In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-120612905References: Upstream kernel

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information     due to uninitialized data. This could lead to local information disclosure with system execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-120612905References: Upstream kernel (CVE-2021-39636)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information     due to uninitialized data. This could lead to local information disclosure with system execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-120612905References: Upstream kernel (CVE-2021-39636)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - kernel: information leak in copy_page_to_iter() in iov_iter.c (CVE-2022-0850)

  - kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5361-1 advisory.

    It was discovered that the VFIO PCI driver in the Linux kernel did not properly handle attempts to access     disabled memory spaces. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2020-12888)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly verify certain     fragmented frames. A physically proximate attacker could possibly use this issue to inject or decrypt     packets. (CVE-2020-26141)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation accepted plaintext fragments in     certain situations. A physically proximate attacker could use this issue to inject packets.
    (CVE-2020-26145)

    It was discovered that a race condition existed in the Atheros Ath9k WiFi driver in the Linux kernel. An     attacker could possibly use this to expose sensitive information (WiFi network traffic). (CVE-2020-3702)

    It was discovered a race condition existed in the Unix domain socket implementation in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2021-0920)

    It was discovered that the IPv6 implementation in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2021-0935)

    Zygo Blaxell discovered that the btrfs file system implementation in the Linux kernel contained a race     condition during certain cloning operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2021-28964)

    Dan Carpenter discovered that the block device manager (dm) implementation in the Linux kernel contained a     buffer overflow in the ioctl for listing devices. A privileged local attacker could use this to cause a     denial of service (system crash). (CVE-2021-31916)

    It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly     handle error conditions. A physically proximate attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

    It was discovered that the network packet filtering implementation in the Linux kernel did not properly     initialize information in certain circumstances. A local attacker could use this to expose sensitive     information (kernel memory). (CVE-2021-39636)

    Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that     could result in a read-after-free. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2021-4083)

    Luo Likang discovered that the FireDTV Firewire driver in the Linux kernel did not properly perform bounds     checking in some situations. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2021-42739)

    Brendan Dolan-Gavitt discovered that the Marvell WiFi-Ex USB device driver in the Linux kernel did not     properly handle some error conditions. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2021-43976)

    Amit Klein discovered that the IPv4 implementation in the Linux kernel could disclose internal state in     some situations. An attacker could possibly use this to expose sensitive information. (CVE-2021-45486)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
247571	Linux Distros Unpatched Vulnerability : CVE-2021-39636	Nessus	Misc.	medium
164235	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2022-2273)	Nessus	Huawei Local Security Checks	high
159387	Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-5361-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-39636

medium

Tenable Plugins

medium

high

high