The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4680-1 advisory.

  - In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in     fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created     with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers     dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs     within blktrace (CVE-2019-19770)

  - In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could     lead to local escalation of privilege in the kernel with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-161151868References: N/A (CVE-2020-0423)

  - Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2     and earlier may allow an unauthenticated user to complete authentication without pairing credentials via     adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or     slave to pair with a previously paired remote device to successfully complete the authentication procedure     without knowing the link key. (CVE-2020-10135)

  - A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was     using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of     bounds. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-25656)

  - A flaw was found in Linux Kernel because access to the global variable fg_console is not properly     synchronized leading to a use after free in con_font_op. (CVE-2020-25668)

  - A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw     allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that     relies on UDP source port randomization are indirectly affected as well on the Linux Based Products     (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4,     SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE     W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All     versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7     LTE EU: Version (CVE-2020-25705)

  - An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. (CVE-2020-27675)

  - A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

  - A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to     read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height. (CVE-2020-28974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4680-1)

high Nessus Plugin ID 144749

Version 1.9

Version 1.8

Version 1.8

Version 1.7

Version 1.6

Version 1.9 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.8 Oct 21, 2023, 9:06 AM Detection Plugin metadata Plugin Feed: 202310210906
Version 1.8 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 1.7 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.6 Dec 7, 2022, 4:47 PM Reference Plugin Feed: 202212071647