The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4576-1 advisory.

    Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket     reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2020-16119)

    Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle     directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2020-14314)

    David Alan Gilbert discovered that the XFS file system implementation in the Linux kernel did not properly     perform metadata validation in some circumstances. A local attacker could use this to cause a denial of     service. (CVE-2020-14385)

    Giuseppe Scrivano discovered that the overlay file system in the Linux kernel did not properly perform     permission checks in some situations. A local attacker could possibly use this to bypass intended     restrictions and gain read access to restricted files. (CVE-2020-16120)

    It was discovered that a race condition existed in the hugetlb sysctl implementation in the Linux kernel.
    A privileged attacker could use this to cause a denial of service (system crash). (CVE-2020-25285)

    It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length     requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update corrects a regression in some Xen virtual machine environments. For reference the original advisory text follows.

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.

CVE-2019-9445

A potential out-of-bounds read was discovered in the F2FS implementation. A user permitted to mount and access arbitrary filesystems could potentially use this to cause a denial of service (crash) or to read sensitive information.

CVE-2019-19073, CVE-2019-19074

Navid Emamdoost discovered potential memory leaks in the ath9k and ath9k_htc drivers. The security impact of these is unclear.

CVE-2019-19448

'Team bobfuzzer' reported a bug in Btrfs that could lead to a use-after-free, and could be triggered by crafted filesystem images. A user permitted to mount and access arbitrary filesystems could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-12351

Andy Nguyen discovered a flaw in the Bluetooth implementation in the way L2CAP packets with A2MP CID are handled. A remote attacker within a short distance, knowing the victim's Bluetooth device address, can send a malicious l2cap packet and cause a denial of service or possibly arbitrary code execution with kernel privileges.

CVE-2020-12352

Andy Nguyen discovered a flaw in the Bluetooth implementation. Stack memory is not properly initialised when handling certain AMP packets.
A remote attacker within a short distance, knowing the victim's Bluetooth device address address, can retrieve kernel stack information.

CVE-2020-12655

Zheng Bin reported that crafted XFS volumes could trigger a system hang. An attacker able to mount such a volume could use this to cause a denial of service.

CVE-2020-12771

Zhiqiang Liu reported a bug in the bcache block driver that could lead to a system hang. The security impact of this is unclear.

CVE-2020-12888

It was discovered that the PCIe Virtual Function I/O (vfio-pci) driver allowed users to disable a device's memory space while it was still mapped into a process. On some hardware platforms, local users or guest virtual machines permitted to access PCIe Virtual Functions could use this to cause a denial of service (hardware error and crash).

CVE-2020-14305

Vasily Averin of Virtuozzo discovered a potential heap buffer overflow in the netfilter nf_contrack_h323 module. When this module is used to perform connection tracking for TCP/IPv6, a remote attacker could use this to cause a denial of service (crash or memory corruption) or possibly for remote code execution with kernel privilege.

CVE-2020-14314

A bug was discovered in the ext4 filesystem that could lead to an out-of-bound read. A local user permitted to mount and access arbitrary filesystem images could use this to cause a denial of service (crash).

CVE-2020-14331

A bug was discovered in the VGA console driver's soft-scrollback feature that could lead to a heap buffer overflow. On a system with a custom kernel that has CONFIG_VGACON_SOFT_SCROLLBACK enabled, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14356, CVE-2020-25220

A bug was discovered in the cgroup subsystem's handling of socket references to cgroups. In some cgroup configurations, this could lead to a use-after-free. A local user might be able to use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

The original fix for this bug introudced a new security issue, which is also addressed in this update.

CVE-2020-14386

Or Cohen discovered a bug in the packet socket (AF_PACKET) implementation which could lead to a heap buffer overflow. A local user with the CAP_NET_RAW capability (in any user namespace) could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-14390

Minh Yuan discovered a bug in the framebuffer console driver's scrollback feature that could lead to a heap buffer overflow. On a system using framebuffer consoles, a local user with access to a console could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

The scrollback feature has been disabled for now, as no other fix was available for this issue.

CVE-2020-15393

Kyungtae Kim reported a memory leak in the usbtest driver. The security impact of this is unclear.

CVE-2020-16166

Amit Klein reported that the random number generator used by the network stack might not be re-seeded for long periods of time, making e.g. client port number allocations more predictable. This made it easier for remote attackers to carry out some network- based attacks such as DNS cache poisoning or device tracking.

CVE-2020-24490

Andy Nguyen discovered a flaw in the Bluetooth implementation that can lead to a heap buffer overflow. On systems with a Bluetooth 5 hardware interface, a remote attacker within a short distance can use this to cause a denial of service (crash or memory corruption) or possibly for remote code execution with kernel privilege.

CVE-2020-25211

A flaw was discovered in netfilter subsystem. A local attacker able to inject conntrack Netlink configuration can cause a denial of service.

CVE-2020-25212

A bug was discovered in the NFSv4 client implementation that could lead to a heap buffer overflow. A malicious NFS server could use this to cause a denial of service (crash or memory corruption) or possibly to execute arbitrary code on the client.

CVE-2020-25284

It was discovered that the Rados block device (rbd) driver allowed tasks running as uid 0 to add and remove rbd devices, even if they dropped capabilities. On a system with the rbd driver loaded, this might allow privilege escalation from a container with a task running as root.

CVE-2020-25285

A race condition was discovered in the hugetlb filesystem's sysctl handlers, that could lead to stack corruption. A local user permitted to write to hugepages sysctls could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation. By default only the root user can do this.

CVE-2020-25641

The syzbot tool found a bug in the block layer that could lead to an infinite loop. A local user with access to a raw block device could use this to cause a denial of service (unbounded CPU use and possible system hang).

CVE-2020-25643

ChenNan Of Chaitin Security Research Lab discovered a flaw in the hdlc_ppp module. Improper input validation in the ppp_cp_parse_cr() function may lead to memory corruption and information disclosure.

CVE-2020-26088

It was discovered that the NFC (Near Field Communication) socket implementation allowed any user to create raw sockets. On a system with an NFC interface, this allowed local users to evade local network security policy.

For Debian 9 stretch, these problems have been fixed in version 4.9.240-1. This update additionally includes many more bug fixes from stable updates 4.9.229-4.9.240 inclusive.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25212: Fixed getxattr kernel panic and memory overflow (bsc#1176381).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).

CVE-2019-25643: Fixed an improper input validation in ppp_cp_parse_cr function which could have led to memory corruption and read overflow (bsc#1177206).

CVE-2020-25641: Fixed ann issue where length bvec was causing softlockups (bsc#1177121).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4431 advisory.

  - kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c     causing denial of service (CVE-2019-12614)

  - kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

  - kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

  - kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

  - kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

  - kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c (CVE-2019-18808)

  - kernel: memory leak in  af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c     (CVE-2019-18809)

  - kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     (CVE-2019-19046)

  - kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows to cause DoS (CVE-2019-19056)

  - kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

  - kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c     allow for a DoS (CVE-2019-19063)

  - kernel: A memory leak in the rtl8xxxu_submit_int_urb() function in     drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows for a DoS (CVE-2019-19068)

  - kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a     DoS (CVE-2019-19072)

  - kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

  - Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

  - kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a     use-after-free in ext4_put_super in fs/ext4/super.c (CVE-2019-19447)

  - kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free (CVE-2019-19524)

  - kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

  - kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

  - kernel: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c (CVE-2019-19543)

  - kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c     and fs/ext4/super.c (CVE-2019-19767)

  - kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c (CVE-2019-19770)

  - kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

  - kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

  - kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure     (CVE-2019-9455)

  - kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

  - kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

  - kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

  - kernel: SELinux netlink permission check bypass (CVE-2020-10751)

  - kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)

  - kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

  - kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

  - kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

  - kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

  - kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c     (CVE-2020-12465)

  - kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

  - kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data     coruption (CVE-2020-12659)

  - kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

  - kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

  - kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

  - kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

  - kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647)

  - kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648)

  - kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c     (CVE-2020-8649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4431 advisory.

    - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875316] {CVE-2020-14385}
    - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876224] {CVE-2020-14386}
    - [net] packet: make tp_drops atomic (Hangbin Liu) [1876224] {CVE-2020-14386}
    - [kernel] Move to dual-signing to split signing keys up better (Frantisek Hrbata) [1837434]     {CVE-2020-10713}
    - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859472] {CVE-2020-14331}
    - [fs] chardev: Avoid potential use-after-free in chrdev_open() (Vladis Dronov) [1866324] {CVE-2020-0305}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c,     there is a possible use after free due to a logic     error. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel(CVE-2020-0466)

  - In the l2tp subsystem, there is a possible use after     free due to a race condition. This could lead to local     escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-152409173(CVE-2020-27067)

  - In the nl80211_policy policy of nl80211.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with System execution privileges needed. User     interaction is not required for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-119770583(CVE-2020-27068)

  - In audit_free_lsm_field of auditfilter.c, there is a     possible bad kfree due to a logic error in     audit_data_to_entry. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-150693166References: Upstream     kernel(CVE-2020-0444)

  - In various methods of hid-multitouch.c, there is a     possible out of bounds write due to a missing bounds     check. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-162844689References: Upstream kernel(CVE-2020-0465)

  - Use-after-free vulnerability in fs/block_dev.c in the     Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging     improper access to a certain error     field.(CVE-2020-15436)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

  - A flaw was found in the Linux kernels implementation of     MIDI, where an attacker with a local account and the     permissions to issue an ioctl commands to midi devices,     could trigger a use-after-free. A write to this     specific memory while freed and before use could cause     the flow of execution to change and possibly allow for     memory corruption or privilege     escalation.(CVE-2020-27786)

  - No description is available for this     CVE.(CVE-2020-27815)

  - NULL-ptr deref in the spk_ttyio_receive_buf2() function     in spk_ttyio.c(CVE-2020-27830)

  - An issue was discovered in __split_huge_pmd in     mm/huge_memory.c in the Linux kernel before 5.7.5. The     copy-on-write implementation can grant unintended write     access because of a race condition in a THP mapcount     check, aka CID-c444eb564fb1.(CVE-2020-29368)

  - An issue was discovered in kmem_cache_alloc_bulk in     mm/slub.c in the Linux kernel before 5.5.11. The     slowpath lacks the required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - A locking issue was discovered in the tty subsystem of     the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free     attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high     rate of events to dom0, aka     CID-e99502f76271.(CVE-2020-27673)

  - An issue was discovered in     drivers/accessibility/speakup/spk_ttyio.c in the Linux     kernel through 5.9.9. Local attackers on systems with     the speakup driver could cause a local denial of     service attack, aka CID-d41227544427. This occurs     because of an invalid free when the line discipline is     used more than once.(CVE-2020-28941)

  - An issue was discovered in the Linux kernel through     5.9.1, as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - A flaw was found in the Linux kernel. A use-after-free     memory flaw was found in the perf subsystem allowing a     local attacker with permission to monitor perf events     to corrupt memory and possibly escalate privileges. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)

  - A flaw in the way reply ICMP packets are limited in the     Linux kernel functionality was found that allows to     quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypassing source     port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)

  - No description is available for this     CVE.(CVE-2020-25668)

  - No description is available for this     CVE.(CVE-2020-25669)

  - A flaw was found in the way RTAS handled memory     accesses in userspace to kernel communication. On a     locked down (usually due to Secure Boot) guest system     running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to     further increase their privileges to that of a running     kernel.(CVE-2020-27777)

  - kernel: perf_event_parse_addr_filter     memory(CVE-2020-25704)

  - Insufficient access control in the Linux kernel driver     for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via     local access.(CVE-2020-8694)

  - A flaw was found in the Linux kernel. A use-after-free     was found in the way the console subsystem was using     ioctls KDGKBSENT and KDSKBSENT. A local user could use     this flaw to get read memory access out of bounds. The     highest threat from this vulnerability is to data     confidentiality.(CVE-2020-25656)

  - In kbd_keycode of keyboard.c, there is a possible out     of bounds write due to a missing bounds check. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-144161459(CVE-2020-0431)

  - A flaw was found in the HDLC_PPP module of the Linux     kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input     validation in the ppp_cp_parse_cr function which can     cause the system to crash or cause a denial of service.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25643)

  - A flaw was found in the Linux kernel in versions before     5.9-rc7. Traffic between two Geneve endpoints may be     unencrypted when IPsec is configured to encrypt traffic     for the specific UDP port used by the GENEVE tunnel     allowing anyone between the two endpoints to read the     traffic unencrypted. The main threat from this     vulnerability is to data     confidentiality.(CVE-2020-25645)

  - Vulnerability Summary for     CVE-2020-12351(CVE-2020-12351)

  - Vulnerability Summary for     CVE-2020-12352(CVE-2020-12352)

  - Vulnerability Summary for     CVE-2020-24490(CVE-2020-24490)

  - A missing CAP_NET_RAW check in NFC socket creation in     net/nfc/rawsock.c in the Linux kernel before 5.8.2     could be used by local attackers to create raw sockets,     bypassing security mechanisms, aka     CID-26896f01467a.(CVE-2020-26088)

  - A flaw was found in the Linux kernel's implementation     of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could     cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker     with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest     threat from this vulnerability is to system     availability.(CVE-2020-25641)

  - In skb_to_mamac of networking.c, there is a possible     out of bounds write due to an integer overflow. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-143560807(CVE-2020-0432)

  - A race condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)

  - A flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)

  - A flaw was found in the Linux kernel before 5.9-rc4.
    Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest     threat from this vulnerability is to data     confidentiality and integrity.(CVE-2020-14386)

  - Insufficient input validation in i40e driver for     Intel(R) Ethernet 700 Series Controllers versions     before 7.0 may allow an authenticated user to     potentially enable a denial of service via local     access.(CVE-2019-0147)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)

  - A flaw was found in the Linux kernel before 5.9-rc4. A     failure of the file system metadata validator in XFS     can cause an inode with a valid, user-creatable     extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise     rendered inaccessible until it is remounted, leading to     a denial of service. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14385)

  - In uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel(CVE-2020-0404)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - A memory out-of-bounds read flaw was found in the Linux     kernel before 5.9-rc2 with the ext3/ext4 file system,     in the way it accesses a directory with broken     indexing. This flaw allows a local user to crash the     system if the directory exists. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14314)

  - A flaw null pointer dereference in the Linux kernel     cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could     use this flaw to crash the system or escalate their     privileges on the system.(CVE-2020-24394)

  - A flaw was found in the Linux kernel's implementation     of the invert video code on VGA consoles when a local     attacker attempts to resize the console, calling an     ioctl VT_RESIZE, which causes an out-of-bounds write to     occur. This flaw allows a local user with access to the     VGA console to crash the system, potentially escalating     their privileges on the system. The highest threat from     this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-14331)

  - The Linux kernel, as used in Red Hat Enterprise Linux     7, kernel-rt, and Enterprise MRG 2 and when booted with     UEFI Secure Boot enabled, allows local users to bypass     intended securelevel/secureboot restrictions by     leveraging improper handling of secure_boot flag across     kexec reboot.(CVE-2015-7837)

  - In the Linux kernel through 5.8.7, local attackers able     to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering     use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in     net/netfilter/nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)

  - A flaw null pointer dereference in the Linux kernel     cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could     use this flaw to crash the system or escalate their     privileges on the system.(CVE-2020-14356)

  - Buffer overflow in i40e driver for Intel(R) Ethernet     700 Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2019-0145)

  - The Linux kernel through 5.7.11 allows remote attackers     to make observations that help to obtain sensitive     information about the internal state of the network     RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)

  - The VFIO PCI driver in the Linux kernel through 5.6.13     mishandles attempts to access disabled memory     space.(CVE-2020-12888)

  - In the Linux kernel through 5.7.6, usbtest_disconnect     in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)

  - A logic bug was found in the Linux kernels     implementation of SSBD. A bug in the logic handling can     allow an attacker with a local account to disable SSBD     protection during a context switch when additional     speculative execution mitigations are in     place.(CVE-2020-10766)

  - The prctl() function can be used to enable indirect     branch speculation even after it has been disabled.
    This same call will incorrectly report it being 'force     disabled' when it is not.(CVE-2020-10768)

  - A flaw was found in the Linux kernel's implementation     of the Enhanced IBPB (Indirect Branch Prediction     Barrier). The IBPB mitigation will be disabled when     STIBP is not available or when the Enhanced Indirect     Branch Restricted Speculation (IBRS) is available. This     flaw allows a local attacker to perform a Spectre V2     style attack when this configuration is active. The     highest threat from this vulnerability is to     confidentiality.(CVE-2020-10767)

  - A flaw was found in the ZRAM kernel module, where a     user with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)

  - A flaw was found in the Linux kernel. An index buffer     overflow during Direct IO write leading to the NFS     client to crash. In some cases, a reach out of the     index after one memory allocation by kmalloc will cause     a kernel panic. The highest threat from this     vulnerability is to data confidentiality and system     availability.(CVE-2020-10742)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4752-1 advisory.

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-     connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to     complete authentication without pairing credentials via adjacent access. A physically proximate attacker     could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

    Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle     directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2020-14314)

    It was discovered that the block layer implementation in the Linux kernel did not properly perform     reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash). (CVE-2020-15436)

    It was discovered that the serial port driver in the Linux kernel did not properly initialize a pointer in     some situations. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2020-15437)

    Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly     handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically     proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2020-24490)

    It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds     checking before copying security labels in some situations. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

    It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform     privilege checks for access to rbd devices in some situations. A local attacker could use this to map or     unmap rbd block devices. (CVE-2020-25284)

    It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length     requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

    It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2020-25643)

    Kiyin () discovered that the perf subsystem in the Linux kernel did not properly deallocate memory     in some situations. A privileged attacker could use this to cause a denial of service (kernel memory     exhaustion). (CVE-2020-25704)

    It was discovered that the KVM hypervisor in the Linux kernel did not properly handle interrupts in     certain situations. A local attacker in a guest VM could possibly use this to cause a denial of service     (host system crash). (CVE-2020-27152)

    It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds     read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash).
    (CVE-2020-27815)

    It was discovered that an information leak existed in the syscall implementation in the Linux kernel on 32     bit systems. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2020-28588)

    It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range     checks in certain situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2020-28915)

    Jann Horn discovered a race condition in the copy-on-write implementation in the Linux kernel when     handling hugepages. A local attacker could use this to gain unintended write access to read-only memory     pages. (CVE-2020-29368)

    Jann Horn discovered that the mmap implementation in the Linux kernel contained a race condition when     handling munmap() operations, leading to a read-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-29369)

    Jann Horn discovered that the romfs file system in the Linux kernel did not properly validate file system     meta-data, leading to an out-of-bounds read. An attacker could use this to construct a malicious romfs     image that, when mounted, exposed sensitive information (kernel memory). (CVE-2020-29371)

    Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some     situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-29660)

    Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the     TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)

    It was discovered that a race condition existed that caused the Linux kernel to not properly restrict exit     signal delivery. A local attacker could possibly use this to send signals to arbitrary processes.
    (CVE-2020-35508)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-25641)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
141451	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4576-1)	Nessus	Ubuntu Local Security Checks	10/14/2020	8/27/2024	high
141559	openSUSE Security Update : the Linux Kernel (openSUSE-2020-1698)	Nessus	SuSE Local Security Checks	10/20/2020	2/15/2024	high
142176	Debian DLA-2420-2 : linux regression update	Nessus	Debian Local Security Checks	11/2/2020	2/13/2024	high
143801	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:2905-1)	Nessus	SuSE Local Security Checks	12/9/2020	5/11/2022	high
145806	CentOS 8 : kernel (CESA-2020:4431)	Nessus	CentOS Local Security Checks	2/1/2021	1/25/2024	high
180891	Oracle Linux 8 : kernel (ELSA-2020-4431)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	high
147512	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2021-1604)	Nessus	Huawei Local Security Checks	3/10/2021	2/9/2023	critical
147982	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-4752-1)	Nessus	Ubuntu Local Security Checks	3/23/2021	8/27/2024	high
247266	Linux Distros Unpatched Vulnerability : CVE-2020-25641	Nessus	Misc.	8/10/2025	10/28/2025	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

high

medium