An update of the linux package has been released.

The SUSE Linux Enterprise 12 SP5 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).

CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).

CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)

CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9085 advisory.

    - xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich)  [Orabug: 32492109]  {CVE-2021-26930}
    - xen-scsiback: dont 'handle' error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
    - xen-netback: dont 'handle' error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
    - xen-blkback: dont 'handle' error by BUG() (Jan Beulich)  [Orabug: 32492101]  {CVE-2021-26931}
    - Xen/gntdev: correct error checking in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492093]     {CVE-2021-26932}
    - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492093]     {CVE-2021-26932}
    - Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492093]     {CVE-2021-26932}
    - Xen/x86: dont bail early from clear_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492093]     {CVE-2021-26932}
    - HID: hid-input: fix stylus battery reporting (Dmitry Torokhov)  [Orabug: 32464784]  {CVE-2020-0431}
    - nbd: freeze the queue while were adding connections (Josef Bacik)  [Orabug: 32447285]  {CVE-2021-3348}
    - futex: Handle faults correctly for PI futexes (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
    - futex: Simplify fixup_pi_state_owner() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
    - futex: Use pi_state_update_owner() in put_pi_state() (Thomas Gleixner)  [Orabug: 32447187]     {CVE-2021-3347}
    - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Thomas Gleixner)  [Orabug: 32447187]     {CVE-2021-3347}
    - futex: Dont enable IRQs unconditionally in put_pi_state() (Dan Carpenter)  [Orabug: 32447187]     {CVE-2021-3347}
    - futex: Provide and use pi_state_update_owner() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
    - futex: Replace pointless printk in fixup_owner() (Thomas Gleixner)  [Orabug: 32447187]  {CVE-2021-3347}
    - futex: Ensure the correct return value from futex_lock_pi() (Thomas Gleixner)  [Orabug: 32447187]     {CVE-2021-3347}
    - ovl: check permission to open real file (Miklos Szeredi)  [Orabug: 32046372]  {CVE-2020-16120}
    - ovl: verify permissions in ovl_path_open() (Miklos Szeredi)  [Orabug: 32046372]  {CVE-2020-16120}
    - ovl: switch to mounter creds in readdir (Miklos Szeredi)  [Orabug: 32046372]  {CVE-2020-16120}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP2 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed permission check to open real file when using overlayfs. It was possible to have a file not readable by an unprivileged user be copied to a mountpoint controlled by that user and then be able to access the file (bsc#1177470).

CVE-2020-12351: Fixed a type confusion while processing AMP packets aka 'BleedingTooth' aka 'BadKarma' (bsc#1177724).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).

CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka 'BleedingTooth (bsc#1177726).

CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon (bsc#1178589)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be     exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was     possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by     the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef (ovl:
    stack file ops). This was fixed in kernel version 5.8 by commits 56230d9 (ovl: verify permissions in     ovl_path_open()), 48bd024 (ovl: switch to mounter creds in readdir) and 05acefb (ovl: check permission     to open real file). Additionally, commits 130fdbc (ovl: pass correct flags for opening real directory)     and 292f902 (ovl: call secutiry hook in ovl_real_ioctl()) in kernel 5.8 might also be desired or     necessary. These additional commits introduced a regression in overlay mounts within user namespaces which     prevented access to files with ownership outside of the user namespace. This regression was mitigated by     subsequent commit b6650da (ovl: do not fail because of O_NOATIMEi) in kernel 5.11. (CVE-2020-16120)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through     5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an     iSCSI transport is registered with the iSCSI subsystem,     the transport's handle is available to unprivileged     users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When     read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which     leaks the handle. This handle is actually the pointer     to an iscsi_transport struct in the kernel module's     global variables.(CVE-2021-27363)

  - An issue was discovered in the Linux kernel through     5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can     exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI,     and has a length up to the maximum length of a Netlink     message.(CVE-2021-27365)

  - An issue was discovered in the Linux kernel through     5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged     user to craft Netlink messages.(CVE-2021-27364)

  - Overlayfs did not properly perform permission checking     when copying up files in an overlayfs and could be     exploited from within a user namespace, if, for     example, unprivileged user namespaces were allowed. It     was possible to have a file not readable by an     unprivileged user to be copied to a mountpoint     controlled by the user, like a removable device. This     was introduced in kernel version 4.19 by commit d1d04ef     ('ovl: stack file ops'). This was fixed in kernel     version 5.8 by commits 56230d9 ('ovl: verify     permissions in ovl_path_open()'), 48bd024 ('ovl: switch     to mounter creds in readdir') and 05acefb ('ovl: check     permission to open real file'). Additionally, commits     130fdbc ('ovl: pass correct flags for opening real     directory') and 292f902 ('ovl: call secutiry hook in     ovl_real_ioctl()') in kernel 5.8 might also be desired     or necessary. These additional commits introduced a     regression in overlay mounts within user namespaces     which prevented access to files with ownership outside     of the user namespace. This regression was mitigated by     subsequent commit b6650da ('ovl: do not fail because of     O_NOATIMEi') in kernel 5.11.(CVE-2020-16120)

  - A flaw was found in the Linux kernel's implementation     of string matching within a packet. A privileged user     (with root or CAP_NET_ADMIN) when inserting iptables     rules could insert a rule which can panic the     system.(CVE-2021-20177)

  - fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8,     when there is an NFS export of a subdirectory of a     filesystem, allows remote attackers to traverse to     other parts of the filesystem via READDIRPLUS. NOTE:
    some parties argue that such a subdirectory export is     not intended to prevent this attack see also the     exports(5) no_subtree_check default     behavior.(CVE-2021-3178)

  - nbd_add_socket in drivers/block/nbd.c in the Linux     kernel through 5.10.12 has an ndb_queue_rq     use-after-free that could be triggered by local     attackers (with access to the nbd device) via an I/O     request at a certain point during device setup, aka     CID-b98e762e3d71.(CVE-2021-3348)

  - An issue was discovered in the Linux kernel through     5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute     code in the kernel, aka     CID-34b1a1ce1458.(CVE-2021-3347)

  - A flaw was found in the Linux kernel. The marvell wifi     driver could allow a local attacker to execute     arbitrary code via a long SSID value in     mwifiex_cmd_802_11_ad_hoc_start function. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-36158)

  - A flaw was found in the Linux kernel's implementation     of the Linux SCSI target host, where an authenticated     attacker could write to any block on the exported SCSI     device backing store. This flaw allows an authenticated     attacker to send LIO block requests to the Linux system     to overwrite data on the backing store. The highest     threat from this vulnerability is to integrity. In     addition, this flaw affects the tcmu-runner package,     where the affected SCSI command is     called.(CVE-2020-28374)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).

CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9084 advisory.

    - ovl: verify permissions in ovl_path_open() (Miklos Szeredi)  [Orabug: 32435220]  {CVE-2020-16120}
    - ovl: switch to mounter creds in readdir (Miklos Szeredi)  [Orabug: 32435220]  {CVE-2020-16120}
    - futex: Handle faults correctly for PI futexes (Thomas Gleixner)  [Orabug: 32447189]  {CVE-2021-3347}
    - futex: Simplify fixup_pi_state_owner() (Thomas Gleixner)  [Orabug: 32447189]  {CVE-2021-3347}
    - futex: Use pi_state_update_owner() in put_pi_state() (Thomas Gleixner)  [Orabug: 32447189]     {CVE-2021-3347}
    - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Thomas Gleixner)  [Orabug: 32447189]     {CVE-2021-3347}
    - futex: Provide and use pi_state_update_owner() (Thomas Gleixner)  [Orabug: 32447189]  {CVE-2021-3347}
    - futex: Replace pointless printk in fixup_owner() (Thomas Gleixner)  [Orabug: 32447189]  {CVE-2021-3347}
    - futex: Ensure the correct return value from futex_lock_pi() (Thomas Gleixner)  [Orabug: 32447189]     {CVE-2021-3347}
    - futex: Don't enable IRQs unconditionally in put_pi_state() (Dan Carpenter)  [Orabug: 32447189]     {CVE-2021-3347}
    - nbd: freeze the queue while we're adding connections (Josef Bacik)  [Orabug: 32447287]  {CVE-2021-3348}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4577-1 advisory.

    Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket     reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2020-16119)

    Giuseppe Scrivano discovered that the overlay file system in the Linux kernel did not properly perform     permission checks in some situations. A local attacker could possibly use this to bypass intended     restrictions and gain read access to restricted files. (CVE-2020-16120)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream. This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
141480	Photon OS 1.0: Linux PHSA-2020-1.0-0333	Nessus	PhotonOS Local Security Checks	2020/10/16	2021/1/27	high
143773	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3281-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/5	high
147204	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9085)	Nessus	Oracle Linux Local Security Checks	2021/3/9	2024/10/22	high
142945	openSUSE Security Update : the Linux Kernel (openSUSE-2020-1906)	Nessus	SuSE Local Security Checks	2020/11/17	2024/2/8	high
143780	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:3522-1)	Nessus	SuSE Local Security Checks	2020/12/9	2022/12/5	high
244310	Linux Distros Unpatched Vulnerability : CVE-2020-16120	Nessus	Misc.	2025/8/6	2025/9/30	medium
148634	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2021-1715)	Nessus	Huawei Local Security Checks	2021/4/15	2024/1/4	high
141496	Photon OS 3.0: Linux PHSA-2020-3.0-0153	Nessus	PhotonOS Local Security Checks	2020/10/19	2025/8/22	high
142921	openSUSE Security Update : the Linux Kernel (openSUSE-2020-1901)	Nessus	SuSE Local Security Checks	2020/11/17	2024/2/8	high
143858	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3326-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/5	high
147202	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2021-9084)	Nessus	Oracle Linux Local Security Checks	2021/3/9	2024/11/2	high
141449	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4577-1)	Nessus	Ubuntu Local Security Checks	2020/10/14	2024/8/27	high
146282	openSUSE Security Update : RT kernel (openSUSE-2021-242)	Nessus	SuSE Local Security Checks	2021/2/8	2023/2/9	critical
207269	Photon OS 4.0: Linux PHSA-2024-4.0-0693	Nessus	PhotonOS Local Security Checks	2024/9/14	2025/10/10	high

检测

插件搜索

high

high

high

high

high

medium

high

high

high

high

high

high

critical

high