The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4752-1 advisory.

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-     connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to     complete authentication without pairing credentials via adjacent access. A physically proximate attacker     could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

    Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle     directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2020-14314)

    It was discovered that the block layer implementation in the Linux kernel did not properly perform     reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash). (CVE-2020-15436)

    It was discovered that the serial port driver in the Linux kernel did not properly initialize a pointer in     some situations. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2020-15437)

    Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly     handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically     proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2020-24490)

    It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds     checking before copying security labels in some situations. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

    It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform     privilege checks for access to rbd devices in some situations. A local attacker could use this to map or     unmap rbd block devices. (CVE-2020-25284)

    It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length     requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

    It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2020-25643)

    Kiyin () discovered that the perf subsystem in the Linux kernel did not properly deallocate memory     in some situations. A privileged attacker could use this to cause a denial of service (kernel memory     exhaustion). (CVE-2020-25704)

    It was discovered that the KVM hypervisor in the Linux kernel did not properly handle interrupts in     certain situations. A local attacker in a guest VM could possibly use this to cause a denial of service     (host system crash). (CVE-2020-27152)

    It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds     read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash).
    (CVE-2020-27815)

    It was discovered that an information leak existed in the syscall implementation in the Linux kernel on 32     bit systems. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2020-28588)

    It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range     checks in certain situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2020-28915)

    Jann Horn discovered a race condition in the copy-on-write implementation in the Linux kernel when     handling hugepages. A local attacker could use this to gain unintended write access to read-only memory     pages. (CVE-2020-29368)

    Jann Horn discovered that the mmap implementation in the Linux kernel contained a race condition when     handling munmap() operations, leading to a read-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-29369)

    Jann Horn discovered that the romfs file system in the Linux kernel did not properly validate file system     meta-data, leading to an out-of-bounds read. An attacker could use this to construct a malicious romfs     image that, when mounted, exposed sensitive information (kernel memory). (CVE-2020-29371)

    Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some     situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-29660)

    Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the     TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)

    It was discovered that a race condition existed that caused the Linux kernel to not properly restrict exit     signal delivery. A local attacker could possibly use this to send signals to arbitrary processes.
    (CVE-2020-35508)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).

CVE-2020-15437: Fixed a NULL pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).

CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).

CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).

CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)

CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).

CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).

CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).

CVE-2020-25705: Fixed an issue which could have allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization (bsc#1175721).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).

CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

CVE-2020-14381: Fixed a UAF in the fast user mutex (futex) wait operation (bsc#1176011).

CVE-2020-25643: Fixed an improper input validation in the ppp_cp_parse_cr function of the HDLC_PPP module (bnc#1177206).

CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)

CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).

CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).

CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).

CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).

CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)

CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In uvc_scan_chain_forward     of uvc_driver.c, there is a possible linked list     corruption due to an unusual root cause. This could     lead to local escalation of privilege in the kernel     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-111893654References: Upstream kernel.(CVE-2020-0404)A     flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)A TOCTOU mismatch in the     NFS client code in the Linux kernel before 5.8.3 could     be used by local attackers to corrupt memory or     possibly have unspecified other impact because a size     check is in fs4proc.c instead of fsfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)A flaw was found in     the Linux kernel before 5.9-rc4. A failure of the file     system metadata validator in XFS can cause an inode     with a valid, user-creatable extended attribute to be     flagged as corrupt. This can lead to the filesystem     being shutdown, or otherwise rendered inaccessible     until it is remounted, leading to a denial of service.
    The highest threat from this vulnerability is to system     availability.(CVE-2020-14385)In the Linux kernel before     5.7.8, fsfsd/vfs.c (in the NFS server) can set     incorrect permissions on new filesystem objects when     the filesystem lacks ACL support, aka CID-22cf8419f131.
    This occurs because the current umask is not     considered.(CVE-2020-24394)The rbd block device driver     in drivers/block/rbd.c in the Linux kernel through     5.8.9 used incomplete permission checking for access to     rbd devices, which could be leveraged by local     attackers to map or unmap rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)An issue was     discovered in net/ipv4/sysctl_net_ipv4.c in the Linux     kernel before 5.0.11. There is a net/ipv4/tcp_input.c     signed integer overflow in tcp_ack_update_rtt() when     userspace writes a very large integer to /proc/sys     et/ipv4/tcp_min_rtt_wlen, leading to a denial of     service or possibly unspecified other impact, aka     CID-19fad20d15a6.(CVE-2019-18805)Insufficient input     validation in i40e driver for Intel(R) Ethernet 700     Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable a denial of     service via local access.(CVE-2019-0147)Buffer overflow     in i40e driver for Intel(R) Ethernet 700 Series     Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2020-0145)A race     condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)A memory     out-of-bounds read flaw was found in the Linux kernel     before 5.9-rc2 with the ext3/ext4 file system, in the     way it accesses a directory with broken indexing. This     flaw allows a local user to crash the system if the     directory exists. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14314)A missing CAP_NET_RAW     check in NFC socket creation in net fc/rawsock.c in the     Linux kernel before 5.8.2 could be used by local     attackers to create raw sockets, bypassing security     mechanisms, aka CID-26896f01467a.(CVE-2020-26088)A flaw     was found in the HDLC_PPP module of the Linux kernel in     versions before 5.9-rc7. Memory corruption and a read     overflow is caused by improper input validation in the     ppp_cp_parse_cr function which can cause the system to     crash or cause a denial of service. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-25643)The Linux kernel, as used     in Red Hat Enterprise Linux 7, kernel-rt, and     Enterprise MRG 2 and when booted with UEFI Secure Boot     enabled, allows local users to bypass intended     securelevel/secureboot restrictions by leveraging     improper handling of secure_boot flag across kexec     reboot.(CVE-2015-7837)A flaw was found in the Linux     kernel's implementation of biovecs in versions before     5.9-rc7. A zero-length biovec request issued by the     block subsystem could cause the kernel to enter an     infinite loop, causing a denial of service. This flaw     allows a local attacker with basic privileges to issue     requests to a block device, resulting in a denial of     service. The highest threat from this vulnerability is     to system availability.(CVE-2020-25641)A flaw was found     in the Linux kernel before 5.9-rc4. Memory corruption     can be exploited to gain root privileges from     unprivileged processes. The highest threat from this     vulnerability is to data confidentiality and     integrity.(CVE-2020-14386)A flaw was found in the Linux     kernel in versions before 5.9-rc7. Traffic between two     Geneve endpoints may be unencrypted when IPsec is     configured to encrypt traffic for the specific UDP port     used by the GENEVE tunnel allowing anyone between the     two endpoints to read the traffic unencrypted. The main     threat from this vulnerability is to data     confidentiality.(CVE-2020-25645)perf: Fix race in     perf_mmap_close function.(CVE-2020-14351)An information     leak flaw was found in the way the Linux kernel's     Bluetooth stack implementation handled initialization     of stack memory when handling certain AMP packets. A     remote attacker in adjacent range could use this flaw     to leak small portions of stack memory on the system by     sending a specially crafted AMP packets. The highest     threat from this vulnerability is to data     confidentiality.(CVE-2020-12352)A flaw was found in the     way the Linux kernel Bluetooth implementation handled     L2CAP packets with A2MP CID. A remote attacker in     adjacent range could use this flaw to crash the system     causing denial of service or potentially execute     arbitrary code on the system by sending a specially     crafted L2CAP packet. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-12351)A heap     buffer overflow flaw was found in the way the Linux     kernel's Bluetooth implementation processed extended     advertising report events. This flaw allows a remote     attacker in an adjacent range to crash the system,     causing a denial of service or to potentially execute     arbitrary code on the system by sending a specially     crafted Bluetooth packet. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-24490)** RESERVED **     This candidate has been reserved by an organization or     individual that will use it when announcing a new     security problem. When the candidate has been     publicized, the details for this candidate will be     provided.(CVE-2020-25656)In skb_to_mamac of     networking.c, there is a possible out of bounds write     due to an integer overflow. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-143560807(CVE-2020-0432)A     slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)A     flaw memory leak in the Linux kernel performance     monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this     flaw to starve the resources causing denial of     service.(CVE-2020-25704)A buffer over-read (at the     framebuffer layer) in the fbcon code in the Linux     kernel before 5.8.15 could be used by local attackers     to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)There is a     use-after-free problem seen due to a race condition     between the release of ptp_clock and cdev while     resource deallocation. When a (high privileged) process     allocates a ptp device file (like /dev/ptpX) and     voluntarily goes to sleep. During this time if the     underlying device is removed, it can cause an     exploitable condition as the process wakes up to     terminate and clean all attached files. The system     crashes due to the cdev structure being invalid (as     already freed) which is pointed to by the     inode.(CVE-2020-10690)A device tracking vulnerability     was found in the flow_dissector feature in the Linux     kernel. This flaw occurs because the auto flowlabel of     the UDP IPv6 packet relies on a 32-bit hashmd value as     a secret, and jhash (instead of siphash) is used. The     hashmd value remains the same starting from boot time     and can be inferred by an     attacker.(CVE-2019-18282)Use-after-free vulnerability     in fs/block_dev.c in the Linux kernel before 5.8 allows     local users to gain privileges or cause a denial of     service by leveraging improper access to a certain     error field.(CVE-2020-15436)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)An issue was discovered     in kmem_cache_alloc_bulk in mm/slub.c in the Linux     kernel before 5.5.11. The slowpath lacks the required     TID increment, aka CID-fd4d9c7d0c71.(CVE-2020-29370)An     issue was discovered in the Linux kernel before 5.2.6.
    On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)An issue was     discovered in the Linux kernel before 5.7.3, related to     mm/gup.c and mm/huge_memory.c. The get_user_pages (aka     gup) implementation, when used for a copy-on-write     page, does not properly consider the semantics of read     operations and therefore can grant unintended write     access, aka CID-17839856fd58.(CVE-2020-29374)A flaw was     found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)In kbd_keycode of keyboard.c,     there is a possible out of bounds write due to a     missing bounds check. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-144161459(CVE-2020-0431)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003991 advisory.

    A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of     service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a memory leak in     perf_event_parse_addr_filter.(CVE-2020-25704)

  - Insufficient access control in the Linux kernel driver     for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via     local access.(CVE-2020-8694)

  - A flaw was found in the Linux kernel. A use-after-free     was found in the way the console subsystem was using     ioctls KDGKBSENT and KDSKBSENT. A local user could use     this flaw to get read memory access out of bounds. The     highest threat from this vulnerability is to data     confidentiality.(CVE-2020-25656)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5995 advisory.

    - vt: Disable KD_FONT_OP_COPY (Daniel Vetter)  [Orabug: 32187748]  {CVE-2020-28974}
    - xen/events: block rogue events for some time (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/events: defer eoi in case of excessive number of events (Juergen Gross)  [Orabug: 32177538]     {CVE-2020-27673}
    - xen/events: use a common cpu hotplug hook for event channels (Juergen Gross)  [Orabug: 32177538]     {CVE-2020-27673}
    - xen/events: switch user event channels to lateeoi model (Juergen Gross)  [Orabug: 32177538]     {CVE-2020-27673}
    - xen/pciback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/pvcallsback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/scsiback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/netback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/blkback: use lateeoi irq binding (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/events: add a new 'late EOI' evtchn framework (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/events: fix race in evtchn_fifo_unmask() (Juergen Gross)  [Orabug: 32177538]  {CVE-2020-27673}
    - xen/events: add a proper barrier to 2-level uevent unmasking (Juergen Gross)  [Orabug: 32177538]     {CVE-2020-27673}
    - tty: make FONTX ioctl use the tty pointer they were actually passed (Linus Torvalds)  [Orabug: 32122729]     {CVE-2020-25668}
    - vt: keyboard, extend func_buf_lock to readers (Jiri Slaby)  [Orabug: 32122952]  {CVE-2020-25656}     {CVE-2020-25656}
    - vt: keyboard, simplify vt_kdgkbsent (Jiri Slaby)  [Orabug: 32122952]  {CVE-2020-25656}
    - perf/core: Fix a memory leak in perf_event_parse_addr_filter() (kiyin)  [Orabug: 32131175]     {CVE-2020-25704}
    - perf/core: Fix bad use of igrab() (Song Liu)  [Orabug: 32131175]  {CVE-2020-25704}
    - powercap: restrict energy meter to root access (Kanth Ghatraju)  [Orabug: 32138487]  {CVE-2020-8694}     {CVE-2020-8695}
    - btrfs: inode: Verify inode mode to avoid NULL pointer dereference (Qu Wenruo)  [Orabug: 31864726]     {CVE-2019-19816}
    - Bluetooth: A2MP: Fix not initializing all members (Luiz Augusto von Dentz)  [Orabug: 32021288]     {CVE-2020-12352}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.20.3.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.3.5 advisory.

  - CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw     V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. (CVE-2022-23307)

  - By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the     values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be     included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or     headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue     only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.
    Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized     SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions. (CVE-2022-23305)

  - AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS     extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. (CVE-2021-45417)

  - Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data     which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when     listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
    (CVE-2019-17571)

  - Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an     SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent     through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 (CVE-2020-9488)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
147982	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-4752-1)	Nessus	Ubuntu Local Security Checks	3/23/2021	8/27/2024	high
142945	openSUSE Security Update : the Linux Kernel (openSUSE-2020-1906)	Nessus	SuSE Local Security Checks	11/17/2020	2/8/2024	high
143860	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3717-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/5/2024	high
143857	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3544-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	high
143875	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:3532-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	high
144731	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2021-1039)	Nessus	Huawei Local Security Checks	1/5/2021	5/11/2022	critical
288495	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003991)	Nessus	Unity Linux Local Security Checks	1/16/2026	1/17/2026	medium
143411	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2020-2498)	Nessus	Huawei Local Security Checks	12/1/2020	2/7/2024	medium
143856	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:3507-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/5/2024	high
144207	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5995)	Nessus	Oracle Linux Local Security Checks	12/14/2020	2/9/2026	high
165276	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.3.5)	Nessus	Misc.	9/21/2022	7/22/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

medium

medium

high

high

critical