The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1372 advisory.

  - The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is     not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to     arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. (CVE-2019-18660)

  - In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of     other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user     starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector     registers. At some point, the vector registers will be corrupted with the values from a different local     Linux process because of a missing arch/powerpc/kernel/process.c check. (CVE-2019-15030)

  - In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of     other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction     (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some     point, the vector registers will be corrupted with the values from a different local Linux process,     because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c. (CVE-2019-15031)

  - In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e. (CVE-2019-19527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : kernel (ELSA-2020-1372)

medium Nessus Plugin ID 135378

Version 1.5