The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9406 advisory.

    - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen)  [Orabug: 33135632]     {CVE-2021-33909}
    - Bluetooth: fix the erroneous flush_work() order (Lin Ma)   {CVE-2021-3564}
    - ath10k: Fix TKIP Michael MIC verification for PCIe (Wen Gong)   {CVE-2020-26141}
    - ath10k: drop MPDU which has discard flag set by firmware for SDIO (Wen Gong)   {CVE-2020-24588}
    - ath10k: drop fragments with multicast DA for SDIO (Wen Gong)   {CVE-2020-26145}
    - ath10k: drop fragments with multicast DA for PCIe (Wen Gong)   {CVE-2020-26145}
    - mac80211: extend protection against mixed key and fragment cache attacks (Wen Gong)   {CVE-2020-24586}     {CVE-2020-24587}
    - mac80211: drop A-MSDUs on old ciphers (Johannes Berg)   {CVE-2020-24588}
    - cfg80211: mitigate A-MSDU aggregation attacks (Mathy Vanhoef)   {CVE-2020-24588}
    - mac80211: prevent mixed key and fragment cache attacks (Mathy Vanhoef)   {CVE-2020-24587}     {CVE-2020-24586}
    - mac80211: assure all fragments are encrypted (Mathy Vanhoef)   {CVE-2020-26147}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2689 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of     arbitrary code, privilege escalation, denial of service, or information leaks. This update is not yet     available for the armel (ARM EABI soft-float) architecture. CVE-2020-24586, CVE-2020-24587, CVE-2020-26147     Mathy Vanhoef discovered that many Wi-Fi implementations, including Linux's mac80211, did not correctly     implement reassembly of fragmented packets. In some circumstances, an attacker within range of a network     could exploit these flaws to forge arbitrary packets and/or to access sensitive data on that network.
    CVE-2020-24588 Mathy Vanhoef discovered that most Wi-Fi implementations, including Linux's mac80211, did     not authenticate the is aggregated packet header flag. An attacker within range of a network could exploit     this to forge arbitrary packets on that network. CVE-2020-25670, CVE-2020-25671, CVE-2021-23134 kiyin     () of TenCent discovered several reference counting bugs in the NFC LLCP implementation which could     lead to use-after-free. A local user could exploit these for denial of service (crash or memory     corruption) or possibly for privilege escalation. Nadav Markus and Or Cohen of Palo Alto Networks     discovered that the original fixes for these introduced a new bug that could result in use-after-free and     double-free. This has also been fixed. CVE-2020-25672 kiyin () of TenCent discovered a memory leak     in the NFC LLCP implementation. A local user could exploit this for denial of service (memory exhaustion).
    CVE-2020-26139 Mathy Vanhoef discovered that a bug in some Wi-Fi implementations, including Linux's     mac80211. When operating in AP mode, they would forward EAPOL frames from one client to another while the     sender was not yet authenticated. An attacker within range of a network could use this for denial of     service or as an aid to exploiting other vulnerabilities. CVE-2020-26558, CVE-2021-0129 Researchers at     ANSSI discovered vulnerabilities in the Bluetooth Passkey authentication method, and in Linux's     implementation of it. An attacker within range of two Bluetooth devices while they pair using Passkey     authentication could exploit this to obtain the shared secret (Passkey) and then impersonate either of the     devices to each other. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's virtual memory     management. A parent and child process initially share all their memory, but when either writes to a     shared page, the page is duplicated and unshared (copy-on-write). However, in case an operation such as     vmsplice() required the kernel to take an additional reference to a shared page, and a copy-on-write     occurs during this operation, the kernel might have accessed the wrong process's memory. For some     programs, this could lead to an information leak or data corruption. CVE-2020-36322, CVE-2021-28950 The     syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not correctly handle a FUSE     server returning invalid attributes for a file. A local user permitted to run a FUSE server could use this     to cause a denial of service (crash). The original fix for this introduced a different potential denial of     service (infinite loop in kernel space), which has also been fixed. CVE-2021-3428 Wolfgang Frisch reported     a potential integer overflow in the ext4 filesystem driver. A user permitted to mount arbitrary filesystem     images could use this to cause a denial of service (crash). CVE-2021-3483  (Zheyu Ma) reported a     bug in the nosy driver for TI PCILynx FireWire controllers, which could lead to list corruption and a use-     after-free. On a system that uses this driver, local users granted access to /dev/nosy could exploit this     to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3564, CVE-2021-3573, CVE-2021-32399 The BlockSec team discovered several race conditions in the     Bluetooth subsystem that could lead to a use-after-free or double-free. A local user could exploit these     to caue a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3587 Active Defense Lab of Venustech discovered a potential null pointer dereference in the NFC     LLCP implementation. A local user could use this to cause a denial of service (crash). CVE-2021-20292 It     was discovered that the TTM buffer allocation API used by GPU drivers did not handle allocation failures     in the way that most drivers expected, resulting in a double-free on failure. A local user on a system     using one of these drivers could possibly exploit this to cause a denial of service (crash or memory     corruption) or for privilege escalation. The API has been changed to match driver expectations.
    CVE-2021-23133 Or Cohen of Palo Alto Networks discovered a race condition in the SCTP implementation,     which can lead to list corruption. A local user could exploit this to cause a denial of service (crash or     memory corruption) or possibly for privilege escalation. CVE-2021-28660 It was discovered that the     rtl8188eu WiFi driver did not correctly limit the length of SSIDs copied into scan results. An attacker     within WiFi range could use this to cause a denial of service (crash or memory corruption) or possibly to     execute code on a vulnerable system. CVE-2021-28688 (XSA-371) It was discovered that the original fix for     CVE-2021-26930 (XSA-365) introduced a potential resource leak. A malicious guest could presumably exploit     this to cause a denial of service (resource exhaustion) within the host. CVE-2021-28964 Zygo Blaxell     reported a race condition in the Btrfs driver which can lead to an assertion failure. On systems using     Btrfs, a local user could exploit this to cause a denial of service (crash). CVE-2021-28971 Vince Weaver     reported a bug in the performance event handler for Intel PEBS. A workaround for a hardware bug on Intel     CPUs codenamed Haswell and earlier could lead to a null pointer dereference. On systems with the affected     CPUs, if users are permitted to access performance events, a local user may exploit this to cause a denial     of service (crash). By default, unprivileged users do not have access to performance events, which     mitigates this issue. This is controlled by the kernel.perf_event_paranoid sysctl. CVE-2021-29154 It was     discovered that the Extended BPF (eBPF) JIT compiler for x86_64 generated incorrect branch instructions in     some cases. On systems where eBPF JIT is enabled, users could exploit this to execute arbitrary code in     the kernel. By default, eBPF JIT is disabled, mitigating this issue. This is controlled by the     net.core.bpf_jit_enable sysctl. CVE-2021-29265 The syzbot tool found a race condition in the USB/IP host     (server) implementation which can lead to a null pointer dereference. On a system acting as a USB/IP host,     a client can exploit this to cause a denial of service (crash). CVE-2021-29647 The syzbot tool found an     information leak in the Qualcomm IPC Router (qrtr) implementation. This protocol is not enabled in     Debian's official kernel configurations. CVE-2021-29650 It was discovered that a data race in the     netfilter subsystem could lead to a null pointer dereference during replacement of a table. A local user     with CAP_NET_ADMIN capability in any user namespace could use this to cause a denial of service (crash).
    By default, unprivileged users cannot create user namespaces, which mitigates this issue. This is     controlled by the kernel.unprivileged_userns_clone sysctl. CVE-2021-30002 Arnd Bergmann and the syzbot     tool found a memory leak in the Video4Linux (v4l) subsystem. A local user permitted to access video     devices (by default, any member of the video group) could exploit this to cause a denial of service     (memory exhaustion). CVE-2021-31916 Dan Carpenter reported incorrect parameter validation in the device-     mapper (dm) subsystem, which could lead to a heap buffer overrun. However, only users with CAP_SYS_ADMIN     capability (i.e. root-equivalent) could trigger this bug, so it did not have any security impact in this     kernel version. CVE-2021-33034 The syzbot tool found a bug in the Bluetooth subsystem that could lead to a     use-after-free. A local user could use this to cause a denial of service (crash or memory corruption) or     possibly for privilege escalation. For Debian 9 stretch, these problems have been fixed in version     4.9.272-1. This update additionally includes many more bug fixes from stable updates 4.9.259-4.9.272     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further     information about Debian LTS security advisories, how to apply these updates to your system and frequently     asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414584 advisory.

    A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c,     there is a possible use after free due to a logic     error. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2020-0466)

  - fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8,     when there is an NFS export of a subdirectory of a     filesystem, allows remote attackers to traverse to     other parts of the filesystem via READDIRPLUS. NOTE:
    some parties argue that such a subdirectory export is     not intended to prevent this attack see also the     exports(5) no_subtree_check default     behavior.(CVE-2021-3178)

  - An issue was discovered in the Linux kernel through     5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an     iSCSI transport is registered with the iSCSI subsystem,     the transport's handle is available to unprivileged     users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When     read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which     leaks the handle. This handle is actually the pointer     to an iscsi_transport struct in the kernel module's     global variables.(CVE-2021-27363)

  - An issue was discovered in the Linux kernel through     5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged     user to craft Netlink messages.(CVE-2021-27364)

  - A race condition was found in the Linux kernels     implementation of the floppy disk drive controller     driver software. The impact of this issue is lessened     by the fact that the default permissions on the floppy     device (/dev/fd0) are restricted to root. If the     permissions on the device have changed the impact     changes greatly. In the default configuration root (or     equivalent) permissions are required to attack this     flaw.(CVE-2021-20261)

  - In fs/ocfs2/cluster/nodemanager.c in the Linux kernel     before 4.15, local users can cause a denial of service     (NULL pointer dereference and BUG) because a required     mutex is not used.(CVE-2017-18216)

  - The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel before     4.10.4 allows local users to cause a denial of service     (tty exhaustion) by leveraging reference count     mishandling.(CVE-2017-8925)

  - A flaw was found in the way memory resources were freed     in the unix_stream_recvmsg function in the Linux kernel     when a signal was pending. This flaw allows an     unprivileged local user to crash the system by     exhausting available memory. The highest threat from     this vulnerability is to system     availability.(CVE-2021-20265)

  - A flaw was found in the JFS filesystem code in the     Linux Kernel which allows a local attacker with the     ability to set extended attributes to panic the system,     causing memory corruption or escalating privileges. The     highest threat from this vulnerability is to     confidentiality, integrity, as well as system     availability.(CVE-2020-27815)

  - An out-of-bounds (OOB) memory access flaw was found in     x25_bind in net/x25/af_x25.c in the Linux kernel     version v5.12-rc5. A bounds check failure allows a     local attacker with a user account on the system to     gain access to out-of-bounds memory, leading to a     system crash or a leak of internal kernel information.
    The highest threat from this vulnerability is to     confidentiality, integrity, as well as system     availability.(CVE-2020-35519)

  - There is a flaw reported in the Linux kernel in     versions before 5.9 in     drivers/gpu/drm/nouveau/nouveau_sgdma.c in     nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The     issue results from the lack of validating the existence     of an object prior to performing operations on the     object. An attacker with a local account with a root     privilege, can leverage this vulnerability to escalate     privileges and execute code in the context of the     kernel.(CVE-2021-20292)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux     kernel through 5.11.8, the RPA PCI Hotplug driver has a     user-tolerable buffer overflow when writing a new     device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame     directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination,     aka CID-cc7a0bb058b8.(CVE-2021-28972)

  - A race condition was discovered in get_old_root in     fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG)     because of a lack of locking on an extent buffer before     a cloning operation, aka     CID-dbcc7d57bffc.(CVE-2021-28964)

  - An issue was discovered in the Linux kernel before     5.11.7. usbip_sockfd_store in     drivers/usb/usbip/stub_dev.c allows attackers to cause     a denial of service (GPF) because the stub-up sequence     has race conditions during an update of the local and     shared status, aka CID-9380afd6df70.(CVE-2021-29265)

  - BPF JIT compilers in the Linux kernel through 5.11.12     have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the     kernel context. This affects     arch/x86/net/bpf_jit_comp.c and     arch/x86/net/bpf_jit_comp32.c.(CVE-2021-29154)

  - The KVM implementation in the Linux kernel through     4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio     stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and     include/trace/events/kvm.h.(CVE-2017-17741)

  - An issue was discovered in the Linux kernel before     5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak     for large arguments, aka     CID-fb18802a338b.(CVE-2021-30002)

  - An issue was discovered in the Linux kernel through     4.17.10. There is an invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when     mounting a crafted btrfs image, related to removing     reloc rb_trees when reloc control has not been     initialized.(CVE-2018-14609)

  - An issue was discovered in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.17.3. A denial of service (memory corruption     and BUG) can occur for a corrupted xfs image upon     encountering an inode that is in extent format, but has     more extents than fit in the inode     fork.(CVE-2018-13095)

  - The vmw_gb_surface_define_ioctl function in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel through 4.10.7 does not validate certain levels     data, which allows local users to cause a denial of     service (system hang) via a crafted ioctl call for a     /dev/dri/renderD* device.(CVE-2017-7346)

  - The klsi_105_get_line_state function in     drivers/usb/serial/kl5kusb105.c in the Linux kernel     before 4.9.5 places uninitialized heap-memory contents     into a log entry upon a failure to read the line     status, which allows local users to obtain sensitive     information by reading the log.(CVE-2017-5549)

  - An integer overflow in the uvesafb_setcmap function in     drivers/video/fbdev/uvesafb.c in the Linux kernel     before 4.17.4 could result in local attackers being     able to crash the kernel or potentially elevate     privileges because kmalloc_array is not     used.(CVE-2018-13406)

  - In the Linux kernel before version 4.12, Kerberos 5     tickets decoded when using the RXRPC keys incorrectly     assumes the size of a field. This could lead to the     size-remaining variable wrapping and the data pointer     going over the end of the buffer. This could possibly     lead to memory corruption and possible privilege     escalation.(CVE-2017-7482)

  - drivers/net/usb/rtl8150.c in the Linux kernel 4.9.x     before 4.9.11 interacts incorrectly with the     CONFIG_VMAP_STACK option, which allows local users to     cause a denial of service (system crash or memory     corruption) or possibly have unspecified other impact     by leveraging use of more than one virtual page for a     DMA scatterlist.(CVE-2017-8069)

  - An issue was discovered in the Linux kernel through     5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can     exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI,     and has a length up to the maximum length of a Netlink     message.(CVE-2021-27365)

  - A flaw was found in the Nosy driver in the Linux     kernel. This issue allows a device to be inserted twice     into a doubly-linked list, leading to a use-after-free     when one of these devices is removed. The highest     threat from this vulnerability is to confidentiality,     integrity, as well as system availability. Versions     before kernel 5.12-rc6 are affected(CVE-2021-3483)

  - An issue was discovered in the FUSE filesystem     implementation in the Linux kernel before 5.10.6, aka     CID-5d069dbe8aaf. fuse_do_getattr() calls     make_bad_inode() in inappropriate situations, causing a     system crash. NOTE: the original fix for this     vulnerability was incomplete, and its incompleteness is     tracked as CVE-2021-28950.(CVE-2020-36322)

  - An out-of-bounds (OOB) memory write flaw was found in     list_devices in drivers/md/dm-ioctl.c in the     Multi-device driver module in the Linux kernel before     5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access     to out-of-bounds memory leading to a system crash or a     leak of internal kernel information. The highest threat     from this vulnerability is to system     availability.(CVE-2021-31916)

  - A vulnerability was found in Linux Kernel, where a     refcount leak in llcp_sock_connect() causing     use-after-free which might lead to privilege     escalations.(CVE-2020-25671)

  - A vulnerability was found in Linux Kernel where     refcount leak in llcp_sock_bind() causing     use-after-free which might lead to privilege     escalations.(CVE-2020-25670)

  - A memory leak vulnerability was found in Linux kernel     in llcp_sock_connect(CVE-2020-25672)

  - The Linux kernel before 5.11.14 has a use-after-free in     cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the     CIPSO and CALIPSO refcounting for the DOI definitions     is mishandled, aka CID-ad5d07f4a9cd. This leads to     writing an arbitrary value.(CVE-2021-33033)

  - Use After Free vulnerability in nfc sockets in the     Linux Kernel before 5.12.4 allows local attackers to     elevate their privileges. In typical configurations,     the issue can only be triggered by a privileged local     user with the CAP_NET_RAW capability.(CVE-2021-23134)

  - A flaw use-after-free in function     hci_sock_bound_ioctl() of the Linux kernel HCI     subsystem was found in the way user detaches bluetooth     dongle or other way triggers unregister bluetooth     device event. A local user could use this flaw to crash     the system or escalate their privileges on the     system.(CVE-2021-3573)

  - An issue was discovered in the Linux kernel through     5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute     code in the kernel, aka     CID-34b1a1ce1458.(CVE-2021-3347)

  - A vulnerability was found in Linux kernel where     non-blocking socket in llcp_sock_connect() leads to     leak and eventually hanging-up the     system.(CVE-2020-25673)

  - net/bluetooth/hci_request.c in the Linux kernel through     5.12.2 has a race condition for removal of the HCI     controller.(CVE-2021-32399)

  - In all Qualcomm products with Android releases from CAF     using the Linux kernel, during DMA allocation, due to     wrong data type of size, allocation size gets truncated     which makes allocation succeed when it should     fail.(CVE-2017-9725)

  - A flaw double-free memory corruption in the Linux     kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device.
    A local user could use this flaw to crash the system.
    This flaw affects all the Linux kernel versions     starting from 3.13.(CVE-2021-3564)

  - A flaw was found in the CAN BCM networking protocol in     the Linux kernel, where a local attacker can abuse a     flaw in the CAN subsystem to corrupt memory, crash the     system or escalate privileges.(CVE-2021-3609)

  - The ip6gre_err function in net/ipv6/ip6_gre.c in the     Linux kernel allows remote attackers to have     unspecified impact via vectors involving GRE flags in     an IPv6 packet, which trigger an out-of-bounds     access.(CVE-2017-5897)

  - An Out-of-Bounds Read was discovered in     arch/arm/mach-footbridge/personal-pci.c in the Linux     kernel through 5.12.11 because of the lack of a check     for a value that shouldn't be negative, e.g., access to     element -2 of an array, aka     CID-298a58e165e4.(CVE-2021-32078)

  - In the Linux kernel before 4.20.8,     kvm_ioctl_create_device in virt/kvm/kvm_main.c     mishandles reference counting because of a race     condition, leading to a use-after-free.(CVE-2019-6974)

  - In uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.(CVE-2020-0404)

  - In create_pinctrl of core.c, there is a possible out of     bounds read due to a use after free. This could lead to     local information disclosure with no additional     execution privileges needed. User interaction is not     needed for exploitation.(CVE-2020-0427)

  - In kbd_keycode of keyboard.c, there is a possible out     of bounds write due to a missing bounds check. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-144161459(CVE-2020-0431)

  - In blk_mq_queue_tag_busy_iter of blk-mq-tag.c, there is     a possible use after free due to improper locking. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2020-0433)

  - In various methods of hid-multitouch.c, there is a     possible out of bounds write due to a missing bounds     check. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2020-0465)

  - A vulnerability was found in the Linux Kernel where the     function sunkbd_reinit having been scheduled by     sunkbd_interrupt before sunkbd being freed. Though the     dangling pointer is set to NULL in sunkbd_disconnect,     there is still an alias in sunkbd_reinit causing Use     After Free.(CVE-2020-25669)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the     OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service     (system crash) or possibly execute arbitrary code via a crafted packet. (CVE-2015-4001)

  - drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure     that certain length values are sufficiently large, which allows remote attackers to cause a denial of     service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to     the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions. (CVE-2015-4002)

  - The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux     kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system     crash) via a crafted packet. (CVE-2015-4003)

  - The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash) via a crafted packet. (CVE-2015-4004)

  - arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the 'strict page     permissions' protection mechanism and modify the system-call table, and consequently gain privileges, by     leveraging write access. (CVE-2015-8967)

  - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows     local users to gain privileges or cause a denial of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)

  - In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux     kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute     NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes (CVE-2017-11089)

  - In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due     to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should     fail. (CVE-2017-9725)

  - A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free     which might lead to privilege escalations. (CVE-2020-25670)

  - A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-     free which might lead to privilege escalations. (CVE-2020-25671)

  - A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak     and eventually hanging-up the system. (CVE-2020-25673)

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - There is a flaw reported in the Linux kernel in versions before 5.9 in     drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue     results from the lack of validating the existence of an object prior to performing operations on the     object. An attacker with a local account with a root privilege, can leverage this vulnerability to     escalate privileges and execute code in the context of the kernel. (CVE-2021-20292)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer     before a cloning operation, aka CID-dbcc7d57bffc. (CVE-2021-28964)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in     drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up     sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
    (CVE-2021-29265)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
    (CVE-2021-3347)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from     kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693)

  - A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice     into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest     threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions     before kernel 5.12-rc6 are affected (CVE-2021-3483)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 6.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.1.1 advisory.

  - JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write     access to the Log4j configuration. The attacker can provide TopicBindingName and     TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result     in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2     when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions. (CVE-2021-4104)

  - It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-     default configurations. This could allows attackers with control over Thread Context Map (MDC) input data     when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for     example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input     data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some     environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix     this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
    (CVE-2021-45046)

  - Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI     features used in configuration, log messages, and parameters do not protect against attacker controlled     LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters     can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From     log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3,     and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to     log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
    (CVE-2021-44228)

  - xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and     watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows     remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory     corruption) via a crafted XML document. (CVE-2016-4658)

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
152389	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9406)	Nessus	Oracle Linux Local Security Checks	8/10/2021	10/22/2024	high
150985	Debian DLA-2689-1 : linux - LTS security update	Nessus	Debian Local Security Checks	6/24/2021	9/24/2025	high
267070	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414584)	Nessus	Unity Linux Local Security Checks	10/7/2025	10/15/2025	medium
153271	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2021-2392)	Nessus	Huawei Local Security Checks	9/14/2021	5/9/2022	critical
154404	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2021-2588)	Nessus	Huawei Local Security Checks	10/25/2021	10/6/2025	high
178888	EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2023-2444)	Nessus	Huawei Local Security Checks	7/26/2023	10/7/2025	critical
164572	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1.1)	Nessus	Misc.	9/1/2022	2/17/2025	high

Detections

Analytics

Plugins Search

high

high

medium

critical

high

critical

high