The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4056 advisory.

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2451-1 advisory.

    The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local     provilege escalation. (bsc#1188116)
    - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root     privileges. (bsc#1188062)
    - CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local     privilege escalation. (bsc#1187215)
    - CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the     kernel with System execution privileges needed. (bsc#1187601)
    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187595)
    - CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive     information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
    - CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation.
    (bsc#1187050)
    - CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to     potentially enable information disclosure via adjacent access. (bsc#1186463)
    - CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
    - CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
    - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-     SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)
    - CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller.
    (bsc#1184611)
    - CVE-2021-33034: Fixed an issue in net/bluetooth/hci_event.c where a use-after-free leads to writing an     arbitrary value. (bsc#1186111)
    - CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients     even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi     networks to launch denial-of-service attacks against connected clients and made it easier to exploit other     vulnerabilities in connected clients. (bsc#1186062)
    - CVE-2021-23134: Fixed a use After Free vulnerability in nfc sockets which allows local attackers to     elevate their privileges. (bsc#1186060)
    - CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network     packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP,     or GCMP. (bsc#1185859)
    - CVE-2020-26141: Fixed a flaw that could allows an adversary to inject and possibly decrypt packets in     WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bsc#1185987)
    - CVE-2020-26145: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an     adversary to inject arbitrary network packets. (bsc#1185860)
    - CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device     sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862)
    - CVE-2020-26147: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an     adversary to inject packets and/or exfiltrate selected fragments when another device sends fragmented     frames. (bsc#1185987)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2427-1 advisory.

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. (CVE-2020-36386)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This     could lead to local information disclosure in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476     (CVE-2021-0605)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

  - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from     kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693)

  - To fix this vulnerability, update the affected packages: linux linux-esx (CVE-2021-3609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2427-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local     provilege escalation. (bsc#1188116)
    - CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary     kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
    - CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the     kernel with System execution privileges needed. (bsc#1187601)
    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187595)
    - CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
    - CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive     information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
    - CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to     potentially enable information disclosure via adjacent access. (bnc#1186463)
    - CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
    - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-     SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
    - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root     privileges. (bsc#1188062)
    - CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local     privilege escalation. (bsc#1187215)
    - CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation.
    (bsc#1187050)
    - CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
157777	Rocky Linux 8 : kernel (RLSA-2021:4056)	Nessus	Rocky Linux Local Security Checks	2/9/2022	11/6/2023	high
152055	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2451-1)	Nessus	SuSE Local Security Checks	7/23/2021	6/25/2026	high
151935	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:2427-1)	Nessus	SuSE Local Security Checks	7/22/2021	10/6/2025	high
151989	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2427-1)	Nessus	SuSE Local Security Checks	7/22/2021	6/25/2026	high

Detections

Analytics

Plugins Search

high

high

high

high