RHEL 8 : kernel (RHSA-2020:4431)

high Nessus Plugin ID 142430

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4431 advisory.

- kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c causing denial of service (CVE-2019-12614)

- kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

- kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

- kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

- kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

- kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c (CVE-2019-18808)

- kernel: memory leak in af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c (CVE-2019-18809)

- kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c (CVE-2019-19046)

- kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows to cause DoS (CVE-2019-19056)

- kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS (CVE-2019-19062)

- kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c allow for a DoS (CVE-2019-19063)

- kernel: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows for a DoS (CVE-2019-19068)

- kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a DoS (CVE-2019-19072)

- kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

- Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

- kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c (CVE-2019-19447)

- kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free (CVE-2019-19524)

- kernel: information leak bug caused by a malicious USB device in the drivers/media/usb/ttusb- dec/ttusb_dec.c (CVE-2019-19533)

- kernel: race condition caused by a malicious USB device in the USB character device driver layer (CVE-2019-19537)

- kernel: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c (CVE-2019-19543)

- kernel: cached use of fpu_fpregs_owner_ctx in arch/x86/include/asm/fpu/internal.h can lead to DoS (CVE-2019-19602)

- kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c and fs/ext4/super.c (CVE-2019-19767)

- kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c (CVE-2019-19770)

- kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

- kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

- kernel: af_packet: TPACKET_V3: invalid timer timeout on error (CVE-2019-20812)

- kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure (CVE-2019-9455)

- kernel: use after free due to race condition in the video driver leads to local privilege escalation (CVE-2019-9458)

- kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

- kernel: bad kfree in auditfilter.c may lead to escalation of privilege (CVE-2020-0444)

- kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

- kernel: SELinux netlink permission check bypass (CVE-2020-10751)

- kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)

- kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features (CVE-2020-10774)

- kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

- kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

- kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

- kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c (CVE-2020-12465)

- kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

- kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption (CVE-2020-12659)

- kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

- kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

- kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

- kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

- kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647)

- kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648)

- kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c (CVE-2020-8649)

- kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 142430

File Name: redhat-RHSA-2020-4431.nasl

Version: 1.11

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 11/4/2020

Updated: 2/9/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-12659

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2019-19770

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-devel, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-modules, p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-tools, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra, cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:rhel_aus:8.4, cpe:/o:redhat:rhel_aus:8.6, cpe:/o:redhat:rhel_e4s:8.4, cpe:/o:redhat:rhel_e4s:8.6, cpe:/o:redhat:rhel_eus:8.4, cpe:/o:redhat:rhel_eus:8.6, cpe:/o:redhat:rhel_tus:8.4, cpe:/o:redhat:rhel_tus:8.6, p-cpe:/a:redhat:enterprise_linux:bpftool, p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists, p-cpe:/a:redhat:enterprise_linux:kernel-core, p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers, p-cpe:/a:redhat:enterprise_linux:kernel-debug, p-cpe:/a:redhat:enterprise_linux:kernel-debug-core, p-cpe:/a:redhat:enterprise_linux:perf, p-cpe:/a:redhat:enterprise_linux:python3-perf

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/4/2020

Vulnerability Publication Date: 5/30/2019

Reference Information

CVE: CVE-2019-12614, CVE-2019-15917, CVE-2019-15925, CVE-2019-16231, CVE-2019-16233, CVE-2019-18808, CVE-2019-18809, CVE-2019-19046, CVE-2019-19056, CVE-2019-19062, CVE-2019-19063, CVE-2019-19068, CVE-2019-19072, CVE-2019-19319, CVE-2019-19332, CVE-2019-19447, CVE-2019-19524, CVE-2019-19533, CVE-2019-19537, CVE-2019-19543, CVE-2019-19767, CVE-2019-19770, CVE-2019-20054, CVE-2019-20636, CVE-2019-9455, CVE-2019-9458, CVE-2020-0305, CVE-2020-10732, CVE-2020-10751, CVE-2020-10773, CVE-2020-10774, CVE-2020-10942, CVE-2020-11565, CVE-2020-11668, CVE-2020-12465, CVE-2020-12655, CVE-2020-12659, CVE-2020-12770, CVE-2020-12826, CVE-2020-14381, CVE-2020-25641, CVE-2020-8647, CVE-2020-8648, CVE-2020-8649

BID: 108550

CWE: 119, 120, 20, 200, 244, 349, 362, 400, 401, 416, 476, 626, 672, 772, 787, 805, 835, 908, 909, 94, 99

RHSA: 2020:4431

Detections

Analytics