The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0004 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c     (CVE-2020-25211)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the RHEL-8.3.z source tree (BZ#1906140)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0003 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c     (CVE-2020-25211)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * avoid flush_backlog IPI for isolated CPUs by configuring RPS cpumask (BZ#1883314)

    * rngd consumes 100% cpu on rhel-8.3 system in fips mode (BZ#1886192)

    * RHEL8.1 - Random memory corruption may occur due to incorrect tlbflush (BZ#1899208)

    * fips mode boot is broken after adding extrng (BZ#1899584)

    * pmtu of 1280 for vxlan as bridge port won't work (BZ#1902082)

    * rpc task loop with kworker spinning at 100% CPU for 10 minutes when umount an NFS 4.x share with     sec=krb5 triggered by unmount of the NFS share (BZ#1907667)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.198-152.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1495 advisory.

    In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure.A flaw was found in the Linux kernel's implementation of BTRFS free space     management, where the kernel does not correctly manage the lifetime of internal data structures used. An     attacker could use this flaw to corrupt memory or escalate privileges. (CVE-2019-19448)

    A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file     system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash     the system if the directory exists. The highest threat from this vulnerability is to system availability.A     memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it     accesses a directory with broken indexing. This flaw allows a local user to crash the system if the     directory exists. The highest threat from this vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability.A flaw was found in the Linux kernel's     implementation of the invert video code on VGA consoles when a local attacker attempts to resize the     console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a     local user with access to the VGA console to crash the system, potentially escalating their privileges on     the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14331)

    In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.A flaw was     found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could     overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25211)

    A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers     to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.A flaw was found in the NFSv4 implementation where when     mounting a remote attacker controlled server it could return specially crafted response allow for local     memory corruption and possibly privilege escalation. (CVE-2020-25212)

    A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified     other impact, aka CID-17743798d812. (CVE-2020-25285)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.203-156.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1556 advisory.

    In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could     lead to local escalation of privilege in the kernel with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-161151868References: N/A (cve-2020-0423)

    A flaw was found in the way the Linux kernel's Bluetooth implementation handled L2CAP (Logical Link     Control and Adaptation Protocol) packets with A2MP (Alternate MAC-PHY Manager Protocol) CID (Channel     Identifier). This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial     of service or potentially executing arbitrary code on the system by sending a specially crafted L2CAP     packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-12351)

    An information leak flaw was found in the way Linux kernel's Bluetooth stack implementation handled     initialization of stack memory when handling certain AMP (Alternate MAC-PHY Manager Protocol) packets.
    This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the     system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data     confidentiality. (CVE-2020-12352)

    A heap buffer overflow flaw was found in the way the Linux kernel's Bluetooth implementation processed     extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the     system, causing a denial of service or to potentially execute arbitrary code on the system by sending a     specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2020-24490)

    A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration,     could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25211)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4658-1 advisory.

    It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-     connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to     complete authentication without pairing credentials via adjacent access. A physically proximate attacker     could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

    It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a     use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

    It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some     edge cases in software scrollback. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2020-14390)

    It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly     perform bounds checking in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2020-25211)

    It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform     privilege checks for access to rbd devices in some situations. A local attacker could use this to map or     unmap rbd block devices. (CVE-2020-25284)

    It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2020-25643)

    It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did     not properly select IP routes in some situations. An attacker could use this to expose sensitive     information (unencrypted network traffic). (CVE-2020-25645)

    Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in     scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that     depend on source port randomization. (CVE-2020-25705)

    It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range     checks in certain situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2020-28915)

    It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in     certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0774 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: bad kfree in auditfilter.c may lead to escalation of privilege (CVE-2020-0444)

    * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c     (CVE-2020-25211)

    * kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661)

    * kernel: performance counters race condition use-after-free (CVE-2020-14351)

    * kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-8.2.z7 Batch source tree (BZ#1915947)

    * kernel-rt possible livelock: WARNING: CPU: 28 PID: 3109 at kernel/ptrace.c:242     ptrace_check_attach+0xdd/0x1a0 (BZ#1925309)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0857 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c     (CVE-2020-25211)

    * kernel: SCSI target (LIO) write to any block on ILO backstore (CVE-2020-28374)

    * kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661)

    * kernel: malicious USB devices can lead to multiple out-of-bounds write (CVE-2019-19532)

    * kernel: out-of-bounds reads in pinctrl subsystem. (CVE-2020-0427)

    * kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c (CVE-2020-7053)

    * kernel: performance counters race condition use-after-free (CVE-2020-14351)

    * kernel: Geneve/IPsec traffic may be unencrypted between two Geneve endpoints (CVE-2020-25645)

    * kernel: use-after-free in read in vt_do_kdgkb_ioctl (CVE-2020-25656)

    * kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

    * kernel: increase slab leak leads to DoS (CVE-2021-20265)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update to the latest RHEL7.9.z4 source tree (BZ#1917909)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
    (CVE-2020-25211)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A stack information leak flaw was found in s390/s390x     in the Linux kernel's memory manager functionality,     where it incorrectly writes to the     /proc/sys/vm/cmm_timeout file. This flaw allows a local     user to see the kernel data.(CVE-2020-10773)

  - In the Android kernel in the video driver there is a     use after free due to a race condition. This could lead     to local escalation of privilege with no additional     execution privileges needed. User interaction is not     needed for exploitation.(CVE-2019-9458)

  - An issue was discovered in the Linux kernel before     5.2.6. On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - An out-of-bounds memory write flaw was found in how the     Linux kernel's Voice Over IP H.323 connection tracking     functionality handled connections on ipv6 port 1720.
    This flaw allows an unauthenticated remote user to     crash the system, causing a denial of service. The     highest threat from this vulnerability is to     confidentiality, integrity, as well as system     availability.(CVE-2020-14305)

  - A locking issue was discovered in the tty subsystem of     the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free     attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - Use-after-free vulnerability in fs/block_dev.c in the     Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging     improper access to a certain error     field.(CVE-2020-15436)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

  - An issue was discovered in kmem_cache_alloc_bulk in     mm/slub.c in the Linux kernel before 5.5.11. The     slowpath lacks the required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)

  - A flaw was found in the Linux kernel. A use-after-free     memory flaw was found in the perf subsystem allowing a     local attacker with permission to monitor perf events     to corrupt memory and possibly escalate privileges. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - Improper access control in BlueZ may allow an     unauthenticated user to potentially enable information     disclosure via adjacent access.(CVE-2020-12352)

  - In cdev_get of char_dev.c, there is a possible     use-after-free due to a race condition. This could lead     to local escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions:
    Android-10Android ID: A-153467744(CVE-2020-0305)

  - A flaw was found in the HDLC_PPP module of the Linux     kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input     validation in the ppp_cp_parse_cr function which can     cause the system to crash or cause a denial of service.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25643)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. The privileged user 'root' with CAP_NET_ADMIN     can create a CAN frame modification rule that makes the     data length code a higher value than the available CAN     frame data size. In combination with a configured     checksum calculation where the result is stored     relatively to the end of the data (e.g.
    cgw_csum_xor_rel) the tail of the skb (e.g. frag_list     pointer in skb_shared_info) can be rewritten which     finally can cause a system crash. Because of a missing     check, the CAN drivers may write arbitrary content     beyond the data registers in the CAN controller's I/O     memory when processing can-gw manipulated outgoing     frames.(CVE-2019-3701)

  - In the Android kernel in Pixel C USB monitor driver     there is a possible OOB write due to a missing bounds     check. This could lead to local escalation of privilege     with System execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2019-9456)

  - A pivot_root race condition in fs/ namespace.c in the     Linux kernel 4.4.x before 4.4.221, 4.9.x before     4.9.221, 4.14.x before 4.14.178, 4.19.x before     4.19.119, and 5.x before 5.3 allows local users to     cause a denial of service (panic) by corrupting a     mountpoint reference counter.(CVE-2020-12114)

  - A flaw was found in the Linux kernel in versions before     5.9-rc7. Traffic between two Geneve endpoints may be     unencrypted when IPsec is configured to encrypt traffic     for the specific UDP port used by the GENEVE tunnel     allowing anyone between the two endpoints to read the     traffic unencrypted. The main threat from this     vulnerability is to data     confidentiality.(CVE-2020-25645)

  - In kbd_keycode of keyboard.c, there is a possible out     of bounds write due to a missing bounds check. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-144161459(CVE-2020-0431)

  - In blk_mq_queue_tag_busy_iter of blk-mq-tag.c, there is     a possible use after free due to improper locking. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-151939299(CVE-2020-0433)

  - In the Linux kernel through 5.8.7, local attackers able     to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering     use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/ netfilter/     nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)

  - A memory out-of-bounds read flaw was found in the Linux     kernel before 5.9-rc2 with the ext3/ext4 file system,     in the way it accesses a directory with broken     indexing. This flaw allows a local user to crash the     system if the directory exists. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14314)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/ nfs/ nfs4proc.c     instead of fs/ nfs/ nfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - A race condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)

  - A flaw was found in the Linux kernel before 5.9-rc4.
    Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest     threat from this vulnerability is to data     confidentiality and integrity.(CVE-2020-14386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0765 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bad kfree in auditfilter.c may lead to escalation of privilege (CVE-2020-0444)

    * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c     (CVE-2020-25211)

    * kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661)

    * kernel: performance counters race condition use-after-free (CVE-2020-14351)

    * kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8.1 - net/smc: fix silent data corruption in SMC (BZ#1882241)

    * [mlx5] VF interface stats are not reflected in ip -s link show / ifconfig <vf> commands (BZ#1889301)

    * [mlx5] IPV6 TOS rewrite flows are not getting offloaded in HW (BZ#1897689)

    * RHEL 8.1 - Call traces show I/O stuck for more than 120 sec when at least one path is available for     NVMe/IB (BZ#1901525)

    * RHEL8: kernel-rt: kernel BUG at kernel/sched/deadline.c:1462! (BZ#1908732)

    * [Hyper-V][RHEL-8] Request to included a commit that adds a timeout to vmbus_wait_for_unload (BZ#1913529)

    * Host becomes unresponsive during stress-ng --cyclic test rcu: INFO: rcu_preempt detected stalls on     CPUs/tasks: (BZ#1913965)

    * race condition when creating child sockets from syncookies (BZ#1915530)

    * Missing mm backport to fix regression introduced by another mm backport (BZ#1915815)

    * On System Z, a hash needs state randomized for entropy extraction (BZ#1915817)

    * [Hyper-V][RHEL-8]video: hyperv_fb: Fix the cache type when mapping the VRAM Edit (BZ#1917712)

    * kvm-rhel8.3 [AMD] - system crash observed while powering on virtual machine with attached VF interfaces.
    (BZ#1919886)

    * [CKI kernel builds]: x86 binaries in non-x86 kernel rpms breaks systemtap (BZ#1929909)

    * rpmbuild cannot build the userspace RPMs in the kernel package when the kernel itself is not built     (BZ#1929911)

    Enhancement(s):

    * [Mellanox 8.4 FEAT] mlx5: Add messages when VF-LAG fails to start (BZ#1892345)

    * Add kernel option to change cpumask for kernel threads (BZ#1915344)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0856 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c     (CVE-2020-25211)

    * kernel: SCSI target (LIO) write to any block on ILO backstore (CVE-2020-28374)

    * kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free (CVE-2020-29661)

    * kernel: malicious USB devices can lead to multiple out-of-bounds write (CVE-2019-19532)

    * kernel: out-of-bounds reads in pinctrl subsystem. (CVE-2020-0427)

    * kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c (CVE-2020-7053)

    * kernel: performance counters race condition use-after-free (CVE-2020-14351)

    * kernel: Geneve/IPsec traffic may be unencrypted between two Geneve endpoints (CVE-2020-25645)

    * kernel: use-after-free in read in vt_do_kdgkb_ioctl (CVE-2020-25656)

    * kernel: ICMP rate limiting can be used for DNS poisoning attack (CVE-2020-25705)

    * kernel: increase slab leak leads to DoS (CVE-2021-20265)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * BUG: scheduling while atomic: memory allocation under spinlock in scsi_register_device_handler()     (BZ#1619147)

    * WARNING in __iscsit_free_cmd during recovery Abort (BZ#1784540)

    * lpfc does not issue adisc to fcp-2 devices, does not respond to nvme targer that send an adisc.
    (BZ#1875961)

    * Panic in semctl_nolock.constprop.15+0x25b (BZ#1877264)

    * [RHEL 7.7][md]Crash due to invalid pool workqueue pointer, work queue race (BZ#1889372)

    * Guest crash on intel CPU with -cpu host,-spec-ctrl,+ibpb (BZ#1890669)

    * RHEL7.9 - kernel/uv: handle length extension properly (BZ#1899172)

    * Commit b144f013fc16a06d7a4b9a4be668a3583fafeda2 'i40e: don't report link up for a VF who hasn't enabled     queues' introducing issues with VM using DPDK (BZ#1901064)

    * writing to /sys/devices/(...)/net/eno49/queues/tx-16/xps_cpus triggers kernel panic (BZ#1903819)

    * [Hyper-V][RHEL-7.9]video: hyperv_fb: Fix the cache type when mapping the VRAM Edit (BZ#1908896)

    * kvm-rhel7.9 [AMD] - system crash observed while powering on virtual machine with attached VF interfaces.
    (BZ#1909036)

    * kernel: nvme nvme7: Connect command failed, error wo/DNR bit: 2 (BZ#1910817)

    * dm-mirror crashes from assuming underlying storage will have a non-NULL merge_bvec_fn (BZ#1916407)

    * watchdog: use nmi registers snapshot in hardlockup handler (BZ#1916589)

    * [DELL EMC 7.9 BUG] - Intel E810 NIC interfaces are not functional in RHEL 7.9 on system with AMD Rome     CPUs (BZ#1918273)

    * [DELL EMC BUG] RHEL system log shows AMD-Vi error when system connected with Gen 4 NVMe drives.
    (BZ#1921187)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5912 advisory.

    - kexec: validate pe files against the system_blacklist_keyring (Eric Snowberg)  [Orabug: 31961119]     {CVE-2020-26541}
    - usb: cdc-acm: make sure a refcount is taken early enough (Oliver Neukum)  [Orabug: 31351088]     {CVE-2019-19530}
    - netfilter: ctnetlink: add a range check for l3/l4 protonum (Will McVicker)  [Orabug: 31872865]     {CVE-2020-25211}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.1 advisory.

  - xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and     watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows     remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory     corruption) via a crafted XML document. (CVE-2016-4658)

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.7 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.5.5 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144705	RHEL 8 : kernel-rt (RHSA-2021:0004)	Nessus	Red Hat Local Security Checks	1/4/2021	11/7/2024	medium
144706	RHEL 8 : kernel (RHSA-2021:0003)	Nessus	Red Hat Local Security Checks	1/4/2021	3/6/2025	medium
141106	Amazon Linux 2 : kernel (ALAS-2020-1495)	Nessus	Amazon Linux Local Security Checks	10/1/2020	12/11/2024	high
142722	Amazon Linux 2 : kernel (ALAS-2020-1556)	Nessus	Amazon Linux Local Security Checks	11/11/2020	12/11/2024	high
143431	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4658-1)	Nessus	Ubuntu Local Security Checks	12/2/2020	8/27/2024	high
147212	RHEL 8 : kernel-rt (RHSA-2021:0774)	Nessus	Red Hat Local Security Checks	3/9/2021	11/7/2024	high
147827	RHEL 7 : kernel-rt (RHSA-2021:0857)	Nessus	Red Hat Local Security Checks	3/17/2021	11/7/2024	high
229946	Linux Distros Unpatched Vulnerability : CVE-2020-25211	Nessus	Misc.	3/5/2025	3/5/2025	medium
145201	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2021-1079)	Nessus	Huawei Local Security Checks	1/20/2021	1/29/2024	high
147207	RHEL 8 : kernel (RHSA-2021:0765)	Nessus	Red Hat Local Security Checks	3/9/2021	11/7/2024	high
147835	RHEL 7 : kernel (RHSA-2021:0856)	Nessus	Red Hat Local Security Checks	3/17/2021	11/7/2024	high
142483	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5912)	Nessus	Oracle Linux Local Security Checks	11/5/2020	10/22/2024	high
164603	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1)	Nessus	Misc.	9/1/2022	2/17/2025	high
164562	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.7)	Nessus	Misc.	9/1/2022	2/19/2025	critical
164590	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5.5)	Nessus	Misc.	9/1/2022	2/17/2025	critical

Detections

Analytics

Plugins Search

medium

medium

high

high

high

high

high

medium

high

high

high

high

high

critical

critical