The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32     architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead     to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in
    __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.
    (CVE-2019-6488)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202006-04 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The glibc package contains standard libraries which are     used by multiple programs on the system. In order to     save disk space and memory, as well as to make     upgrading easier, common system code is kept in one     place and shared between programs. This particular     package contains the most important sets of shared     libraries: the standard C library and the standard math     library. Without these two libraries, a Linux system     will not function.Security Fix(es):The string component     in the GNU C Library (aka glibc or libc6) through 2.28,     when running on the x32 architecture, incorrectly     attempts to use a 64-bit register for size_t in     assembly codes, which can lead to a segmentation fault     or possibly unspecified other impact, as demonstrated     by a crash in __memmove_avx_unaligned_erms in     sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S     during a memcpy.(CVE-2019-6488)** DISPUTED ** In the     GNU C Library (aka glibc or libc6) through 2.29,     check_dst_limits_calc_pos_1 in posix/regexec.c has     Uncontrolled Recursion, as demonstrated by     '(|)(\\1\\1)*' in grep, a different issue than     CVE-2018-20796. NOTE: the software maintainer disputes     that this is a vulnerability because the behavior     occurs only with a crafted pattern.(CVE-2019-9192)In     the GNU C Library (aka glibc or libc6) through 2.29,     check_dst_limits_calc_pos_1 in posix/regexec.c has     Uncontrolled Recursion, as demonstrated by     '(\227|)(\\1\\1|t1|\\\2537)+' in     grep.(CVE-2018-20796)The GNU C Library (aka glibc or     libc6) before 2.32 could overflow an on-stack buffer     during range reduction if an input to an 80-bit long     double function contains a non-canonical bit pattern, a     seen when passing a 0x5d414141414141410000 value to     sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.(CVE-2020-10029)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In the GNU C Library (aka glibc or libc6) through 2.28,     the getaddrinfo function would successfully parse a     string that contained an IPv4 address followed by     whitespace and arbitrary characters, which could lead     applications to incorrectly assume that it had parsed a     valid string, without the possibility of embedded HTTP     headers or other potentially dangerous     substrings.(CVE-2016-10739)

  - On the x86-64 architecture, the GNU C Library (aka     glibc) before 2.31 fails to ignore the     LD_PREFER_MAP_32BIT_EXEC environment variable during     program execution after a security transition, allowing     local attackers to restrict the possible mapping     addresses for loaded libraries and thus bypass ASLR for     a setuid program.(CVE-2019-19126)

  - The string component in the GNU C Library (aka glibc or     libc6) through 2.28, when running on the x32     architecture, incorrectly attempts to use a 64-bit     register for size_t in assembly codes, which can lead     to a segmentation fault or possibly unspecified other     impact, as demonstrated by a crash in
    __memmove_avx_unaligned_erms in     sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S     during a memcpy.(CVE-2019-6488)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The string component in the GNU C Library (aka glibc or     libc6) through 2.28, when running on the x32     architecture, incorrectly attempts to use a 64-bit     register for size_t in assembly codes, which can lead     to a segmentation fault or possibly unspecified other     impact, as demonstrated by a crash in
    __memmove_avx_unaligned_erms in     sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S     during a memcpy.(CVE-2019-6488)

  - On the x86-64 architecture, the GNU C Library (aka     glibc) before 2.31 fails to ignore the     LD_PREFER_MAP_32BIT_EXEC environment variable during     program execution after a security transition, allowing     local attackers to restrict the possible mapping     addresses for loaded libraries and thus bypass ASLR for     a setuid program.(CVE-2019-19126)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
248349	Linux Distros Unpatched Vulnerability : CVE-2019-6488	Nessus	Misc.	high
137441	GLSA-202006-04 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
136217	EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2020-1514)	Nessus	Huawei Local Security Checks	high
132795	EulerOS Virtualization for ARM 64 3.0.5.0 : glibc (EulerOS-SA-2020-1041)	Nessus	Huawei Local Security Checks	high
132600	EulerOS 2.0 SP8 : glibc (EulerOS-SA-2020-1007)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2019-6488

high

Tenable Plugins

high

critical

high

high

high