Debian DLA-2494-1 : linux security update
high Nessus Plugin ID 144494
Language:
Synopsis
The remote Debian host is missing a security update.Description
Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.CVE-2020-0427
Elena Petrova reported a bug in the pinctrl subsystem that can lead to a use-after-free after a device is renamed. The security impact of this is unclear.
CVE-2020-8694
Multiple researchers discovered that the powercap subsystem allowed all users to read CPU energy meters, by default. On systems using Intel CPUs, this provided a side channel that could leak sensitive information between user processes, or from the kernel to user processes. The energy meters are now readable only by root, by default.
This issue can be mitigated by running :
chmod go-r /sys/devices/virtual/powercap/*/*/energy_uj
This needs to be repeated each time the system is booted with an unfixed kernel version.
CVE-2020-14351
A race condition was discovered in the performance events subsystem, which could lead to a use-after-free. A local user permitted to access performance events could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.
CVE-2020-25645
A flaw was discovered in the interface driver for GENEVE encapsulated traffic when combined with IPsec. If IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel, tunneled data isn't correctly routed over the encrypted link and sent unencrypted instead.
CVE-2020-25656
Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with the CAP_SYS_TTY_CONFIG capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
CVE-2020-25668
Yuan Ming and Bodong Zhao discovered a race condition in the virtual terminal (vt) driver that could lead to a use-after-free. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
CVE-2020-25669
Bodong Zhao discovered a bug in the Sun keyboard driver (sunkbd) that could lead to a use-after-free. On a system using this driver, a local user could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
CVE-2020-25704
kiyin(尹亮) discovered a potential memory leak in the performance events subsystem. A local user permitted to access performance events could use this to cause a denial of service (memory exhaustion).
Debian's kernel configuration does not allow unprivileged users to access peformance events by default, which fully mitigates this issue.
CVE-2020-25705
Keyu Man reported that strict rate-limiting of ICMP packet transmission provided a side-channel that could help networked attackers to carry out packet spoofing. In particular, this made it practical for off-path networked attackers to 'poison' DNS caches with spoofed responses ('SAD DNS' attack).
This issue has been mitigated by randomising whether packets are counted against the rate limit.
CVE-2020-27673 / XSA-332
Julien Grall from Arm discovered a bug in the Xen event handling code.
Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (excessive CPU usage or hang) in dom0.
CVE-2020-27675 / XSA-331
Jinoh Kang of Theori discovered a race condition in the Xen event handling code. Where Linux was used in a Xen dom0, unprivileged (domU) guests could cause a denial of service (crash) in dom0.
CVE-2020-28974
Yuan Ming discovered a bug in the virtual terminal (vt) driver that could lead to an out-of-bounds read. A local user with access to a virtual terminal, or with the CAP_SYS_TTY_CONFIG capability, could possibly use this to obtain sensitive information from the kernel or to cause a denial of service (crash).
The specific ioctl operation affected by this bug (KD_FONT_OP_COPY) has been disabled, as it is not believed that any programs depended on it.
For Debian 9 stretch, these problems have been fixed in version 4.9.246-2.
We recommend that you upgrade your linux packages.
For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected packages.See Also
https://security-tracker.debian.org/tracker/source-package/linux
https://packages.debian.org/source/stretch/linux
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
Plugin Details
Severity: High
ID: 144494
File Name: debian_DLA-2494.nasl
Version: 1.4
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 12/21/2020
Updated: 6/8/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: CVSS2#E:U/RL:OF/RC:C
CVSS Score Source: CVE-2020-25669
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-libc-dev:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:libusbip-dev:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:usbip:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-doc-4.9:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-kbuild-4.9:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-manual-4.9:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-perf-4.9:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-source-4.9:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:hyperv-daemons:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:libcpupower-dev:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:libcpupower1:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-compiler-gcc-6-arm:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-compiler-gcc-6-s390:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-compiler-gcc-6-x86:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-cpupower:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-4kc-malta:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-5kc-malta:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-686:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-686-pae:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-amd64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-arm64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-armel:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-armhf:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-i386:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-mips:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-mips64el:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-mipsel:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-ppc64el:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-all-s390x:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-amd64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-arm64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-armmp:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-armmp-lpae:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-common:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-common-rt:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-loongson-3:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-marvell:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-octeon:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-powerpc64le:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-rt-686-pae:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-rt-amd64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-headers-4.9.0-9-s390x:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-4kc-malta:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-4kc-malta-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-5kc-malta:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-5kc-malta-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-686:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-686-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-686-pae:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-686-pae-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-amd64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-amd64-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-arm64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-arm64-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-armmp:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-armmp-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-armmp-lpae:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-armmp-lpae-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-loongson-3:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-loongson-3-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-marvell:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-marvell-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-octeon:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-octeon-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-powerpc64le:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-powerpc64le-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-rt-686-pae:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-rt-686-pae-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-rt-amd64:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-rt-amd64-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-s390x:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-image-4.9.0-9-s390x-dbg:*:*:*:*:*:*:*, p-cpe:2.3:a:debian:debian_linux:linux-support-4.9.0-9:*:*:*:*:*:*:*
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 12/18/2020
Vulnerability Publication Date: 9/17/2020
Reference Information
CVE: CVE-2020-0427, CVE-2020-25645, CVE-2020-27673, CVE-2020-27675, CVE-2020-14351, CVE-2020-8694, CVE-2020-25656, CVE-2020-25705, CVE-2020-25704, CVE-2020-25668, CVE-2020-28974, CVE-2020-25669