The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9395 advisory.

    - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen)  [Orabug: 33143006]     {CVE-2021-33909}
    - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk)  [Orabug: 31895301]  {CVE-2020-14304}
    - net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query (Erez Alfasi)  [Orabug: 31895301]     {CVE-2020-14304}
    - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal)  [Orabug:
    33093028]  {CVE-2021-22555}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2714 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: size_t-to-int conversion vulnerability in the filesystem layer (CVE-2021-33909)

    * kernel: race condition for removal of the HCI controller (CVE-2021-32399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * pinctrl_emmitsburg: improper configuration (BZ#1963984)

    * [Ampere] locking/qrwlock: Fix ordering in queued_write_lock_slowpath (BZ#1964419)

    * RHEL8.4 - [P10] [NPIV Multi queue Test kernel- 4.18.0-283.el8.ibmvfc_11022021.ppc64le] DLPAR operation     fails for ibmvfc on Denali (ibmvfc/dlpar/RHEL8.4) (BZ#1964697)

    * Every server is displaying the same power levels for all of our i40e  25G interfaces. 10G interfaces     seem to be correct. Ethtool version is 5.0 (BZ#1967099)

    * backport fixes for Connection Tracking offload (BZ#1968679)

    * fm10k: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969910)

    * ixgbevf: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969911)

    * ena: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969913)

    * b44, bnx2, bnx2x, bnxt, tg3: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969914)

    * e1000, e1000e: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969915)

    * ice: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969917)

    * igb: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969919)

    * igbvf: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969920)

    * igc: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969921)

    * ixgbe: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969922)

    * i40e: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969923)

    * iavf: removal of MODULE_VERSION deemed improper for y-stream release (BZ#1969925)

    * Backport netlink extack tracepoint (BZ#1972938)

    * [RHEL8.4] kernel panic when create NPIV port on qedf driver (BZ#1974968)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2714 advisory.

  - kernel: race condition for removal of the HCI controller (CVE-2021-32399)

  - kernel: size_t-to-int conversion vulnerability in the filesystem layer (CVE-2021-33909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2714 advisory.

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
160459	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-002 (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	5/2/2022	2/9/2026	high
152195	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9395)	Nessus	Oracle Linux Local Security Checks	8/4/2021	2/9/2026	high
151846	RHEL 8 : kernel (RHSA-2021:2714)	Nessus	Red Hat Local Security Checks	7/21/2021	3/6/2025	high
151879	CentOS 8 : kernel (CESA-2021:2714)	Nessus	CentOS Local Security Checks	7/21/2021	7/30/2021	high
157560	AlmaLinux 8 : kernel (ALSA-2021:2714)	Nessus	Alma Linux Local Security Checks	2/9/2022	2/14/2022	high

Detections

Analytics

Plugins Search

high

high

high

high

high