According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Linux kernel through 5.7.11 allows remote attackers     to make observations that help to obtain sensitive     information about the internal state of the network     RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)

  - A flaw was found in the Linux kernel's implementation     of the invert video code on VGA consoles when a local     attacker attempts to resize the console, calling an     ioctl VT_RESIZE, which causes an out-of-bounds write to     occur. This flaw allows a local user with access to the     VGA console to crash the system, potentially escalating     their privileges on the system. The highest threat from     this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-14331)

  - A buffer over-read flaw was found in RH kernel versions     before 5.0 in crypto_authenc_extractkeys in     crypto/authenc.c in the IPsec Cryptographic algorithm's     module, authenc. When a payload longer than 4 bytes,     and is not following 4-byte alignment boundary     guidelines, it causes a buffer over-read threat,     leading to a system crash. This flaw allows a local     attacker with user privileges to cause a denial of     service.(CVE-2020-10769)

  - An issue was discovered in the Linux kernel through     5.7.1. drivers/tty/vt/keyboard.c has an integer     overflow if k_ascii is called several times in a row,     aka CID-b86dab054059. NOTE: Members in the community     argue that the integer overflow does not lead to a     security issue in this case.(CVE-2020-13974)

  - In the Linux kernel through 5.7.6, usbtest_disconnect     in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)

  - The VFIO PCI driver in the Linux kernel through 5.6.13     mishandles attempts to access disabled memory     space.(CVE-2020-12888)

  - go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)

  - An issue was discovered in the Linux kernel before     5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a     reference count is mishandled, aka     CID-a3e23f719f5c.(CVE-2019-20811)

  - An issue was discovered in the Linux kernel before     5.4.7. The prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)

  - A flaw was found in the Linux kernel's implementation     of Userspace core dumps. This flaw allows an attacker     with a local account to crash a trivial program and     exfiltrate private kernel data.(CVE-2020-10732)

  - A flaw was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further processing.(CVE-2020-10751)

  - gadget_dev_desc_UDC_store in     drivers/usb/gadget/configfs.c in the Linux kernel     through 5.6.13 relies on kstrdup without considering     the possibility of an internal '\0' value, which allows     attackers to trigger an out-of-bounds read, aka     CID-15753588bcd4.(CVE-2020-13143)

  - A signal access-control issue was discovered in the     Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
    Because exec_id in include/linux/sched.h is only 32     bits, an integer overflow can interfere with a     do_notify_parent protection mechanism. A child process     can send an arbitrary signal to a parent process in a     different security domain. Exploitation limitations     include the amount of elapsed time before an integer     overflow occurs, and the lack of scenarios where     signals to a parent process present a substantial     operational threat.(CVE-2020-12826)

  - The __mptctl_ioctl function in     drivers/message/fusion/mptctl.c in the Linux kernel     before 5.4.14 allows local users to hold an incorrect     lock during the ioctl operation and trigger a race     condition, i.e., a 'double fetch' vulnerability, aka     CID-28d76df18f0a. NOTE: the vendor states 'The security     impact of this bug is not as bad as it could have been     because these operations are all privileged and root     already has enormous destructive     power.'(CVE-2020-12652)

  - An issue was found in Linux kernel before 5.5.4. The     mwifiex_cmd_append_vsie_tlv() function in     drivers/net/wireless/marvell/mwifiex/scan.c allows     local users to gain privileges or cause a denial of     service because of an incorrect memcpy and buffer     overflow, aka CID-b70261a288ea.(CVE-2020-12653)

  - An issue was found in Linux kernel before 5.5.4.
    mwifiex_ret_wmm_get_status() in     drivers/net/wireless/marvell/mwifiex/wmm.c allows a     remote AP to trigger a heap-based buffer overflow     because of an incorrect memcpy, aka     CID-3a9b153c5591.(CVE-2020-12654)

  - An issue was discovered in xfs_agf_verify in     fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through     5.6.10. Attackers may trigger a sync of excessive     duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767.(CVE-2020-12655)

  - A flaw was found in the Linux kernel's implementation     of GRO in versions before 5.2. This flaw allows an     attacker with local access to crash the     system.(CVE-2020-10720)

  - An issue was discovered in the Linux kernel through     5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka     CID-83c6f2390040.(CVE-2020-12770)

  - In the Linux kernel before 5.4.12,     drivers/input/input.c has out-of-bounds writes via a     crafted keycode table, as demonstrated by     input_set_keycode, aka     CID-cb222aed03d7.(CVE-2019-20636)

  - An issue was discovered in the stv06xx subsystem in the     Linux kernel before 5.6.1.
    drivers/media/usb/gspca/stv06xx/stv06xx.c and     drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c     mishandle invalid descriptors, as demonstrated by a     NULL pointer dereference, aka     CID-485b06aadb93.(CVE-2020-11609)

  - In the netlink driver, there is a possible out of     bounds write due to a race condition. This could lead     to local escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-65025077(CVE-2020-0066)

  - In the Linux kernel before 5.5.8, get_raw_socket in     drivers/vhost/net.c lacks validation of an sk_family     field, which might allow attackers to trigger kernel     stack corruption via crafted system     calls.(CVE-2020-10942)

  - An issue was discovered in slc_bump in     drivers/net/can/slcan.c in the Linux kernel through     5.6.2. It allows attackers to read uninitialized     can_frame data, potentially containing sensitive     information from kernel stack memory, if the     configuration lacks CONFIG_INIT_STACK_ALL, aka     CID-b9258a2cece4.(CVE-2020-11494)

  - An issue was discovered in the Linux kernel through     5.6.2. mpol_parse_str in mm/mempolicy.c has a     stack-based out-of-bounds write because an empty     nodelist is mishandled during mount option parsing, aka     CID-aa9f7d5172fa. NOTE: Someone in the security     community disagrees that this is a vulnerability     because the issue 'is a bug in parsing mount options     which can only be specified by a privileged user, so     triggering the bug does not grant any powers not     already held.'.(CVE-2020-11565)

  - An issue was discovered in the Linux kernel before     5.6.1. drivers/media/usb/gspca/ov519.c allows NULL     pointer dereferences in ov511_mode_init_regs and     ov518_mode_init_regs when there are zero endpoints, aka     CID-998912346c0d.(CVE-2020-11608)

  - The kernel in Red Hat Enterprise Linux 7 and MRG-2 does     not clear garbage data for SG_IO buffer, which may     leaking sensitive information to     userspace.(CVE-2014-8181)

  - In the Linux kernel 5.0.21, mounting a crafted ext4     filesystem image, performing some operations, and     unmounting can lead to a use-after-free in     ext4_put_super in fs/ext4/super.c, related to     dump_orphan_list in fs/ext4/super.c.(CVE-2019-19447)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4060 advisory.

  - An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an     out of bounds write in the function i2c_smbus_xfer_emulated. (CVE-2017-18551)

  - An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout()     and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. (CVE-2018-20836)

  - An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). (CVE-2019-12614)

  - An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver. (CVE-2019-15217)

  - In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS     expander discovery fails. This will cause a BUG and denial of service. (CVE-2019-15807)

  - An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when     hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c. (CVE-2019-15917)

  - drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16231)

  - drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16233)

  - In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when     register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka     CID-07f12b26e21a. (CVE-2019-16994)

  - ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel     through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket,     aka CID-e69dbd4619e7. (CVE-2019-17053)

  - base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through     5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21. (CVE-2019-17055)

  - A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.
    (CVE-2019-18808)

  - A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because     an attacker cannot realistically control this failure at probe time (CVE-2019-19046)

  - A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     nl80211hdr_put() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because     it occurs on a code path where a successful allocation has already occurred (CVE-2019-19055)

  - A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     alloc_page() failures, aka CID-b4b814fec1a5. (CVE-2019-19058)

  - Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in     drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow     attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or     dma_alloc_coherent() failures, aka CID-0f4f199443fa. (CVE-2019-19059)

  - A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_report_alg() failures, aka CID-ffdde5932042. (CVE-2019-19062)

  - Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the     Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka     CID-3f9361695113. (CVE-2019-19063)

  - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way     the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of service. (CVE-2019-19332)

  - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and     unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list     in fs/ext4/super.c. (CVE-2019-19447)

  - In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79. (CVE-2019-19523)

  - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. (CVE-2019-19524)

  - In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef. (CVE-2019-19530)

  - In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device     in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29. (CVE-2019-19534)

  - In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB     device in the USB character device driver layer, aka CID-303911cfc5b9. This affects     drivers/usb/core/file.c. (CVE-2019-19537)

  - The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors     in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka     CID-4ea99936a163. (CVE-2019-19767)

  - In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code     refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The     timeri variable was originally intended to be for a newly created timer instance, but was used for a     different purpose after refactoring. (CVE-2019-19807)

  - In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. (CVE-2019-20054)

  - mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has     some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will     cause a memory leak and denial of service. (CVE-2019-20095)

  - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode     table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. (CVE-2019-20636)

  - In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9454)

  - In the Android kernel in the video driver there is a use after free due to a race condition. This could     lead to local escalation of privilege with no additional execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9458)

  - There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of     ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device     file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed,     it can cause an exploitable condition as the process wakes up to terminate and clean all attached files.
    The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the     inode. (CVE-2020-10690)

  - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an     attacker with a local account to crash a trivial program and exfiltrate private kernel data.
    (CVE-2020-10732)

  - A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS     client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause     a kernel panic. The highest threat from this vulnerability is to data confidentiality and system     availability. (CVE-2020-10742)

  - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it     incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly     only validate the first netlink message in the skb and allow or deny the rest of the messages within the     skb with the granted permission without further processing. (CVE-2020-10751)

  - In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family     field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
    (CVE-2020-10942)

  - An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-     based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-     aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the     issue is a bug in parsing mount options which can only be specified by a privileged user, so triggering     the bug does not grant any powers not already held. (CVE-2020-11565)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
    Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a     do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in     a different security domain. Exploitation limitations include the amount of elapsed time before an integer     overflow occurs, and the lack of scenarios where signals to a parent process present a substantial     operational threat. (CVE-2020-12826)

  - An out-of-bounds memory write flaw was found in how the Linux kernel's Voice Over IP H.323 connection     tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote     user to crash the system, causing a denial of service. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-14305)

  - A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN     and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't     correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would     allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this     vulnerability is to data confidentiality. (CVE-2020-1749)

  - A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest     when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into     accessing sensitive L1 resources that should be inaccessible to the L2 guest. (CVE-2020-2732)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c. (CVE-2020-8647)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region     function in drivers/video/console/vgacon.c. (CVE-2020-8649)

  - An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to     a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it,     aka CID-2e90ca68b0d2. (CVE-2020-9383)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2854 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * kernel: nfs: use-after-free in svc_process_common() (CVE-2018-16884)

    * Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption     (CVE-2020-8834)

    * Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario (CVE-2020-12888)

    * kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

    * kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c     (CVE-2019-11811)

    * kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

    * kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c (CVE-2019-18808)

    * kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c     and fs/ext4/super.c (CVE-2019-19767)

    * kernel: an out-of-bounds write via crafted keycode table (CVE-2019-20636)

    * kernel: use-after-free read in napi_gro_frags() in the Linux kernel (CVE-2020-10720)

    * kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

    * kernel: A memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for a DoS     (CVE-2019-19062)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * XFS: Metadata corruption detected at xfs_attr3_leaf_read_verify [rhel-alt-7.6.z] (BZ#1830836)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4609 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

    * kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

    * kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

    * kernel: memory leak in ccp_run_sha_cmd() (CVE-2019-18808)

    * kernel: Denial Of Service in the __ipmi_bmc_register()  (CVE-2019-19046)

    * kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

    * Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

    * kernel: use-after-free in ext4_put_super (CVE-2019-19447)

    * kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free     (CVE-2019-19524)

    * kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

    * kernel: use-after-free in serial_ir_init_module() (CVE-2019-19543)

    * kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry (CVE-2019-19767)

    * kernel: use-after-free in debugfs_remove (CVE-2019-19770)

    * kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

    * kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

    * kernel: out-of-bounds read in in vc_do_resize (CVE-2020-8647)

    * kernel: use-after-free in n_tty_receive_buf_common (CVE-2020-8648)

    * kernel: invalid read location in vgacon_invert_region (CVE-2020-8649)

    * kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

    * kernel: SELinux netlink permission check bypass (CVE-2020-10751)

    * kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

    * kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

    * kernel: out-of-bounds write in xdp_umem_reg (CVE-2020-12659)

    * kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

    * kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

    * kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

    * kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

    * kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information     disclosure (CVE-2019-9455)

    * kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

    * kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

    * kernel: memory leak in  af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c     (CVE-2019-18809)

    * kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() (CVE-2019-19056)

    * kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

    * kernel: Two memory leaks in the rtl_usb_probe() (CVE-2019-19063)

    * kernel: A memory leak in the rtl8xxxu_submit_int_urb() (CVE-2019-19068)

    * kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for     a DoS (CVE-2019-19072)

    * kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

    * kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

    * kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

    * kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

    * kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5656 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: out of bounds write in function i2c_smbus_xfer_emulated in drivers/i2c/i2c-core-smbus.c     (CVE-2017-18551)

    * kernel: race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c     leads to use-after-free (CVE-2018-20836)

    * kernel: out of bounds write in i2c driver leads to local escalation of privilege (CVE-2019-9454)

    * kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     (CVE-2019-19046)

    * kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to     a use-after-free in ext4_put_super in fs/ext4/super.c (CVE-2019-19447)

    * kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

    * kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Input: ff-memless - kill timer in destroy (Oliver     Neukum) [Orabug: 31213691] (CVE-2019-19524)

  - libertas: Fix two buffer overflows at parsing bss     descriptor (Wen Huang) [Orabug: 31351307]     (CVE-2019-14896) (CVE-2019-14897) (CVE-2019-14897)

  - binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Kees Cook)     [Orabug: 31352068] (CVE-2017-1000370) (CVE-2017-1000371)     (CVE-2017-1000370)

  - NFSv4.0: Remove transport protocol name from non-UCS     client ID (Chuck Lever) [Orabug: 31357212]

  - NFSv4.0: Remove cl_ipaddr from non-UCS client ID (Chuck     Lever) 

  - xen/manage: enable C_A_D to force reboot (Dongli Zhang)     [Orabug: 31387466]

  - acpi: disable erst (Wengang Wang) [Orabug: 31194253]

  - mdio_bus: Fix use-after-free on device_register fails     (YueHaibing) [Orabug: 31222292] (CVE-2019-12819)

  - rds: ib: Fix dysfunctional long address resolve timeout     (Hakon Bugge) 

  - vxlan: don't migrate permanent fdb entries during learn     (Roopa Prabhu) 

  - USB: iowarrior: fix use-after-free on disconnect (Johan     Hovold) [Orabug: 31351061] (CVE-2019-19528)

  - usb: iowarrior: fix deadlock on disconnect (Oliver     Neukum) [Orabug: 31351061] (CVE-2019-19528)

  - mremap: properly flush TLB before releasing the page     (Linus Torvalds) [Orabug: 31352011] (CVE-2018-18281)

  - Input: add safety guards to input_set_keycode (Dmitry     Torokhov) [Orabug: 31200558] (CVE-2019-20636)

  - media: stv06xx: add missing descriptor sanity checks     (Johan Hovold) [Orabug: 31200579] (CVE-2020-11609)

  - media: ov519: add missing endpoint sanity checks (Johan     Hovold) [Orabug: 31213758] (CVE-2020-11608)

  - media: xirlink_cit: add missing descriptor sanity checks     (Johan Hovold) [Orabug: 31213767] (CVE-2020-11668)

  - mwifiex: pcie: Fix memory leak in     mwifiex_pcie_init_evt_ring (Navid Emamdoost) [Orabug:
    31263147] (CVE-2019-19057)

  - USB: core: Fix races in character device registration     and deregistraion (Alan Stern) [Orabug: 31317667]     (CVE-2019-19537)

ID	Name	Product	Family	Published	Updated	Severity
140917	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2020-2150)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	high
141619	CentOS 7 : kernel (RHSA-2020:4060)	Nessus	CentOS Local Security Checks	10/20/2020	10/9/2024	high
143086	RHEL 7 : kernel-alt (RHSA-2020:2854)	Nessus	Red Hat Local Security Checks	11/19/2020	11/7/2024	high
137516	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2020-1674)	Nessus	Huawei Local Security Checks	6/17/2020	4/25/2023	critical
142382	RHEL 8 : kernel-rt (RHSA-2020:4609)	Nessus	Red Hat Local Security Checks	11/4/2020	11/7/2024	high
144554	RHEL 7 : kernel (RHSA-2020:5656)	Nessus	Red Hat Local Security Checks	12/22/2020	11/7/2024	high
137217	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0020) (Stack Clash)	Nessus	OracleVM Local Security Checks	6/8/2020	3/7/2024	critical

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

critical