The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4727-1 advisory.

  - A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions     in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race     conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
    (CVE-2021-26708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1093 advisory.

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic     error. This could lead to local escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel (CVE-2020-0466)

  - A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions     in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race     conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
    (CVE-2021-26708)

  - An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before     5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering,     aka CID-77377064c3a9. (CVE-2020-27152)

  - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
    (CVE-2021-3347)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking     in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal     in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker     has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are     proxied via an attacker-selected backstore. (CVE-2020-28374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1093 advisory.

  - kernel: use after free in eventpoll.c may lead to escalation of privilege (CVE-2020-0466)

  - Kernel: KVM: host stack overflow due to lazy update IOAPIC (CVE-2020-27152)

  - kernel: SCSI target (LIO) write to any block on ILO backstore (CVE-2020-28374)

  - kernel: race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c (CVE-2021-26708)

  - kernel: iscsi: unrestricted access to sessions and handles (CVE-2021-27363)

  - kernel: out-of-bounds read in libiscsi module (CVE-2021-27364)

  - kernel: heap buffer overflow in the iSCSI subsystem (CVE-2021-27365)

  - kernel: Use after free via PI futex state (CVE-2021-3347)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1093 advisory.

  - kernel: use after free in eventpoll.c may lead to escalation of privilege (CVE-2020-0466)

  - Kernel: KVM: host stack overflow due to lazy update IOAPIC (CVE-2020-27152)

  - kernel: SCSI target (LIO) write to any block on ILO backstore (CVE-2020-28374)

  - kernel: Use after free via PI futex state (CVE-2021-3347)

  - kernel: race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c (CVE-2021-26708)

  - kernel: iscsi: unrestricted access to sessions and handles (CVE-2021-27363)

  - kernel: out-of-bounds read in libiscsi module (CVE-2021-27364)

  - kernel: heap buffer overflow in the iSCSI subsystem (CVE-2021-27365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1093 advisory.

  - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic     error. This could lead to local escalation of privilege with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel (CVE-2020-0466)

  - An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before     5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering,     aka CID-77377064c3a9. (CVE-2020-27152)

  - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking     in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal     in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker     has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are     proxied via an attacker-selected backstore. (CVE-2020-28374)

  - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
    (CVE-2021-3347)

  - A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions     in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race     conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
    (CVE-2021-26708)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1081 advisory.

  - kernel: use after free in eventpoll.c may lead to escalation of privilege (CVE-2020-0466)

  - Kernel: KVM: host stack overflow due to lazy update IOAPIC (CVE-2020-27152)

  - kernel: SCSI target (LIO) write to any block on ILO backstore (CVE-2020-28374)

  - kernel: race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c (CVE-2021-26708)

  - kernel: iscsi: unrestricted access to sessions and handles (CVE-2021-27363)

  - kernel: out-of-bounds read in libiscsi module (CVE-2021-27364)

  - kernel: heap buffer overflow in the iSCSI subsystem (CVE-2021-27365)

  - kernel: Use after free via PI futex state (CVE-2021-3347)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
146350	Ubuntu 20.04 LTS : Linux kernel vulnerability (USN-4727-1)	Nessus	Ubuntu Local Security Checks	2/10/2021	1/9/2024	high
148371	Oracle Linux 8 : kernel (ELSA-2021-1093)	Nessus	Oracle Linux Local Security Checks	4/7/2021	1/5/2024	high
148422	CentOS 8 : kernel (CESA-2021:1093)	Nessus	CentOS Local Security Checks	4/9/2021	1/5/2024	high
148370	RHEL 8 : kernel (RHSA-2021:1093)	Nessus	Red Hat Local Security Checks	4/7/2021	4/28/2024	high
148350	Photon OS 4.0: Linux PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	4/7/2021	1/5/2024	high
157559	AlmaLinux 8 : kernel (ALSA-2021:1093)	Nessus	Alma Linux Local Security Checks	2/9/2022	11/10/2023	high
148369	RHEL 8 : kernel-rt (RHSA-2021:1081)	Nessus	Red Hat Local Security Checks	4/7/2021	1/5/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high