The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5217-1 advisory.

  - An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may     lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local     attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and     confidentiality threat. (CVE-2021-4090)

  - An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input     Validation. This flaw allows a local attacker with a special privilege to crash the system or leak     internal information. (CVE-2021-4204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5362-1 advisory.

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may     lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local     attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and     confidentiality threat. (CVE-2021-4090)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel     through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU     display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when     it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer. (CVE-2021-42327)

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem     Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in     case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local     user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to     legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for     s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain     unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
    (CVE-2022-0516)

  - Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making     it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit     2d3916f3189172d5c69d33065c3c21119fe539fc. (CVE-2022-0742)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

  - The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to     gain access to files opened by other processes on the system through a dangling 'file' pointer.
    (CVE-2022-22942)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges     because of a heap out-of-bounds write. This is related to nf_tables_offload. (CVE-2022-25636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5265-1 advisory.

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and     bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special     privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel     versions prior to 5.16 rc2. (CVE-2021-4001)

  - An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may     lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local     attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and     confidentiality threat. (CVE-2021-4090)

  - A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State     (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a     malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason     SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape     scenario. (CVE-2021-4093)

  - A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in     the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem     while the device is getting removed, leading to a privilege escalation problem. (CVE-2021-4202)

  - dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel     through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU     display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when     it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer. (CVE-2021-42327)

  - A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user     calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or     escalate privileges on the system. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-42739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
156612	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5217-1)	Nessus	Ubuntu Local Security Checks	1/11/2022	1/9/2024	high
159395	Ubuntu 20.04 LTS : Linux kernel (Intel IOTG) vulnerabilities (USN-5362-1)	Nessus	Ubuntu Local Security Checks	4/1/2022	1/9/2024	high
157351	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5265-1)	Nessus	Ubuntu Local Security Checks	2/3/2022	1/9/2024	high

Detections

Analytics

Plugins Search

high

high

high