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could     use this flaw to crash the system or escalate their     privileges on the system.(CVE-2020-24394)

  - A flaw was found in the Linux kernel's implementation     of the invert video code on VGA consoles when a local     attacker attempts to resize the console, calling an     ioctl VT_RESIZE, which causes an out-of-bounds write to     occur. This flaw allows a local user with access to the     VGA console to crash the system, potentially escalating     their privileges on the system. The highest threat from     this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-14331)

  - The Linux kernel, as used in Red Hat Enterprise Linux     7, kernel-rt, and Enterprise MRG 2 and when booted with     UEFI Secure Boot enabled, allows local users to bypass     intended securelevel/secureboot restrictions by     leveraging improper handling of secure_boot flag across     kexec reboot.(CVE-2015-7837)

  - In the Linux kernel through 5.8.7, local attackers able     to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering     use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in     net/netfilter/nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)

  - A flaw null pointer dereference in the Linux kernel     cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could     use this flaw to crash the system or escalate their     privileges on the system.(CVE-2020-14356)

  - Buffer overflow in i40e driver for Intel(R) Ethernet     700 Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2019-0145)

  - The Linux kernel through 5.7.11 allows remote attackers     to make observations that help to obtain sensitive     information about the internal state of the network     RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)

  - The VFIO PCI driver in the Linux kernel through 5.6.13     mishandles attempts to access disabled memory     space.(CVE-2020-12888)

  - In the Linux kernel through 5.7.6, usbtest_disconnect     in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)

  - A logic bug was found in the Linux kernels     implementation of SSBD. A bug in the logic handling can     allow an attacker with a local account to disable SSBD     protection during a context switch when additional     speculative execution mitigations are in     place.(CVE-2020-10766)

  - The prctl() function can be used to enable indirect     branch speculation even after it has been disabled.
    This same call will incorrectly report it being 'force     disabled' when it is not.(CVE-2020-10768)

  - A flaw was found in the Linux kernel's implementation     of the Enhanced IBPB (Indirect Branch Prediction     Barrier). The IBPB mitigation will be disabled when     STIBP is not available or when the Enhanced Indirect     Branch Restricted Speculation (IBRS) is available. This     flaw allows a local attacker to perform a Spectre V2     style attack when this configuration is active. The     highest threat from this vulnerability is to     confidentiality.(CVE-2020-10767)

  - A flaw was found in the ZRAM kernel module, where a     user with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)

  - A flaw was found in the Linux kernel. An index buffer     overflow during Direct IO write leading to the NFS     client to crash. In some cases, a reach out of the     index after one memory allocation by kmalloc will cause     a kernel panic. The highest threat from this     vulnerability is to data confidentiality and system     availability.(CVE-2020-10742)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In do_epoll_ctl and     ep_loop_check_proc of eventpoll.c, there is a possible     use after free due to a logic error. This could lead to     local escalation of privilege with no additional     execution privileges needed.(CVE-2020-0466)In the l2tp     subsystem, there is a possible use after free due to a     race condition. This could lead to local escalation of     privilege with System execution privileges     needed.(CVE-2020-27067)In the nl80211_policy policy of     nl80211.c, there is a possible out of bounds read due     to a missing bounds check. This could lead to local     information disclosure with System execution privileges     needed.(CVE-2020-27068)In audit_free_lsm_field of     auditfilter.c, there is a possible bad kfree due to a     logic error in audit_data_to_entry. This could lead to     local escalation of privilege with no additional     execution privileges needed.(CVE-2020-0444)In various     methods of hid-multitouch.c, there is a possible out of     bounds write due to a missing bounds check. This could     lead to local escalation of privilege with no     additional execution privileges     needed.(CVE-2020-0465)Use-after-free vulnerability in     fs/block_dev.c in the Linux kernel before 5.8 allows     local users to gain privileges or cause a denial of     service by leveraging improper access to a certain     error field.(CVE-2020-15436)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)A flaw was found in the     Linux kernels implementation of MIDI, where an attacker     with a local account and the permissions to issue an     ioctl commands to midi devices, could trigger a     use-after-free. A write to this specific memory while     freed and before use could cause the flow of execution     to change and possibly allow for memory corruption or     privilege escalation.(CVE-2020-27786)Array index out of     bounds access when setting extended attributes on     journaling filesystems.(CVE-2020-27815)NULL-ptr deref     in the spk_ttyio_receive_buf2() function in     spk_ttyio.c(CVE-2020-27830)An issue was discovered in
    __split_huge_pmd in mm/huge_memory.c in the Linux     kernel before 5.7.5. The copy-on-write implementation     can grant unintended write access because of a race     condition in a THP mapcount check, aka     CID-c444eb564fb1.(CVE-2020-29368)An issue was     discovered in kmem_cache_alloc_bulk in mm/slub.c in the     Linux kernel before 5.5.11. The slowpath lacks the     required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)A locking     inconsistency issue was discovered in the tty subsystem     of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)A locking issue was     discovered in the tty subsystem of the Linux kernel     through 5.9.13. drivers/tty/tty_jobctrl.c allows a     use-after-free attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)A slab-out-of-bounds     read in fbcon in the Linux kernel before 5.9.7 could be     used by local attackers to read privileged information     or potentially crash the kernel, aka CID-3c4e0dff2095.
    This occurs because KD_FONT_OP_COPY in     drivers/tty/vt/vt.c can be used for manipulations such     as font height.(CVE-2020-28974) An issue was discovered     in the Linux kernel through 5.9.1, as used with Xen     through 4.14.x. Guest OS users can cause a denial of     service (host OS hang) via a high rate of events to     dom0, aka CID-e99502f76271.(CVE-2020-27673)An issue was     discovered in drivers/accessibility/speakup/spk_ttyio.c     in the Linux kernel through 5.9.9. Local attackers on     systems with the speakup driver could cause a local     denial of service attack, aka CID-d41227544427. This     occurs because of an invalid free when the line     discipline is used more than once.(CVE-2020-28941)An     issue was discovered in the Linux kernel through 5.9.1,     as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)A buffer     over-read (at the framebuffer layer) in the fbcon code     in the Linux kernel before 5.8.15 could be used by     local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)A flaw was found in     the Linux kernel. A use-after-free memory flaw was     found in the perf subsystem allowing a local attacker     with permission to monitor perf events to corrupt     memory and possibly escalate privileges. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)A flaw in the way reply     ICMP packets are limited in the Linux kernel     functionality was found that allows to quickly scan     open UDP ports. This flaw allows an off-path remote     user to effectively bypassing source port UDP     randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)race condition in fg_console can     lead to use-after-free in     con_font_op.(CVE-2020-25668)use-after-free read in     sunkbd_reinit in     drivers/input/keyboard/sunkbd.c.(CVE-2020-25669)A flaw     was found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

CVE-2020-0427

Elena Petrova reported a bug in the pinctrl subsystem that can lead to a use-after-free after a device is renamed. The security impact of this is unclear.

CVE-2020-8694

Multiple researchers discovered that the powercap subsystem allowed all users to read CPU energy meters, by default. On systems using Intel CPUs, this provided a side channel that could leak sensitive information between user processes, or from the kernel to user processes. The energy meters are now readable only by root, by default.

This issue can be mitigated by running :

chmod go-r /sys/devices/virtual/powercap/*/*/energy_uj

This needs to be repeated each time the system is booted with an unfixed kernel version.

CVE-2020-14351

A race condition was discovered in the performance events subsystem, which could lead to a use-after-free. A local user permitted to access performance events could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2020-25645

A flaw was discovered in the interface driver for GENEVE encapsulated traffic when combined with IPsec. If IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel, tunneled data isn't correctly routed over the encrypted link and sent unencrypted instead.

CVE-2020-25656

Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with the CAP_SYS_TTY_CONFIG capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25668

Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25669

Bodong Zhao discovered a bug in the Sun keyboard driver (sunkbd) that could lead to a use-after-free. On a system using this driver, a local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-25704

kiyin(&#x5C39;&#x4EAE;) discovered a potential memory leak in the performance events subsystem. A local user permitted to access performance events could use this to cause a denial of service (memory exhaustion).

Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.

CVE-2020-25705

Keyu Man reported that strict rate-limiting of ICMP packet transmission provided a side-channel that could help networked attackers to carry out packet spoofing. In particular, this made it practical for off-path networked attackers to 'poison' DNS caches with spoofed responses ('SAD DNS' attack).

This issue has been mitigated by randomising whether packets are counted against the rate limit.

CVE-2020-27673 / XSA-332

Julien Grall from Arm discovered a bug in the Xen event handling code.
Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (excessive CPU usage or hang) in dom0.

CVE-2020-27675 / XSA-331

Jinoh Kang of Theori discovered a race condition in the Xen event handling code. Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (crash) in dom0.

CVE-2020-28974

Yuan Ming discovered a bug in the virtual terminal (vt) driver that could lead to an out-of-bounds read. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could possibly use this to obtain sensitive information from the kernel or to cause a denial of service (crash).

The specific ioctl operation affected by this bug (KD_FONT_OP_COPY) has been disabled, as it is not believed that any programs depended on it.

For Debian 9 stretch, these problems have been fixed in version 4.9.246-2.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).

CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).

CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The version of AOS installed on the remote host is prior to 5.15.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.6 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.20. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
143314	openSUSE Security Update : the Linux Kernel (openSUSE-2020-2034)	Nessus	SuSE Local Security Checks	11/30/2020	2/7/2024	high
144906	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9007)	Nessus	Oracle Linux Local Security Checks	1/13/2021	10/22/2024	high
147011	RHEL 8 : kernel (RHSA-2021:0686)	Nessus	Red Hat Local Security Checks	3/3/2021	11/7/2024	high
150422	RHEL 7 : kernel (RHSA-2021:2355)	Nessus	Red Hat Local Security Checks	6/9/2021	11/7/2024	high
229948	Linux Distros Unpatched Vulnerability : CVE-2020-25705	Nessus	Misc.	3/5/2025	3/6/2025	high
143654	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3501-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	high
147512	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2021-1604)	Nessus	Huawei Local Security Checks	3/10/2021	2/9/2023	critical
144313	openSUSE Security Update : the Linux Kernel (openSUSE-2020-2260)	Nessus	SuSE Local Security Checks	12/16/2020	2/1/2024	high
144693	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-1028)	Nessus	Huawei Local Security Checks	1/4/2021	2/9/2023	critical
144494	Debian DLA-2494-1 : linux security update	Nessus	Debian Local Security Checks	12/21/2020	1/31/2024	high
143802	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:3513-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	high
143065	Photon OS 1.0: Linux PHSA-2020-1.0-0338	Nessus	PhotonOS Local Security Checks	11/19/2020	7/23/2024	high
164567	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.6)	Nessus	Misc.	9/1/2022	2/19/2025	medium
164557	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20)	Nessus	Misc.	9/1/2022	2/17/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

high

critical

high

high

high

medium

critical