The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way Linux kernel KVM hypervisor     before 4.18 emulated instructions such as     sgdt/sidt/fxsave/fxrstor. It did not check current     privilege(CPL) level while emulating unprivileged     instructions. An unprivileged guest user/process could     use this flaw to potentially escalate privileges inside     guest. (CVE-2018-10853)

  - A flaw was found in the Linux Kernel where an attacker     may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between     connect() and close() function may allow an attacker     using the AF_VSOCK protocol to gather a 4 byte     information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients.
    (CVE-2018-14625)

  - drivers/infiniband/core/ucma.c in the Linux kernel     through 4.17.11 allows ucma_leave_multicast to access a     certain data structure after a cleanup step in     ucma_process_join, which allows attackers to cause a     denial of service (use-after-free). (CVE-2018-14734)

  - arch/x86/kernel/paravirt.c in the Linux kernel before     4.18.1 mishandles certain indirect calls, which makes it     easier for attackers to conduct Spectre-v2 attacks     against paravirtual guests. (CVE-2018-15594)

  - A flaw was found in the Linux kernel's NFS     implementation, all versions 3.x and all versions 4.x up     to 4.20. An attacker, who is able to mount an exported     NFS filesystem, is able to trigger a null pointer     dereference by using an invalid NFS sequence. This can     panic the machine and deny access to the NFS server. Any     outstanding disk writes to the NFS server will be lost.
    (CVE-2018-16871)

  - A flaw was found in the Linux kernel's NFS41+ subsystem.
    NFS41+ shares mounted in different network namespaces at     the same time can make bc_svc_process() use wrong back-     channel IDs and cause a use-after-free vulnerability.
    Thus a malicious container user can cause a host kernel     memory corruption and a system panic. Due to the nature     of the flaw, privilege escalation cannot be fully ruled     out. (CVE-2018-16884)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and reused. This is     fixed in the following kernel versions: 4.9.135,     4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - In the hidp_process_report in bluetooth, there is an     integer overflow. This could lead to an out of bounds     write with no additional execution privileges needed.
    User interaction is not needed for exploitation.
    Product: Android Versions: Android kernel Android ID:
    A-65853588 References: Upstream kernel. (CVE-2018-9363)

  - In pppol2tp_connect, there is possible memory corruption     due to a use after free. This could lead to local     escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation.
    Product: Android. Versions: Android kernel. Android ID:
    A-38159931. (CVE-2018-9517)

  - Insufficient input validation in Kernel Mode Driver in     Intel(R) i915 Graphics for Linux before version 5.0 may     allow an authenticated user to potentially enable     escalation of privilege via local access.
    (CVE-2019-11085)

  - The coredump implementation in the Linux kernel before     5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs,     which allows local users to obtain sensitive     information, cause a denial of service, or possibly have     unspecified other impact by triggering a race condition     with mmget_not_zero or get_task_mm calls. This is     related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and     drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - An issue was discovered in the Linux kernel before     5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in     megasas_alloc_cmds() in     drivers/scsi/megaraid/megaraid_sas_base.c. This causes a     Denial of Service, related to a use-after-free.
    (CVE-2019-11810)

  - An issue was discovered in the Linux kernel before     5.0.4. There is a use-after-free upon attempted read     access to /proc/ioports after the ipmi_si module is     removed, related to drivers/char/ipmi/ipmi_si_intf.c,     drivers/char/ipmi/ipmi_si_mem_io.c, and     drivers/char/ipmi/ipmi_si_port_io.c. (CVE-2019-11811)

  - fs/ext4/extents.c in the Linux kernel through 5.1.2 does     not zero out the unused memory region in the extent tree     block, which might allow local users to obtain sensitive     information by reading uninitialized data in the     filesystem. (CVE-2019-11833)

  - A heap address information leak while using     L2CAP_GET_CONF_OPT was discovered in the Linux kernel     before 5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including     L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - A flaw was found in the Linux kernel's vfio interface     implementation that permits violation of the user's     locked memory limit. If a device is bound to a vfio     driver, such as vfio-pci, and the local attacker is     administratively granted ownership of the device, it may     cause a system memory exhaustion and thus a denial of     service (DoS). Versions 3.10, 4.14 and 4.18 are     vulnerable. (CVE-2019-3882)

  - An infinite loop issue was found in the vhost_net kernel     module in Linux Kernel up to and including v5.1-rc6,     while handling incoming packets in handle_rx(). It could     occur if one end sends packets faster than the other end     can process them. A guest user, maybe remote one, could     use this flaw to stall the vhost_net kernel thread,     resulting in a DoS scenario. (CVE-2019-3900)

  - The mincore() implementation in mm/mincore.c in the     Linux kernel through 4.19.13 allowed local attackers to     observe page cache access patterns of other processes on     the same system, potentially allowing sniffing of secret     information. (Fixing this affects the output of the     fincore program.) Limited remote exploitation may be     possible, as demonstrated by latency differences in     accessing public files from an Apache HTTP Server.
    (CVE-2019-5489)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Linux kernel's NFS41+ subsystem.
    NFS41+ shares mounted in different network namespaces at     the same time can make bc_svc_process() use wrong back-     channel IDs and cause a use-after-free vulnerability.
    Thus a malicious container user can cause a host kernel     memory corruption and a system panic. Due to the nature     of the flaw, privilege escalation cannot be fully ruled     out. (CVE-2018-16884)

  - Insufficient input validation in Kernel Mode Driver in     Intel(R) i915 Graphics for Linux before version 5.0 may     allow an authenticated user to potentially enable     escalation of privilege via local access.
    (CVE-2019-11085)

  - A flaw was found in the Linux kernel's NFS     implementation, all versions 3.x and all versions 4.x up     to 4.20. An attacker, who is able to mount an exported     NFS filesystem, is able to trigger a null pointer     dereference by using an invalid NFS sequence. This can     panic the machine and deny access to the NFS server. Any     outstanding disk writes to the NFS server will be lost.
    (CVE-2018-16871)

  - An issue was discovered in the Linux kernel before     5.0.4. There is a use-after-free upon attempted read     access to /proc/ioports after the ipmi_si module is     removed, related to drivers/char/ipmi/ipmi_si_intf.c,     drivers/char/ipmi/ipmi_si_mem_io.c, and     drivers/char/ipmi/ipmi_si_port_io.c. (CVE-2019-11811)

  - A flaw was found in the way Linux kernel KVM hypervisor     before 4.18 emulated instructions such as     sgdt/sidt/fxsave/fxrstor. It did not check current     privilege(CPL) level while emulating unprivileged     instructions. An unprivileged guest user/process could     use this flaw to potentially escalate privileges inside     guest. (CVE-2018-10853)

  - A flaw was found in the Linux Kernel where an attacker     may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between     connect() and close() function may allow an attacker     using the AF_VSOCK protocol to gather a 4 byte     information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients.
    (CVE-2018-14625)

  - drivers/infiniband/core/ucma.c in the Linux kernel     through 4.17.11 allows ucma_leave_multicast to access a     certain data structure after a cleanup step in     ucma_process_join, which allows attackers to cause a     denial of service (use-after-free). (CVE-2018-14734)

  - arch/x86/kernel/paravirt.c in the Linux kernel before     4.18.1 mishandles certain indirect calls, which makes it     easier for attackers to conduct Spectre-v2 attacks     against paravirtual guests. (CVE-2018-15594)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and reused. This is     fixed in the following kernel versions: 4.9.135,     4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - An issue was discovered in the Linux kernel before     4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain     error case is mishandled. (CVE-2018-20856)

  - In the hidp_process_report in bluetooth, there is an     integer overflow. This could lead to an out of bounds     write with no additional execution privileges needed.
    User interaction is not needed for exploitation.
    Product: Android Versions: Android kernel Android ID:
    A-65853588 References: Upstream kernel. (CVE-2018-9363)

  - In pppol2tp_connect, there is possible memory corruption     due to a use after free. This could lead to local     escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation.
    Product: Android. Versions: Android kernel. Android ID:
    A-38159931. (CVE-2018-9517)

  - A flaw was found in the Linux kernel. A heap based     buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead     to memory corruption and possibly other consequences.
    (CVE-2019-10126)

  - An information disclosure vulnerability exists when     certain central processing units (CPU) speculatively     access memory, aka 'Windows Kernel Information     Disclosure Vulnerability'. This CVE ID is unique from     CVE-2019-1071, CVE-2019-1073. (CVE-2019-1125)

  - The coredump implementation in the Linux kernel before     5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs,     which allows local users to obtain sensitive     information, cause a denial of service, or possibly have     unspecified other impact by triggering a race condition     with mmget_not_zero or get_task_mm calls. This is     related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and     drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - An issue was discovered in the Linux kernel before     5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in     megasas_alloc_cmds() in     drivers/scsi/megaraid/megaraid_sas_base.c. This causes a     Denial of Service, related to a use-after-free.
    (CVE-2019-11810)

  - fs/ext4/extents.c in the Linux kernel through 5.1.2 does     not zero out the unused memory region in the extent tree     block, which might allow local users to obtain sensitive     information by reading uninitialized data in the     filesystem. (CVE-2019-11833)

  - An out-of-bounds access issue was found in the Linux     kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO     write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write     indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged     host user or process with access to '/dev/kvm' device     could use this flaw to crash the host kernel, resulting     in a denial of service or potentially escalating     privileges on the system. (CVE-2019-14821)

  - A buffer overflow flaw was found, in versions from     2.6.34 to 5.2.x, in the way Linux kernel's vhost     functionality that translates virtqueue buffers to IOVs,     logged the buffer descriptors during migration. A     privileged guest user able to pass descriptors with     invalid length to the host when migration is underway,     could use this flaw to increase their privileges on the     host. (CVE-2019-14835)

  - A heap address information leak while using     L2CAP_GET_CONF_OPT was discovered in the Linux kernel     before 5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including     L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - A flaw that allowed an attacker to corrupt memory and     possibly escalate privileges was found in the mwifiex     kernel module while connecting to a malicious wireless     network. (CVE-2019-3846)

  - A flaw was found in the Linux kernel's vfio interface     implementation that permits violation of the user's     locked memory limit. If a device is bound to a vfio     driver, such as vfio-pci, and the local attacker is     administratively granted ownership of the device, it may     cause a system memory exhaustion and thus a denial of     service (DoS). Versions 3.10, 4.14 and 4.18 are     vulnerable. (CVE-2019-3882)

  - An infinite loop issue was found in the vhost_net kernel     module in Linux Kernel up to and including v5.1-rc6,     while handling incoming packets in handle_rx(). It could     occur if one end sends packets faster than the other end     can process them. A guest user, maybe remote one, could     use this flaw to stall the vhost_net kernel thread,     resulting in a DoS scenario. (CVE-2019-3900)

  - The mincore() implementation in mm/mincore.c in the     Linux kernel through 4.19.13 allowed local attackers to     observe page cache access patterns of other processes on     the same system, potentially allowing sniffing of secret     information. (Fixing this affects the output of the     fincore program.) Limited remote exploitation may be     possible, as demonstrated by latency differences in     accessing public files from an Apache HTTP Server.
    (CVE-2019-5489)

  - The Bluetooth BR/EDR specification up to and including     version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from influencing     the key length negotiation. This allows practical brute-     force attacks (aka KNOB) that can decrypt traffic and     inject arbitrary ciphertext without the victim noticing.
    (CVE-2019-9506)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to     RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack     will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance     between the end of the PIE binary's read-write segment and the start of the stack becomes small enough     that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5.
    This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to     i386 based systems. (CVE-2017-1000371)

  - The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux     kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated,     which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ     operation. (CVE-2017-12192)

  - The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain     match field, related to the keyring_search_iterator function in keyring.c. (CVE-2017-2647)

  - Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R)     Processors may allow an authenticated user to potentially enable denial of service of the host system via     local access. (CVE-2018-12207)

  - Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th     Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold     Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900     Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2019-0154)

  - Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th     Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold     Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900     Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R)     Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077     (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11,     4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of     privilege via local access. (CVE-2019-0155)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm'     device could use this flaw to crash the host kernel, resulting in a denial of service or potentially     escalating privileges on the system. (CVE-2019-14821)

  - base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through     5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21. (CVE-2019-17055)

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
    This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into     the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO     restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate     that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer     dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network     user to crash the system kernel, resulting in a denial of service. (CVE-2020-10711)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

  - A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux     kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by     exhausting available memory. The highest threat from this vulnerability is to system availability.
    (CVE-2021-20265)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3517 advisory.

    - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746804] {CVE-2019-14821}
    - [vhost] vhost: make sure log_num < in_num (Eugenio Perez) [1750882] {CVE-2019-14835}
    - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714476] {CVE-2019-3846}
    - [net] Bluetooth: Fix faulty expression for minimum encryption key size check (Gopal Tiwari) [1743076]     {CVE-2019-9506}
    - [net] Bluetooth: Fix regression with minimum encryption key size alignment (Gopal Tiwari) [1743076]     {CVE-2019-9506}
    - [net] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (Gopal Tiwari)     [1743076] {CVE-2019-9506}
    - [bluetooth] Bluetooth: hci_uart: check for missing tty operations (Gopal Tiwari) [1734239]     {CVE-2019-10207}
    - [documentation] Documentation: Add swapgs description to the Spectre v1 documentation (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [documentation] Documentation: Add section about CPU vulnerabilities for Spectre (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [x86] x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS (Josh Poimboeuf) [1724501]     {CVE-2019-1125}
    - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724501]     {CVE-2019-1125}
    - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [net] sunrpc: make visible processing error in bc_svc_process() ('J. Bruce Fields') [1660823]     {CVE-2018-16884}
    - [net] sunrpc: remove unused xpo_prep_reply_hdr callback ('J. Bruce Fields') [1660823] {CVE-2018-16884}
    - [net] sunrpc: remove svc_tcp_bc_class ('J. Bruce Fields') [1660823] {CVE-2018-16884}
    - [net] sunrpc: replace svc_serv->sv_bc_xprt by boolean flag ('J. Bruce Fields') [1660823]     {CVE-2018-16884}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3217-1 advisory.

  - In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local     escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. (CVE-2018-9517)

  - The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An     attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are     believed to be vulnerable. (CVE-2019-3874)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the virt_ext field, this issue could allow a malicious L1 to     disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the     L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire     system, leak of sensitive data or potential guest-to-host escape. (CVE-2021-3656)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem     with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be     accessible. (CVE-2021-3732)

  - A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may     cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl     (KDSETMDE). The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3753)

  - A memory overflow vulnerability was found in the Linux kernel's ipc functionality of the memcg subsystem,     in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local     user to starve the resources, causing a denial of service. The highest threat from this vulnerability is     to system availability. (CVE-2021-3759)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2029 advisory.

    - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712861]     {CVE-2019-11810}
    - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719915] {CVE-2019-11479}
    - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719915] {CVE-2019-11479}
    - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719595] {CVE-2019-11477}
    - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719595] {CVE-2019-11477}
    - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719850] {CVE-2019-11478}
    - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664199] {CVE-2019-5489}
    - [kernel] alarmtimer: Prevent overflow for relative nanosleep (Artem Savkov) [1653677] {CVE-2018-13053}
    - [fs] ext4: zero out the unused memory region in the extent tree block (Lukas Czerner) [1715280]     {CVE-2019-11833}
    - [vhost] vsock: add weight support (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost_net: fix possible infinite loop (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost_net: introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost_net: use packet weight for rx handler, too (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Jason Wang) [1702943] {CVE-2019-3900}
    - [x86] kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access (Paolo Bonzini)     [1657358] {CVE-2018-10853}
    - [x86] kvm: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system (Paolo Bonzini)     [1657358] {CVE-2018-10853}
    - [x86] kvm: x86: introduce linear_{read,write}_system (Paolo Bonzini) [1657358] {CVE-2018-10853}
    - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714408] {CVE-2019-11811}
    - [fs] sunrpc: make visible processing error in bc_svc_process() ('J. Bruce Fields') [1653675]     {CVE-2018-16884}
    - [fs] sunrpc: remove unused xpo_prep_reply_hdr callback ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] sunrpc: remove svc_tcp_bc_class ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] sunrpc: replace svc_serv->sv_bc_xprt by boolean flag ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] sunrpc: use-after-free in svc_process_common() ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] svcauth_gss: Close connection when dropping an incoming message ('J. Bruce Fields') [1653675]     {CVE-2018-16884}
    - [x86] spectre: Fix an error message (Waiman Long) [1709296 1690335 1690348 1690358] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Fix documentation typo (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] Correct the possible MDS sysfs values (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/mds: Add MDSUM variant to the MDS documentation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add 'mitigations=' support for MDS (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] s390/speculation: Support 'mitigations=' cmdline option (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] powerpc/speculation: Support 'mitigations=' cmdline option (Waiman Long) [1709296     1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation: Support 'mitigations=' cmdline option (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/l1tf: Increase l1tf memory limit for Nehalem+ (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spectre: Simplify spectre_v2 command line parsing (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Properly set/clear mds_idle_clear static key (Waiman Long) [1709296 1690358     1690348 1690335 1707292] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Fix comment (Waiman Long) [1709296 1690358 1690348 1690335] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add SMT warning message (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1709296     1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1709296 1690358     1690348 1690335 1710501 1710498] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] documentation: Add MDS vulnerability documentation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] documentation: Move L1TF to separate directory (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add mitigation control for MDS (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long)     [1709296 1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Consolidate CPU whitelists (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] msr-index: Cleanup bit defines (Waiman Long) [1709296 1690358 1690348 1690335] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] l1tf: Show actual SMT state (Waiman Long) [1709296 1690358 1690348 1690335] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [kernel] x86/speculation: Rework SMT state change (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1709296     1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Add casting to fix compilation error (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [tools] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3967 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * Kernel: KVM: potential use-after-free via kvm_ioctl_create_device() (CVE-2019-6974)

    * Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer (CVE-2019-7221)

    * kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of     service (CVE-2017-18208)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A cluster node has multiple hung mv processes that are accessing a gfs2 filesystem. (BZ#1716321)

    * Growing unreclaimable slab memory (BZ#1741918)

    * [LLNL 7.5 Bug] slab leak causing a crash when using kmem control group (BZ#1748236)

    * kernel build: parallelize redhat/mod-sign.sh (BZ#1755328)

    * kernel build: speed up module compression step (BZ#1755337)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure. (CVE-2019-19448)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before     4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a     denial of service (panic) by corrupting a mountpoint reference counter. (CVE-2020-12114)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat     fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets,     independent of the network configuration. (CVE-2020-26142)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3517 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nfs: use-after-free in svc_process_common() (CVE-2018-16884)

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) (CVE-2019-9506)

    * kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in     drivers/net/wireless/marvell/mwifiex/ie.c (CVE-2019-10126)

    * Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

    * kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c (CVE-2018-19854)

    * kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

    * kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

    * kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

    * kernel: SCTP socket buffer memory leak leading to denial of service (CVE-2019-3874)

    * kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

    * kernel: null-pointer dereference in hci_uart_set_flow_control (CVE-2019-10207)

    * kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

    * kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

    * kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command     (CVE-2019-11884)

    * kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

    * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

    * kernel: Linux stack ASLR implementation Integer overflow (CVE-2015-1593)

    * kernel: oob memory read in hso_probe in drivers/net/usb/hso.c (CVE-2018-19985)

    * Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

    * Kernel: net: weak IP ID generation leads to remote device tracking (CVE-2019-10638)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2043 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * kernel: Buffer overflow in hidp_process_report (CVE-2018-9363)

    * kernel: l2tp: Race condition between pppol2tp_session_create() and l2tp_eth_create() (CVE-2018-9517)

    * kernel: kvm: guest userspace to guest kernel write (CVE-2018-10853)

    * kernel: use-after-free Read in vhost_transport_send_pkt (CVE-2018-14625)

    * kernel: use-after-free in ucma_leave_multicast in drivers/infiniband/core/ucma.c (CVE-2018-14734)

    * kernel: Mishandling of indirect calls weakens Spectre mitigation for paravirtual guests (CVE-2018-15594)

    * kernel: TLB flush happens too late on mremap (CVE-2018-18281)

    * kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

    * kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

    * kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

    * kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

    * kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS     (CVE-2019-11810)

    * kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

    * kernel: Information exposure in fd_locked_ioctl function in drivers/block/floppy.c (CVE-2018-7755)

    * kernel: Memory leak in drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() can lead to potential     denial of service (CVE-2018-8087)

    * kernel: HID: debug: Buffer overflow in hid_debug_events_read() in drivers/hid/hid-debug.c     (CVE-2018-9516)

    * kernel: Integer overflow in the alarm_timer_nsleep function (CVE-2018-13053)

    * kernel: NULL pointer dereference in lookup_slow function (CVE-2018-13093)

    * kernel: NULL pointer dereference in xfs_da_shrink_inode function (CVE-2018-13094)

    * kernel: NULL pointer dereference in fs/xfs/libxfs/xfs_inode_buf.c (CVE-2018-13095)

    * kernel: Information leak in cdrom_ioctl_drive_status (CVE-2018-16658)

    * kernel: out-of-bound read in memcpy_fromiovecend() (CVE-2018-16885)

    * Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Kernel: vhost_net: infinite loop while receiving packets     leads to DoS (CVE-2019-3900)

  - Kernel: page cache side channel attacks (CVE-2019-5489)

  - kernel: Buffer overflow in hidp_process_report     (CVE-2018-9363)

  - kernel: l2tp: Race condition between     pppol2tp_session_create() and l2tp_eth_create()     (CVE-2018-9517)

  - kernel: kvm: guest userspace to guest kernel write     (CVE-2018-10853)

  - kernel: use-after-free Read in vhost_transport_send_pkt     (CVE-2018-14625)

  - kernel: use-after-free in ucma_leave_multicast in     drivers/infiniband/core/ucma.c (CVE-2018-14734)

  - kernel: Mishandling of indirect calls weakens Spectre     mitigation for paravirtual guests (CVE-2018-15594)

  - kernel: TLB flush happens too late on mremap     (CVE-2018-18281)

  - kernel: Heap address information leak while using     L2CAP_GET_CONF_OPT (CVE-2019-3459)

  - kernel: Heap address information leak while using     L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

  - kernel: denial of service vector through vfio DMA     mappings (CVE-2019-3882)

  - kernel: fix race condition between     mmget_not_zero()/get_task_mm() and core dumping     (CVE-2019-11599)

  - kernel: a NULL pointer dereference in     drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS     (CVE-2019-11810)

  - kernel: fs/ext4/extents.c leads to information     disclosure (CVE-2019-11833)

  - kernel: Information exposure in fd_locked_ioctl function     in drivers/block/floppy.c (CVE-2018-7755)

  - kernel: Memory leak in     drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl     () can lead to potential denial of service     (CVE-2018-8087)

  - kernel: HID: debug: Buffer overflow in     hid_debug_events_read() in drivers/hid/hid-debug.c     (CVE-2018-9516)

  - kernel: Integer overflow in the alarm_timer_nsleep     function (CVE-2018-13053)

  - kernel: NULL pointer dereference in lookup_slow function     (CVE-2018-13093)

  - kernel: NULL pointer dereference in xfs_da_shrink_inode     function (CVE-2018-13094)

  - kernel: NULL pointer dereference in     fs/xfs/libxfs/xfs_inode_buf.c (CVE-2018-13095)

  - kernel: Information leak in cdrom_ioctl_drive_status     (CVE-2018-16658)

  - kernel: out-of-bound read in memcpy_fromiovecend()     (CVE-2018-16885)

  - Kernel: KVM: leak of uninitialized stack contents to     guest (CVE-2019-7222)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2015-8553     Jan Beulich discovered that CVE-2015-2150 was not     completely addressed. If a PCI physical function is     passed through to a Xen guest, the guest is able to     access its memory and I/O regions before enabling     decoding of those regions. This could result in a     denial-of-service (unexpected NMI) on the host.

  The fix for this is incompatible with qemu versions before 2.5.

  - CVE-2017-18509     Denis Andzakovic reported a missing type check in the     IPv4 multicast routing implementation. A user with the     CAP_NET_ADMIN capability (in any user namespace) could     use this for denial-of-service (memory corruption or     crash) or possibly for privilege escalation.

  - CVE-2018-5995     ADLab of VenusTech discovered that the kernel logged the     virtual addresses assigned to per-CPU data, which could     make it easier to exploit other vulnerabilities.

  - CVE-2018-20836     chenxiang reported a race condition in libsas, the     kernel subsystem supporting Serial Attached SCSI (SAS)     devices, which could lead to a use-after-free. It is not     clear how this might be exploited.

  - CVE-2018-20856     Xiao Jin reported a potential double-free in the block     subsystem, in case an error occurs while initialising     the I/O scheduler for a block device. It is not clear     how this might be exploited.

  - CVE-2019-1125     It was discovered that most x86 processors could     speculatively skip a conditional SWAPGS instruction used     when entering the kernel from user mode, and/or could     speculatively execute it when it should be skipped. This     is a subtype of Spectre variant 1, which could allow     local users to obtain sensitive information from the     kernel or other processes. It has been mitigated by     using memory barriers to limit speculative execution.
    Systems using an i386 kernel are not affected as the     kernel does not use SWAPGS.

  - CVE-2019-3882     It was found that the vfio implementation did not limit     the number of DMA mappings to device memory. A local     user granted ownership of a vfio device could use this     to cause a denial of service (out-of-memory condition).

  - CVE-2019-3900     It was discovered that vhost drivers did not properly     control the amount of work done to service requests from     guest VMs. A malicious guest could use this to cause a     denial-of-service (unbounded CPU usage) on the host.

  - CVE-2019-10207     The syzkaller tool found a potential null dereference in     various drivers for UART-attached Bluetooth adapters. A     local user with access to a pty device or other suitable     tty device could use this for denial-of-service     (BUG/oops).

  - CVE-2019-10638     Amit Klein and Benny Pinkas discovered that the     generation of IP packet IDs used a weak hash function,     'jhash'. This could enable tracking individual computers     as they communicate with different remote servers and     from different networks. The 'siphash' function is now     used instead.

  - CVE-2019-10639     Amit Klein and Benny Pinkas discovered that the     generation of IP packet IDs used a weak hash function     that incorporated a kernel virtual address. This hash     function is no longer used for IP IDs, although it is     still used for other purposes in the network stack.

  - CVE-2019-13631     It was discovered that the gtco driver for USB input     tablets could overrun a stack buffer with constant data     while parsing the device's descriptor. A physically     present user with a specially constructed USB device     could use this to cause a denial-of-service (BUG/oops),     or possibly for privilege escalation.

  - CVE-2019-13648     Praveen Pandey reported that on PowerPC (ppc64el)     systems without Transactional Memory (TM), the kernel     would still attempt to restore TM state passed to the     sigreturn() system call. A local user could use this for     denial-of-service (oops).

  - CVE-2019-14283     The syzkaller tool found a missing bounds check in the     floppy disk driver. A local user with access to a floppy     disk device, with a disk present, could use this to read     kernel memory beyond the I/O buffer, possibly obtaining     sensitive information.

  - CVE-2019-14284     The syzkaller tool found a potential division-by-zero in     the floppy disk driver. A local user with access to a     floppy disk device could use this for denial-of-service     (oops).

  - CVE-2019-15239     Denis Andzakovic reported a possible use-after-free in     the TCP sockets implementation. A local user could use     this for denial-of-service (memory corruption or crash)     or possibly for privilege escalation.

  - (CVE ID not yet assigned)

    The netfilter conntrack subsystem used kernel addresses     as user-visible IDs, which could make it easier to     exploit other security vulnerabilities.

  - XSA-300

    Julien Grall reported that Linux does not limit the     amount of memory which a domain will attempt to balloon     out, nor limits the amount of 'foreign / grant map'     memory which any individual guest can consume, leading     to denial of service conditions (for host or guests).

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3263-1 advisory.

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the     machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector     (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (CVE-2022-21385)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from     the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length     heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary     code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged     code on the target system to exploit this vulnerability. (CVE-2022-2991)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
129920	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0183)	Nessus	NewStart CGSL Local Security Checks	10/15/2019	12/5/2022	high
132495	NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0253)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	12/5/2022	critical
160761	NewStart CGSL MAIN 4.06 : kernel Multiple Vulnerabilities (NS-SA-2022-0075)	Nessus	NewStart CGSL Local Security Checks	5/9/2022	10/30/2023	critical
180632	Oracle Linux 8 : kernel (ELSA-2019-3517)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	critical
153616	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:3217-1)	Nessus	SuSE Local Security Checks	9/24/2021	7/13/2023	high
180763	Oracle Linux 7 : kernel (ELSA-2019-2029)	Nessus	Oracle Linux Local Security Checks	9/7/2023	10/22/2024	high
131375	RHEL 7 : kernel (RHSA-2019:3967)	Nessus	Red Hat Local Security Checks	11/27/2019	11/7/2024	high
153582	OracleVM 3.4 : kernel-uek (OVMSA-2021-0031)	Nessus	OracleVM Local Security Checks	9/23/2021	11/29/2023	critical
130547	RHEL 8 : kernel (RHSA-2019:3517)	Nessus	Red Hat Local Security Checks	11/6/2019	4/15/2025	critical
127655	RHEL 7 : kernel-rt (RHSA-2019:2043)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	high
128226	Scientific Linux Security Update : kernel on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	8/27/2019	5/1/2024	high
127867	Debian DSA-4497-1 : linux - security update	Nessus	Debian Local Security Checks	8/14/2019	5/3/2024	high
165193	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:3263-1)	Nessus	SuSE Local Security Checks	9/15/2022	1/15/2024	high

Detections

Analytics

Plugins Search

high

critical

critical

critical

high

high

high

critical

critical

high

high

high

high