An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The     get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider     the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
    (CVE-2020-29374)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5096 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's     virtual memory management. A parent and child process initially share all their memory, but when either     writes to a shared page, the page is duplicated and unshared (copy-on-write). However, in case an     operation such as vmsplice() required the kernel to take an additional reference to a shared page, and a     copy-on-write occurs during this operation, the kernel might have accessed the wrong process's memory. For     some programs, this could lead to an information leak or data corruption. This issue was already fixed for     most architectures, but not on MIPS and System z. This update corrects that. CVE-2020-36322,     CVE-2021-28950 The syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not     correctly handle a FUSE server returning invalid attributes for a file. A local user permitted to run a     FUSE server could use this to cause a denial of service (crash). The original fix for this introduced a     different potential denial of service (infinite loop in kernel space), which has also been fixed.
    CVE-2021-3640 Lin Ma discovered a race condiiton in the Bluetooth protocol implementation that can lead to     a use-after-free. A local user could exploit this to cause a denial of service (memory corruption or     crash) or possibly for privilege escalation. CVE-2021-3744, CVE-2021-3764 minihanshen reported bugs in the     ccp driver for AMD Cryptographic Coprocessors that could lead to a resource leak. On systems using this     driver, a local user could exploit this to cause a denial of service. CVE-2021-3752 Likang Luo of NSFOCUS     Security Team discovered a flaw in the Bluetooth L2CAP implementation that can lead to a user-after-free.
    A local user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-3760, CVE-2021-4202 Lin Ma discovered race conditions in the NCI (NFC     Controller Interface) driver, which could lead to a use-after-free. A local user could exploit this to     cause a denial of service (memory corruption or crash) or possibly for privilege escalation. This driver     is not enabled in Debian's official kernel configurations. CVE-2021-3772 A flaw was found in the SCTP     protocol implementation, which would allow a networked attacker to break an SCTP association. The attacker     would only need to know or guess the IP addresses and ports for the association. CVE-2021-4002 It was     discovered that hugetlbfs, the virtual filesystem used by applications to allocate huge pages in RAM, did     not flush the CPU's TLB in one case where it was necessary. In some circumstances a local user would be     able to read and write huge pages after they are freed and reallocated to a different process. This could     lead to privilege escalation, denial of service or information leaks. CVE-2021-4083 Jann Horn reported a     race condition in the local (Unix) sockets garbage collector, that can lead to use-after-free. A local     user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-4135 A flaw was found in the netdevsim driver which would lead to an     information leak. This driver is not enabled in Debian's official kernel configurations. CVE-2021-4155     Kirill Tkhai discovered a data leak in the way the XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for     a size increase of files with unaligned size. A local attacker can take advantage of this flaw to leak     data on the XFS filesystem. CVE-2021-4203 Jann Horn reported a race condition in the local (Unix) sockets     implementation that can lead to a use-after-free. A local user could exploit this to leak sensitive     information from the kernel. CVE-2021-20317 It was discovered that the timer queue structure could become     corrupt, leading to waiting tasks never being woken up. A local user with certain privileges could exploit     this to cause a denial of service (system hang). CVE-2021-20321 A race condition was discovered in the     overlayfs filesystem driver. A local user with access to an overlayfs mount and to its underlying upper     directory could exploit this for privilege escalation. CVE-2021-20322 An information leak was discovered     in the IPv4 implementation. A remote attacker could exploit this to quickly discover which UDP ports a     system is using, making it easier for them to carry out a DNS poisoning attack against that system.
    CVE-2021-22600 The syzbot tool found a flaw in the packet socket (AF_PACKET) implementation which could     lead to incorrectly freeing memory. A local user with CAP_NET_RAW capability (in any user namespace) could     exploit this for denial of service (memory corruption or crash) or possibly for privilege escalation.
    CVE-2021-28711, CVE-2021-28712, CVE-2021-28713 (XSA-391) Juergen Gross reported that malicious PV backends     can cause a denial of service to guests being serviced by those backends via high frequency events, even     if those backends are running in a less privileged environment. CVE-2021-28714, CVE-2021-28715 (XSA-392)     Juergen Gross discovered that Xen guests can force the Linux netback driver to hog large amounts of kernel     memory, resulting in denial of service. CVE-2021-38300 Piotr Krysiuk discovered a flaw in the classic BPF     (cBPF) JIT compiler for MIPS architectures. A local user could exploit this to excute arbitrary code in     the kernel. This issue is mitigated by setting sysctl net.core.bpf_jit_enable=0, which is the default. It     is *not* mitigated by disabling unprivileged use of eBPF. CVE-2021-39685 Szymon Heidrich discovered a     buffer overflow vulnerability in the USB gadget subsystem, resulting in information disclosure, denial of     service or privilege escalation. CVE-2021-39686 A race condition was discovered in the Android binder     driver, that could lead to incorrect security checks. On systems where the binder driver is loaded, a     local user could exploit this for privilege escalation. CVE-2021-39698 Linus Torvalds reported a flaw in     the file polling implementation, which could lead to a use-after-free. A local user could exploit this for     denial of service (memory corruption or crash) or possibly for privilege escalation. CVE-2021-39713 The     syzbot tool found a race condition in the network scheduling subsystem which could lead to a use-after-     free. A local user could exploit this for denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-41864 An integer overflow was discovered in the Extended BPF (eBPF)     subsystem. A local user could exploit this for denial of service (memory corruption or crash), or possibly     for privilege escalation. This can be mitigated by setting sysctl kernel.unprivileged_bpf_disabled=1,     which disables eBPF use by unprivileged users. CVE-2021-42739 A heap buffer overflow was discovered in the     firedtv driver for FireWire-connected DVB receivers. A local user with access to a firedtv device could     exploit this for denial of service (memory corruption or crash), or possibly for privilege escalation.
    CVE-2021-43389 The Active Defense Lab of Venustech discovered a flaw in the CMTP subsystem as used by     Bluetooth, which could lead to an out-of-bounds read and object type confusion. A local user with     CAP_NET_ADMIN capability in the initial user namespace could exploit this for denial of service (memory     corruption or crash), or possibly for privilege escalation. CVE-2021-43975 Brendan Dolan-Gavitt reported a     flaw in the hw_atl_utils_fw_rpc_wait() function in the aQuantia AQtion ethernet device driver which can     result in denial of service or the execution of arbitrary code. CVE-2021-43976 Zekun Shen and Brendan     Dolan-Gavitt discovered a flaw in the mwifiex_usb_recv() function of the Marvell WiFi-Ex USB Driver. An     attacker able to connect a crafted USB device can take advantage of this flaw to cause a denial of     service. CVE-2021-44733 A race condition was discovered in the Trusted Execution Environment (TEE)     subsystem for Arm processors, which could lead to a use-after-free. A local user permitted to access a TEE     device could exploit this for denial of service (memory corruption or crash) or possibly for privilege     escalation. CVE-2021-45095 It was discovered that the Phone Network protocol (PhoNet) driver has a     reference count leak in the pep_sock_accept() function. CVE-2021-45469 Wenqing Liu reported an out-of-     bounds memory access in the f2fs implementation if an inode has an invalid last xattr entry. An attacker     able to mount a specially crafted image can take advantage of this flaw for denial of service.
    CVE-2021-45480 A memory leak flaw was discovered in the __rds_conn_create() function in the RDS (Reliable     Datagram Sockets) protocol subsystem. CVE-2022-0001 (INTEL-SA-00598) Researchers at VUSec discovered that     the Branch History Buffer in Intel processors can be exploited to create information side channels with     speculative execution. This issue is similar to Spectre variant 2, but requires additional mitigations on     some processors. This can be exploited to obtain sensitive information from a different security context,     such as from user-space to the kernel, or from a KVM guest to the kernel. CVE-2022-0002 (INTEL-SA-00598)     This is a similar issue to CVE-2022-0001, but covers exploitation within a security context, such as from     JIT-compiled code in a sandbox to hosting code in the same process. This can be partly mitigated by     disabling eBPF for unprivileged users with the sysctl: kernel.unprivileged_bpf_disabled=2. This update     does that by default. CVE-2022-0322 Eiichi Tsukata discovered a flaw in the sctp_make_strreset_req()     function in the SCTP network protocol implementation which can result in denial of service. CVE-2022-0330     Sushma Venkatesh Reddy discovered a missing GPU TLB flush in the i915 driver, resulting in denial of     service or privilege escalation. CVE-2022-0435 Samuel Page and Eric Dumazet reported a stack overflow in     the networking module for the Transparent Inter-Process Communication (TIPC) protocol, resulting in denial     of service or potentially the execution of arbitrary code. CVE-2022-0487 A use-after-free was discovered     in the MOXART SD/MMC Host Controller support driver. This flaw does not impact the Debian binary packages     as CONFIG_MMC_MOXART is not set. CVE-2022-0492 Yiqi Sun and Kevin Wang reported that the cgroup-v1     subsystem does not properly restrict access to the release-agent feature. A local user can take advantage     of this flaw for privilege escalation and bypass of namespace isolation. CVE-2022-0617 butt3rflyh4ck     discovered a NULL pointer dereference in the UDF filesystem. A local user that can mount a specially     crafted UDF image can use this flaw to crash the system. CVE-2022-0644 Hao Sun reported a missing check     for file read permission in the finit_module() and kexec_file_load() system calls. The security impact of     this is unclear, since these system calls are usually only available to the root user. CVE-2022-22942 It     was discovered that wrong file file descriptor handling in the VMware Virtual GPU driver (vmwgfx) could     result in information leak or privilege escalation. CVE-2022-24448 Lyu Tao reported a flaw in the NFS     implementation in the Linux kernel when handling requests to open a directory on a regular file, which     could result in a information leak. CVE-2022-24959 A memory leak was discovered in the     yam_siocdevprivate() function of the YAM driver for AX.25, which could result in denial of service.
    CVE-2022-25258 Szymon Heidrich reported the USB Gadget subsystem lacks certain validation of interface OS     descriptor requests, resulting in memory corruption. CVE-2022-25375 Szymon Heidrich reported that the     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command, resulting in information leak     from kernel memory. For the oldstable distribution (buster), these problems have been fixed in version     4.19.232-1. This update additionally includes many more bug fixes from stable updates 4.19.209-4.19.232     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 4.4.301 / 4.4.301_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-031-01 advisory.

  - An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The     get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider     the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
    (CVE-2020-29374)

  - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to     improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for     a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon     Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon     Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W,     MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]     Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. (CVE-2021-28714) (CVE-2021-28715)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

  - drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for     attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM     pointer). (CVE-2021-38205)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43389. Reason: This candidate is a     reservation duplicate of CVE-2021-43389. Notes: All CVE users should reference CVE-2021-43389 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2021-3896)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab     out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
    (CVE-2021-42008)

  - An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in     the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. (CVE-2021-43389)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
    (CVE-2021-45095)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2689 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of     arbitrary code, privilege escalation, denial of service, or information leaks. This update is not yet     available for the armel (ARM EABI soft-float) architecture. CVE-2020-24586, CVE-2020-24587, CVE-2020-26147     Mathy Vanhoef discovered that many Wi-Fi implementations, including Linux's mac80211, did not correctly     implement reassembly of fragmented packets. In some circumstances, an attacker within range of a network     could exploit these flaws to forge arbitrary packets and/or to access sensitive data on that network.
    CVE-2020-24588 Mathy Vanhoef discovered that most Wi-Fi implementations, including Linux's mac80211, did     not authenticate the is aggregated packet header flag. An attacker within range of a network could exploit     this to forge arbitrary packets on that network. CVE-2020-25670, CVE-2020-25671, CVE-2021-23134 kiyin     () of TenCent discovered several reference counting bugs in the NFC LLCP implementation which could     lead to use-after-free. A local user could exploit these for denial of service (crash or memory     corruption) or possibly for privilege escalation. Nadav Markus and Or Cohen of Palo Alto Networks     discovered that the original fixes for these introduced a new bug that could result in use-after-free and     double-free. This has also been fixed. CVE-2020-25672 kiyin () of TenCent discovered a memory leak     in the NFC LLCP implementation. A local user could exploit this for denial of service (memory exhaustion).
    CVE-2020-26139 Mathy Vanhoef discovered that a bug in some Wi-Fi implementations, including Linux's     mac80211. When operating in AP mode, they would forward EAPOL frames from one client to another while the     sender was not yet authenticated. An attacker within range of a network could use this for denial of     service or as an aid to exploiting other vulnerabilities. CVE-2020-26558, CVE-2021-0129 Researchers at     ANSSI discovered vulnerabilities in the Bluetooth Passkey authentication method, and in Linux's     implementation of it. An attacker within range of two Bluetooth devices while they pair using Passkey     authentication could exploit this to obtain the shared secret (Passkey) and then impersonate either of the     devices to each other. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's virtual memory     management. A parent and child process initially share all their memory, but when either writes to a     shared page, the page is duplicated and unshared (copy-on-write). However, in case an operation such as     vmsplice() required the kernel to take an additional reference to a shared page, and a copy-on-write     occurs during this operation, the kernel might have accessed the wrong process's memory. For some     programs, this could lead to an information leak or data corruption. CVE-2020-36322, CVE-2021-28950 The     syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not correctly handle a FUSE     server returning invalid attributes for a file. A local user permitted to run a FUSE server could use this     to cause a denial of service (crash). The original fix for this introduced a different potential denial of     service (infinite loop in kernel space), which has also been fixed. CVE-2021-3428 Wolfgang Frisch reported     a potential integer overflow in the ext4 filesystem driver. A user permitted to mount arbitrary filesystem     images could use this to cause a denial of service (crash). CVE-2021-3483  (Zheyu Ma) reported a     bug in the nosy driver for TI PCILynx FireWire controllers, which could lead to list corruption and a use-     after-free. On a system that uses this driver, local users granted access to /dev/nosy could exploit this     to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3564, CVE-2021-3573, CVE-2021-32399 The BlockSec team discovered several race conditions in the     Bluetooth subsystem that could lead to a use-after-free or double-free. A local user could exploit these     to caue a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3587 Active Defense Lab of Venustech discovered a potential null pointer dereference in the NFC     LLCP implementation. A local user could use this to cause a denial of service (crash). CVE-2021-20292 It     was discovered that the TTM buffer allocation API used by GPU drivers did not handle allocation failures     in the way that most drivers expected, resulting in a double-free on failure. A local user on a system     using one of these drivers could possibly exploit this to cause a denial of service (crash or memory     corruption) or for privilege escalation. The API has been changed to match driver expectations.
    CVE-2021-23133 Or Cohen of Palo Alto Networks discovered a race condition in the SCTP implementation,     which can lead to list corruption. A local user could exploit this to cause a denial of service (crash or     memory corruption) or possibly for privilege escalation. CVE-2021-28660 It was discovered that the     rtl8188eu WiFi driver did not correctly limit the length of SSIDs copied into scan results. An attacker     within WiFi range could use this to cause a denial of service (crash or memory corruption) or possibly to     execute code on a vulnerable system. CVE-2021-28688 (XSA-371) It was discovered that the original fix for     CVE-2021-26930 (XSA-365) introduced a potential resource leak. A malicious guest could presumably exploit     this to cause a denial of service (resource exhaustion) within the host. CVE-2021-28964 Zygo Blaxell     reported a race condition in the Btrfs driver which can lead to an assertion failure. On systems using     Btrfs, a local user could exploit this to cause a denial of service (crash). CVE-2021-28971 Vince Weaver     reported a bug in the performance event handler for Intel PEBS. A workaround for a hardware bug on Intel     CPUs codenamed Haswell and earlier could lead to a null pointer dereference. On systems with the affected     CPUs, if users are permitted to access performance events, a local user may exploit this to cause a denial     of service (crash). By default, unprivileged users do not have access to performance events, which     mitigates this issue. This is controlled by the kernel.perf_event_paranoid sysctl. CVE-2021-29154 It was     discovered that the Extended BPF (eBPF) JIT compiler for x86_64 generated incorrect branch instructions in     some cases. On systems where eBPF JIT is enabled, users could exploit this to execute arbitrary code in     the kernel. By default, eBPF JIT is disabled, mitigating this issue. This is controlled by the     net.core.bpf_jit_enable sysctl. CVE-2021-29265 The syzbot tool found a race condition in the USB/IP host     (server) implementation which can lead to a null pointer dereference. On a system acting as a USB/IP host,     a client can exploit this to cause a denial of service (crash). CVE-2021-29647 The syzbot tool found an     information leak in the Qualcomm IPC Router (qrtr) implementation. This protocol is not enabled in     Debian's official kernel configurations. CVE-2021-29650 It was discovered that a data race in the     netfilter subsystem could lead to a null pointer dereference during replacement of a table. A local user     with CAP_NET_ADMIN capability in any user namespace could use this to cause a denial of service (crash).
    By default, unprivileged users cannot create user namespaces, which mitigates this issue. This is     controlled by the kernel.unprivileged_userns_clone sysctl. CVE-2021-30002 Arnd Bergmann and the syzbot     tool found a memory leak in the Video4Linux (v4l) subsystem. A local user permitted to access video     devices (by default, any member of the video group) could exploit this to cause a denial of service     (memory exhaustion). CVE-2021-31916 Dan Carpenter reported incorrect parameter validation in the device-     mapper (dm) subsystem, which could lead to a heap buffer overrun. However, only users with CAP_SYS_ADMIN     capability (i.e. root-equivalent) could trigger this bug, so it did not have any security impact in this     kernel version. CVE-2021-33034 The syzbot tool found a bug in the Bluetooth subsystem that could lead to a     use-after-free. A local user could use this to cause a denial of service (crash or memory corruption) or     possibly for privilege escalation. For Debian 9 stretch, these problems have been fixed in version     4.9.272-1. This update additionally includes many more bug fixes from stable updates 4.9.259-4.9.272     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further     information about Debian LTS security advisories, how to apply these updates to your system and frequently     asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service, or information leaks.

CVE-2020-24586, CVE-2020-24587, CVE-2020-26147

Mathy Vanhoef discovered that many Wi-Fi implementations, including Linux's mac80211, did not correctly implement reassembly of fragmented packets. In some circumstances, an attacker within range of a network could exploit these flaws to forge arbitrary packets and/or to access sensitive data on that network.

CVE-2020-24588

Mathy Vanhoef discovered that most Wi-Fi implementations, including Linux's mac80211, did not authenticate the 'is aggregated' packet header flag. An attacker within range of a network could exploit this to forge arbitrary packets on that network.

CVE-2020-25670, CVE-2020-25671, CVE-2021-23134

kiyin (&#x5C39;&#x4EAE;) of TenCent discovered several reference counting bugs in the NFC LLCP implementation which could lead to use-after-free. A local user could exploit these for denial of service (crash or memory corruption) or possibly for privilege escalation.

Nadav Markus and Or Cohen of Palo Alto Networks discovered that the original fixes for these introduced a new bug that could result in use-after-free and double-free. This has also been fixed.

CVE-2020-25672

kiyin (&#x5C39;&#x4EAE;) of TenCent discovered a memory leak in the NFC LLCP implementation. A local user could exploit this for denial of service (memory exhaustion).

CVE-2020-26139

Mathy Vanhoef discovered that a bug in some Wi-Fi implementations, including Linux's mac80211. When operating in AP mode, they would forward EAPOL frames from one client to another while the sender was not yet authenticated. An attacker within range of a network could use this for denial of service or as an aid to exploiting other vulnerabilities.

CVE-2020-26558, CVE-2021-0129

Researchers at ANSSI discovered vulnerabilities in the Bluetooth Passkey authentication method, and in Linux's implementation of it. An attacker within range of two Bluetooth devices while they pair using Passkey authentication could exploit this to obtain the shared secret (Passkey) and then impersonate either of the devices to each other.

CVE-2020-29374

Jann Horn of Google reported a flaw in Linux's virtual memory management. A parent and child process initially share all their memory, but when either writes to a shared page, the page is duplicated and unshared (copy-on-write). However, in case an operation such as vmsplice() required the kernel to take an additional reference to a shared page, and a copy-on-write occurs during this operation, the kernel might have accessed the wrong process's memory. For some programs, this could lead to an information leak or data corruption.

CVE-2021-3483

&#x9A6C;&#x54F2;&#x5B87; (Zheyu Ma) reported a bug in the 'nosy' driver for TI PCILynx FireWire controllers, which could lead to list corruption and a use-after-free. On a system that uses this driver, local users granted access to /dev/nosy could exploit this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2021-3506

The ADLab of venustech discovered a bug in the F2FS driver which could lead to an out-of-bounds read when accessing a crafted filesystem. A local user permitted to mount arbitrary filesystems could exploit this to cause a denial of service (crash) or other security impact.

CVE-2021-3564, CVE-2021-3573, CVE-2021-32399

The BlockSec team discovered several race conditions in the Bluetooth subsystem that could lead to a use-after-free or double-free. A local user could exploit these to caue a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2021-3587

Active Defense Lab of Venustech discovered a potential NULL pointer dereference in the NFC LLCP implementation. A local user could use this to cause a denial of service (crash).

CVE-2021-23133

Or Cohen of Palo Alto Networks discovered a race condition in the SCTP implementation, which can lead to list corruption. A local user could exploit this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2021-28688 (XSA-371)

It was discovered that the original fix for CVE-2021-26930 (XSA-365) introduced a potential resource leak. A malicious guest could presumably exploit this to cause a denial of service (resource exhaustion) within the host.

CVE-2021-28964

Zygo Blaxell reported a race condition in the Btrfs driver which can lead to an assertion failure. On systems using Btrfs, a local user could exploit this to cause a denial of service (crash).

CVE-2021-28971

Vince Weaver reported a bug in the performance event handler for Intel PEBS. A workaround for a hardware bug on Intel CPUs codenamed 'Haswell' and earlier could lead to a NULL pointer dereference. On systems with the affected CPUs, if users are permitted to access performance events, a local user may exploit this to cause a denial of service (crash).

By default, unprivileged users do not have access to performance events, which mitigates this issue. This is controlled by the kernel.perf_event_paranoid sysctl.

CVE-2021-29154

It was discovered that the Extended BPF (eBPF) JIT compiler for x86_64 generated incorrect branch instructions in some cases. On systems where eBPF JIT is enabled, users could exploit this to execute arbitrary code in the kernel.

By default, eBPF JIT is disabled, mitigating this issue.
This is controlled by the net.core.bpf_jit_enable sysctl.

CVE-2021-29155, CVE-2021-31829

Piotr Krysiuk and Benedict Schlueter discovered that the Extended BPF (eBPF) verifier did not completely protect against information leaks due to speculative execution. A local user could exploit these to obtain sensitive information from kernel memory.

CVE-2021-29264

It was discovered that the 'gianfar' Ethernet driver used with some Freescale SoCs did not correctly handle a Rx queue overrun when jumbo packets were enabled. On systems using this driver and jumbo packets, an attacker on the network could exploit this to cause a denial of service (crash).

This driver is not enabled in Debian's official kernel configurations.

CVE-2021-29647

The syzbot tool found an information leak in the Qualcomm IPC Router (qrtr) implementation.

This protocol is not enabled in Debian's official kernel configurations.

CVE-2021-29650

It was discovered that a data race in the netfilter subsystem could lead to a NULL pointer dereference during replacement of a table. A local user with CAP_NET_ADMIN capability in any user namespace could use this to cause a denial of service (crash).

By default, unprivileged users cannot create user namespaces, which mitigates this issue. This is controlled by the kernel.unprivileged_userns_clone sysctl.

CVE-2021-31916

Dan Carpenter reported incorrect parameter validation in the device-mapper (dm) subsystem, which could lead to a heap buffer overrun. However, only users with CAP_SYS_ADMIN capability (i.e.
root-equivalent) could trigger this bug, so it did not have any security impact in this kernel version.

CVE-2021-33034

The syzbot tool found a bug in the Bluetooth subsystem that could lead to a use-after-free. A local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

For Debian 9 stretch, these problems have been fixed in version 4.19.194-1~deb9u1. This update additionally fixes Debian bug #986949, #988352, and #989451; and includes many more bug fixes from stable updates 4.19.182-4.19.194 inclusive.

We recommend that you upgrade your linux-4.19 packages.

For the detailed security status of linux-4.19 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/linux-4.19

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of kernel installed on the remote host is prior to 4.14.232-123.381. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1503 advisory.

    kernel: refcount leak in llcp_sock_bind() (CVE-2020-25670)

    kernel: refcount leak in llcp_sock_connect() (CVE-2020-25671)

    kernel: memory leak in llcp_sock_connect() (CVE-2020-25672)

    An issue was discovered in the Linux kernel related to mm/gup.c and mm/huge_memory.c. The get_user_pages     (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of     read operations and therefore can grant unintended write access. (CVE-2020-29374)

    A use-after-free flaw was found in the Linux kernel's SCTP socket functionality that triggers a race     condition. This flaw allows a local user to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-23133)

    The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

    A race condition flaw was found in get_old_root in fs/btrfs/ctree.c in the Linux kernel in btrfs file-     system. This flaw allows a local attacker with a special user privilege to cause a denial of service due     to not locking an extent buffer before a cloning operation. The highest threat from this vulnerability is     to system availability. (CVE-2021-28964)

    A flaw was found in the Linux kernel. On some Haswell CPUs, userspace applications (such as perf-fuzzer)     can cause a system crash because the PEBS status in a PEBS record is mishandled. (CVE-2021-28971)

    A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only     accessible to privileged users with CAP_SYS_ADMIN.   A local user with the ability to insert eBPF     instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-29154)

    A vulnerability was discovered in retrieve_ptr_limit in kernel/bpf/verifier.c in the Linux kernel     mechanism to mitigate speculatively out-of-bounds loads (Spectre mitigation). In this flaw a local,     special user privileged (CAP_SYS_ADMIN) BPF program running on affected systems may bypass the protection,     and execute speculatively out-of-bounds loads from the kernel memory. This can be abused to extract     contents of kernel memory via side-channel. (CVE-2021-29155)

    A flaw was found in the Linux kernel's eBPF verification code. By default, accessing the eBPF verifier is     only accessible to privileged users with CAP_SYS_ADMIN. This flaw allows a local user who can insert eBPF     instructions, to use the eBPF verifier to abuse a spectre-like flaw and infer all system memory. The     highest threat from this vulnerability is to confidentiality. (CVE-2021-31829)

    An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel. A bound check failure allows an attacker with special user     (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of     internal kernel information. The highest threat from this vulnerability is to system availability.
    (CVE-2021-31916)

    The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.232-176.381. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1636 advisory.

    2024-05-23: CVE-2021-46909 was added to this advisory.

    2024-05-23: CVE-2021-46974 was added to this advisory.

    2024-03-13: CVE-2021-46905 was added to this advisory.

    2024-03-13: CVE-2021-46904 was added to this advisory.

    2024-03-13: CVE-2021-46915 was added to this advisory.

    An issue was discovered in the Linux kernel related to mm/gup.c and mm/huge_memory.c. The get_user_pages     (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of     read operations and therefore can grant unintended read access. (CVE-2020-29374)

    A use-after-free flaw was found in the Linux kernel's SCTP socket functionality that triggers a race     condition. This flaw allows a local user to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-23133)

    A vulnerability was discovered in retrieve_ptr_limit in kernel/bpf/verifier.c in the Linux kernel     mechanism to mitigate speculatively out-of-bounds loads (Spectre mitigation). In this flaw a local,     special user privileged (CAP_SYS_ADMIN) BPF program running on affected systems may bypass the protection,     and execute speculatively out-of-bounds loads from the kernel memory. This can be abused to extract     contents of kernel memory via side-channel. (CVE-2021-29155)

    A flaw was found in the Linux kernel's eBPF verification code. By default, accessing the eBPF verifier is     only accessible to privileged users with CAP_SYS_ADMIN. This flaw allows a local user who can insert eBPF     instructions, to use the eBPF verifier to abuse a spectre-like flaw and infer all system memory. The     highest threat from this vulnerability is to confidentiality. (CVE-2021-31829)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hso: fix null-ptr-deref during tty device unregistration

    Multiple ttys try to claim the same the minor number causing a doubleunregistration of the same device.
    The first unregistration succeedsbut the next one results in a null-ptr-deref.

    The get_free_serial_index() function returns an available minor numberbut doesn't assign it immediately.
    The assignment is done by the callerlater. But before this assignment, calls to     get_free_serial_index()would return the same minor number.

    Fix this by modifying get_free_serial_index to assign the minor numberimmediately after one is found to be     and rename it to obtain_minor()to better reflect what it does. Similary, rename set_serial_by_index()to     release_minor() and modify it to free up the minor number of thegiven hso_serial. Every obtain_minor()     should have correspondingrelease_minor() call. (CVE-2021-46904)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hso: fix NULL-deref on disconnect regression

    Commit 8a12f8836145 (net: hso: fix null-ptr-deref during tty deviceunregistration) fixed the racy minor     allocation reported by syzbot, butintroduced an unconditional NULL-pointer dereference on every     disconnectinstead.

    Specifically, the serial device table must no longer be accessed afterthe minor has been released by     hso_serial_tty_unregister(). (CVE-2021-46905)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: footbridge: fix PCI interrupt mapping (CVE-2021-46909)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_limit: avoid possible divide error in nft_limit_init

    div_u64() divides u64 by u32.

    nft_limit_init() wants to divide u64 by u64, use the appropriatemath function (div64_u64)

    divide error: 0000 [#1] PREEMPT SMP KASANCPU: 1 PID: 8390 Comm: syz-executor188 Not tainted     5.12.0-rc4-syzkaller #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google     01/01/2011RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]RIP: 0010:div_u64     include/linux/math64.h:127 [inline]RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85Code:
    ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3 45     89 ed 31 d2 4c 89 f0 <49> f7 f5 49 89 c6 e8 d3 9e 22 fa 48 8d 7d 48 48 b8 00 00 00 00 00RSP:
    0018:ffffc90009447198 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000200000000000 RCX:
    0000000000000000RDX: 0000000000000000 RSI: ffffffff875152e6 RDI: 0000000000000003RBP: ffff888020f80908     R08: 0000200000000000 R09: 0000000000000000R10: ffffffff875152d8 R11: 0000000000000000 R12:
    ffffc90009447270R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000FS:
    000000000097a300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0:
    0000000080050033CR2: 00000000200001c4 CR3: 0000000026a52000 CR4: 00000000001506e0DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400Call Trace:nf_tables_newexpr net/netfilter/nf_tables_api.c:2675     [inline]nft_expr_init+0x145/0x2d0 net/netfilter/nf_tables_api.c:2713nft_set_elem_expr_alloc+0x27/0x280     net/netfilter/nf_tables_api.c:5160nf_tables_newset+0x1997/0x3150     net/netfilter/nf_tables_api.c:4321nfnetlink_rcv_batch+0x85a/0x21b0     net/netfilter/nfnetlink.c:456nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:580     [inline]nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:598netlink_unicast_kernel     net/netlink/af_netlink.c:1312 [inline]netlink_unicast+0x533/0x7d0     net/netlink/af_netlink.c:1338netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927sock_sendmsg_nosec     net/socket.c:654 [inline]sock_sendmsg+0xcf/0x120 net/socket.c:674____sys_sendmsg+0x6e8/0x810     net/socket.c:2350___sys_sendmsg+0xf3/0x170 net/socket.c:2404__sys_sendmsg+0xe5/0x1b0     net/socket.c:2433do_syscall_64+0x2d/0x70     arch/x86/entry/common.c:46entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2021-46915)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix masking negation logic upon negative dst register (CVE-2021-46974)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).

CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).

CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).

CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).

CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).

CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).

CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).

CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).

CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).

CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).

CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).

CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).

CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).

CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access (bsc#1179660, bsc#1179428).

CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).

CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).

CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).

CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).

CVE-2021-3483: Fixed a use-after-free in nosy.c (bsc#1184393).

CVE-2021-30002: Fixed a memory leak for large arguments in video_usercopy (bsc#1184120).

CVE-2021-29154: Fixed incorrect computation of branch displacements, allowing arbitrary code execution (bsc#1184391).

CVE-2021-20219: Fixed a denial of service in n_tty_receive_char_special (bsc#1184397).

CVE-2020-36311: Fixed a denial of service (soft lockup) by triggering destruction of a large SEV VM (bsc#1184511).

CVE-2020-25670, CVE-2020-25671, CVE-2020-25672, CVE-2020-25673: Fixed multiple bugs in NFC subsytem (bsc#1178181).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).

CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).

CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).

CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).

CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).

CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).

CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).

CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).

CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).

CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).

CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).

CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).

CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).

CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).

CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).

CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).

CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).

CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4749-1 advisory.

    Bodong Zhao discovered a use-after-free in the Sun keyboard driver implementation in the Linux kernel. A     local attacker could use this to cause a denial of service or possibly execute arbitrary code.
    (CVE-2020-25669)

    It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds     read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash).
    (CVE-2020-27815)

    Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in the Linux kernel did not     correctly handle setting line discipline in some situations. A local attacker could use this to cause a     denial of service (system crash). (CVE-2020-27830, CVE-2020-28941)

    It was discovered that the memory management subsystem in the Linux kernel did not properly handle copy-     on-write operations in some situations. A local attacker could possibly use this to gain unintended write     access to read-only memory pages. (CVE-2020-29374)

    Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event processing backend in the Linux     kernel did not properly limit the number of events queued. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2020-29568)

    Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the Xen paravirt block backend in     the Linux kernel, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2020-29569)

    Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some     situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-29660)

    Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the     TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4748-1 advisory.

    It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds     read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash).
    (CVE-2020-27815)

    It was discovered that the memory management subsystem in the Linux kernel did not properly handle copy-     on-write operations in some situations. A local attacker could possibly use this to gain unintended write     access to read-only memory pages. (CVE-2020-29374)

    Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event processing backend in the Linux     kernel did not properly limit the number of events queued. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2020-29568)

    Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some     situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-29660)

    Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the     TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP2 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).

CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).

CVE-2020-12364: Fixed a NULL pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).

CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).

CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).

CVE-2020-12364: Fixed a NULL pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).

CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 kernel was updated receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In uvc_scan_chain_forward     of uvc_driver.c, there is a possible linked list     corruption due to an unusual root cause. This could     lead to local escalation of privilege in the kernel     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-111893654References: Upstream kernel.(CVE-2020-0404)A     flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)A TOCTOU mismatch in the     NFS client code in the Linux kernel before 5.8.3 could     be used by local attackers to corrupt memory or     possibly have unspecified other impact because a size     check is in fs4proc.c instead of fsfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)A flaw was found in     the Linux kernel before 5.9-rc4. A failure of the file     system metadata validator in XFS can cause an inode     with a valid, user-creatable extended attribute to be     flagged as corrupt. This can lead to the filesystem     being shutdown, or otherwise rendered inaccessible     until it is remounted, leading to a denial of service.
    The highest threat from this vulnerability is to system     availability.(CVE-2020-14385)In the Linux kernel before     5.7.8, fsfsd/vfs.c (in the NFS server) can set     incorrect permissions on new filesystem objects when     the filesystem lacks ACL support, aka CID-22cf8419f131.
    This occurs because the current umask is not     considered.(CVE-2020-24394)The rbd block device driver     in drivers/block/rbd.c in the Linux kernel through     5.8.9 used incomplete permission checking for access to     rbd devices, which could be leveraged by local     attackers to map or unmap rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)An issue was     discovered in net/ipv4/sysctl_net_ipv4.c in the Linux     kernel before 5.0.11. There is a net/ipv4/tcp_input.c     signed integer overflow in tcp_ack_update_rtt() when     userspace writes a very large integer to /proc/sys     et/ipv4/tcp_min_rtt_wlen, leading to a denial of     service or possibly unspecified other impact, aka     CID-19fad20d15a6.(CVE-2019-18805)Insufficient input     validation in i40e driver for Intel(R) Ethernet 700     Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable a denial of     service via local access.(CVE-2019-0147)Buffer overflow     in i40e driver for Intel(R) Ethernet 700 Series     Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2020-0145)A race     condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)A memory     out-of-bounds read flaw was found in the Linux kernel     before 5.9-rc2 with the ext3/ext4 file system, in the     way it accesses a directory with broken indexing. This     flaw allows a local user to crash the system if the     directory exists. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14314)A missing CAP_NET_RAW     check in NFC socket creation in net fc/rawsock.c in the     Linux kernel before 5.8.2 could be used by local     attackers to create raw sockets, bypassing security     mechanisms, aka CID-26896f01467a.(CVE-2020-26088)A flaw     was found in the HDLC_PPP module of the Linux kernel in     versions before 5.9-rc7. Memory corruption and a read     overflow is caused by improper input validation in the     ppp_cp_parse_cr function which can cause the system to     crash or cause a denial of service. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-25643)The Linux kernel, as used     in Red Hat Enterprise Linux 7, kernel-rt, and     Enterprise MRG 2 and when booted with UEFI Secure Boot     enabled, allows local users to bypass intended     securelevel/secureboot restrictions by leveraging     improper handling of secure_boot flag across kexec     reboot.(CVE-2015-7837)A flaw was found in the Linux     kernel's implementation of biovecs in versions before     5.9-rc7. A zero-length biovec request issued by the     block subsystem could cause the kernel to enter an     infinite loop, causing a denial of service. This flaw     allows a local attacker with basic privileges to issue     requests to a block device, resulting in a denial of     service. The highest threat from this vulnerability is     to system availability.(CVE-2020-25641)A flaw was found     in the Linux kernel before 5.9-rc4. Memory corruption     can be exploited to gain root privileges from     unprivileged processes. The highest threat from this     vulnerability is to data confidentiality and     integrity.(CVE-2020-14386)A flaw was found in the Linux     kernel in versions before 5.9-rc7. Traffic between two     Geneve endpoints may be unencrypted when IPsec is     configured to encrypt traffic for the specific UDP port     used by the GENEVE tunnel allowing anyone between the     two endpoints to read the traffic unencrypted. The main     threat from this vulnerability is to data     confidentiality.(CVE-2020-25645)perf: Fix race in     perf_mmap_close function.(CVE-2020-14351)An information     leak flaw was found in the way the Linux kernel's     Bluetooth stack implementation handled initialization     of stack memory when handling certain AMP packets. A     remote attacker in adjacent range could use this flaw     to leak small portions of stack memory on the system by     sending a specially crafted AMP packets. The highest     threat from this vulnerability is to data     confidentiality.(CVE-2020-12352)A flaw was found in the     way the Linux kernel Bluetooth implementation handled     L2CAP packets with A2MP CID. A remote attacker in     adjacent range could use this flaw to crash the system     causing denial of service or potentially execute     arbitrary code on the system by sending a specially     crafted L2CAP packet. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-12351)A heap     buffer overflow flaw was found in the way the Linux     kernel's Bluetooth implementation processed extended     advertising report events. This flaw allows a remote     attacker in an adjacent range to crash the system,     causing a denial of service or to potentially execute     arbitrary code on the system by sending a specially     crafted Bluetooth packet. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-24490)** RESERVED **     This candidate has been reserved by an organization or     individual that will use it when announcing a new     security problem. When the candidate has been     publicized, the details for this candidate will be     provided.(CVE-2020-25656)In skb_to_mamac of     networking.c, there is a possible out of bounds write     due to an integer overflow. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-143560807(CVE-2020-0432)A     slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)A     flaw memory leak in the Linux kernel performance     monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this     flaw to starve the resources causing denial of     service.(CVE-2020-25704)A buffer over-read (at the     framebuffer layer) in the fbcon code in the Linux     kernel before 5.8.15 could be used by local attackers     to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)There is a     use-after-free problem seen due to a race condition     between the release of ptp_clock and cdev while     resource deallocation. When a (high privileged) process     allocates a ptp device file (like /dev/ptpX) and     voluntarily goes to sleep. During this time if the     underlying device is removed, it can cause an     exploitable condition as the process wakes up to     terminate and clean all attached files. The system     crashes due to the cdev structure being invalid (as     already freed) which is pointed to by the     inode.(CVE-2020-10690)A device tracking vulnerability     was found in the flow_dissector feature in the Linux     kernel. This flaw occurs because the auto flowlabel of     the UDP IPv6 packet relies on a 32-bit hashmd value as     a secret, and jhash (instead of siphash) is used. The     hashmd value remains the same starting from boot time     and can be inferred by an     attacker.(CVE-2019-18282)Use-after-free vulnerability     in fs/block_dev.c in the Linux kernel before 5.8 allows     local users to gain privileges or cause a denial of     service by leveraging improper access to a certain     error field.(CVE-2020-15436)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)An issue was discovered     in kmem_cache_alloc_bulk in mm/slub.c in the Linux     kernel before 5.5.11. The slowpath lacks the required     TID increment, aka CID-fd4d9c7d0c71.(CVE-2020-29370)An     issue was discovered in the Linux kernel before 5.2.6.
    On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)An issue was     discovered in the Linux kernel before 5.7.3, related to     mm/gup.c and mm/huge_memory.c. The get_user_pages (aka     gup) implementation, when used for a copy-on-write     page, does not properly consider the semantics of read     operations and therefore can grant unintended write     access, aka CID-17839856fd58.(CVE-2020-29374)A flaw was     found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)In kbd_keycode of keyboard.c,     there is a possible out of bounds write due to a     missing bounds check. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-144161459(CVE-2020-0431)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
223569	Linux Distros Unpatched Vulnerability : CVE-2020-29374	Nessus	Misc.	low
203842	Photon OS 3.0: Linux PHSA-2021-3.0-0234	Nessus	PhotonOS Local Security Checks	high
158761	Debian DSA-5096-1 : linux - security update	Nessus	Debian Local Security Checks	high
157284	Slackware Linux 14.2 kernel-generic Multiple Vulnerabilities (SSA:2022-031-01)	Nessus	Slackware Local Security Checks	high
150985	Debian DLA-2689-1 : linux - LTS security update	Nessus	Debian Local Security Checks	high
150984	Debian DLA-2690-1 : linux-4.19 security update	Nessus	Debian Local Security Checks	high
149872	Amazon Linux AMI : kernel (ALAS-2021-1503)	Nessus	Amazon Linux Local Security Checks	high
149870	Amazon Linux 2 : kernel (ALAS-2021-1636)	Nessus	Amazon Linux Local Security Checks	high
148700	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:1210-1)	Nessus	SuSE Local Security Checks	high
148509	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:1175-1)	Nessus	SuSE Local Security Checks	high
147983	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4749-1)	Nessus	Ubuntu Local Security Checks	high
147975	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4748-1)	Nessus	Ubuntu Local Security Checks	high
147591	SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0735-1)	Nessus	SuSE Local Security Checks	high
147586	SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0740-1)	Nessus	SuSE Local Security Checks	high
147579	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2021:0741-1)	Nessus	SuSE Local Security Checks	high
147568	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0736-1)	Nessus	SuSE Local Security Checks	high
147563	openSUSE Security Update : the Linux Kernel (openSUSE-2021-393)	Nessus	SuSE Local Security Checks	high
147464	SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0737-1)	Nessus	SuSE Local Security Checks	high
144731	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2021-1039)	Nessus	Huawei Local Security Checks	critical

Detections

Analytics

CVE-2020-29374

low

Tenable Plugins

low

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical