A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() function.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive     information via vgacon_invert_region() function. (CVE-2020-27418)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.4.38-17.76. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-011 advisory.

    In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function     (related to include/trace/events/lock.h). (CVE-2019-19769)

    A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem. This flaw occurs while     importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible     bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the     system kernel, resulting in a denial of service. (CVE-2020-10711)

    A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive     information via vgacon_invert_region() function. (CVE-2020-27418)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: keep alloc_hash updated after hash allocation (CVE-2020-36791)

    An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It     ignores the top byte in the address passed to the brk system call, potentially moving the memory break     downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to     cause heap corruption with the GNU C Library malloc implementation. (CVE-2020-9391)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.173-106.229. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1360 advisory.

    2023-11-29: CVE-2020-27418 was added to this advisory.

    A stack buffer overflow issue was found in the get_raw_socket() routine of the Host kernel accelerator for     virtio net (vhost-net) driver. It could occur while doing an ictol(VHOST_NET_SET_BACKEND) call, and     retrieving socket name in a kernel stack variable via get_raw_socket(). A user able to perform ioctl(2)     calls on the '/dev/vhost-net' device may use this flaw to crash the kernel resulting in DoS issue.
    (CVE-2020-10942)

    A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1)     virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into     accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to potentially access     information of the L1 hypervisor. (CVE-2020-2732)

    A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive     information via vgacon_invert_region() function. (CVE-2020-27418)

    A use-after-free flaw was found in the Linux kernel console driver when using the copy-paste buffer. This     flaw allows a local user  to crash the system. (CVE-2020-8648)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.173-137.228. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1405 advisory.

    2023-11-29: CVE-2020-27418 was added to this advisory.

    A stack buffer overflow issue was found in the get_raw_socket() routine of the Host kernel accelerator for     virtio net (vhost-net) driver. It could occur while doing an ictol(VHOST_NET_SET_BACKEND) call, and     retrieving socket name in a kernel stack variable via get_raw_socket(). A user able to perform ioctl(2)     calls on the '/dev/vhost-net' device may use this flaw to crash the kernel resulting in DoS issue.
    (CVE-2020-10942)

    A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1)     virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into     accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to potentially access     information of the L1 hypervisor. (CVE-2020-2732)

    A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive     information via vgacon_invert_region() function. (CVE-2020-27418)

    A use-after-free flaw was found in the Linux kernel console driver when using the copy-paste buffer. This     flaw allows a local user  to crash the system. (CVE-2020-8648)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
248584	Linux Distros Unpatched Vulnerability : CVE-2020-27418	Nessus	Misc.	medium
160458	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-011)	Nessus	Amazon Linux Local Security Checks	high
135936	Amazon Linux AMI : kernel (ALAS-2020-1360)	Nessus	Amazon Linux Local Security Checks	high
134896	Amazon Linux 2 : kernel (ALAS-2020-1405)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2020-27418

medium

Tenable Plugins

medium

high

high

high