The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5050-1 advisory.

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force     Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in     response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-     after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0     will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
    (CVE-2021-28691)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573)

  - net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial     of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure     of a bind call. (CVE-2021-38208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-30 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5015-1 advisory.

  - Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force     Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in     response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-     after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0     will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
    (CVE-2021-28691)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5046-1 advisory.

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force     Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in     response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-     after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0     will have already exited and thus the call to kthread_stop will be performed against a stale pointer.
    (CVE-2021-28691)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
152774	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5050-1)	Nessus	Ubuntu Local Security Checks	8/24/2021	1/9/2024	high
160459	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-002)	Nessus	Amazon Linux Local Security Checks	5/2/2022	4/25/2024	high
157004	GLSA-202107-30 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/24/2022	1/26/2022	high
151921	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5015-1)	Nessus	Ubuntu Local Security Checks	7/22/2021	1/9/2024	high
152665	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5046-1)	Nessus	Ubuntu Local Security Checks	8/19/2021	1/9/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high