Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2019-2182     Hanjun Guo and Lei Li reported a race condition in the     arm64 virtual memory management code, which could lead     to an information disclosure, denial of service (crash),     or possibly privilege escalation.

  - CVE-2019-5108     Mitchell Frank of Cisco discovered that when the IEEE     802.11 (WiFi) stack was used in AP mode with roaming, it     would trigger roaming for a newly associated station     before the station was authenticated. An attacker within     range of the AP could use this to cause a denial of     service, either by filling up a switching table or by     redirecting traffic away from other stations.

  - CVE-2019-19319     Jungyeon discovered that a crafted filesystem can cause     the ext4 implementation to deallocate or reallocate     journal blocks. A user permitted to mount filesystems     could use this to cause a denial of service (crash), or     possibly for privilege escalation.

  - CVE-2019-19462     The syzbot tool found a missing error check in the     'relay' library used to implement various files under     debugfs. A local user permitted to access debugfs could     use this to cause a denial of service (crash) or     possibly for privilege escalation.

  - CVE-2019-19768     Tristan Madani reported a race condition in the blktrace     debug facility that could result in a use-after-free. A     local user able to trigger removal of block devices     could possibly use this to cause a denial of service     (crash) or for privilege escalation.

  - CVE-2019-20806     A potential NULL pointer dereference was discovered in     the tw5864 media driver. The security impact of this is     unclear.

  - CVE-2019-20811     The Hulk Robot tool found a reference-counting bug in an     error path in the network subsystem. The security impact     of this is unclear.

  - CVE-2020-0543     Researchers at VU Amsterdam discovered that on some     Intel CPUs supporting the RDRAND and RDSEED     instructions, part of a random value generated by these     instructions may be used in a later speculative     execution on any core of the same physical CPU.
    Depending on how these instructions are used by     applications, a local user or VM guest could use this to     obtain sensitive information such as cryptographic keys     from other users or VMs.

  This vulnerability can be mitigated by a microcode update, either as   part of system firmware (BIOS) or through the intel-microcode   package in Debian's non-free archive section. This kernel update   only provides reporting of the vulnerability and the option to   disable the mitigation if it is not needed.

  - CVE-2020-2732     Paulo Bonzini discovered that the KVM implementation for     Intel processors did not properly handle instruction     emulation for L2 guests when nested virtualization is     enabled. This could allow an L2 guest to cause privilege     escalation, denial of service, or information leaks in     the L1 guest.

  - CVE-2020-8428     Al Viro discovered a potential use-after-free in the     filesystem core (vfs). A local user could exploit this     to cause a denial of service (crash) or possibly to     obtain sensitive information from the kernel.

  - CVE-2020-8647, CVE-2020-8649     The Hulk Robot tool found a potential MMIO out-of-bounds     access in the vgacon driver. A local user permitted to     access a virtual terminal (/dev/tty1 etc.) on a system     using the vgacon driver could use this to cause a denial     of service (crash or memory corruption) or possibly for     privilege escalation.

  - CVE-2020-8648     The syzbot tool found a race condition in the the     virtual terminal driver, which could result in a     use-after-free. A local user permitted to access a     virtual terminal could use this to cause a denial of     service (crash or memory corruption) or possibly for     privilege escalation.

  - CVE-2020-9383     Jordy Zomer reported an incorrect range check in the     floppy driver which could lead to a static out-of-bounds     access. A local user permitted to access a floppy drive     could use this to cause a denial of service (crash or     memory corruption) or possibly for privilege escalation.

  - CVE-2020-10711     Matthew Sheets reported NULL pointer dereference issues     in the SELinux subsystem while receiving CIPSO packet     with null category. A remote attacker can take advantage     of this flaw to cause a denial of service (crash). Note     that this issue does not affect the binary packages     distributed in Debian as CONFIG_NETLABEL is not enabled.

  - CVE-2020-10732     An information leak of kernel private memory to     userspace was found in the kernel's implementation of     core dumping userspace processes.

  - CVE-2020-10751     Dmitry Vyukov reported that the SELinux subsystem did     not properly handle validating multiple messages, which     could allow a privileged attacker to bypass SELinux     netlink restrictions.

  - CVE-2020-10757     Fan Yang reported a flaw in the way mremap handled DAX     hugepages, allowing a local user to escalate their     privileges

  - CVE-2020-10942     It was discovered that the vhost_net driver did not     properly validate the type of sockets set as back-ends.
    A local user permitted to access /dev/vhost-net could     use this to cause a stack corruption via crafted system     calls, resulting in denial of service (crash) or     possibly privilege escalation.

  - CVE-2020-11494     It was discovered that the slcan (serial line CAN)     network driver did not fully initialise CAN headers for     received packets, resulting in an information leak from     the kernel to user-space or over the CAN network.

  - CVE-2020-11565     Entropy Moe reported that the shared memory filesystem     (tmpfs) did not correctly handle an 'mpol' mount option     specifying an empty node list, leading to a stack-based     out-of-bounds write. If user namespaces are enabled, a     local user could use this to cause a denial of service     (crash) or possibly for privilege escalation.

  - CVE-2020-11608, CVE-2020-11609, CVE-2020-11668     It was discovered that the ov519, stv06xx, and     xirlink_cit media drivers did not properly validate USB     device descriptors. A physically present user with a     specially constructed USB device could use this to cause     a denial-of-service (crash) or possibly for privilege     escalation.

  - CVE-2020-12114     Piotr Krysiuk discovered a race condition between the     umount and pivot_root operations in the filesystem core     (vfs). A local user with the CAP_SYS_ADMIN capability in     any user namespace could use this to cause a denial of     service (crash).

  - CVE-2020-12464     Kyungtae Kim reported a race condition in the USB core     that can result in a use-after-free. It is not clear how     this can be exploited, but it could result in a denial     of service (crash or memory corruption) or privilege     escalation.

  - CVE-2020-12652     Tom Hatskevich reported a bug in the mptfusion storage     drivers. An ioctl handler fetched a parameter from user     memory twice, creating a race condition which could     result in incorrect locking of internal data structures.
    A local user permitted to access /dev/mptctl could use     this to cause a denial of service (crash or memory     corruption) or for privilege escalation.

  - CVE-2020-12653     It was discovered that the mwifiex WiFi driver did not     sufficiently validate scan requests, resulting a     potential heap buffer overflow. A local user with     CAP_NET_ADMIN capability could use this to cause a     denial of service (crash or memory corruption) or     possibly for privilege escalation.

  - CVE-2020-12654     It was discovered that the mwifiex WiFi driver did not     sufficiently validate WMM parameters received from an     access point (AP), resulting a potential heap buffer     overflow. A malicious AP could use this to cause a     denial of service (crash or memory corruption) or     possibly to execute code on a vulnerable system.

  - CVE-2020-12770     It was discovered that the sg (SCSI generic) driver did     not correctly release internal resources in a particular     error case. A local user permitted to access an sg     device could possibly use this to cause a denial of     service (resource exhaustion).

  - CVE-2020-13143     Kyungtae Kim reported a potential heap out-of-bounds     write in the USB gadget subsystem. A local user     permitted to write to the gadget configuration     filesystem could use this to cause a denial of service     (crash or memory corruption) or potentially for     privilege escalation.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5722 advisory.

  - Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-0543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12114: Fixed A pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.12.3 fixes the following issues :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1172205).

Added support for new 64bit libxl memory API (bsc#1167007 and bsc#1157490).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2020:2432 :

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2432 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS)     (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2757 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2758 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2021:3027 advisory.

  - Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-0543)

  - Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2020-0548)

  - Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user     to potentially enable information disclosure via local access. (CVE-2020-0549)

  - Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2020-24489)

  - Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to     potentially enable information disclosure via local access. (CVE-2020-24511, CVE-2020-8698)

  - Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially     enable information disclosure via local access. (CVE-2020-24512)

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

  - Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow     an authenticated user to potentially enable information disclosure via local access. (CVE-2020-8696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12768: Fixed a memory leak in svm_cpu_uninit in arch/x86/kvm/svm.c (bsc#1171736).

CVE-2020-12659: Fixed an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) due to improper headroom validation (bsc#1171214).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20806: Fixed a NULL pointer dereference which may had lead to denial of service (bsc#1172199).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).

CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).

CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).

CVE-2020-12768: Fixed a memory leak in svm_cpu_uninit in arch/x86/kvm/svm.c (bsc#1171736).

CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).

CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).

CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).

CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).

CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).

CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).

CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).

CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).

CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).

CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).

CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).

CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).

CVE-2020-10711: Fixed a NULL pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).

CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).

CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).

CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).

CVE-2019-20806: Fixed a NULL pointer dereference which may had lead to denial of service (bsc#1172199).

CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).

CVE-2018-1000199: Fixed a potential local code execution via ptrace (bsc#1089895).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
137340	Debian DSA-4698-1 : linux - security update	Nessus	Debian Local Security Checks	6/11/2020	3/7/2024	high
137388	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5722)	Nessus	Oracle Linux Local Security Checks	6/12/2020	9/8/2021	medium
137611	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1596-1)	Nessus	SuSE Local Security Checks	6/18/2020	3/6/2024	high
137620	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:1609-1)	Nessus	SuSE Local Security Checks	6/18/2020	1/13/2021	medium
137694	Oracle Linux 7 : microcode_ctl (ELSA-2020-2432)	Nessus	Oracle Linux Local Security Checks	6/22/2020	3/6/2024	medium
137882	RHEL 8 : microcode_ctl (RHSA-2020:2757)	Nessus	Red Hat Local Security Checks	6/29/2020	4/28/2024	medium
137883	RHEL 7 : microcode_ctl (RHSA-2020:2758)	Nessus	Red Hat Local Security Checks	6/29/2020	4/28/2024	medium
165248	Ubuntu 20.04 LTS : Xen vulnerabilities (USN-5617-1)	Nessus	Ubuntu Local Security Checks	9/19/2022	7/12/2023	high
184626	Rocky Linux 8 : microcode_ctl (RLSA-2021:3027)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	high
137613	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:1599-1)	Nessus	SuSE Local Security Checks	6/18/2020	3/6/2024	high
137617	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1605-1)	Nessus	SuSE Local Security Checks	6/18/2020	3/6/2024	high

Detections

Analytics

Plugins Search

high

medium

high

medium

medium

medium

medium

high

high

high

high