An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution.
Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data. (CVE-2020-6096)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0122 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-19126:
    On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the     LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition,     allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass     ASLR for a setuid program.

    CVE-2020-10029:
    The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

    CVE-2020-1751:
    An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on     PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the     frame address, resulting in a denial of service or potential code execution. The highest threat from this     vulnerability is to system availability.

    CVE-2020-1752:
    A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde     expansion was carried out. Directory paths containing an initial tilde followed by a valid username were     affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path     that, when processed by the glob function, would potentially lead to arbitrary code execution. This was     fixed in version 2.32.

    CVE-2020-6096:
    An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3152 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3152-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Helmut Grohne     October 17, 2022                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : glibc     Version        : 2.28-10+deb10u2     CVE ID         : CVE-2016-10228 CVE-2019-19126 CVE-2019-25013                      CVE-2020-1752 CVE-2020-6096 CVE-2020-10029                      CVE-2020-27618 CVE-2021-3326 CVE-2021-3999                      CVE-2021-27645 CVE-2021-33574 CVE-2021-35942                      CVE-2022-23218 CVE-2022-23219     Debian Bug     : 856503 945250 953108 953788 961452 973914 979273 981198                      983479 989147 990542

    This update fixes a wide range of vulnerabilities. A significant portion     affects character set conversion.

    CVE-2016-10228

        The iconv program in the GNU C Library when invoked with multiple         suffixes in the destination encoding (TRANSLATE or IGNORE) along with         the -c option, enters an infinite loop when processing invalid         multi-byte input sequences, leading to a denial of service.

    CVE-2019-19126

        On the x86-64 architecture, the GNU C Library fails to ignore the         LD_PREFER_MAP_32BIT_EXEC environment variable during program         execution after a security transition, allowing local attackers to         restrict the possible mapping addresses for loaded libraries and         thus bypass ASLR for a setuid program.

    CVE-2019-25013

        The iconv feature in the GNU C Library, when processing invalid         multi-byte input sequences in the EUC-KR encoding, may have a buffer         over-read.

    CVE-2020-10029

        The GNU C Library could overflow an on-stack buffer during range         reduction if an input to an 80-bit long double function contains a         non-canonical bit pattern, a seen when passing a         0x5d414141414141410000 value to sinl on x86 targets. This is related         to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

    CVE-2020-1752

        A use-after-free vulnerability introduced in glibc was found in the         way the tilde expansion was carried out. Directory paths containing         an initial tilde followed by a valid username were affected by this         issue. A local attacker could exploit this flaw by creating a         specially crafted path that, when processed by the glob function,         would potentially lead to arbitrary code execution.

    CVE-2020-27618

        The iconv function in the GNU C Library, when processing invalid         multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390,         and IBM1399 encodings, fails to advance the input state, which could         lead to an infinite loop in applications, resulting in a denial of         service, a different vulnerability from CVE-2016-10228.

    CVE-2020-6096

        An exploitable signed comparison vulnerability exists in the ARMv7         memcpy() implementation of GNU glibc. Calling memcpy() (on ARMv7         targets that utilize the GNU glibc implementation) with a negative         value for the 'num' parameter results in a signed comparison         vulnerability. If an attacker underflows the 'num' parameter to         memcpy(), this vulnerability could lead to undefined behavior such as         writing to out-of-bounds memory and potentially remote code         execution.  Furthermore, this memcpy() implementation allows for         program execution to continue in scenarios where a segmentation fault         or crash should have occurred. The dangers occur in that subsequent         execution and iterations of this code will be executed with this         corrupted data.

    CVE-2021-27645

        The nameserver caching daemon (nscd) in the GNU C Library, when         processing a request for netgroup lookup, may crash due to a         double-free, potentially resulting in degraded service or Denial of         Service on the local system. This is related to netgroupcache.c.

    CVE-2021-3326

        The iconv function in the GNU C Library, when processing invalid         input sequences in the ISO-2022-JP-3 encoding, fails an assertion in         the code path and aborts the program, potentially resulting in a         denial of service.

    CVE-2021-33574

        The mq_notify function in the GNU C Library has a use-after-free. It         may use the notification thread attributes object (passed through         its struct sigevent parameter) after it has been freed by the caller,         leading to a denial of service (application crash) or possibly         unspecified other impact.

    CVE-2021-35942

        The wordexp function in the GNU C Library may crash or read arbitrary         memory in parse_param (in posix/wordexp.c) when called with an         untrusted, crafted pattern, potentially resulting in a denial of         service or disclosure of information. This occurs because atoi was         used but strtoul should have been used to ensure correct calculations.

    CVE-2021-3999

        An off-by-one buffer overflow and underflow in getcwd() may lead to         memory corruption when the size of the buffer is exactly 1. A local         attacker who can control the input buffer and size passed to getcwd()         in a setuid program could use this flaw to potentially execute         arbitrary code and escalate their privileges on the system.

    CVE-2022-23218

        The deprecated compatibility function svcunix_create in the sunrpc         module of the GNU C Library copies its path argument on the stack         without validating its length, which may result in a buffer overflow,         potentially resulting in a denial of service or (if an application         is not built with a stack protector enabled) arbitrary code execution.

    CVE-2022-23219

        The deprecated compatibility function clnt_create in the sunrpc module         of the GNU C Library copies its hostname argument on the stack without         validating its length, which may result in a buffer overflow,         potentially resulting in a denial of service or (if an application is         not built with a stack protector enabled) arbitrary code execution.


    For Debian 10 buster, these problems have been fixed in version     2.28-10+deb10u2.

    We recommend that you upgrade your glibc packages.

    For the detailed security status of glibc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/glibc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-1 advisory.

    Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly     handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to     hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

    Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on     ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-6096)

    It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An     attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

    It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2021-35942)

    It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10.
    (CVE-2021-3998)

    It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could     use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2021-3999)

    It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker     could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service.
    (CVE-2022-23218, CVE-2022-23219)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4954-1 advisory.

    Jason Royes and Samuel Dytrych discovered that the memcpy() implementation for 32 bit ARM processors in     the GNU C Library contained an integer underflow vulnerability. An attacker could possibly use this to     cause a denial of service (application crash) or execute arbitrary code. (CVE-2020-6096)

    It was discovered that the POSIX regex implementation in the GNU C Library did not properly parse     alternatives. An attacker could use this to cause a denial of service. (CVE-2009-5155)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An exploitable signed comparison vulnerability exists     in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that     utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed     comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could     lead to undefined behavior such as writing to     out-of-bounds memory and potentially remote code     execution. Furthermore, this memcpy() implementation     allows for program execution to continue in scenarios     where a segmentation fault or crash should have     occurred. The dangers occur in that subsequent     execution and iterations of this code will be executed     with this corrupted data.(CVE-2020-6096)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of glibc installed on the remote host is prior to 2.26-41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1605 advisory.

    The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

    A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could     cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from     this vulnerability is to system availability. (CVE-2019-25013)

    A denial of service flaw was found in the way glibc's iconv function handled UCS4 text containing an     irreversible character. This flaw causes an application compiled with glibc and using the vulnerable     function to terminate with an assertion, resulting in a denial of service. The highest threat from this     vulnerability is to system availability. (CVE-2020-29562)

    A signed comparison vulnerability was found in GNU libc in the ARMv7 implementation of memcpy(). The flaw     affects the third argument to memcpy() that specifies the number of bytes to copy. An underflow on the     third argument could lead to undefined behavior such as out-of-bounds memory write and potentially remote     code execution. (CVE-2020-6096)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-20 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-6e581c051a advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data. (CVE-2020-6096)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An exploitable signed comparison vulnerability exists     in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that     utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed     comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could     lead to undefined behavior such as writing to     out-of-bounds memory and potentially remote code     execution. Furthermore, this memcpy() implementation     allows for program execution to continue in scenarios     where a segmentation fault or crash should have     occurred. The dangers occur in that subsequent     execution and iterations of this code will be executed     with this corrupted data.(CVE-2020-6096)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds write vulnerability was found in glibc     when handling signal trampolines on PowerPC. The     backtrace function did not properly check the array     bounds when storing the frame address resulting in a     denial of service or potential code execution. The     highest threat from this vulnerability is to system     availability.(CVE-2020-1751)

  - A signed comparison vulnerability was found in GNU libc     in the ARMv7 implementation of memcpy(). The flaw     affects the third argument to memcpy() that specifies     the number of bytes to copy. An underflow on the third     argument could lead to undefined behavior such as     out-of-bounds memory write and potentially remote code     execution.(CVE-2020-6096)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An exploitable signed comparison vulnerability exists     in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that     utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed     comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could     lead to undefined behavior such as writing to     out-of-bounds memory and potentially remote code     execution. Furthermore, this memcpy() implementation     allows for program execution to continue in scenarios     where a segmentation fault or crash should have     occurred. The dangers occur in that subsequent     execution and iterations of this code will be executed     with this corrupted data.(CVE-2020-6096)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update incorporates fixes from the upstream glibc 2.30 stable release branch, including a fix for a medium severity security vulnerability. (CVE-2020-6096)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update incorporates fixes from the upstream glibc 2.31 stable release branch, including a fix for a medium severity security vulnerability. (CVE-2020-6096)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
504313	Siemens SIMATIC S7-1500 Signed to Unsigned Conversion Error (CVE-2020-6096)	Tenable OT Security	Tenable.ot	high
244972	Linux Distros Unpatched Vulnerability : CVE-2020-6096	Nessus	Misc.	high
236471	Alibaba Cloud Linux 3 : 0122: glibc (ALINUX3-SA-2022:0122)	Nessus	Alibaba Cloud Linux Local Security Checks	high
166426	Debian dla-3152 : glibc-doc - security update	Nessus	Debian Local Security Checks	critical
158502	Ubuntu 18.04 LTS / 20.04 LTS : GNU C Library vulnerabilities (USN-5310-1)	Nessus	Ubuntu Local Security Checks	critical
149477	Ubuntu 16.04 LTS : GNU C Library vulnerabilities (USN-4954-1)	Nessus	Ubuntu Local Security Checks	high
147594	EulerOS Virtualization 2.9.1 : glibc (EulerOS-SA-2021-1600)	Nessus	Huawei Local Security Checks	high
146627	Amazon Linux 2 : glibc (ALAS-2021-1605)	Nessus	Amazon Linux Local Security Checks	high
145333	GLSA-202101-20 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
145196	Fedora 32 : glibc (2021-6e581c051a)	Nessus	Fedora Local Security Checks	high
140967	EulerOS Virtualization for ARM 64 3.0.6.0 : glibc (EulerOS-SA-2020-2019)	Nessus	Huawei Local Security Checks	high
140326	EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2020-1956)	Nessus	Huawei Local Security Checks	high
139952	EulerOS 2.0 SP8 : glibc (EulerOS-SA-2020-1849)	Nessus	Huawei Local Security Checks	high
139259	Fedora 31 : glibc (2020-4e92a61688)	Nessus	Fedora Local Security Checks	high
138656	Fedora 32 : glibc (2020-d860479b2a)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-6096

high

Tenable Plugins

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high