The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2387-1 advisory.

    This update for the Linux Kernel 5.3.18-24_37 fixes several issues.

    The following security issues were fixed:

    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187597)
    - CVE-2021-23133: Fixed a race condition in the SCTP sockets that can lead to kernel privilege escalation     from the context of a network service or an unprivileged process. (bsc#1185901)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2377-1 advisory.

    This update for the Linux Kernel 5.3.18-22 fixes several issues.

    The following security issues were fixed:

    - CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the     kernel with System execution privileges needed. (bsc#1187687)
    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187597)
    - CVE-2021-23133: Fixed a race condition in the SCTP sockets that can lead to kernel privilege escalation     from the context of a network service or an unprivileged process. (bsc#1185901)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2453-1 advisory.

    This update for the Linux Kernel 4.12.14-122_54 fixes several issues.

    The following security issues were fixed:

    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187597)
    - CVE-2021-23133: Fixed a race condition in the SCTP sockets that can lead to kernel privilege escalation     from the context of a network service or an unprivileged process. (bsc#1185901)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2689 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of     arbitrary code, privilege escalation, denial of service, or information leaks. This update is not yet     available for the armel (ARM EABI soft-float) architecture. CVE-2020-24586, CVE-2020-24587, CVE-2020-26147     Mathy Vanhoef discovered that many Wi-Fi implementations, including Linux's mac80211, did not correctly     implement reassembly of fragmented packets. In some circumstances, an attacker within range of a network     could exploit these flaws to forge arbitrary packets and/or to access sensitive data on that network.
    CVE-2020-24588 Mathy Vanhoef discovered that most Wi-Fi implementations, including Linux's mac80211, did     not authenticate the is aggregated packet header flag. An attacker within range of a network could exploit     this to forge arbitrary packets on that network. CVE-2020-25670, CVE-2020-25671, CVE-2021-23134 kiyin     () of TenCent discovered several reference counting bugs in the NFC LLCP implementation which could     lead to use-after-free. A local user could exploit these for denial of service (crash or memory     corruption) or possibly for privilege escalation. Nadav Markus and Or Cohen of Palo Alto Networks     discovered that the original fixes for these introduced a new bug that could result in use-after-free and     double-free. This has also been fixed. CVE-2020-25672 kiyin () of TenCent discovered a memory leak     in the NFC LLCP implementation. A local user could exploit this for denial of service (memory exhaustion).
    CVE-2020-26139 Mathy Vanhoef discovered that a bug in some Wi-Fi implementations, including Linux's     mac80211. When operating in AP mode, they would forward EAPOL frames from one client to another while the     sender was not yet authenticated. An attacker within range of a network could use this for denial of     service or as an aid to exploiting other vulnerabilities. CVE-2020-26558, CVE-2021-0129 Researchers at     ANSSI discovered vulnerabilities in the Bluetooth Passkey authentication method, and in Linux's     implementation of it. An attacker within range of two Bluetooth devices while they pair using Passkey     authentication could exploit this to obtain the shared secret (Passkey) and then impersonate either of the     devices to each other. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's virtual memory     management. A parent and child process initially share all their memory, but when either writes to a     shared page, the page is duplicated and unshared (copy-on-write). However, in case an operation such as     vmsplice() required the kernel to take an additional reference to a shared page, and a copy-on-write     occurs during this operation, the kernel might have accessed the wrong process's memory. For some     programs, this could lead to an information leak or data corruption. CVE-2020-36322, CVE-2021-28950 The     syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not correctly handle a FUSE     server returning invalid attributes for a file. A local user permitted to run a FUSE server could use this     to cause a denial of service (crash). The original fix for this introduced a different potential denial of     service (infinite loop in kernel space), which has also been fixed. CVE-2021-3428 Wolfgang Frisch reported     a potential integer overflow in the ext4 filesystem driver. A user permitted to mount arbitrary filesystem     images could use this to cause a denial of service (crash). CVE-2021-3483  (Zheyu Ma) reported a     bug in the nosy driver for TI PCILynx FireWire controllers, which could lead to list corruption and a use-     after-free. On a system that uses this driver, local users granted access to /dev/nosy could exploit this     to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3564, CVE-2021-3573, CVE-2021-32399 The BlockSec team discovered several race conditions in the     Bluetooth subsystem that could lead to a use-after-free or double-free. A local user could exploit these     to caue a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3587 Active Defense Lab of Venustech discovered a potential null pointer dereference in the NFC     LLCP implementation. A local user could use this to cause a denial of service (crash). CVE-2021-20292 It     was discovered that the TTM buffer allocation API used by GPU drivers did not handle allocation failures     in the way that most drivers expected, resulting in a double-free on failure. A local user on a system     using one of these drivers could possibly exploit this to cause a denial of service (crash or memory     corruption) or for privilege escalation. The API has been changed to match driver expectations.
    CVE-2021-23133 Or Cohen of Palo Alto Networks discovered a race condition in the SCTP implementation,     which can lead to list corruption. A local user could exploit this to cause a denial of service (crash or     memory corruption) or possibly for privilege escalation. CVE-2021-28660 It was discovered that the     rtl8188eu WiFi driver did not correctly limit the length of SSIDs copied into scan results. An attacker     within WiFi range could use this to cause a denial of service (crash or memory corruption) or possibly to     execute code on a vulnerable system. CVE-2021-28688 (XSA-371) It was discovered that the original fix for     CVE-2021-26930 (XSA-365) introduced a potential resource leak. A malicious guest could presumably exploit     this to cause a denial of service (resource exhaustion) within the host. CVE-2021-28964 Zygo Blaxell     reported a race condition in the Btrfs driver which can lead to an assertion failure. On systems using     Btrfs, a local user could exploit this to cause a denial of service (crash). CVE-2021-28971 Vince Weaver     reported a bug in the performance event handler for Intel PEBS. A workaround for a hardware bug on Intel     CPUs codenamed Haswell and earlier could lead to a null pointer dereference. On systems with the affected     CPUs, if users are permitted to access performance events, a local user may exploit this to cause a denial     of service (crash). By default, unprivileged users do not have access to performance events, which     mitigates this issue. This is controlled by the kernel.perf_event_paranoid sysctl. CVE-2021-29154 It was     discovered that the Extended BPF (eBPF) JIT compiler for x86_64 generated incorrect branch instructions in     some cases. On systems where eBPF JIT is enabled, users could exploit this to execute arbitrary code in     the kernel. By default, eBPF JIT is disabled, mitigating this issue. This is controlled by the     net.core.bpf_jit_enable sysctl. CVE-2021-29265 The syzbot tool found a race condition in the USB/IP host     (server) implementation which can lead to a null pointer dereference. On a system acting as a USB/IP host,     a client can exploit this to cause a denial of service (crash). CVE-2021-29647 The syzbot tool found an     information leak in the Qualcomm IPC Router (qrtr) implementation. This protocol is not enabled in     Debian's official kernel configurations. CVE-2021-29650 It was discovered that a data race in the     netfilter subsystem could lead to a null pointer dereference during replacement of a table. A local user     with CAP_NET_ADMIN capability in any user namespace could use this to cause a denial of service (crash).
    By default, unprivileged users cannot create user namespaces, which mitigates this issue. This is     controlled by the kernel.unprivileged_userns_clone sysctl. CVE-2021-30002 Arnd Bergmann and the syzbot     tool found a memory leak in the Video4Linux (v4l) subsystem. A local user permitted to access video     devices (by default, any member of the video group) could exploit this to cause a denial of service     (memory exhaustion). CVE-2021-31916 Dan Carpenter reported incorrect parameter validation in the device-     mapper (dm) subsystem, which could lead to a heap buffer overrun. However, only users with CAP_SYS_ADMIN     capability (i.e. root-equivalent) could trigger this bug, so it did not have any security impact in this     kernel version. CVE-2021-33034 The syzbot tool found a bug in the Bluetooth subsystem that could lead to a     use-after-free. A local user could use this to cause a denial of service (crash or memory corruption) or     possibly for privilege escalation. For Debian 9 stretch, these problems have been fixed in version     4.9.272-1. This update additionally includes many more bug fixes from stable updates 4.9.259-4.9.272     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further     information about Debian LTS security advisories, how to apply these updates to your system and frequently     asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5001-1 advisory.

    Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel     leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute     arbitrary code. (CVE-2021-3609)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly clear received     fragments from memory in some situations. A physically proximate attacker could possibly use this issue to     inject packets or expose sensitive information. (CVE-2020-24586)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled encrypted     fragments. A physically proximate attacker could possibly use this issue to decrypt fragments.
    (CVE-2020-24587)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled certain     malformed frames. If a user were tricked into connecting to a malicious server, a physically proximate     attacker could use this issue to inject packets. (CVE-2020-24588)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation incorrectly handled EAPOL frames     from unauthenticated senders. A physically proximate attacker could inject malicious packets to cause a     denial of service (system crash). (CVE-2020-26139)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation did not properly verify certain     fragmented frames. A physically proximate attacker could possibly use this issue to inject or decrypt     packets. (CVE-2020-26141)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation accepted plaintext fragments in     certain situations. A physically proximate attacker could use this issue to inject packets.
    (CVE-2020-26145)

    Mathy Vanhoef discovered that the Linux kernels WiFi implementation could reassemble mixed encrypted     and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets     or exfiltrate selected fragments. (CVE-2020-26147)

    Or Cohen discovered that the SCTP implementation in the Linux kernel contained a race condition in some     situations, leading to a use-after-free condition. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2021-23133)

    Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the nfc implementation in the Linux     kernel. A privileged local attacker could use this issue to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-23134)

    Manfred Paul discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel     contained an out-of-bounds vulnerability. A local attacker could use this issue to execute arbitrary code.
    (CVE-2021-31440)

    It was discovered that a race condition in the kernel Bluetooth subsystem could lead to use-after-free of     slab objects. An attacker could use this issue to possibly execute arbitrary code. (CVE-2021-32399)

    It was discovered that a use-after-free existed in the Bluetooth HCI driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-33034)

    It was discovered that an out-of-bounds (OOB) memory access flaw existed in the f2fs module of the Linux     kernel. A local attacker could use this issue to cause a denial of service (system crash). (CVE-2021-3506)

    Mathias Krause discovered that a null pointer dereference existed in the Nitro Enclaves kernel driver of     the Linux kernel. A local attacker could use this issue to cause a denial of service or possibly execute     arbitrary code. (CVE-2021-3543)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4356 advisory.

  - kernel: Intel graphics card information leak. (CVE-2019-14615)

  - kernel: out-of-bounds reads in pinctrl subsystem. (CVE-2020-0427)

  - kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24502)

  - kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24503)

  - kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24504)

  - kernel: Fragmentation cache not cleared on reconnection (CVE-2020-24586)

  - kernel: Reassembling fragments encrypted under different keys (CVE-2020-24587)

  - kernel: wifi frame payload being parsed incorrectly as an L2 frame (CVE-2020-24588)

  - kernel: Forwarding EAPOL from unauthenticated wifi client (CVE-2020-26139)

  - kernel: accepting plaintext data frames in protected networks (CVE-2020-26140)

  - kernel: not verifying TKIP MIC of fragmented frames (CVE-2020-26141)

  - kernel: accepting fragmented plaintext frames in protected networks (CVE-2020-26143)

  - kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header (CVE-2020-26144)

  - kernel: accepting plaintext broadcast fragments as full frames (CVE-2020-26145)

  - kernel: reassembling encrypted fragments with non-consecutive packet numbers (CVE-2020-26146)

  - kernel: reassembling mixed encrypted/plaintext fragments (CVE-2020-26147)

  - kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777)

  - kernel: the copy-on-write implementation can grant unintended write access because of a race condition in     a THP mapcount check (CVE-2020-29368)

  - kernel: locking inconsistency in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c can lead to a read-     after-free (CVE-2020-29660)

  - kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function in     drivers/net/wireless/marvell/mwifiex/join.c via a long SSID value (CVE-2020-36158)

  - kernel: memory leak upon a kmalloc failure in kvm_io_bus_unregister_dev function in virt/kvm/kvm_main.c     (CVE-2020-36312)

  - kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() in net/bluetooth/hci_event.c     (CVE-2020-36386)

  - kernel: Improper access control in BlueZ may allow information disclosure vulnerability. (CVE-2021-0129)

  - kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() (CVE-2021-20194)

  - kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure (CVE-2021-20239)

  - kernel: Race condition in sctp_destroy_sock list_del (CVE-2021-23133)

  - kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode     (CVE-2021-28950)

  - kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c (CVE-2021-28971)

  - kernel: protection for sequences of pointer arithmetic operations against speculatively out-of-bounds     loads can be bypassed to leak content of kernel memory (CVE-2021-29155)

  - kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c (CVE-2021-29646)

  - kernel: lack a full memory barrier upon the assignment of a new table value in net/netfilter/x_tables.c     and include/linux/netfilter/x_tables.h may lead to DoS (CVE-2021-29650)

  - kernel: local escalation of privileges in handling of eBPF programs (CVE-2021-31440)

  - kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak content     of kernel memory (CVE-2021-31829)

  - kernel: out of bounds array access in drivers/md/dm-ioctl.c (CVE-2021-31916)

  - kernel: use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c (CVE-2021-33033)

  - kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations     by BPF verifier (CVE-2021-33200)

  - kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c (CVE-2021-3348)

  - kernel: Linux kernel eBPF RINGBUF map oversized allocation (CVE-2021-3489)

  - kernel: double free in bluetooth subsystem when the HCI device initialization fails (CVE-2021-3564)

  - kernel: use-after-free in function hci_sock_bound_ioctl() (CVE-2021-3573)

  - kernel: eBPF 32-bit source register truncation on div/mod (CVE-2021-3600)

  - kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 (CVE-2021-3635)

  - kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)

  - kernel: DoS in rb_per_cpu_empty() (CVE-2021-3679)

  - kernel: overlayfs: Mounting overlayfs inside an unprivileged user namespace can reveal files     (CVE-2021-3732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4356 advisory.

    - ovl: prevent private clone if bind mount is not allowed (Miklos Szeredi) [1993131] {CVE-2021-3732}
    - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985413]     {CVE-2021-3653}
    - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) (Jon Maloy) [1985430]     {CVE-2021-3656}
    - mt76: validate rx A-MSDU subframes (Inigo Huguet) [1991459] {CVE-2020-24588 CVE-2020-26144}
    - ath11k: Drop multicast fragments (Inigo Huguet) [1991459] {CVE-2020-26145}
    - ath11k: Clear the fragment cache during key install (Inigo Huguet) [1991459] {CVE-2020-24587}
    - ath10k: Validate first subframe of A-MSDU before processing the list (Inigo Huguet) [1991459]     {CVE-2020-24588 CVE-2020-26144}
    - ath10k: Fix TKIP Michael MIC verification for PCIe (Inigo Huguet) [1991459] {CVE-2020-26141}
    - ath10k: drop MPDU which has discard flag set by firmware for SDIO (Inigo Huguet) [1991459]     {CVE-2020-24588}
    - ath10k: drop fragments with multicast DA for SDIO (Inigo Huguet) [1991459] {CVE-2020-26145}
    - ath10k: drop fragments with multicast DA for PCIe (Inigo Huguet) [1991459] {CVE-2020-26145}
    - mac80211: extend protection against mixed key and fragment cache attacks (Inigo Huguet) [1991459]     {CVE-2020-24586 CVE-2020-24587}
    - mac80211: do not accept/forward invalid EAPOL frames (Inigo Huguet) [1991459] {CVE-2020-26139}
    - mac80211: prevent attacks on TKIP/WEP as well (Inigo Huguet) [1991459] {CVE-2020-26141}
    - mac80211: add fragment cache to sta_info (Inigo Huguet) [1991459] {CVE-2020-24586 CVE-2020-24587}
    - mac80211: drop A-MSDUs on old ciphers (Inigo Huguet) [1991459] {CVE-2020-24588}
    - cfg80211: mitigate A-MSDU aggregation attacks (Inigo Huguet) [1991459] {CVE-2020-24588 CVE-2020-26144}
    - mac80211: prevent mixed key and fragment cache attacks (Inigo Huguet) [1991459] {CVE-2020-24586     CVE-2020-24587}
    - mac80211: assure all fragments are encrypted (Inigo Huguet) [1991459] {CVE-2020-26147}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4356 advisory.

  - Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor     Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
    (CVE-2019-14615)

  - In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could     lead to local information disclosure with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171     (CVE-2020-0427)

  - Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4     and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial     of service via local access. (CVE-2020-24502)

  - Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4     may allow an authenticated user to potentially enable information disclosure via local access.
    (CVE-2020-24503)

  - Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version     1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
    (CVE-2020-24504)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

  - An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The     copy-on-write implementation can grant unintended write access because of a race condition in a THP     mapcount check, aka CID-c444eb564fb1. (CVE-2020-29368)

  - A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID,     aka CID-c8bcd9c5be24. (CVE-2020-29660)

  - mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through     5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.
    (CVE-2020-36158)

  - An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a     kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d. (CVE-2020-36312)

  - An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. (CVE-2020-36386)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-     free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a     certain point during device setup, aka CID-b98e762e3d71. (CVE-2021-3348)

  - The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size     was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel     and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee (bpf, ringbuf: Deny     reserve of buffers larger than ringbuf) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. It was introduced via 457f44363a88 (bpf: Implement BPF ring buffer and verifier     support for it) (v5.8-rc1). (CVE-2021-3489)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573)

  - A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with     root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.
    (CVE-2021-3635)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config     params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y ,     CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution,     the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap     overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly     privileges escalation. (CVE-2021-20194)

  - A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an     attacker with a local account to leak information about kernel internal addresses. The highest threat from     this vulnerability is to confidentiality. (CVE-2021-20239)

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A stall on CPU can occur     because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1. (CVE-2021-28950)

  - In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some     Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS     status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. (CVE-2021-28971)

  - An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer     arithmetic operations, the pointer modification performed by the first operation is not correctly     accounted for when restricting subsequent operations. (CVE-2021-29155)

  - An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does     not properly validate certain data sizes, aka CID-0217ed2848e8. (CVE-2021-29646)

  - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    (CVE-2021-29650)

  - This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel     5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in     order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The     issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them.
    An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the     context of the kernel. Was ZDI-CAN-13661. (CVE-2021-31440)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading     to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not     protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized     data that might represent sensitive information previously operated on by the kernel. (CVE-2021-31829)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before     5.11.7. usbip_sockfd_store in     drivers/usb/usbip/stub_dev.c allows attackers to cause     a denial of service (GPF) because the stub-up sequence     has race conditions during an update of the local and     shared status, aka CID-9380afd6df70.(CVE-2021-29265)

  - A race condition was discovered in get_old_root in     fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG)     because of a lack of locking on an extent buffer before     a cloning operation, aka     CID-dbcc7d57bffc.(CVE-2021-28964)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux     kernel through 5.11.8, the RPA PCI Hotplug driver has a     user-tolerable buffer overflow when writing a new     device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame     directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination,     aka CID-cc7a0bb058b8.(CVE-2021-28972)

  - An issue was discovered in the Linux kernel before     5.8.10. virt/kvm/kvm_main.c has a     kvm_io_bus_unregister_dev memory leak upon a kmalloc     failure, aka CID-f65886606c2d.(CVE-2020-36312)

  - An issue was discovered in the Linux kernel before 5.9.
    arch/x86/kvm/svm/sev.c allows attackers to cause a     denial of service (soft lockup) by triggering     destruction of a large SEV VM (which requires     unregistering many encrypted regions), aka     CID-7be74942f184.(CVE-2020-36311)

  - BPF JIT compilers in the Linux kernel through 5.11.12     have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the     kernel context. This affects     arch/x86/net/bpf_jit_comp.c and     arch/x86/net/bpf_jit_comp32.c.(CVE-2021-29154)

  - An issue was discovered in the Linux kernel before     5.11.8. kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic,     leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from     kernel memory, aka CID-f232326f6966. This affects     pointer types that do not define a     ptr_limit.(CVE-2020-27170)

  - An issue was discovered in the Linux kernel before     5.11.8. kernel/bpf/verifier.c has an off-by-one error     (with a resultant integer underflow) affecting     out-of-bounds speculation on pointer arithmetic,     leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from     kernel memory, aka CID-10d2bb2e6b1d.(CVE-2020-27171)

  - An out-of-bounds (OOB) memory access flaw was found in     x25_bind in net/x25/af_x25.c in the Linux kernel     version v5.12-rc5. A bounds check failure allows a     local attacker with a user account on the system to     gain access to out-of-bounds memory, leading to a     system crash or a leak of internal kernel information.
    The highest threat from this vulnerability is to     confidentiality, integrity, as well as system     availability.(CVE-2020-35519)

  - An issue was discovered in the Linux kernel through     5.11.10. drivers/net/ethernet/freescale/gianfar.c in     the Freescale Gianfar Ethernet driver allows attackers     to cause a system crash because a negative fragment     size is calculated in situations involving an rx queue     overrun when jumbo packets are used and NAPI is     enabled, aka CID-d8861bab48b6.(CVE-2021-29264)

  - An issue was discovered in the Linux kernel before     5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows     attackers to obtain sensitive information from kernel     memory because of a partially uninitialized data     structure, aka CID-50535249f624.(CVE-2021-29647)

  - An issue was discovered in the FUSE filesystem     implementation in the Linux kernel before 5.10.6, aka     CID-5d069dbe8aaf. fuse_do_getattr() calls     make_bad_inode() in inappropriate situations, causing a     system crash. NOTE: the original fix for this     vulnerability was incomplete, and its incompleteness is     tracked as CVE-2021-28950.(CVE-2020-36322)

  - An issue was discovered in the Linux kernel through     5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can     exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI,     and has a length up to the maximum length of a Netlink     message.(CVE-2021-27365)

  - A flaw was found in the Nosy driver in the Linux     kernel. This issue allows a device to be inserted twice     into a doubly-linked list, leading to a use-after-free     when one of these devices is removed. The highest     threat from this vulnerability is to confidentiality,     integrity, as well as system availability. Versions     before kernel 5.12-rc6 are affected(CVE-2021-3483)

  - An issue was discovered in the Linux kernel before     5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak     for large arguments, aka     CID-fb18802a338b.(CVE-2021-30002)

  - The fix for XSA-365 includes initialization of pointers     such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went     too far and may under certain conditions also overwrite     pointers which are in need of cleaning up. The lack of     cleanup would result in leaking persistent grants. The     leak in turn would prevent fully cleaning up after a     respective guest has died, leaving around zombie     domains. All Linux versions having the fix for XSA-365     applied are vulnerable. XSA-365 was classified to     affect versions back to at least 3.11.(CVE-2021-28688)

  - A race condition in Linux kernel SCTP sockets     (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network     service or an unprivileged process. If     sctp_destroy_sock is called without     sock_net(sk)->sctp.addr_wq_lock then an element is     removed from the auto_asconf_splist list without any     proper locking. This can be exploited by an attacker     with network service privileges to escalate to root or     from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies     creation of some SCTP socket.(CVE-2021-23133)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2785:26 advisory.

    * kernel: out-of-bounds reads in pinctrl subsystem (CVE-2020-0427)
      * kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24502)
      * kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24503)
      * kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers     (CVE-2020-24504)
      * kernel: Fragmentation cache not cleared on reconnection (CVE-2020-24586)
      * kernel: Reassembling fragments encrypted under different keys (CVE-2020-24587)
      * kernel: wifi frame payload being parsed incorrectly as an L2 frame (CVE-2020-24588)
      * kernel: Forwarding EAPOL from unauthenticated wifi client (CVE-2020-26139)
      * kernel: accepting plaintext data frames in protected networks (CVE-2020-26140)
      * kernel: not verifying TKIP MIC of fragmented frames (CVE-2020-26141)
      * kernel: accepting fragmented plaintext frames in protected networks (CVE-2020-26143)
      * kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header (CVE-2020-26144)
      * kernel: accepting plaintext broadcast fragments as full frames (CVE-2020-26145)
      * kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777)
      * kernel: locking inconsistency in tty_io.c and tty_jobctrl.c can lead to a read-after-free     (CVE-2020-29660)
      * kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function via a long SSID value     (CVE-2020-36158)
      * kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() (CVE-2020-36386)
      * kernel: Improper access control in BlueZ may allow information disclosure vulnerability.
    (CVE-2021-0129)
      * kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c (CVE-2021-3348)
      * kernel: Linux kernel eBPF RINGBUF map oversized allocation (CVE-2021-3489)
      * kernel: double free in bluetooth subsystem when the HCI device initialization fails (CVE-2021-3564)
      * kernel: use-after-free in function hci_sock_bound_ioctl() (CVE-2021-3573)
      * kernel: eBPF 32-bit source register truncation on div/mod (CVE-2021-3600)
      * kernel: DoS in rb_per_cpu_empty() (CVE-2021-3679)
      * kernel: Mounting overlayfs inside an unprivileged user namespace can reveal files (CVE-2021-3732)
      * kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() (CVE-2021-20194)
      * kernel: Race condition in sctp_destroy_sock list_del (CVE-2021-23133)
      * kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode     (CVE-2021-28950)
      * kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c (CVE-2021-28971)
      * kernel: protection can be bypassed to leak content of kernel memory (CVE-2021-29155)
      * kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c (CVE-2021-29646)
      * kernel: lack a full memory barrier may lead to DoS (CVE-2021-29650)
      * kernel: local escalation of privileges in handling of eBPF programs (CVE-2021-31440)
      * kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak     content of kernel memory (CVE-2021-31829)
      * kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic     operations by BPF verifier (CVE-2021-33200)
      * kernel: reassembling encrypted fragments with non-consecutive packet numbers (CVE-2020-26146)
      * kernel: reassembling mixed encrypted/plaintext fragments (CVE-2020-26147)
      * kernel: the copy-on-write implementation can grant unintended write access because of a race condition     in a THP mapcount check (CVE-2020-29368)
      * kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 (CVE-2021-3635)
      * kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)
      * kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure (CVE-2021-20239)
      * kernel: out of bounds array access in drivers/md/dm-ioctl.c (CVE-2021-31916)     CVE-2020-0427     In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could     lead to local information disclosure with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171     CVE-2020-24502     Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4     and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial     of service via local access.
    CVE-2020-24503     Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4     may allow an authenticated user to potentially enable information disclosure via local access.
    CVE-2020-24504     Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version     1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
    CVE-2020-24586     The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    CVE-2020-24587     The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed.
    CVE-2020-24588     The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets.
    CVE-2020-26139     An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients.
    CVE-2020-26140     An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration.
    CVE-2020-26141     An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol.
    CVE-2020-26143     An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration.
    CVE-2020-26144     An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration.
    CVE-2020-26145     An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration.
    CVE-2020-26146     An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design.
    CVE-2020-26147     An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used.
    CVE-2020-27777     A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel.
    CVE-2020-29368     An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The     copy-on-write implementation can grant unintended write access because of a race condition in a THP     mapcount check, aka CID-c444eb564fb1.
    CVE-2020-29660     A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID,     aka CID-c8bcd9c5be24.
    CVE-2020-36158     mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through     5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.
    CVE-2020-36386     An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf.
    CVE-2021-0129     Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access.
    CVE-2021-20194     There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config     params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y ,     CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution,     the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap     overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly     privileges escalation.
    CVE-2021-20239     A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an     attacker with a local account to leak information about kernel internal addresses. The highest threat from     this vulnerability is to confidentiality.
    CVE-2021-23133     A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.
    CVE-2021-28950     An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A stall on CPU can occur     because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.
    CVE-2021-28971     In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some     Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS     status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.
    CVE-2021-29155     An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer     arithmetic operations, the pointer modification performed by the first operation is not correctly     accounted for when restricting subsequent operations.
    CVE-2021-29646     An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does     not properly validate certain data sizes, aka CID-0217ed2848e8.
    CVE-2021-29650     An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    CVE-2021-31440     This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel     5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in     order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The     issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them.
    An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the     context of the kernel. Was ZDI-CAN-13661.
    CVE-2021-31829     kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading     to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not     protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized     data that might represent sensitive information previously operated on by the kernel.
    CVE-2021-31916     An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability.
    CVE-2021-33200     kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    CVE-2021-3348     nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-     free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a     certain point during device setup, aka CID-b98e762e3d71.
    CVE-2021-33909     fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05.
    CVE-2021-3489     The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size     was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel     and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee (bpf, ringbuf: Deny     reserve of buffers larger than ringbuf) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. It was introduced via 457f44363a88 (bpf: Implement BPF ring buffer and verifier     support for it) (v5.8-rc1).
    CVE-2021-3564     A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13.
    CVE-2021-3573     A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.
    CVE-2021-3600
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    CVE-2021-3635     A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with     root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.
    CVE-2021-3659
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    CVE-2021-3679     A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    CVE-2021-3732
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
151801	SUSE SLES15 Security Update : kernel (Live Patch 7 for SLE 15 SP2) (SUSE-SU-2021:2387-1)	Nessus	SuSE Local Security Checks	7/17/2021	6/25/2026	high
151804	SUSE SLES15 Security Update : kernel (Live Patch 0 for SLE 15 SP2) (SUSE-SU-2021:2377-1)	Nessus	SuSE Local Security Checks	7/17/2021	6/25/2026	high
152048	SUSE SLES12 Security Update : kernel (Live Patch 13 for SLE 12 SP5) (SUSE-SU-2021:2453-1)	Nessus	SuSE Local Security Checks	7/23/2021	6/25/2026	high
150985	Debian DLA-2689-1 : linux - LTS security update	Nessus	Debian Local Security Checks	6/24/2021	9/24/2025	high
150955	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5001-1)	Nessus	Ubuntu Local Security Checks	6/23/2021	8/27/2024	high
155145	CentOS 8 : kernel (CESA-2021:4356)	Nessus	CentOS Local Security Checks	11/11/2021	1/16/2024	high
155425	Oracle Linux 8 : kernel (ELSA-2021-4356)	Nessus	Oracle Linux Local Security Checks	11/17/2021	2/9/2026	high
157497	AlmaLinux 8 : kernel (ALSA-2021:4356)	Nessus	Alma Linux Local Security Checks	2/9/2022	1/16/2024	high
151042	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2021-1983)	Nessus	Huawei Local Security Checks	6/28/2021	12/12/2023	high
294759	MiracleLinux 8 : kernel-4.18.0-348.el8 (AXSA:2021-2785:26)	Nessus	Miracle Linux Local Security Checks	1/20/2026	2/4/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high