The version of kernel installed on the remote host is prior to 4.14.192-147.314. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1480 advisory.

    2024-06-19: CVE-2020-14356 was added to this advisory.

    The Serial Attached SCSI (SAS) implementation in the Linux kernel mishandles a mutex within libsas. This     allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.
    (CVE-2017-18232)

    The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel can cause a NULL     pointer dereference in xfs_bmapi_write function. An attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted xfs filesystem image to cause a kernel panic and thus a     denial of service. (CVE-2018-10323)

    The Linux kernel was found vulnerable to a NULL pointer dereference in the drivers/net/phy/mdio-bcm-     unimac.c:unimac_mdio_probe() function caused by an unchecked return value from the platform_get_resource()     function. A successful flaw exploitation can cause a system panic and a denial of service. This flaw is     believed not to be an attacker triggerable as bad return value can be caused by hardware misconfiguration.
    (CVE-2018-8043)

    A flaw was found in the AMD Cryptographic Co-processor driver in the Linux kernel. An attacker, able to     send invalid SHA type commands, could cause the system to crash. The highest threat from this     vulnerability is to system availability. (CVE-2019-18808)

    A flaw was found in the Linux kernel. The CX23888 Integrated Consumer Infrared Controller probe code     handles resource cleanup low memory conditions. A local attacker able to induce low memory conditions     could use this flaw to crash the system. The highest threat from this vulnerability is to system     availability. (CVE-2019-19054)

    A memory leak flaw was found in the adis_update_scan_mode_burst() function in     drivers/iio/imu/adis_buffer.c in the Linux kernel. This flaw allows attackers to cause a denial of     service. (CVE-2019-19061)

    Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow     attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout()     failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the     htc_connect_service() function, aka CID-853acf7caf10. (CVE-2019-19073)

    A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
    (CVE-2019-19074)

    A flaw was found in the way Linux kernel's KVM hypervisor handled deferred TLB flush requests from guest.
    A race condition may occur between the guest issuing a deferred TLB flush request to KVM, and then KVM     handling and acknowledging it. This may result in invalid address translations from TLB being used to     access guest memory, leading to a potential information leakage issue. An attacker may use this flaw to     access guest memory locations that it should not have access to. (CVE-2019-3016)

    In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check.
    This could lead to local information disclosure with system execution privileges needed. User interaction     is not needed for exploitation. (CVE-2019-9445)

    A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device.
    With this vulnerability, continually reading the device may consume a large amount of system memory and     cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making     the system inoperable. (CVE-2020-10781)

    A flaw was discovered in the XFS source in the Linux kernel. This flaw allows an attacker with the ability     to mount an XFS filesystem, to trigger a denial of service while attempting to sync a file located on an     XFS v5 image with crafted metadata. (CVE-2020-12655)

    A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found     in the way when reboot the system. A local user could use this flaw to crash the system or escalate their     privileges on the system. (CVE-2020-14356)

    In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak,     aka CID-28ebeb8db770. (CVE-2020-15393)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5526 advisory.

    - x86/KVM: Clean up host's steal time structure (Boris Ostrovsky)  [Orabug: 30489861]  {CVE-2019-3016}     {CVE-2019-3016}
    - x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed (Boris Ostrovsky)  [Orabug: 30489861]     {CVE-2019-3016} {CVE-2019-3016}
    - x86/kvm: Cache gfn to pfn translation (Boris Ostrovsky)  [Orabug: 30489861]  {CVE-2019-3016}     {CVE-2019-3016}
    - x86/kvm: Introduce kvm_(un)map_gfn() (Boris Ostrovsky)  [Orabug: 30489861]  {CVE-2019-3016}     {CVE-2019-3016}
    - x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit (Boris Ostrovsky)  [Orabug: 30489861]     {CVE-2019-3016} {CVE-2019-3016}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000253 advisory.

    In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory     locations from another process in the same guest. This problem is limit to the host running linux kernel     4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel     CPUs cannot be ruled out.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
139858	Amazon Linux 2 : kernel (ALAS-2020-1480)	Nessus	Amazon Linux Local Security Checks	2020/8/26	2026/2/24	high
133381	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5526)	Nessus	Oracle Linux Local Security Checks	2020/1/31	2026/2/9	high
282143	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000253)	Nessus	Unity Linux Local Security Checks	2026/1/7	2026/1/7	medium
203339	Photon OS 4.0: Linux PHSA-2023-4.0-0318	Nessus	PhotonOS Local Security Checks	2024/7/23	2026/3/4	high

检测

插件搜索

high

high

medium

high