リモートの Ubuntu 18.04 LTS ホストには、USN-4440-1のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - 5.2.13 までの Linux カーネルに問題が見つかりました。drivers/block/nbd.c の nbd_genl_status が nla_nest_start_noflag の戻り値をチェックしません。(CVE-2019-16089)

  -以前5.4.1のLinuxカーネルのkernel/relay.c内のrelay_openでは、ローカルユーザーがNULLのalloc_percpu結果をトリガーすることによってサービス拒否 (中継妨害など) を引き起こす可能性があります。(CVE-2019-19462)

  - 5.6 より前の Linux カーネル内の drivers/media/usb/go7007/snd-go7007.c の go7007_snd_init が失敗パスに対して snd_card_free を呼び出さないため、メモリリークが発生します (CID-9453264ef586)。(CVE-2019-20810)

  -5.4より前のLinuxカーネルのdrivers/firmware/efi/efi.cに問題が発見されました。efivar_ssdt ACPI変数に対する誤ったアクセス権限が、攻撃者によって使用され、ロックダウンまたはセキュアブート制限がバイパスされる可能性があります (別名CID-1957a85b0032)。(CVE-2019-20908) 

  -ユーザー空間コアダンプのLinuxカーネルの実装で欠陥が見つかりました。この欠陥を使用すれば、ローカルアカウントを持っている攻撃者が、重要ではないプログラムをクラッシュさせ、非公開のカーネルデータを盗み出すことができます。
    (CVE-2020-10732)

  -Linuxカーネルの4.5-rc1以降のバージョンで、mremapによってDAX Huge Pagesが処理される方法で欠陥が見つかりました。
    この欠陥により、DAXが有効になっているストレージにアクセスできるローカル攻撃者が、システム上で自分の権限を昇格させる可能性があります。(CVE-2020-10757)

  - 5.8-rc1 より前の Linux カーネルの SSBD 実装で論理バグの欠陥が見つかりました。論理処理のバグにより、ローカルアカウントを持つ攻撃者が、追加の投機的実行の緩和策が実施されているとき、コンテキスト切り替えでSSBD保護を無効にする可能性があります。この問題は、タスク/プロセスごとの条件付きSTIPB切り替えが既存のSSBD切り替えの一番上に追加されたときに発生します。この脆弱性による主な脅威は、機密性に関するものです。(CVE-2020-10766)

  -5.8-rc1以前のLinux カーネルのEnhanced IBPB (間接分岐予測バリア) 実装で欠陥が見つかりました。STIBPが利用できない場合またはEnhanced Indirect Branch Restricted Speculation (IBRS) が利用可能な場合は、IBPB緩和策が無効になります。この欠陥により、ローカル攻撃者が、この構成がアクティブな場合にSpectre V2スタイルの攻撃を仕掛ける可能性があります。この脆弱性による主な脅威は、機密性に関するものです。(CVE-2020-10767)

  -5.8-rc1より前のLinux カーネルのprctl()関数で欠陥が見つかりました。この欠陥を利用することで、無効化された後に間接分岐推論を可能にできます。この呼び出しは、強制が無効になっていないときに誤って「強制が無効になっている」と報告し、システムをSpecter v2攻撃にさらします。この脆弱性による主な脅威は、機密性に関するものです。(CVE-2020-10768)

  - aufs が vfsub_dentry_open() メソッドの inode 参照カウントを不適切に管理していることが判明しました。ローカルの攻撃者がこの脆弱性を悪用して、サービス拒否攻撃を引き起こす可能性があります。(CVE-2020-11935) 

  - Linux kernel 4.4から 5.7.1に問題が見つかりました。k_ascii が連続して複数回呼び出された場合、drivers/tty/vt/keyboard.c で整数オーバーフローが発生します (別名 CID-b86dab054059)。注: コミュニティのメンバーは、整数オーバーフローがこの場合はセキュリティ問題につながらないことを主張しています。(CVE-2020-13974)

  -5.7.7より前のLinuxカーネルのdrivers/acpi/acpi_configfs.cに問題が発見されました。configfsを介した悪意のあるACPIテーブルのインジェクションが、攻撃者によって使用され、ロックダウンとセキュアブート制限がバイパスされる可能性があります (別名CID-75b0cea7bf30)。(CVE-2020-15780) 

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

SUSE Linux Enterprise 15 GA LTSSカーネルが更新され、さまざまなセキュリティとバグ修正が適用されました。

以下のセキュリティバグが修正されました。

CVE-2020-0305：char_dev.cのcdev_getでは、競合状態によりUse-After-Freeが発生する可能性があります。これにより、システム実行権限が必要なローカルでの権限昇格が引き起こされる可能性があります。悪用はユーザーの操作を必要としません（bnc#1174462）。

CVE-2019-20908：drivers/firmware/efi/efi.cで問題が検出されました。これは、攻撃者がefivar_ssdt ACPI変数に対する誤ったアクセス権限を使用して、ロックダウンまたはセキュアブート制限をバイパスすることができるというものです（別名CID-1957a85b0032）（bnc#1173567）。

CVE-2020-15780：drivers/acpi/acpi_configfs.cで問題が検出されました。これは、攻撃者が構成を介した悪意のあるACPIテーブルのインジェクションにより、ロックダウンとセキュアブート制限をバイパスすることができるというものです（別名CID-75b0cea7bf30）（bnc#1173573）。

CVE-2020-15393：drivers/usb/misc/usbtest.c内のusbtest_disconnectでメモリリークが発生します（別名CID-28ebeb8db770）（bnc#1173514）。

CVE-2020-12771：drivers/md/bcache/btree.c内のbtree_gc_coalesceでは、一体化操作が失敗した場合に、デッドロックが発生します（bnc#1171732）。

CVE-2019-16746：net/wireless/nl80211.cで問題が検出されました。これは、ビーコンヘッド内の変数要素の長さがチェックされないために、バッファオーバーフローが引き起こされるというものです（bnc#1152107 1173659）。

CVE-2020-12888：VFIO PCIドライバーは、無効なメモリ空間へのアクセスの試行を誤って処理します（bnc#1171868）。

CVE-2020-10769：IPsec暗号化アルゴリズムのモジュールであるauthencのcrypto/authenc.cのcrypto_authenc_extractkeysで、バッファオーバーリードの欠陥が見つかりました。ペイロードが4バイトより長く、4バイトのアライメント境界のガイドラインに従っていない場合、バッファオーバーリードの脅威が発生し、システムクラッシュを引き起こします。この欠陥により、ユーザー権限を持つローカルの攻撃者がサービス拒否を引き起こす可能性があります（bnc#1173265）。

CVE-2020-10773：s390/s390xにおけるカーネルスタック情報の漏洩が終止されました（bnc#1172999）。

CVE-2020-14416：slipおよびslcan回線制御のtty->disc_data処理における競合状態によって、Use-After-Freeが引き起こされる可能性があります（CID-0ace17d56824）。これはdrivers/net/slip/slip.cおよびdrivers/net/can/slcan.cに影響します（bnc#1162002）。

CVE-2020-10768：間接分岐投機は、PR_SPEC_FORCE_DISABLE prctlコマンドによって強制的に無効にされた後、有効にされる可能性があります（bnc#1172783）。

CVE-2020-10766：Linuxスケジューラの論理バグにより攻撃者がSSBD保護を無効にできる、不正なクロスプロセスSSBDシャットダウンを修正しました（bnc#1172781）。

CVE-2020-10767：STIBPが利用できない場合または強化されたIBRSが利用できる場合に、間接分岐予測バリアは強制的に無効にされていました。
（bnc#1172782）。

CVE-2020-13974：k_asciiが連続して複数回呼び出された場合、drivers/tty/vt/keyboard.cで整数オーバーフローが発生しました（CID-b86dab054059）（bnc#1172775）。

更新パッケージには、セキュリティ関連以外の修正も含まれています。詳細については、アドバイザリを参照してください。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

遠端 Oracle Linux 7 主機上安裝的套件受到 ELSA-2020-5791 公告中提及的一個弱點影響。

  在 5.4 版之前的 Linux 核心的 drivers/firmware/efi/efi.c 中發現一個問題。攻擊者可以使用 efivar_ssdt ACPI 變數的錯誤存取權限繞過鎖定或安全開機限制，亦稱 CID-1957a85b0032。(CVE-2019-20908)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020: 3219 公告中提及的多個弱點影響。

  - 核心：lockdown：透過 efivar_ssdt 導致的 ACPI 寫入繞過 (CVE-2019-20908)

  - 核心：lockdown：透過 acpi_configfs 導致的 ACPI 寫入繞過 (CVE-2020-15780)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 16.04 LTS 主機上安裝的一個套件受到 USN-4427-1 公告中所提及的多個弱點影響。

  - ** 有爭議 ** 在 Linux 核心 5.1.5 及其之前版本的 efi 子系統中發現一個問題。
    arch/x86/platform/efi/efi.c 中的 phys_efi_set_virtual_address_map 和 arch/x86/platform/efi/efi_64.c 中的 efi_call_phys_prolog 未正確處理記憶體配置失敗。注意：有觀點認為此 ID 並非問題，因為提及的認可中涉及的所有程式碼只會在開機時且任何使用者處理程序啟動之前執行。因此，無權限的使用者無法控制它。
    (CVE-2019-12380)

  - 在 5.4.6 及之前版本的 Linux 核心中，drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c 驅動程式中的 USB 裝置有未初始化記憶體的資訊洩漏問題，此弱點亦稱 CID-da2311a6385c。(CVE-2019-19947)

  - 在 5.6 版之前的 Linux 核心中，drivers/media/usb/go7007/snd-go7007.c 的 go7007_snd_init 未針對失敗路徑呼叫 snd_card_free，進而造成記憶體洩漏，此弱點亦稱 CID-9453264ef586。(CVE-2019-20810)

  在 5.4 版之前的 Linux 核心的 drivers/firmware/efi/efi.c 中發現一個問題。攻擊者可以使用 efivar_ssdt ACPI 變數的錯誤存取權限繞過鎖定或安全開機限制，亦稱 CID-1957a85b0032。(CVE-2019-20908)

  - 在 Linux 核心的使用者空間核心傾印實作中發現一個瑕疵。此瑕疵可讓擁有本機帳戶的攻擊者損毀簡單的程式，並洩漏私人核心資料。
    (CVE-2020-10732)

  - 在 5.8-rc1 之前的 Linux 核心 SSBD 實作中發現一個邏輯錯誤缺陷。邏輯處理中有一個錯誤，允許擁有本機帳戶的攻擊者在有其他推測性執行緩解措施的情況下於內容切換期間停用 SSBD 保護機制。此問題是在現有 SSBD 交換的基礎上，新增每個工作/處理程序的條件 STIPB 交換時引入的。此弱點對機密性的威脅最大。(CVE-2020-10766)

  - 在 Linux 核心 5.8-rc1 之前版本的 Enhanced IBPB (Indirect Branch Prediction Barrier) 實作中發現一個瑕疵。當無法使用 STIBP 或可使用增強型間接分支限制推測 (IBRS)時，將停用 IBPB 緩解措施。此瑕疵允許本機攻擊者在此組態啟用的情況下發動 Spectre V2 樣式攻擊。此弱點對機密性的威脅最大。(CVE-2020-10767)

  在 5.8-rc1之前的 Linux 核心的 prctl() 函式中發現一個瑕疵，即此函式停用後仍可被用來啟用間接分支推測。此呼叫會在並未強制停用時誤報「已強制停用」，從而令系統容易遭受 Spectre v2 攻擊。此弱點對機密性的威脅最大。(CVE-2020-10768)

  - 據發現，aufs 未正確管理 vfsub_dentry_open() 方法中的 inode 參照計數。本機攻擊者可利用此弱點造成拒絕服務攻擊。(CVE-2020-11935)

  - 在 Linux 核心 4.4 至 5.7.1 版本中發現一個問題。如果連續多次呼叫 k_ascii，drivers/tty/vt/keyboard.c 中會發生整數溢位，亦即 CID-b86dab054059。注意：社群成員認為，在此情況下，整數溢位不會導致安全性問題。(CVE-2020-13974)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 18.04 LTS 主機上安裝的一個套件受到 USN-4440-1 公告中所提及的多個弱點影響。

  - 在 Linux 核心 5.2.13 及之前版本中發現一個問題。drivers/block/nbd.c 中的 nbd_genl_status 未檢查 nla_nest_start_noflag 傳回值。(CVE-2019-16089)

  - 在 Linux 核心 5.4.1 及之前版本中，kernel/relay.c 的 relay_open 允許本機使用者觸發一個NULL alloc_percpu 結果，進而造成拒絕服務 (如轉送堵塞)。(CVE-2019-19462)

  - 在 5.6 版之前的 Linux 核心中，drivers/media/usb/go7007/snd-go7007.c 的 go7007_snd_init 未針對失敗路徑呼叫 snd_card_free，進而造成記憶體洩漏，此弱點亦稱 CID-9453264ef586。(CVE-2019-20810)

  在 5.4 版之前的 Linux 核心的 drivers/firmware/efi/efi.c 中發現一個問題。攻擊者可以使用 efivar_ssdt ACPI 變數的錯誤存取權限繞過鎖定或安全開機限制，亦稱 CID-1957a85b0032。(CVE-2019-20908)

  - 在 Linux 核心的使用者空間核心傾印實作中發現一個瑕疵。此瑕疵可讓擁有本機帳戶的攻擊者損毀簡單的程式，並洩漏私人核心資料。
    (CVE-2020-10732)

  - 在 Linux 核心 4.5-rc1 之後的版本中，mremap 處理 DAX Huge Pages 的方式中發現一個缺陷。
    此瑕疵允許對啟用 DAX 的儲存空間具有存取權的本機攻擊者提升其系統權限。(CVE-2020-10757)

  - 在 5.8-rc1 之前的 Linux 核心 SSBD 實作中發現一個邏輯錯誤缺陷。邏輯處理中有一個錯誤，允許擁有本機帳戶的攻擊者在有其他推測性執行緩解措施的情況下於內容切換期間停用 SSBD 保護機制。此問題是在現有 SSBD 交換的基礎上，新增每個工作/處理程序的條件 STIPB 交換時引入的。此弱點對機密性的威脅最大。(CVE-2020-10766)

  - 在 Linux 核心 5.8-rc1 之前版本的 Enhanced IBPB (Indirect Branch Prediction Barrier) 實作中發現一個瑕疵。當無法使用 STIBP 或可使用增強型間接分支限制推測 (IBRS)時，將停用 IBPB 緩解措施。此瑕疵允許本機攻擊者在此組態啟用的情況下發動 Spectre V2 樣式攻擊。此弱點對機密性的威脅最大。(CVE-2020-10767)

  在 5.8-rc1之前的 Linux 核心的 prctl() 函式中發現一個瑕疵，即此函式停用後仍可被用來啟用間接分支推測。此呼叫會在並未強制停用時誤報「已強制停用」，從而令系統容易遭受 Spectre v2 攻擊。此弱點對機密性的威脅最大。(CVE-2020-10768)

  - 據發現，aufs 未正確管理 vfsub_dentry_open() 方法中的 inode 參照計數。本機攻擊者可利用此弱點造成拒絕服務攻擊。(CVE-2020-11935)

  - 在 Linux 核心 4.4 至 5.7.1 版本中發現一個問題。如果連續多次呼叫 k_ascii，drivers/tty/vt/keyboard.c 中會發生整數溢位，亦即 CID-b86dab054059。注意：社群成員認為，在此情況下，整數溢位不會導致安全性問題。(CVE-2020-13974)

  - 在 5.7.7 版之前的 Linux 核心的 drivers/acpi/acpi_configfs.c 中發現一個問題。攻擊者可利用透過 configfs 插入的惡意 ACPI 表格來繞過鎖定及安全開機限制，亦稱 CID-75b0cea7bf30。(CVE-2020-15780)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3218 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: lockdown: bypass through ACPI write via efivar_ssdt (CVE-2019-20908)

    * kernel: lockdown: bypass through ACPI write via acpi_configfs (CVE-2020-15780)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel: provide infrastructure to support dual-signing of the kernel (foundation to help address     CVE-2020-10713) (BZ#1837433)

    * [Regression] RHEL8.2 RC  - [Boston/DD2.1] [RHEL8.2/kernel-4.18.0-193.el8.ppc64le] Host kernel crashes     while running storage test bucket on KVM guest (iscsi) (BZ#1852048)

    * RHEL8.2 - s390/mm: fix panic in gup_fast on large pud (BZ#1853336)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3228 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: lockdown: bypass through ACPI write via efivar_ssdt (CVE-2019-20908)

    * kernel: lockdown: bypass through ACPI write via acpi_configfs (CVE-2020-15780)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel: provide infrastructure to support dual-signing of the kernel (foundation to help address     CVE-2020-10713) (BZ#1837431)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3218 advisory.

    - Reverse keys order for dual-signing (Frantisek Hrbata) [1837433 1837434] {CVE-2020-10713}
    - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837433 1837434]     {CVE-2020-10713}
    - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837433 1837434]     {CVE-2020-10713}
    - [acpi] ACPI: configfs: Disallow loading ACPI tables when locked down (Lenny Szubowicz) [1852968 1852969]     {CVE-2020-15780}
    - [firmware] efi: Restrict efivar_ssdt_load when the kernel is locked down (Lenny Szubowicz) [1852948     1852949] {CVE-2019-20908}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-14331: A buffer over write in vgacon_scroll was fixed (bnc#1174205).

CVE-2020-10135: Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key (bnc#1171988).

CVE-2020-0305: In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1174462).

CVE-2019-20908: An issue was discovered in drivers/firmware/efi/efi.c where incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032 (bnc#1173567).

CVE-2020-10781: zram sysfs resource consumption was fixed (bnc#1173074).

CVE-2020-15780: An issue was discovered in drivers/acpi/acpi_configfs.c where injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30 (bnc#1173573).

CVE-2020-15393: usbtest_disconnect in drivers/usb/misc/usbtest.c had a memory leak, aka CID-28ebeb8db770 (bnc#1173514).

CVE-2020-12771: btree_gc_coalesce in drivers/md/bcache/btree.c had a deadlock if a coalescing operation fails (bnc#1171732).

CVE-2019-16746: net/wireless/nl80211.c did not check the length of variable elements in a beacon head, leading to a buffer overflow (bnc#1152107).

CVE-2020-12888: The VFIO PCI driver mishandled attempts to access disabled memory space (bnc#1171868).

CVE-2020-10769: A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allowed a local attacker with user privileges to cause a denial of service (bnc#1173265).

CVE-2020-10773: A kernel stack information leak on s390/s390x was fixed (bnc#1172999).

CVE-2020-14416: A race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c (bnc#1162002).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4439-1 advisory.

    It was discovered that the network block device (nbd) implementation in the Linux kernel did not properly     check for error conditions in some situations. An attacker could possibly use this to cause a denial of     service (system crash). (CVE-2019-16089)

    It was discovered that the btrfs file system implementation in the Linux kernel did not properly validate     file system metadata in some situations. An attacker could use this to construct a malicious btrfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2019-19036)

    It was discovered that the kernel->user space relay implementation in the Linux kernel did not properly     check return values in some situations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2019-19462)

    Chuhong Yuan discovered that go7007 USB audio device driver in the Linux kernel did not properly     deallocate memory in some failure conditions. A physically proximate attacker could use this to cause a     denial of service (memory exhaustion). (CVE-2019-20810)

    It was discovered that the elf handling code in the Linux kernel did not initialize memory before using it     in certain situations. A local attacker could use this to possibly expose sensitive information (kernel     memory). (CVE-2020-10732)

    Fan Yang discovered that the mremap implementation in the Linux kernel did not properly handle DAX Huge     Pages. A local attacker with access to DAX storage could use this to gain administrative privileges.
    (CVE-2020-10757)

    It was discovered that the Linux kernel did not correctly apply Speculative Store Bypass Disable (SSBD)     mitigations in certain situations. A local attacker could possibly use this to expose sensitive     information. (CVE-2020-10766)

    It was discovered that the Linux kernel did not correctly apply Indirect Branch Predictor Barrier (IBPB)     mitigations in certain situations. A local attacker could possibly use this to expose sensitive     information. (CVE-2020-10767)

    It was discovered that the Linux kernel could incorrectly enable Indirect Branch Speculation after it has     been disabled for a process via a prctl() call. A local attacker could possibly use this to expose     sensitive information. (CVE-2020-10768)

    Mauricio Faria de Oliveira discovered that the aufs implementation in the Linux kernel improperly managed     inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to     cause a denial of service. (CVE-2020-11935)

    It was discovered that the Virtual Terminal keyboard driver in the Linux kernel contained an integer     overflow. A local attacker could possibly use this to have an unspecified impact. (CVE-2020-13974)

    It was discovered that the efi subsystem in the Linux kernel did not handle memory allocation failures     during early boot in some situations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2019-12380)

    Jason A. Donenfeld discovered that the ACPI implementation in the Linux kernel did not properly restrict     loading SSDT code from an EFI variable. A privileged attacker could use this to bypass Secure Boot     lockdown restrictions and execute arbitrary code in the kernel. (CVE-2019-20908)

    Jason A. Donenfeld discovered that the ACPI implementation in the Linux kernel did not properly restrict     loading ACPI tables via configfs. A privileged attacker could use this to bypass Secure Boot lockdown     restrictions and execute arbitrary code in the kernel. (CVE-2020-15780)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0305: In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1174462).

CVE-2019-20908: An issue was discovered in drivers/firmware/efi/efi.c where incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032 (bnc#1173567).

CVE-2020-15780: An issue was discovered in drivers/acpi/acpi_configfs.c where injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30 (bnc#1173573).

CVE-2020-15393: usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770 (bnc#1173514).

CVE-2020-12771: btree_gc_coalesce in drivers/md/bcache/btree.c had a deadlock if a coalescing operation fails (bnc#1171732).

CVE-2019-16746: net/wireless/nl80211.c did not check the length of variable elements in a beacon head, leading to a buffer overflow (bnc#1152107).

CVE-2020-12888: The VFIO PCI driver mishandled attempts to access disabled memory space (bnc#1171868).

CVE-2020-10769: A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allowed a local attacker with user privileges to cause a denial of service (bnc#1173265).

CVE-2020-10773: A kernel stack information leak on s390/s390x was fixed (bnc#1172999).

CVE-2020-14416: A race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c (bnc#1162002).

CVE-2020-10768: Indirect branch speculation could have been enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command. (bnc#1172783).

CVE-2020-10766: Fixed Rogue cross-process SSBD shutdown, where a Linux scheduler logical bug allows an attacker to turn off the SSBD protection. (bnc#1172781).

CVE-2020-10767: Indirect Branch Prediction Barrier was force-disabled when STIBP is unavailable or enhanced IBRS is available.
(bnc#1172782).

CVE-2020-13974: drivers/tty/vt/keyboard.c had an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059.
(bnc#1172775).

CVE-2019-20810: go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel did not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586 (bnc#1172458).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-10135: Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key (bnc#1171988).

CVE-2020-0305: In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1174462).

CVE-2019-20908: An issue was discovered in drivers/firmware/efi/efi.c where incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032 (bnc#1173567).

CVE-2020-10781: zram sysfs resource consumption was fixed (bnc#1173074).

CVE-2020-15780: An issue was discovered in drivers/acpi/acpi_configfs.c where injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30 (bnc#1173573).

CVE-2020-15393: usbtest_disconnect in drivers/usb/misc/usbtest.c had a memory leak, aka CID-28ebeb8db770 (bnc#1173514).

CVE-2020-12771: btree_gc_coalesce in drivers/md/bcache/btree.c had a deadlock if a coalescing operation fails (bnc#1171732).

CVE-2020-12888: The VFIO PCI driver mishandled attempts to access disabled memory space (bnc#1171868).

CVE-2020-10769: A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allowed a local attacker with user privileges to cause a denial of service (bnc#1173265).

CVE-2020-10773: A kernel stack information leak on s390/s390x was fixed (bnc#1172999).

CVE-2020-14416: A race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c (bnc#1162002).

CVE-2020-10766: Fixed an issue which allowed an attacker with a local account to disable SSBD protection (bnc#1172781).

CVE-2020-10767: Fixed an issue where Indirect Branch Prediction Barrier was disabled in certain circumstances, leaving the system open to a spectre v2 style attack (bnc#1172782).

CVE-2020-10768: Fixed an issue with the prctl() function, where indirect branch speculation could be enabled even though it was diabled before (bnc#1172783).

CVE-2020-13974: Fixed a integer overflow in drivers/tty/vt/keyboard.c, if k_ascii is called several times in a row (bnc#1172775).

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12659: Fixed an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) due to improper headroom validation (bsc#1171214).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20806: Fixed a NULL pointer dereference which may had lead to denial of service (bsc#1172199).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2019-20810: go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c did not call snd_card_free for a failure path, which caused a memory leak, aka CID-9453264ef586 (bnc#1172458).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
139028	Ubuntu 18.04 LTS: Linux カーネルの脆弱性 (USN-4440-1)	Nessus	Ubuntu Local Security Checks	7/28/2020	8/27/2024	high
139309	SUSE SLES15セキュリティ更新プログラム：カーネル（SUSE-SU-2020:2106-1）	Nessus	SuSE Local Security Checks	8/4/2020	2/27/2024	critical
139166	Oracle Linux 7：Unbreakable Enterprise 核心 (ELSA-2020-5791)	Nessus	Oracle Linux Local Security Checks	7/30/2020	11/1/2024	medium
139183	RHEL 8：kernel-rt (RHSA-2020: 3219)	Nessus	Red Hat Local Security Checks	7/30/2020	11/7/2024	medium
138836	Ubuntu 16.04 LTS：Linux 核心弱點 (USN-4427-1)	Nessus	Ubuntu Local Security Checks	7/22/2020	8/27/2024	high
139028	Ubuntu 18.04 LTS：Linux 核心弱點 (USN-4440-1)	Nessus	Ubuntu Local Security Checks	7/28/2020	8/27/2024	high
139188	RHEL 8 : kernel (RHSA-2020:3218)	Nessus	Red Hat Local Security Checks	7/30/2020	11/7/2024	medium
139191	RHEL 8 : kernel (RHSA-2020:3228)	Nessus	Red Hat Local Security Checks	7/30/2020	11/7/2024	medium
139275	Oracle Linux 8 : kernel (ELSA-2020-3218)	Nessus	Oracle Linux Local Security Checks	8/3/2020	11/1/2024	medium
139363	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2122-1)	Nessus	SuSE Local Security Checks	8/6/2020	2/26/2024	critical
139027	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4439-1)	Nessus	Ubuntu Local Security Checks	7/28/2020	8/27/2024	high
139362	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2121-1)	Nessus	SuSE Local Security Checks	8/6/2020	2/26/2024	critical
140378	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:2487-1)	Nessus	SuSE Local Security Checks	9/8/2020	5/12/2022	high

Detections

Analytics

Plugins Search

high

critical

medium

medium

high

high

medium

medium

medium

critical

high

critical

high