The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2559-1 advisory.

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3876-1 advisory.

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local     escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. (CVE-2018-9517)

  - The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An     attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are     believed to be vulnerable. (CVE-2019-3874)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a     use after free. This could lead to local escalation of privilege with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-152735806 (CVE-2020-0429)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to     improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for     a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon     Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon     Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W,     MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

  - IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive     information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
    (CVE-2020-4788)

  - In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References:
    Upstream kernel (CVE-2021-0941)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a     reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2021-3542)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE) (CVE-2021-3656)

  - kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - kernel: overlayfs: Mounting overlayfs inside an unprivileged user namespace can reveal files     (CVE-2021-3732)

  - ccp - fix resource leaks in ccp_run_aes_gcm_cmd() [fedora-all] (CVE-2021-3744)

  - A flaw was found in the Linux kernel. When reusing a socket with an attached dccps_hc_tx_ccid as a     listener, the socket will be used after being released leading to denial of service (DoS) or a potential     code execution. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2020-16119) (CVE-2021-3753)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the     timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user     privileges to cause a denial of service, slowing and eventually stopping the system while running OSP. The     highest threat from this vulnerability is system availability. (CVE-2021-20317) (CVE-2021-3764)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel through 5.14.9 allows     unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds     write. (CVE-2021-41864)

  - The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab     out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
    (CVE-2021-42008)

  - An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux     kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite     memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a     certain comparison uses values that are not memory sizes. (CVE-2021-42252)

  - The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to     drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt     mishandles bounds checking. (CVE-2021-42739)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2731 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: size_t-to-int conversion vulnerability in the filesystem layer (CVE-2021-33909)

    * kernel: Use after free via PI futex state (CVE-2021-3347)

    * kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan (CVE-2021-33034)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2416-1 advisory.

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse     a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race     condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
    (CVE-2021-3609)

  - An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions     before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the     system or possibly escalate their privileges on the system. The highest threat from this vulnerability is     to confidentiality, integrity, as well as system availability. (CVE-2021-3612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2678-1 advisory.

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - A NULL pointer dereference flaw was found in the Linux kernel's IEEE 802.15.4 wireless networking     subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the     system. The highest threat from this vulnerability is to system availability. (CVE-2021-3659)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
152160	SUSE SLES15 Security Update : kernel (Live Patch 2 for SLE 15 SP3) (SUSE-SU-2021:2559-1)	Nessus	SuSE Local Security Checks	7/30/2021	12/6/2023	high
155824	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:3876-1)	Nessus	SuSE Local Security Checks	12/3/2021	12/5/2022	high
151843	RHEL 7 : kpatch-patch (RHSA-2021:2731)	Nessus	Red Hat Local Security Checks	7/21/2021	11/7/2024	high
151873	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2021:2416-1)	Nessus	SuSE Local Security Checks	7/21/2021	7/13/2023	high
152545	SUSE SLES15 Security Update : kernel (SUSE-SU-2021:2678-1)	Nessus	SuSE Local Security Checks	8/13/2021	7/13/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high