The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4710-1 advisory.

    Kiyin () discovered that the perf subsystem in the Linux kernel did not properly deallocate memory     in some situations. A privileged attacker could use this to cause a denial of service (kernel memory     exhaustion).

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - mwifiex_cmd_802_11_ad_hoc_start in     drivers/net/wireless/marvell/mwifiex/join.c in the     Linux kernel through 5.10.4 might allow remote     attackers to execute arbitrary code via a long SSID     value, aka CID-5c455c5ab332.(CVE-2020-36158)

  - Incomplete cleanup from specific special register read     operations in some Intel(R) Processors may allow an     authenticated user to potentially enable information     disclosure via local access.(CVE-2020-0543)

  - An infinite loop issue was found in the vhost_net     kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in     handle_rx(). It could occur if one end sends packets     faster than the other end can process them. A guest     user, maybe remote one, could use this flaw to stall     the vhost_net kernel thread, resulting in a DoS     scenario.(CVE-2019-3900)

  - In pppol2tp_connect, there is possible memory     corruption due to a use after free. This could lead to     local escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation. Product: Android. Versions: Android     kernel. Android ID: A-38159931.(CVE-2018-9517)

  - A flaw was found in the fix for CVE-2019-11135, in the     Linux upstream kernel versions before 5.5 where, the     way Intel CPUs handle speculative execution of     instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected     by the TAA flaw (TAA_NO=0), but is not affected by the     MDS issue (MDS_NO=1), the guest was to clear the     affected buffers by using a VERW instruction mechanism.
    But when the MDS_NO=1 bit was exported to the guests,     the guests did not use the VERW mechanism to clear the     affected buffers. This issue affects guests running on     Cascade Lake CPUs and requires that host has 'TSX'     enabled. Confidentiality of data is the highest threat     associated with this vulnerability.(CVE-2019-19338)

  - There is a use-after-free in kernel versions before 5.5     due to a race condition between the release of     ptp_clock and cdev while resource deallocation. When a     (high privileged) process allocates a ptp device file     (like /dev/ptpX) and voluntarily goes to sleep. During     this time if the underlying device is removed, it can     cause an exploitable condition as the process wakes up     to terminate and clean all attached files. The system     crashes due to the cdev structure being invalid (as     already freed) which is pointed to by the     inode.(CVE-2020-10690)

  - Improper input validation in BlueZ may allow an     unauthenticated user to potentially enable escalation     of privilege via adjacent access.(CVE-2020-12351)

  - A flaw was found in the Linux kernels implementation of     MIDI, where an attacker with a local account and the     permissions to issue an ioctl commands to midi devices,     could trigger a use-after-free. A write to this     specific memory while freed and before use could cause     the flow of execution to change and possibly allow for     memory corruption or privilege     escalation.(CVE-2020-27786)

  - use-after-free read in sunkbd_reinit in     drivers/input/keyboard/sunkbd.c(CVE-2020-25669)

  - A flaw was found in the way RTAS handled memory     accesses in userspace to kernel communication. On a     locked down (usually due to Secure Boot) guest system     running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to     further increase their privileges to that of a running     kernel.(CVE-2020-27777)

  - A locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)

  - A locking issue was discovered in the tty subsystem of     the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free     attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)

  - An out-of-bounds memory write flaw was found in how the     Linux kernel's Voice Over IP H.323 connection tracking     functionality handled connections on ipv6 port 1720.
    This flaw allows an unauthenticated remote user to     crash the system, causing a denial of service. The     highest threat from this vulnerability is to     confidentiality, integrity, as well as system     availability.(CVE-2020-14305)

  - An issue was discovered in the Linux kernel before     5.2.6. On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)

  - IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors     could allow a local user to obtain sensitive     information from the data in the L1 cache under     extenuating circumstances. IBM X-Force ID:
    189296.(CVE-2020-4788)

  - A flaw memory leak in the Linux kernel performance     monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this     flaw to starve the resources causing denial of     service.(CVE-2020-25704)

  - An issue was discovered in kmem_cache_alloc_bulk in     mm/slub.c in the Linux kernel before 5.5.11. The     slowpath lacks the required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - Use-after-free vulnerability in fs/block_dev.c in the     Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging     improper access to a certain error     field.(CVE-2020-15436)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0063-1 advisory.

  - kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)

  - kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations (CVE-2020-36322)

  - kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0063 advisory.

  - A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of     service. (CVE-2020-25704)

  - An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka     CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system     crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as     CVE-2021-28950. (CVE-2020-36322)

  - The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to     drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt     mishandles bounds checking. (CVE-2021-42739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0065 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: perf_event_parse_addr_filter memory (CVE-2020-25704)

    * kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations (CVE-2020-36322)

    * kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update to the latest RHEL7.9.z11 source tree (BZ#2022891)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0063 advisory.

    [3.10.0-1160.53.1.OL7]
    - Update Oracle Linux certificates (Ilya Okomin)
    - Oracle Linux RHCK Module Signing Key was compiled into kernel     (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
    - Update x509.genkey [Orabug: 24817676]
    - Conflict with shim-ia32 and shim-x64 <= 15-2.0.9
    - Update oracle(kernel-sig-key) value to match new certificate (Ilya Okomin)

    [3.10.0-1160.53.1]
    - fuse: fix live lock in fuse_iget() (Miklos Szeredi) [1952046]
    - fuse: fix bad inode (Miklos Szeredi) [1952046]
    - GFS2: Truncate address space mapping when deleting an inode (Bob Peterson) [1364234]
    - gfs2: Fix gfs2_testbit to use clone bitmaps (Bob Peterson) [1364234]
    - gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps (Bob Peterson) [1364234]
    - gfs2: Fix oversight in gfs2_ail1_flush (Bob Peterson) [1364234]
    - gfs2: Additional information when gfs2_ail1_flush withdraws (Bob Peterson) [1364234]
    - gfs2: leaf_dealloc needs to allocate one more revoke (Bob Peterson) [1364234]
    - gfs2: allow journal replay to hold sd_log_flush_lock (Bob Peterson) [1364234]
    - gfs2: don't allow releasepage to free bd still used for revokes (Bob Peterson) [1364234]
    - gfs2: flesh out delayed withdraw for gfs2_log_flush (Bob Peterson) [1364234]
    - gfs2: Do proper error checking for go_sync family of glops functions (Bob Peterson) [1364234]
    - gfs2: drain the ail2 list after io errors (Bob Peterson) [1364234]
    - gfs2: Withdraw in gfs2_ail1_flush if write_cache_pages fails (Bob Peterson) [1364234]
    - gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty (Bob Peterson) [1364234]
    - gfs2: Check for log write errors before telling dlm to unlock (Bob Peterson) [1364234]
    - gfs2: Prepare to withdraw as soon as an IO error occurs in log write (Bob Peterson) [1364234]
    - gfs2: Issue revokes more intelligently (Bob Peterson) [1364234]
    - gfs2: Add verbose option to check_journal_clean (Bob Peterson) [1364234]
    - gfs2: fix infinite loop when checking ail item count before go_inval (Bob Peterson) [1364234]
    - gfs2: Force withdraw to replay journals and wait for it to finish (Bob Peterson) [1364234]
    - gfs2: Allow some glocks to be used during withdraw (Bob Peterson) [1364234]
    - gfs2: move check_journal_clean to util.c for future use (Bob Peterson) [1364234]
    - gfs2: Ignore dlm recovery requests if gfs2 is withdrawn (Bob Peterson) [1364234]
    - gfs2: Only complain the first time an io error occurs in quota or log (Bob Peterson) [1364234]
    - gfs2: log error reform (Bob Peterson) [1364234]
    - gfs2: Rework how rgrp buffer_heads are managed (Bob Peterson) [1364234]
    - gfs2: clear ail1 list when gfs2 withdraws (Bob Peterson) [1364234]
    - gfs2: Introduce concept of a pending withdraw (Bob Peterson) [1364234]
    - gfs2: Return bool from gfs2_assert functions (Bob Peterson) [1364234]
    - gfs2: Turn gfs2_consist into void functions (Bob Peterson) [1364234]
    - gfs2: Remove usused cluster_wide arguments of gfs2_consist functions (Bob Peterson) [1364234]
    - gfs2: Report errors before withdraw (Bob Peterson) [1364234]
    - gfs2: Split gfs2_lm_withdraw into two functions (Bob Peterson) [1364234]
    - gfs2: Fix incorrect variable name (Bob Peterson) [1364234]
    - gfs2: Don't write log headers after file system withdraw (Bob Peterson) [1364234]
    - gfs2: clean up iopen glock mess in gfs2_create_inode (Bob Peterson) [1364234]
    - gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS (Bob Peterson) [1364234]
    - gfs2: fix infinite loop in gfs2_ail1_flush on io error (Bob Peterson) [1364234]
    - gfs2: Introduce function gfs2_withdrawn (Bob Peterson) [1364234]
    - gfs2: replace more printk with calls to fs_info and friends (Bob Peterson) [1364234]
    - gfs2: dump fsid when dumping glock problems (Bob Peterson) [1364234]
    - gfs2: simplify gfs2_freeze by removing case (Bob Peterson) [1364234]
    - gfs2: Rename SDF_SHUTDOWN to SDF_WITHDRAWN (Bob Peterson) [1364234]
    - gfs2: Warn when a journal replay overwrites a rgrp with buffers (Bob Peterson) [1364234]
    - gfs2: log which portion of the journal is replayed (Bob Peterson) [1364234]
    - gfs2: slow the deluge of io error messages (Bob Peterson) [1364234]
    - gfs2: Don't withdraw under a spin lock (Bob Peterson) [1364234]
    - GFS2: Clear gl_object when deleting an inode in gfs2_delete_inode (Bob Peterson) [1364234]
    - gfs2: Use fs_* functions instead of pr_* function where we can (Bob Peterson) [1364234]     more consistently (Bob Peterson) [1364234]

    [3.10.0-1160.52.1]
    - acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (David Arcari) [2019588]
    - x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (David Arcari) [2019218]
    - x86/cpu/AMD: Fix erratum 1076 (CPB bit) (David Arcari) [2019218]
    - i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps (Stefan Assmann) [1977246]
    - i40e: Fix virtchnl_queue_select bitmap validation (Stefan Assmann) [1977246]

    [3.10.0-1160.51.1]
    - mm, fs: Fix do_generic_file_read() error return (Carlos Maiolino) [2020857]
    - perf/core: Fix a memory leak in perf_event_parse_addr_filter() (Michael Petlan) [1901932]

    [3.10.0-1160.50.1]
    - tcp: grow window for OOO packets only for SACK flows (Guillaume Nault) [1990665]
    - scsi: mpt3sas: Fix unlock imbalance (Tomas Henzl) [2006536]
    - pci-hyperv: Fix setting CPU affinity on Azure (Vitaly Kuznetsov) [2019272]
    - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() (Lucas Zampieri) [1956471]     {CVE-2021-42739}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1578 advisory.

    - drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935281] {CVE-2020-12362}
    - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930833] {CVE-2021-27365}
    - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930856] {CVE-2021-27363}
    - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930809]     {CVE-2021-27364}
    - vt: Disable KD_FONT_OP_COPY (Dave Airlie) [1903937] {CVE-2020-28974}
    - fix regression in 'epoll: Keep a reference on files added to the check list' (Carlos Maiolino) [1920776]     {CVE-2020-0466}
    - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920776] {CVE-2020-0466}
    - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920776] {CVE-2020-0466}
    - net/vmw_vsock: fix NULL pointer dereference (Jon Maloy) [1925600] {CVE-2021-26708}
    - net/vmw_vsock: improve locking in vsock_connect_timeout() (Jon Maloy) [1925600] {CVE-2021-26708}
    - vsock: fix locking in vsock_shutdown() (Jon Maloy) [1925600] {CVE-2021-26708}
    - vsock: fix the race conditions in multi-transport support (Jon Maloy) [1925600] {CVE-2021-26708}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bnc#1178123).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).

CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

CVE-2020-14381: Fixed a UAF in the fast user mutex (futex) wait operation (bsc#1176011).

CVE-2020-25643: Fixed an improper input validation in the ppp_cp_parse_cr function of the HDLC_PPP module (bnc#1177206).

CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)

CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic     error. This could lead to local escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel (CVE-2020-0466)

  - A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified     other impact, aka CID-17743798d812. (CVE-2020-25285)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of     service. (CVE-2020-25704)

  - The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database     (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.
    (CVE-2020-26541)

  - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking     in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal     in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker     has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are     proxied via an attacker-selected backstore. (CVE-2020-28374)

  - In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This     could lead to local information disclosure in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476     (CVE-2021-0605)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
    (CVE-2021-3347)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API,     is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-     of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
    (CVE-2021-3501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
145518	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerability (USN-4710-1)	Nessus	Ubuntu Local Security Checks	1/28/2021	8/27/2024	medium
148041	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2021-1684)	Nessus	Huawei Local Security Checks	3/24/2021	12/5/2022	high
156757	Scientific Linux Security Update : kernel on SL7.x x86_64 (2022:0063)	Nessus	Scientific Linux Local Security Checks	1/14/2022	1/14/2022	medium
156820	CentOS 7 : kernel (RHSA-2022:0063)	Nessus	CentOS Local Security Checks	1/19/2022	10/9/2024	medium
156632	RHEL 7 : kernel-rt (RHSA-2022:0065)	Nessus	Red Hat Local Security Checks	1/12/2022	11/7/2024	medium
156664	Oracle Linux 7 : kernel (ELSA-2022-0063)	Nessus	Oracle Linux Local Security Checks	1/12/2022	10/22/2024	medium
149914	Oracle Linux 8 : kernel (ELSA-2021-1578)	Nessus	Oracle Linux Local Security Checks	5/26/2021	11/1/2024	high
143857	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3544-1)	Nessus	SuSE Local Security Checks	12/9/2020	12/5/2022	high
160868	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2022-0059)	Nessus	NewStart CGSL Local Security Checks	5/10/2022	5/11/2022	high

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

medium

high

high

high