An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka     the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and     escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective     credentials of another task. (CVE-2021-43057)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43057 advisory.

  - An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka     the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and     escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective     credentials of another task. (CVE-2021-43057)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5162-1 advisory.

    Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform     size validations on incoming packets in some situations. An attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2021-3655)

    It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly     deallocate memory in some error conditions. A local attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

    It was discovered that the Aspeed Low Pin Count (LPC) Bus Controller implementation in the Linux kernel     did not properly perform boundary checks in some situations, allowing out-of-bounds write access. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. In     Ubuntu, this issue only affected systems running armhf kernels. (CVE-2021-42252)

    Jann Horn discovered that the SELinux subsystem in the Linux kernel did not properly handle subjective     credentials for tasks in some situations. On systems where SELinux has been enabled, a local attacker     could possibly use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2021-43057)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243654	Linux Distros Unpatched Vulnerability : CVE-2021-43057	Nessus	Misc.	high
172760	CBL Mariner 2.0 Security Update: kernel (CVE-2021-43057)	Nessus	MarinerOS Local Security Checks	high
155751	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5162-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-43057

high

Tenable Plugins

high

high

high