The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function     hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.
    (CVE-2019-15925)

  - A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.
    (CVE-2019-18808)

  - ** DISPUTED ** A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by     triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of     this because an attacker cannot realistically control this failure at probe time. (CVE-2019-19046)

  - In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a     slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when     a large old_size value is used in a memset call, aka CID-345c0dbf3a30. (CVE-2019-19319)

  - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way     the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of service. (CVE-2019-19332)

  - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. (CVE-2019-19524)

  - In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB     device in the USB character device driver layer, aka CID-303911cfc5b9. This affects     drivers/usb/core/file.c. (CVE-2019-19537)

  - In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in     drivers/media/rc/serial_ir.c. (CVE-2019-19543)

  - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode     table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. (CVE-2019-20636)

  - In the Android kernel in the video driver there is a use after free due to a race condition. This could     lead to local escalation of privilege with no additional execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9458)

  - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an     attacker with a local account to crash a trivial program and exfiltrate private kernel data.
    (CVE-2020-10732)

  - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it     incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly     only validate the first netlink message in the skb and allow or deny the rest of the messages within the     skb with the granted permission without further processing. (CVE-2020-10751)

  - ** DISPUTED ** An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c     has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing,     aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability     because the issue is a bug in parsing mount options which can only be specified by a privileged user, so     triggering the bug does not grant any powers not already held.. (CVE-2020-11565)

  - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB     driver) mishandles invalid descriptors, aka CID-a246b4d54770. (CVE-2020-11668)

  - Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of     privilege via adjacent access. (CVE-2020-12351)

  - Improper access control in BlueZ may allow an unauthenticated user to potentially enable information     disclosure via adjacent access. (CVE-2020-12352)

  - An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-     of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.
    (CVE-2020-12659)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - A flaw was found in the Linux kernels implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14331)

  - A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest threat from this vulnerability is to data     confidentiality and integrity. (CVE-2020-14386)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c. (CVE-2020-8647)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common     function in drivers/tty/n_tty.c. (CVE-2020-8648)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region     function in drivers/video/console/vgacon.c. (CVE-2020-8649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-19462: relay_open in kernel/relay.c in the Linux kernel allowed local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result (bnc#1158265).

CVE-2019-20810: Fixed a memory leak in go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c because it did not call snd_card_free for a failure path (bnc#1172458).

CVE-2019-20812: An issue was discovered in the prb_calc_retire_blk_tmo() function in net/packet/af_packet.c could result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3 (bnc#1172453).

CVE-2020-0305: In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1174462).

CVE-2020-10135: Legacy pairing and secure-connections pairing authentication in Bluetooth&Acirc;&reg; BR/EDR Core Specification v5.2 and earlier may have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key (bnc#1171988).

CVE-2020-10711: A NULL pointer dereference flaw was found in the SELinux subsystem in versions This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine.
This flaw allowed a remote network user to crash the system kernel, resulting in a denial of service (bnc#1171191).

CVE-2020-10732: A flaw was found in the implementation of Userspace core dumps. This flaw allowed an attacker with a local account to crash a trivial program and exfiltrate private kernel data (bnc#1171220).

CVE-2020-10751: A flaw was found in the SELinux LSM hook implementation, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing (bnc#1171189).

CVE-2020-10766: Fixed an issue which allowed an attacker with a local account to disable SSBD protection (bnc#1172781).

CVE-2020-10767: Fixed an issue where Indirect Branch Prediction Barrier was disabled in certain circumstances, leaving the system open to a spectre v2 style attack (bnc#1172782).

CVE-2020-10768: Fixed an issue with the prctl() function, where indirect branch speculation could be enabled even though it was diabled before (bnc#1172783).

CVE-2020-10773: Fixed a memory leak on s390/s390x, in the cmm_timeout_hander in file arch/s390/mm/cmm.c (bnc#1172999).

CVE-2020-10781: A zram sysfs resource consumption was fixed (bnc#1173074).

CVE-2020-12656: Fixed a memory leak in gss_mech_free in the rpcsec_gss_krb5 implementation, caused by a lack of certain domain_release calls (bnc#1171219).

CVE-2020-12769: An issue was discovered in drivers/spi/spi-dw.c allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bnc#1171983).

CVE-2020-12771: An issue was discovered in btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails (bnc#1171732).

CVE-2020-12888: The VFIO PCI driver mishandled attempts to access disabled memory space (bnc#1171868).

CVE-2020-13143: gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c relies on kstrdup without considering the possibility of an internal '\0' value, which allowed attackers to trigger an out-of-bounds read (bnc#1171982).

CVE-2020-13974: Fixed a integer overflow in drivers/tty/vt/keyboard.c, if k_ascii is called several times in a row (bnc#1172775).

CVE-2020-14416: Fixed a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free.
This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c (bnc#1162002).

CVE-2020-15393: Fixed a memory leak in usbtest_disconnect (bnc#1173514).

CVE-2020-15780: An issue was discovered in drivers/acpi/acpi_configfs.c where injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30 (bnc#1173573).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5804 advisory.

  - The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory     space. (CVE-2020-12888)

  - A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to     enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being     'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this     vulnerability is to confidentiality. (CVE-2020-10768)

  - An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access     permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot     restrictions, aka CID-1957a85b0032. (CVE-2019-20908)

  - A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_report_alg() failures, aka CID-ffdde5932042. (CVE-2019-19062)

  - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an     attacker with a local account to crash a trivial program and exfiltrate private kernel data.
    (CVE-2020-10732)

  - drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16232)

  - drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16234)

  - ** DISPUTED ** A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux     kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering     of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this     because unittest.c can only be reached during boot. (CVE-2019-19049)

  - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and     unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list     in fs/ext4/super.c. (CVE-2019-19447)

  - ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference     because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero. (CVE-2019-19037)

  - An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.
    (CVE-2019-20811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):A flaw was found in the     Linux kernel's implementation of the invert video code     on VGA consoles when a local attacker attempts to     resize the console, calling an ioctl VT_RESIZE, which     causes an out-of-bounds write to occur. This flaw     allows a local user with access to the VGA console to     crash the system, potentially escalating their     privileges on the system. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-14331)A flaw     was found in the HDLC_PPP module of the Linux kernel in     versions before 5.9-rc7. Memory corruption and a read     overflow is caused by improper input validation in the     ppp_cp_parse_cr function which can cause the system to     crash or cause a denial of service. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-25643)A memory out-of-bounds     read flaw was found in the Linux kernel before 5.9-rc2     with the ext3/ext4 file system, in the way it accesses     a directory with broken indexing. This flaw allows a     local user to crash the system if the directory exists.
    The highest threat from this vulnerability is to system     availability.(CVE-2020-14314)A TOCTOU mismatch in the     NFS client code in the Linux kernel before 5.8.3 could     be used by local attackers to corrupt memory or     possibly have unspecified other impact because a size     check is in fs/ nfs/ nfs4proc.c instead of fs/ nfs/     nfs4xdr.c, aka CID-b4487b935452.(CVE-2020-25212)The rbd     block device driver in drivers/block/rbd.c in the Linux     kernel through 5.8.9 used incomplete permission     checking for access to rbd devices, which could be     leveraged by local attackers to map or unmap rbd block     devices, aka CID-f44d04e696fe.(CVE-2020-25284)A race     condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)A flaw was     found in the Linux kernel before 5.9-rc4. Memory     corruption can be exploited to gain root privileges     from unprivileged processes. The highest threat from     this vulnerability is to data confidentiality and     integrity.(CVE-2020-14386)In the Linux kernel through     5.8.7, local attackers able to inject conntrack netlink     configuration could overflow a local buffer, causing     crashes or triggering use of incorrect protocol numbers     in ctnetlink_parse_tuple_filter in net/ netfilter/     nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)The VFIO PCI driver in     the Linux kernel through 5.6.13 mishandles attempts to     access disabled memory space.(CVE-2020-12888)The kernel     in Red Hat Enterprise Linux 7 and MRG-2 does not clear     garbage data for SG_IO buffer, which may leaking     sensitive information to userspace.(CVE-2014-8181)A     flaw was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further     processing.(CVE-2020-10751)The Linux kernel through     5.7.11 allows remote attackers to make observations     that help to obtain sensitive information about the     internal state of the network RNG, aka     CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)A buffer over-read     flaw was found in RH kernel versions before 5.0 in     crypto_authenc_extractkeys in crypto/authenc.c in the     IPsec Cryptographic algorithm's module, authenc. When a     payload longer than 4 bytes, and is not following     4-byte alignment boundary guidelines, it causes a     buffer over-read threat, leading to a system crash.
    This flaw allows a local attacker with user privileges     to cause a denial of service.(CVE-2020-10769)In the     Linux kernel through 5.7.6, usbtest_disconnect in     drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)An issue was     discovered in the Linux kernel through 5.7.1.
    drivers/tty/vt/keyboard.c has an integer overflow if     k_ascii is called several times in a row, aka     CID-b86dab054059.(CVE-2020-13974)go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)An issue was     discovered in the Linux kernel before 5.0.6. In     rx_queue_add_kobject() and netdev_queue_add_kobject()     in net/core/ net-sysfs.c, a reference count is     mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)An     issue was discovered in the Linux kernel before 5.4.7.
    The prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)A flaw was found in     the Linux kernel's implementation of Userspace core     dumps. This flaw allows an attacker with a local     account to crash a trivial program and exfiltrate     private kernel data.(CVE-2020-10732)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
195722	RHEL 5 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/13/2024	critical
147318	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2021-0078)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	5/10/2022	high
139308	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2020:2105-1)	Nessus	SuSE Local Security Checks	8/4/2020	5/12/2022	high
139476	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5804)	Nessus	Oracle Linux Local Security Checks	8/11/2020	2/26/2024	high
142240	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2020-2353)	Nessus	Huawei Local Security Checks	11/3/2020	2/12/2024	high
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	9/1/2022	5/1/2024	critical

Detections

Analytics

Plugins Search

critical

high

high

high

high

critical