The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4388-1 advisory.

    It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform     bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive     information (kernel memory). (CVE-2020-0067)

    It was discovered that memory contents previously stored in microarchitectural special registers after     RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly     exposed to processes on the same or different processor cores. A local attacker could use this to expose     sensitive information. (CVE-2020-0543)

    Piotr Krysiuk discovered that race conditions existed in the file system implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-12114)

    It was discovered that the USB susbsystem's scatter-gather implementation in the Linux kernel did not     properly take data references in some situations, leading to a use-after-free. A physically proximate     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2020-12464)

    Bui Quang Minh discovered that the XDP socket implementation in the Linux kernel did not properly validate     meta-data passed from user space, leading to an out-of-bounds write vulnerability. A local attacker with     the CAP_NET_ADMIN capability could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2020-12659)

    Xiumei Mu discovered that the IPSec implementation in the Linux kernel did not properly encrypt IPv6     traffic in some situations. An attacker could use this to expose sensitive information. (CVE-2020-1749)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4388-1)

high Nessus Plugin ID 137298

Version 1.8

Version 1.7

Version 1.6

Version 1.6

Version 1.8 Aug 29, 2024, 4:23 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408291623
Version 1.7 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.6 Oct 21, 2023, 5:06 AM Plugin metadata Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Detection CVSSv3 score source (set to "CVE-2020-1749") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Plugin Feed: 202310210506
Version 1.6 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856