The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1437 advisory.

  - In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure. (CVE-2019-19448)

  - The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory     space. (CVE-2020-12888)

  - A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file     system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash     the system if the directory exists. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14314)

  - A flaw was found in the Linux kernels implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14331)

  - A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-     bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of     the flaw, privilege escalation cannot be fully ruled out. (CVE-2020-14390)

  - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers     to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. (CVE-2020-25212)

  - The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap     rbd block devices, aka CID-f44d04e696fe. (CVE-2020-25284)

  - A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified     other impact, aka CID-17743798d812. (CVE-2020-25285)

  - A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-25641)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may     be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE     tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from     this vulnerability is to data confidentiality. (CVE-2020-25645)

  - A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2     could be used by local attackers to create raw sockets, bypassing security mechanisms, aka     CID-26896f01467a. (CVE-2020-26088)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2854 advisory.

  - kernel: nfs: use-after-free in svc_process_common() (CVE-2018-16884)

  - kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c     (CVE-2019-11811)

  - kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

  - kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c (CVE-2019-18808)

  - kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

  - kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c     and fs/ext4/super.c (CVE-2019-19767)

  - kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

  - kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

  - kernel: use-after-free read in napi_gro_frags() in the Linux kernel (CVE-2020-10720)

  - kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

  - Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario (CVE-2020-12888)

  - Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption     (CVE-2020-8834)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.68-34.125. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-016 advisory.

  - In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure. (CVE-2019-19448)

  - ** DISPUTED ** In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove     function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously     created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel     developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of     debugfs within blktrace. (CVE-2019-19770)

  - The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory     space. (CVE-2020-12888)

  - A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file     system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash     the system if the directory exists. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14314)

  - A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in     XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading     to a denial of service. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14385)

  - A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-     bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of     the flaw, privilege escalation cannot be fully ruled out. (CVE-2020-14390)

  - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers     to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. (CVE-2020-25212)

  - The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap     rbd block devices, aka CID-f44d04e696fe. (CVE-2020-25284)

  - A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified     other impact, aka CID-17743798d812. (CVE-2020-25285)

  - A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-25641)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3016 advisory.

  - kernel: kvm: Information leak within a KVM guest (CVE-2019-3016)

  - kernel: use-after-free in sound/core/timer.c (CVE-2019-19807)

  - kernel: kernel: DAX hugepages not considered during mremap (CVE-2020-10757)

  - kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the     SSBD protection. (CVE-2020-10766)

  - kernel: Indirect Branch Prediction Barrier is force-disabled when STIBP is unavailable or enhanced IBRS is     available. (CVE-2020-10767)

  - kernel: Indirect branch speculation can be enabled after it was force-disabled by the     PR_SPEC_FORCE_DISABLE prctl command. (CVE-2020-10768)

  - kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in     drivers/net/wireless/marvell/mwifiex/scan.c (CVE-2020-12653)

  - kernel: heap-based buffer overflow in mwifiex_ret_wmm_get_status function in     drivers/net/wireless/marvell/mwifiex/wmm.c (CVE-2020-12654)

  - Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario (CVE-2020-12888)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream. This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
141961	Amazon Linux AMI : kernel (ALAS-2020-1437)	Nessus	Amazon Linux Local Security Checks	10/28/2020	2/13/2024	high
143086	RHEL 7 : kernel-alt (RHSA-2020:2854)	Nessus	Red Hat Local Security Checks	11/19/2020	2/8/2024	high
160437	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-016)	Nessus	Amazon Linux Local Security Checks	5/2/2022	9/5/2023	high
138807	RHEL 8 : kernel-rt (RHSA-2020:3016)	Nessus	Red Hat Local Security Checks	7/21/2020	4/24/2024	high
146282	openSUSE Security Update : RT kernel (openSUSE-2021-242)	Nessus	SuSE Local Security Checks	2/8/2021	2/9/2023	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical