The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9459 advisory.

    - fs/namespace.c: fix mountpoint reference counter race (Piotr Krysiuk)  [Orabug: 33369433]     {CVE-2020-12114} {CVE-2020-12114}
    - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik)     [Orabug: 33369414]  {CVE-2019-19448} {CVE-2019-19448}
    - cfg80211: wext: avoid copying malformed SSIDs (Will Deacon)  [Orabug: 33369390]  {CVE-2019-17133}
    - vhost_net: fix possible infinite loop (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900} {CVE-2019-3900}
    - vhost: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost_net: introduce vhost_exceeds_weight() (Jason Wang)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost_net: use packet weight for rx handler, too (Paolo Abeni)  [Orabug: 33369374]  {CVE-2019-3900}
    - vhost-net: set packet weight of tx polling to 2 * vq size (haibinzhang)  [Orabug: 33369374]     {CVE-2019-3900}
    - mac80211: extend protection against mixed key and fragment cache attacks (Wen Gong)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147} {CVE-2020-24586} {CVE-2020-24587}
    - mac80211: do not accept/forward invalid EAPOL frames (Johannes Berg)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147}
    - mac80211: prevent attacks on TKIP/WEP as well (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: check defrag PN against current frame (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: add fragment cache to sta_info (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}
    - mac80211: drop A-MSDUs on old ciphers (Johannes Berg)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-24588}
    - cfg80211: mitigate A-MSDU aggregation attacks (Mathy Vanhoef)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-24588}
    - mac80211: properly handle A-MSDUs that start with an RFC 1042 header (Mathy Vanhoef)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147}
    - mac80211: prevent mixed key and fragment cache attacks (Mathy Vanhoef)  [Orabug: 33369361]     {CVE-2020-24586} {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140}     {CVE-2020-26141} {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146}     {CVE-2020-26147} {CVE-2020-24587} {CVE-2020-24586}
    - mac80211: assure all fragments are encrypted (Mathy Vanhoef)  [Orabug: 33369361]  {CVE-2020-24586}     {CVE-2020-26139} {CVE-2020-24587} {CVE-2020-24588} {CVE-2020-26139} {CVE-2020-26140} {CVE-2020-26141}     {CVE-2020-26142} {CVE-2020-26143} {CVE-2020-26144} {CVE-2020-26145} {CVE-2020-26146} {CVE-2020-26147}     {CVE-2020-26147}
    - sctp: validate from_addr_param return (Marcelo Ricardo Leitner)  [Orabug: 33369303]  {CVE-2021-3655}
    - virtio_console: Assure used length from device is limited (Xie Yongji)  [Orabug: 33369276]     {CVE-2021-38160}
    - net_sched: cls_route: remove the right filter from hashtable (Cong Wang)  [Orabug: 33369231]     {CVE-2021-3715}
    - HID: make arrays usage and value to be the same (Will McVicker)  [Orabug: 33369121]  {CVE-2021-0512}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5091-2 advisory.

    Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the     Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack.
    An attacker could use this to expose sensitive information. (CVE-2021-33624)

    It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu     ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

    It was discovered that the Virtio console implementation in the Linux kernel did not properly validate     input lengths in some situations. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2021-38160)

    Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly     order connection setup operations. An attacker controlling a remote NFS server could use this to cause a     denial of service on the client. (CVE-2021-38199)

    It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle     device removal events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2021-38204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3876-1 advisory.

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local     escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. (CVE-2018-9517)

  - The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An     attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are     believed to be vulnerable. (CVE-2019-3874)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a     use after free. This could lead to local escalation of privilege with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-152735806 (CVE-2020-0429)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to     improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for     a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon     Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon     Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W,     MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

  - IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive     information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
    (CVE-2020-4788)

  - In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References:
    Upstream kernel (CVE-2021-0941)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a     reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2021-3542)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE) (CVE-2021-3656)

  - kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - kernel: overlayfs: Mounting overlayfs inside an unprivileged user namespace can reveal files     (CVE-2021-3732)

  - ccp - fix resource leaks in ccp_run_aes_gcm_cmd() [fedora-all] (CVE-2021-3744)

  - A flaw was found in the Linux kernel. When reusing a socket with an attached dccps_hc_tx_ccid as a     listener, the socket will be used after being released leading to denial of service (DoS) or a potential     code execution. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2020-16119) (CVE-2021-3753)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the     timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user     privileges to cause a denial of service, slowing and eventually stopping the system while running OSP. The     highest threat from this vulnerability is system availability. (CVE-2021-20317) (CVE-2021-3764)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel through 5.14.9 allows     unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds     write. (CVE-2021-41864)

  - The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab     out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
    (CVE-2021-42008)

  - An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux     kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite     memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a     certain comparison uses values that are not memory sizes. (CVE-2021-42252)

  - The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to     drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt     mishandles bounds checking. (CVE-2021-42739)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3935-1 advisory.

    The SUSE Linux Enterprise 12 SP3 LTSS kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have     happened in the past (jsc#SLE-22573)

      You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
    (kernel.unprivileged_bpf_disabled = 0)

    - CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-     ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker     with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system     crash or a leak of internal kernel information. The highest threat from this vulnerability is to system     availability (bnc#1192781).
    - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks     about UDP ports in use. (bsc#1191790)
    - CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails  (bsc#1191961).
    - CVE-2020-12655: An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c. Attackers may     trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767     (bnc#1171217).
    - CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in     drivers/isdn/capi/kcapi.c (bnc#1191958).
    - CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking     for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).
    - CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a     Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of     uninitialized memory locations on the BPF stack (bnc#1188983).
    - CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a     Speculative Store Bypass side-channel attack because a certain preempting store operation did not     necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).
    - CVE-2017-17862: kernel/bpf/verifier.c in the Linux kernel ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic     issue, could possibly be used by local users for denial of service (bnc#1073928).
    - CVE-2017-17864: kernel/bpf/verifier.c in the Linux kernel mishandled states_equal comparisons between     the pointer data type and the UNKNOWN_VALUE data type, which allowed local users to obtain potentially     sensitive address information, aka a 'pointer leak (bnc#1073928).
    - CVE-2021-20265: A flaw was found in the way memory resources were freed in the unix_stream_recvmsg     function in the Linux kernel when a signal was pending. This flaw allowed an unprivileged local user to     crash the system by exhausting available memory. The highest threat from this vulnerability is to system     availability (bnc#1183089).
    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read     uninitialized memory (bnc#1188563).
    - CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to     create files with an unintended group ownership, in a scenario where a directory is SGID to a certain     group and is writable by a user who is not a member of that group. Here, the non-member can trigger     creation of a plain file whose group ownership is that group. The intended behavior was that the non-     member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The     non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem in the Linux kernel has a buffer overflow related to     drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt     mishandled bounds checking (bnc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c     because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd.
    This leads to writing an arbitrary value (bnc#1186109 bnc#1186390 bnc#1188876).
    - CVE-2020-14305: An out-of-bounds memory write flaw was found in how the Linux kernel's Voice Over     IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allowed an     unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability (bnc#1173346).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-42008: The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel has a slab     out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access     (bnc#1191315).
    - CVE-2020-3702: Specifically timed and handcrafted traffic can cause internal errors in a WLAN device     that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure     over the air for a discrete set of traffic (bnc#1191193).
    - CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module.
    (bsc#1190023)
    - CVE-2021-40490: A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the     ext4 subsystem in the Linux kernel (bnc#1190159 bnc#1192775)
    - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth     stack (bsc#1188172).
    - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a     buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
    - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
    - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
    - CVE-2021-3653: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw     occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a     nested guest (L2). Due to improper validation of the 'int_ctl' field, this issue could allow a malicious     L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2     guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire     system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions     prior to 5.14-rc7 (bnc#1189399 bnc#1189420).
    - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262 bnc#1189278).
    - CVE-2021-38204: drivers/usb/host/max3421-hcd.c in the Linux kernel allowed physically proximate     attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in     certain situations (bnc#1189291).
    - CVE-2021-3679: A lack of CPU resource in the Linux kernel tracing module functionality in versions prior     to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local     users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of     service (bnc#1189057).
    - CVE-2018-16882: A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed     posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an     error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc'     descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this     flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel     versions and are vulnerable (bnc#1119934).
    - CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory     corruption due to a use after free. This could lead to local escalation of privilege with System execution     privileges needed. User interaction is not needed for exploitation (bnc#1176724).
    - CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain     sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID:
    189296 (bnc#1177666 bnc#1181158).
    - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c     (bsc#1188876).
    - CVE-2021-37576: arch/powerpc/kvm/book3s_rtas.c in the Linux kernel on the powerpc platform allowed KVM     guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e (bnc#1188838).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3972-1 advisory.

    The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have     happened in the past (jsc#SLE-22573)

      You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
    (kernel.unprivileged_bpf_disabled = 0)


    The following security bugs were fixed:

    - CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use     after free. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation (bnc#1192045).
    - CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-     ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker     with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system     crash or a leak of internal kernel information. The highest threat from this vulnerability is to system     availability (bnc#1192781).
    - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks     about UDP ports in use. (bsc#1191790)
    - CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).
    - CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in     drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state     (bnc#1188601).
    - CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and     cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent     possibility of information disclosure. (bnc#1191193)
    - CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module.
    (bsc#1190023)
    - CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local     priviledge escalation. (bnc#1190159)
    - CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
    - CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
    - CVE-2021-3772: Fixed a remote denial of service in the SCTP stack, if the attacker can spoof IP     addresses and knows the IP-addresses and port numbers being used (bnc#1190351).
    - CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect     (bsc#1108488).
    - CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace     applications (bnc#1129898).
    - CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx()     (bnc#1133374).
    - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth     stack (bsc#1188172).
    - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable     AVIC support for the L2 guest. (bsc#1189399).
    - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to     disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
    - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses     trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use     this flaw to starve the resources causing denial of service (bnc#1189057).
    - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
    - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
    - CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS     attacks (bsc#1190115).
    - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a     buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
    - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow     page, leading to a missing guest protection page fault (bnc#1189262).
    - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial     of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations     (bnc#1189291).
    - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program     that could have obtain sensitive information from kernel memory (bsc#1188983).
    - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of     arbitrary kernel memory (bsc#1188985).
    - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
    - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c     (bsc#1188876).
    - CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and     can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the     ability to start and control a VM to read/write random pages of memory and can result in local privilege     escalation (bsc#1186482).
    - CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS     memory corruption via rtas_args.nargs (bsc#1188838).
    - CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory     corruption due to a use after free. This could lead to local escalation of privilege with System execution     privileges needed. (bsc#1176724).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be     triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the     vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior     (CVE-2021-38160)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3969-1 advisory.

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads     before the addresses of all prior memory writes are known may allow unauthorized disclosure of information     to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),     Variant 4. (CVE-2018-3639)

  - In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local     escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. (CVE-2018-9517)

  - The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An     attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are     believed to be vulnerable. (CVE-2019-3874)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to     improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for     a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon     Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon     Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W,     MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

  - In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References:
    Upstream kernel (CVE-2021-0941)

  - A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In     this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a     confidentiality problem. (CVE-2021-20320)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - A flaw was found in the Linux kernel's CAPI over Bluetooth connection code. An attacker with a local     account can escalate privileges when CAPI (ISDN) hardware connection fails. (CVE-2021-34981)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the virt_ext field, this issue could allow a malicious L1 to     disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the     L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire     system, leak of sensitive data or potential guest-to-host escape. (CVE-2021-3656)

  - A NULL pointer dereference flaw was found in the Linux kernel's IEEE 802.15.4 wireless networking     subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the     system. The highest threat from this vulnerability is to system availability. (CVE-2021-3659)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem     with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be     accessible. (CVE-2021-3732)

  - A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in     drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption).
    This vulnerability is similar with the older CVE-2019-18808. (CVE-2021-3744)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may     cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl     (KDSETMDE). The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3753)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat     to confidentiality, integrity, and system availability. (CVE-2021-3760)

  - A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker     to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat     from this vulnerability is to system availability. (CVE-2021-3764)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows     unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds     write. (CVE-2021-41864)

  - The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab     out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
    (CVE-2021-42008)

  - An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux     kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite     memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a     certain comparison uses values that are not memory sizes. (CVE-2021-42252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free,     related to an xfrm_state_fini panic, aka CID-dbb2483b2a46. (CVE-2019-25045)

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free.
    This could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-204573007References: Upstream kernel (CVE-2021-1048)

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from     kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which     allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for     those servers to be unreachable during trunking detection. (CVE-2021-38199)

  - net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in     any net namespace because these changes are leaked into all other net namespaces. This is related to the     NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. (CVE-2021-38209)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic     error. This could lead to local escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel (CVE-2020-0466)

  - A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the     ability to set extended attributes to panic the system, causing memory corruption or escalating     privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27815)

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be     triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the     vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior     (CVE-2021-38160)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the     group key handshake, allowing an attacker within radio range to replay frames from access points to     clients. (CVE-2017-13080)

  - It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable     to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on     network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph     service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. (CVE-2018-1128)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat     fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets,     independent of the network configuration. (CVE-2020-26142)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - A flaw was found in the Linux kernel's implementation of MIDI, where an attacker with a local account and     the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to     this specific memory while freed and before use causes the flow of execution to change and possibly allow     for memory corruption or privilege escalation. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-27786)

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
    (CVE-2021-20321)

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
    (CVE-2021-30002)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in     any net namespace because these changes are leaked into all other net namespaces. This is related to the     NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. (CVE-2021-38209)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an     improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of     service (DOS) due to a deadlock problem. (CVE-2021-4149)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds     memory access when an inode has an invalid last xattr entry. (CVE-2021-45469)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
153557	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9459)	Nessus	Oracle Linux Local Security Checks	9/22/2021	10/22/2024	critical
153801	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-5091-2)	Nessus	Ubuntu Local Security Checks	9/30/2021	8/27/2024	high
155824	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:3876-1)	Nessus	SuSE Local Security Checks	12/3/2021	12/5/2022	high
155902	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:3935-1)	Nessus	SuSE Local Security Checks	12/7/2021	9/24/2025	high
155959	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:3972-1)	Nessus	SuSE Local Security Checks	12/9/2021	9/24/2025	high
224067	Linux Distros Unpatched Vulnerability : CVE-2021-38160	Nessus	Misc.	3/5/2025	10/28/2025	high
155930	SUSE SLES15 Security Update : kernel (SUSE-SU-2021:3969-1)	Nessus	SuSE Local Security Checks	12/8/2021	7/13/2023	high
156347	EulerOS Virtualization 3.0.2.0 : kernel (EulerOS-SA-2021-2818)	Nessus	Huawei Local Security Checks	12/29/2021	10/7/2025	high
188948	EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2023-1262)	Nessus	Huawei Local Security Checks	1/16/2024	10/6/2025	high
161565	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2022-1735)	Nessus	Huawei Local Security Checks	5/26/2022	12/7/2023	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

high

high

high