Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  -Linuxカーネルの5.12-rc1より前のバージョンのGPU Nouveauドライバーの機能性において、ユーザーがioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOCを呼び出す方法に、NULLポインターデリファレンスの欠陥が見つかりました。この欠陥により、ローカルユーザーがシステムをクラッシュさせる可能性があります。(CVE-2020-25639)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote Fedora 32 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-1db4ab0a3d advisory.

  - A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in     versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw     allows a local user to crash the system. (CVE-2020-25639)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9141 advisory.

    - bpf, selftests: Fix up some test_verifier cases for unprivileged (Piotr Krysiuk)  [Orabug: 32656761]     {CVE-2020-27170} {CVE-2020-27171}
    - bpf: Add sanity check for upper ptr_limit (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170}     {CVE-2020-27171}
    - bpf: Simplify alu_limit masking for pointer arithmetic (Piotr Krysiuk)  [Orabug: 32656761]     {CVE-2020-27170} {CVE-2020-27171}
    - bpf: Fix off-by-one for area size in creating mask to left (Piotr Krysiuk)  [Orabug: 32656761]     {CVE-2020-27170} {CVE-2020-27171}
    - bpf: Prohibit alu ops for pointer types not defining ptr_limit (Piotr Krysiuk)  [Orabug: 32656761]     {CVE-2020-27170} {CVE-2020-27171}
    - selftests/bpf: Test access to bpf map pointer (Andrey Ignatov)  [Orabug: 32656761]  {CVE-2020-27170}     {CVE-2020-27171}
    - bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann)  [Orabug: 32673813]     {CVE-2021-3444}
    - bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann)  [Orabug: 32673813]     {CVE-2021-3444}
    - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech)  [Orabug: 32603378]  {CVE-2021-27363}     {CVE-2021-27364} {CVE-2021-27365}
    - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech)  [Orabug: 32603378]     {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
    - scsi: iscsi: Report connection state in sysfs (Gabriel Krisman Bertazi)  [Orabug: 32603378]     {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
    - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output (Joe Perches)  [Orabug: 32603378]     {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
    - scsi: iscsi: Restrict sessions and handles to admin capabilities (Lee Duncan)  [Orabug: 32603378]     {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365}
    - drm/nouveau: bail out of nouveau_channel_new if channel init fails (Frantisek Hrbata)  [Orabug:
    32591559]  {CVE-2020-25639}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4945-2 advisory.

    USN-4945-1 fixed vulnerabilities in the Linux kernel for Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. This     update provides the corresponding Linux kernel updates targeted specifically for Raspberry Pi devices in     those same Ubuntu Releases.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).

CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).

CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required.
(bnc#1180812)

CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).

CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).

CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).

CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).

CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through     5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an     iSCSI transport is registered with the iSCSI subsystem,     the transport's handle is available to unprivileged     users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When     read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which     leaks the handle. This handle is actually the pointer     to an iscsi_transport struct in the kernel module's     global variables.(CVE-2021-27363)

  - An issue was discovered in the Linux kernel through     5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can     exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI,     and has a length up to the maximum length of a Netlink     message.(CVE-2021-27365)

  - An issue was discovered in the Linux kernel through     5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged     user to craft Netlink messages.(CVE-2021-27364)

  - A NULL pointer dereference flaw was found in the Linux     kernel's GPU Nouveau driver functionality in versions     prior to 5.12-rc1 in the way the user calls ioctl     DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a     local user to crash the system.(CVE-2020-25639)

  - Overlayfs did not properly perform permission checking     when copying up files in an overlayfs and could be     exploited from within a user namespace, if, for     example, unprivileged user namespaces were allowed. It     was possible to have a file not readable by an     unprivileged user to be copied to a mountpoint     controlled by the user, like a removable device. This     was introduced in kernel version 4.19 by commit d1d04ef     ('ovl: stack file ops'). This was fixed in kernel     version 5.8 by commits 56230d9 ('ovl: verify     permissions in ovl_path_open()'), 48bd024 ('ovl: switch     to mounter creds in readdir') and 05acefb ('ovl: check     permission to open real file'). Additionally, commits     130fdbc ('ovl: pass correct flags for opening real     directory') and 292f902 ('ovl: call secutiry hook in     ovl_real_ioctl()') in kernel 5.8 might also be desired     or necessary. These additional commits introduced a     regression in overlay mounts within user namespaces     which prevented access to files with ownership outside     of the user namespace. This regression was mitigated by     subsequent commit b6650da ('ovl: do not fail because of     O_NOATIMEi') in kernel 5.11.(CVE-2020-16120)

  - In various methods of hid-multitouch.c, there is a     possible out of bounds write due to a missing bounds     check. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-162844689References: Upstream kernel(CVE-2020-0465)

  - nbd_add_socket in drivers/block/nbd.c in the Linux     kernel through 5.10.12 has an ndb_queue_rq     use-after-free that could be triggered by local     attackers (with access to the nbd device) via an I/O     request at a certain point during device setup, aka     CID-b98e762e3d71.(CVE-2021-3348)

  - An issue was discovered in the Linux kernel through     5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute     code in the kernel, aka     CID-34b1a1ce1458.(CVE-2021-3347)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through     5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an     iSCSI transport is registered with the iSCSI subsystem,     the transport's handle is available to unprivileged     users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When     read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which     leaks the handle. This handle is actually the pointer     to an iscsi_transport struct in the kernel module's     global variables.(CVE-2021-27363)

  - An issue was discovered in the Linux kernel through     5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can     exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI,     and has a length up to the maximum length of a Netlink     message.(CVE-2021-27365)

  - An issue was discovered in the Linux kernel through     5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged     user to craft Netlink messages.(CVE-2021-27364)

  - Overlayfs did not properly perform permission checking     when copying up files in an overlayfs and could be     exploited from within a user namespace, if, for     example, unprivileged user namespaces were allowed. It     was possible to have a file not readable by an     unprivileged user to be copied to a mountpoint     controlled by the user, like a removable device. This     was introduced in kernel version 4.19 by commit d1d04ef     ('ovl: stack file ops'). This was fixed in kernel     version 5.8 by commits 56230d9 ('ovl: verify     permissions in ovl_path_open()'), 48bd024 ('ovl: switch     to mounter creds in readdir') and 05acefb ('ovl: check     permission to open real file'). Additionally, commits     130fdbc ('ovl: pass correct flags for opening real     directory') and 292f902 ('ovl: call secutiry hook in     ovl_real_ioctl()') in kernel 5.8 might also be desired     or necessary. These additional commits introduced a     regression in overlay mounts within user namespaces     which prevented access to files with ownership outside     of the user namespace. This regression was mitigated by     subsequent commit b6650da ('ovl: do not fail because of     O_NOATIMEi') in kernel 5.11.(CVE-2020-16120)

  - A flaw was found in the Linux kernel's implementation     of string matching within a packet. A privileged user     (with root or CAP_NET_ADMIN) when inserting iptables     rules could insert a rule which can panic the     system.(CVE-2021-20177)

  - fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8,     when there is an NFS export of a subdirectory of a     filesystem, allows remote attackers to traverse to     other parts of the filesystem via READDIRPLUS. NOTE:
    some parties argue that such a subdirectory export is     not intended to prevent this attack see also the     exports(5) no_subtree_check default     behavior.(CVE-2021-3178)

  - nbd_add_socket in drivers/block/nbd.c in the Linux     kernel through 5.10.12 has an ndb_queue_rq     use-after-free that could be triggered by local     attackers (with access to the nbd device) via an I/O     request at a certain point during device setup, aka     CID-b98e762e3d71.(CVE-2021-3348)

  - An issue was discovered in the Linux kernel through     5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute     code in the kernel, aka     CID-34b1a1ce1458.(CVE-2021-3347)

  - A flaw use after free in the Linux kernel TUN/TAP     device driver functionality was found in the way user     create and use tun/tap device. A local user could use     this flaw to crash the system or possibly escalate     their privileges on the system.(CVE-2021-0342)

  - A flaw was found in the Linux kernel. A use-after-free     memory flaw was found in the perf subsystem allowing a     local attacker with permission to monitor perf events     to corrupt memory and possibly escalate privileges. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)

  - A flaw was found in the Linux kernel's multi-touch     input system. An out-of-bounds write triggered by a     use-after-free issue could lead to memory corruption or     possible privilege escalation. The highest threat from     this vulnerability is to confidentiality, integrity, as     well as system availability.(CVE-2020-0465)

  - A NULL pointer dereference flaw was found in the Linux     kernel's GPU Nouveau driver functionality in the way     the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC.
    This flaw allows a local user to crash the     system.(CVE-2020-25639)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
229957	Linux Distros のパッチ未適用の脆弱性: CVE-2020-25639	Nessus	Misc.	2025/3/5	2025/11/25	medium
147469	Fedora 32 : kernel / kernel-headers / kernel-tools (2021-1db4ab0a3d)	Nessus	Fedora Local Security Checks	2021/3/10	2024/1/11	medium
148458	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9141)	Nessus	Oracle Linux Local Security Checks	2021/4/13	2024/10/22	high
149661	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-4945-2)	Nessus	Ubuntu Local Security Checks	2021/5/19	2024/10/29	high
146359	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0353-1)	Nessus	SuSE Local Security Checks	2021/2/10	2024/1/22	high
150214	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-1929)	Nessus	Huawei Local Security Checks	2021/6/3	2023/12/27	high
148604	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2021-1751)	Nessus	Huawei Local Security Checks	2021/4/15	2024/1/4	high
148350	Photon OS 4.0: Linux PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	2021/4/7	2025/11/13	high

检测

插件搜索

medium

medium

high

high

high

high

high

high