RHEL 8 : kernel (RHSA-2021:1578)

high Nessus Plugin ID 149670
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1578 advisory.

- kernel: memory leak in sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c (CVE-2019-18811)

- kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver (CVE-2019-19523)

- kernel: use-after-free bug caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver (CVE-2019-19528)

- kernel: possible out of bounds write in kbd_keycode of keyboard.c (CVE-2020-0431)

- kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in drivers/media/usb/gspca/ov519.c (CVE-2020-11608)

- kernel: DoS by corrupting mountpoint reference counter (CVE-2020-12114)

- kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362)

- kernel: Improper input validation in some Intel(R) Graphics Drivers (CVE-2020-12363)

- kernel: Null pointer dereference in some Intel(R) Graphics Drivers (CVE-2020-12364)

- kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c (CVE-2020-12464)

- kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

- kernel: Use After Free vulnerability in cgroup BPF component (CVE-2020-14356)

- kernel: NULL pointer dereference in serial8250_isa_init_ports function in drivers/tty/serial/8250/8250_core.c (CVE-2020-15437)

- kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

- kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

- kernel: incomplete permission checking for access to rbd devices (CVE-2020-25284)

- kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c (CVE-2020-25285)

- kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow (CVE-2020-25643)

- kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)

- kernel: use-after-free in kernel midi subsystem (CVE-2020-27786)

- kernel: child process is able to access parent mm through hfi dev file handle (CVE-2020-27835)

- kernel: slab-out-of-bounds read in fbcon (CVE-2020-28974)

- kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent (CVE-2020-35508)

- kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations (CVE-2020-36322)

- kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege (CVE-2021-0342)

- kernel: In pfkey_dump() dplen and splen can both be specified to access the xfrm_address_t structure out of bounds (CVE-2021-0605)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://cwe.mitre.org/data/definitions/20.html

https://cwe.mitre.org/data/definitions/119.html

https://cwe.mitre.org/data/definitions/125.html

https://cwe.mitre.org/data/definitions/190.html

https://cwe.mitre.org/data/definitions/284.html

https://cwe.mitre.org/data/definitions/362.html

https://cwe.mitre.org/data/definitions/367.html

https://cwe.mitre.org/data/definitions/400.html

https://cwe.mitre.org/data/definitions/416.html

https://cwe.mitre.org/data/definitions/459.html

https://cwe.mitre.org/data/definitions/476.html

https://cwe.mitre.org/data/definitions/665.html

https://cwe.mitre.org/data/definitions/732.html

https://access.redhat.com/security/cve/CVE-2019-18811

https://access.redhat.com/security/cve/CVE-2019-19523

https://access.redhat.com/security/cve/CVE-2019-19528

https://access.redhat.com/security/cve/CVE-2020-0431

https://access.redhat.com/security/cve/CVE-2020-11608

https://access.redhat.com/security/cve/CVE-2020-12114

https://access.redhat.com/security/cve/CVE-2020-12362

https://access.redhat.com/security/cve/CVE-2020-12363

https://access.redhat.com/security/cve/CVE-2020-12364

https://access.redhat.com/security/cve/CVE-2020-12464

https://access.redhat.com/security/cve/CVE-2020-14314

https://access.redhat.com/security/cve/CVE-2020-14356

https://access.redhat.com/security/cve/CVE-2020-15437

https://access.redhat.com/security/cve/CVE-2020-24394

https://access.redhat.com/security/cve/CVE-2020-25212

https://access.redhat.com/security/cve/CVE-2020-25284

https://access.redhat.com/security/cve/CVE-2020-25285

https://access.redhat.com/security/cve/CVE-2020-25643

https://access.redhat.com/security/cve/CVE-2020-25704

https://access.redhat.com/security/cve/CVE-2020-27786

https://access.redhat.com/security/cve/CVE-2020-27835

https://access.redhat.com/security/cve/CVE-2020-28974

https://access.redhat.com/security/cve/CVE-2020-35508

https://access.redhat.com/security/cve/CVE-2020-36322

https://access.redhat.com/security/cve/CVE-2021-0342

https://access.redhat.com/security/cve/CVE-2021-0605

https://access.redhat.com/errata/RHSA-2021:1578

https://bugzilla.redhat.com/1777455

https://bugzilla.redhat.com/1783434

https://bugzilla.redhat.com/1783507

https://bugzilla.redhat.com/1831726

https://bugzilla.redhat.com/1833445

https://bugzilla.redhat.com/1848652

https://bugzilla.redhat.com/1853922

https://bugzilla.redhat.com/1868453

https://bugzilla.redhat.com/1869141

https://bugzilla.redhat.com/1877575

https://bugzilla.redhat.com/1879981

https://bugzilla.redhat.com/1882591

https://bugzilla.redhat.com/1882594

https://bugzilla.redhat.com/1895961

https://bugzilla.redhat.com/1900933

https://bugzilla.redhat.com/1901161

https://bugzilla.redhat.com/1901709

https://bugzilla.redhat.com/1902724

https://bugzilla.redhat.com/1903126

https://bugzilla.redhat.com/1915799

https://bugzilla.redhat.com/1919889

https://bugzilla.redhat.com/1930246

https://bugzilla.redhat.com/1930249

https://bugzilla.redhat.com/1930251

https://bugzilla.redhat.com/1949560

https://bugzilla.redhat.com/1974823

Plugin Details

Severity: High

ID: 149670

File Name: redhat-RHSA-2021-1578.nasl

Version: 1.3

Type: local

Agent: unix

Published: 5/19/2021

Updated: 7/26/2021

Dependencies: ssh_get_info.nasl, redhat_repos.nasl, linux_alt_patch_detect.nasl

Risk Information

CVSS Score Source: CVE-2020-25643

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:rhel_aus:8.4, cpe:/o:redhat:rhel_e4s:8.4, cpe:/o:redhat:rhel_eus:8.4, cpe:/o:redhat:rhel_tus:8.4, p-cpe:/a:redhat:enterprise_linux:bpftool, p-cpe:/a:redhat:enterprise_linux:kernel, p-cpe:/a:redhat:enterprise_linux:kernel-abi-stablelists, p-cpe:/a:redhat:enterprise_linux:kernel-core, p-cpe:/a:redhat:enterprise_linux:kernel-cross-headers, p-cpe:/a:redhat:enterprise_linux:kernel-debug, p-cpe:/a:redhat:enterprise_linux:kernel-debug-core, p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules, p-cpe:/a:redhat:enterprise_linux:kernel-debug-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-devel, p-cpe:/a:redhat:enterprise_linux:kernel-headers, p-cpe:/a:redhat:enterprise_linux:kernel-modules, p-cpe:/a:redhat:enterprise_linux:kernel-modules-extra, p-cpe:/a:redhat:enterprise_linux:kernel-tools, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs, p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-core, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-devel, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules, p-cpe:/a:redhat:enterprise_linux:kernel-zfcpdump-modules-extra, p-cpe:/a:redhat:enterprise_linux:perf, p-cpe:/a:redhat:enterprise_linux:python3-perf

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 5/18/2021

Vulnerability Publication Date: 11/7/2019

Reference Information

CVE: CVE-2019-18811, CVE-2019-19523, CVE-2019-19528, CVE-2020-0431, CVE-2020-11608, CVE-2020-12114, CVE-2020-12362, CVE-2020-12464, CVE-2020-14314, CVE-2020-14356, CVE-2020-15437, CVE-2020-24394, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25643, CVE-2020-25704, CVE-2020-27786, CVE-2020-27835, CVE-2020-28974, CVE-2020-35508, CVE-2020-36322, CVE-2021-0342

RHSA: 2021:1578

CWE: 20, 119, 125, 190, 284, 362, 367, 400, 416, 459, 476, 665, 732