The version of kernel installed on the remote host is prior to 5.4.68-34.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-016 advisory.

    A flaw was found in the Linux kernel's implementation of BTRFS free space management, where the kernel     does not correctly manage the lifetime of internal data structures used. An attacker could use this flaw     to corrupt memory or escalate privileges. (CVE-2019-19448)

    A use-after-free flaw was found in the debugfs_remove function in the Linux kernel. The flaw could allow a     local attacker with special user (or root) privilege to crash the system at the time of file or directory     removal. This vulnerability can lead to a kernel information leak. The highest threat from this     vulnerability is to system availability. (CVE-2019-19770)

    A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to     directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable     access to the devices' MMIO memory address spaces. If a user attempts to access the read/write devices'     MMIO address space when it is disabled, some h/w devices issue an interrupt to the CPU to indicate a fatal     error condition, crashing the system. This flaw allows a guest user or process to crash the host system     resulting in a denial of service. (CVE-2020-12888)

    A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it     accesses a directory with broken indexing. This flaw allows a local user to crash the system if the     directory exists. The highest threat from this vulnerability is to system availability. (CVE-2020-14314)

    A flaw was found in the Linux kernel. A failure of the file system metadata validator in XFS can cause an     inode with a valid, user-creatable extended attribute to be flagged as corrupt.  This can lead to the     filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial     of service. The highest threat from this vulnerability is to system availability. (CVE-2020-14385)

    A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur     leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2020-14390)

    A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it     could return specially crafted response allow for local memory corruption and possibly privilege     escalation. (CVE-2020-25212)

    A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel.
    Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add     or remove Rados Block Devices from the system. (CVE-2020-25284)

    A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root     level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on     internal variables leading to a system crash or memory corruption. (CVE-2020-25285)

    A flaw was found in the Linux kernel's implementation of biovecs. A zero-length biovec request issued by     the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This     flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25641)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1739 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362)

    * kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver     (CVE-2019-19523)

    * kernel: use-after-free bug caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver     (CVE-2019-19528)

    * kernel: possible out of bounds write in kbd_keycode of keyboard.c (CVE-2020-0431)

    * kernel: DoS by corrupting mountpoint reference counter (CVE-2020-12114)

    * kernel: use-after-free in usb_sg_cancel function in drivers/usb/core/message.c (CVE-2020-12464)

    * kernel: buffer uses out of index in ext3/4 filesystem (CVE-2020-14314)

    * kernel: Use After Free vulnerability in cgroup BPF component (CVE-2020-14356)

    * kernel: NULL pointer dereference in serial8250_isa_init_ports function in     drivers/tty/serial/8250/8250_core.c (CVE-2020-15437)

    * kernel: umask not applied on filesystem without ACL support (CVE-2020-24394)

    * kernel: TOCTOU mismatch in the NFS client code (CVE-2020-25212)

    * kernel: incomplete permission checking for access to rbd devices (CVE-2020-25284)

    * kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c (CVE-2020-25285)

    * kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read     overflow (CVE-2020-25643)

    * kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)

    * kernel: use-after-free in kernel midi subsystem (CVE-2020-27786)

    * kernel: child process is able to access parent mm through hfi dev file handle (CVE-2020-27835)

    * kernel: slab-out-of-bounds read in fbcon (CVE-2020-28974)

    * kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent (CVE-2020-35508)

    * kernel: use after free in tun_get_user of tun.c could lead to local escalation of privilege     (CVE-2021-0342)

    * kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in     drivers/media/usb/gspca/ov519.c (CVE-2020-11608)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic     error. This could lead to local escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel (CVE-2020-0466)

  - A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified     other impact, aka CID-17743798d812. (CVE-2020-25285)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of     service. (CVE-2020-25704)

  - The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database     (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.
    (CVE-2020-26541)

  - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking     in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal     in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker     has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are     proxied via an attacker-selected backstore. (CVE-2020-28374)

  - In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This     could lead to local information disclosure in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476     (CVE-2021-0605)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
    (CVE-2021-3347)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API,     is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-     of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
    (CVE-2021-3501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
160437	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-016)	Nessus	Amazon Linux Local Security Checks	5/2/2022	2/26/2026	high
149660	RHEL 8 : kernel-rt (RHSA-2021:1739)	Nessus	Red Hat Local Security Checks	5/19/2021	11/7/2024	high
143398	openSUSE Security Update : the Linux Kernel (openSUSE-2020-2112)	Nessus	SuSE Local Security Checks	12/1/2020	2/7/2024	high
160868	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2022-0059)	Nessus	NewStart CGSL Local Security Checks	5/10/2022	5/11/2022	high

Detections

Analytics

Plugins Search

high

high

high

high