The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2208-1 advisory.

    The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-33200: Enforcing incorrect limits for pointer arithmetic operations by the BPF verifier could     be abused to perform out-of-bounds reads and writes in kernel memory (bsc#1186484).
    - CVE-2021-33034: Fixed a use-after-free when destroying an hci_chan. This could lead to writing an     arbitrary values. (bsc#1186111)
    - CVE-2020-26139: Fixed a denial-of-service when an Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. (bnc#1186062)
    - CVE-2021-23134: A Use After Free vulnerability in nfc sockets allowed local attackers to elevate their     privileges. (bnc#1186060)
    - CVE-2021-3491: Fixed a potential heap overflow in mem_rw(). This vulnerability is related to the     PROVIDE_BUFFERS operation, which allowed the MAX_RW_COUNT limit to be bypassed (bsc#1185642).
    - CVE-2021-32399: Fixed a race condition when removing the HCI controller (bnc#1184611).
    - CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after     (re)connecting to a network. Under the right circumstances this can be abused to inject arbitrary network     packets and/or exfiltrate user data (bnc#1185859).
    - CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same     key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames     and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862).
    - CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments, even though some of     them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected     fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality     protocol is used (bnc#1185859).
    - CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is     authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of     802.11n), an adversary can abuse this to inject arbitrary network packets. (bnc#1185861)
    - CVE-2020-26145: An issue was discovered with Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2,     and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and     process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (bnc#1185860)
    - CVE-2020-26141: An issue was discovered in the ALFA driver for AWUS036H, where the Message Integrity     Check (authenticity) of fragmented TKIP frames was not verified. An adversary can abuse this to inject and     possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
    (bnc#1185987)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2421-1 advisory.

    The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116 ).
    - CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and     code execution (bsc#1188062).
    - CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
    - CVE-2021-33624: In kernel/bpf/verifier.c a branch can be mispredicted (e.g., because of type confusion)     and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel     attack, aka CID-9183671af6db (bnc#1187554).
    - CVE-2021-0605: In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds     check. This could lead to local information disclosure with System execution privileges needed. User     interaction is not needed for exploitation (bnc#1187601).
    - CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of     bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no     additional execution privileges needed. User interaction is not needed for exploitation (bnc#1187595).
    - CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a     nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey     authentication procedure) by reflection of the public key and the authentication evidence of the     initiating device, potentially permitting this attacker to complete authenticated pairing with the     responding device using the correct Passkey for the pairing session. The attack methodology determines the     Passkey value one bit at a time (bnc#1179610).
    - CVE-2021-34693: net/can/bcm.c in the Linux kernel allowed local users to obtain sensitive information     from kernel stack memory because parts of a data structure are uninitialized (bnc#1187452).
    - CVE-2020-36385: An issue was discovered in the Linux kernel drivers/infiniband/core/ucma.c has a use-     after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close     is called, aka CID-f5449e74802c (bnc#1187050).
    - CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially     enable information disclosure via adjacent access (bnc#1186463).
    - CVE-2020-36386: An issue was discovered in the Linux kernel net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf (bnc#1187038).
    - CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is     authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of     802.11n), an adversary can abuse this to inject arbitrary network packets (bnc#1185861).
    - CVE-2021-33200: kernel/bpf/verifier.c enforced incorrect limits for pointer arithmetic operations, aka     CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading     to local privilege escalation to root. In particular, there is a corner case where the off reg causes a     masking direction change, which then results in an incorrect final aux->alu_limit (bnc#1186484).
    - CVE-2021-33034: net/bluetooth/hci_event.c had a use-after-free when destroying an hci_chan, aka     CID-5c4c8c954409. This leads to writing an arbitrary value (bnc#1186111).
    - CVE-2020-26139: An Access Point (AP) forwards EAPOL frames to other clients even though the sender has     not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch     denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in     connected clients (bnc#1186062).
    - CVE-2021-23134: Use After Free vulnerability in nfc sockets allowed local attackers to elevate their     privileges. In typical configurations, the issue can only be triggered by a privileged local user with the     CAP_NET_RAW capability (bnc#1186060).
    - CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after     (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames     encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or     exfiltrate user data (bnc#1185859).
    - CVE-2020-26141: The Wi-Fi implementation did not verify the Message Integrity Check (authenticity) of     fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2     networks that support the TKIP data-confidentiality protocol (bnc#1185987).
    - CVE-2020-26145: The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast     fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse     this to inject arbitrary network packets independent of the network configuration (bnc#1185860).
    - CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same     key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames     and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862).
    - CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of     them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected     fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality     protocol is used. ()
    - CVE-2021-3491: The io_uring subsystem allowed the MAX_RW_COUNT limit to be bypassed in the     PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem.
    This could be used to create a heap overflow leading to arbitrary code execution in the kernel.
    (bnc#1185642).
    - CVE-2021-23133: A race condition in SCTP sockets (net/sctp/socket.c) could lead to kernel privilege     escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is     called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list     without any proper locking. This can be exploited by an attacker with network service privileges to     escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is     attached which denies creation of some SCTP socket (bnc#1184675).
    - CVE-2021-32399: net/bluetooth/hci_request.c in the Linux kernel has a race condition for removal of the     HCI controller (bnc#1184611 bnc#1185898).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4948-1 advisory.

    Ryota Shiga discovered that the eBPF implementation in the Linux kernel did not properly verify that a BPF     program only reserved as much memory for a ring buffer as was allocated. A local attacker could use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3489)

    Manfred Paul discovered that the eBPF implementation in the Linux kernel did not properly track bounds on     bitwise operations. A local attacker could use this to cause a denial of service (system crash) or execute     arbitrary code. (CVE-2021-3490)

    Billy Jheng Bing-Jhong discovered that the io_uring implementation of the Linux kernel did not properly     enforce the MAX_RW_COUNT limit in some situations. A local attacker could use this to cause a denial of     service (system crash) or execute arbitrary code. (CVE-2021-3491)

    Kiyin () discovered that the NFC LLCP protocol implementation in the Linux kernel contained a     reference counting error. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2020-25670)

    Kiyin () discovered that the NFC LLCP protocol implementation in the Linux kernel did not properly     deallocate memory in certain error situations. A local attacker could use this to cause a denial of     service (memory exhaustion). (CVE-2020-25671, CVE-2020-25672)

    It was discovered that the Xen paravirtualization backend in the Linux kernel did not properly deallocate     memory in some situations. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2021-28688)

    It was discovered that the io_uring subsystem in the Linux kernel contained a race condition leading to a     deadlock condition. A local attacker could use this to cause a denial of service. (CVE-2021-28951)

    John Stultz discovered that the audio driver for Qualcomm SDM845 systems in the Linux kernel did not     properly validate port ID numbers. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2021-28952)

    Zygo Blaxell discovered that the btrfs file system implementation in the Linux kernel contained a race     condition during certain cloning operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2021-28964)

    Vince Weaver discovered that the perf subsystem in the Linux kernel did not properly handle certain PEBS     records properly for some Intel Haswell processors. A local attacker could use this to cause a denial of     service (system crash). (CVE-2021-28971)

    It was discovered that the RPA PCI Hotplug driver implementation in the Linux kernel did not properly     handle device name writes via sysfs, leading to a buffer overflow. A privileged attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-28972)

    It was discovered that the Freescale Gianfar Ethernet driver for the Linux kernel did not properly handle     receive queue overrun when jumbo frames were enabled in some situations. An attacker could use this to     cause a denial of service (system crash). (CVE-2021-29264)

    It was discovered that the vDPA backend virtio driver in the Linux kernel contained a use-after-free     vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2021-29266)

    It was discovered that the TIPC protocol implementation in the Linux kernel did not properly validate     passed encryption key sizes. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2021-29646)

    It was discovered that the Qualcomm IPC router implementation in the Linux kernel did not properly     initialize memory passed to user space. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2021-29647)

    It was discovered that the BPF user mode driver implementation in the Linux kernel did not properly     deallocate memory in some situations. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2021-29649)

    It was discovered that a race condition existed in the netfilter subsystem of the Linux kernel when     replacing tables. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2021-29650)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel for AMD processors contained race     conditions on nested VMCB controls. A local attacker in a guest vm could possibly use this to gain     elevated privileges. (CVE-2021-29657)

    Dan Carpenter discovered that the block device manager (dm) implementation in the Linux kernel contained a     buffer overflow in the ioctl for listing devices. A privileged local attacker could use this to cause a     denial of service (system crash). (CVE-2021-31916)

     discovered that the IEEE 1394 (Firewire) nosy packet sniffer driver in the Linux kernel did not     properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-3483)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the     PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem.
    This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was     addressed via commit d1f82808877b (io_uring: truncate lengths larger than MAX_RW_COUNT on provide     buffers) (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was     introduced in ddf0322db79c (io_uring: add IORING_OP_PROVIDE_BUFFERS) (v5.7-rc1). (CVE-2021-3491)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1899-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-33200: Enforcing incorrect limits for pointer arithmetic operations by the BPF verifier could     be abused to perform out-of-bounds reads and writes in kernel memory (bsc#1186484).
    - CVE-2021-33034: Fixed a use-after-free when destroying an hci_chan. This could lead to writing an     arbitrary values. (bsc#1186111)
    - CVE-2020-26139: Fixed a denial-of-service when an Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. (bnc#1186062)
    - CVE-2021-23134: A Use After Free vulnerability in nfc sockets allowed local attackers to elevate their     privileges. (bnc#1186060)
    - CVE-2021-3491: Fixed a potential heap overflow in mem_rw(). This vulnerability is related to the     PROVIDE_BUFFERS operation, which allowed the MAX_RW_COUNT limit to be bypassed (bsc#1185642).
    - CVE-2021-32399: Fixed a race condition when removing the HCI controller (bnc#1184611).
    - CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after     (re)connecting to a network. Under the right circumstances this can be abused to inject arbitrary network     packets and/or exfiltrate user data (bnc#1185859).
    - CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same     key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames     and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862).
    - CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments, even though some of     them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected     fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality     protocol is used (bnc#1185859).
    - CVE-2020-26145: An issue was discovered with Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2,     and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and     process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (bnc#1185860)
    - CVE-2020-26141: An issue was discovered in the ALFA driver for AWUS036H, where the Message Integrity     Check (authenticity) of fragmented TKIP frames was not verified. An adversary can abuse this to inject and     possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
    (bnc#1185987)
    - CVE-2021-23133: Fixed a race condition in SCTP sockets, which could lead to privilege escalation from     the context of a network service or an unprivileged process. (bnc#1184675)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0947-1 advisory.

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to     elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local     user with the CAP_NET_RAW capability. (CVE-2021-23134)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

  - The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the     PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem.
    This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was     addressed via commit d1f82808877b (io_uring: truncate lengths larger than MAX_RW_COUNT on provide     buffers) (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was     introduced in ddf0322db79c (io_uring: add IORING_OP_PROVIDE_BUFFERS) (v5.7-rc1). (CVE-2021-3491)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4949-1 advisory.

    Ryota Shiga discovered that the eBPF implementation in the Linux kernel did not properly verify that a BPF     program only reserved as much memory for a ring buffer as was allocated. A local attacker could use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3489)

    Manfred Paul discovered that the eBPF implementation in the Linux kernel did not properly track bounds on     bitwise operations. A local attacker could use this to cause a denial of service (system crash) or execute     arbitrary code. (CVE-2021-3490)

    Billy Jheng Bing-Jhong discovered that the io_uring implementation of the Linux kernel did not properly     enforce the MAX_RW_COUNT limit in some situations. A local attacker could use this to cause a denial of     service (system crash) or execute arbitrary code. (CVE-2021-3491)

    It was discovered that the Nouveau GPU driver in the Linux kernel did not properly handle error conditions     in some situations. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2020-25639)

    Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schnherr discovered that the Xen     paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in     some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host     domain crash). (CVE-2021-26930)

    Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain     error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a     denial of service (host domain crash). (CVE-2021-26931)

    It was discovered that the fastrpc driver in the Linux kernel did not prevent user space applications from     sending kernel RPC messages. A local attacker could possibly use this to gain elevated privileges.
    (CVE-2021-28375)

    It was discovered that the Freescale Gianfar Ethernet driver for the Linux kernel did not properly handle     receive queue overrun when jumbo frames were enabled in some situations. An attacker could use this to     cause a denial of service (system crash). (CVE-2021-29264)

    It was discovered that the USB/IP driver in the Linux kernel contained race conditions during the update     of local and shared status. An attacker could use this to cause a denial of service (system crash).
    (CVE-2021-29265)

    It was discovered that the vDPA backend virtio driver in the Linux kernel contained a use-after-free     vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2021-29266)

    It was discovered that the TIPC protocol implementation in the Linux kernel did not properly validate     passed encryption key sizes. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2021-29646)

    It was discovered that a race condition existed in the netfilter subsystem of the Linux kernel when     replacing tables. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2021-29650)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1977-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-33200: Enforcing incorrect limits for pointer arithmetic operations by the BPF verifier could     be abused to perform out-of-bounds reads and writes in kernel memory (bsc#1186484).
    - CVE-2021-33034: Fixed a use-after-free when destroying an hci_chan. This could lead to writing an     arbitrary values. (bsc#1186111)
    - CVE-2020-26139: Fixed a denial-of-service when an Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. (bnc#1186062)
    - CVE-2021-23134: A Use After Free vulnerability in nfc sockets allowed local attackers to elevate their     privileges. (bnc#1186060)
    - CVE-2021-3491: Fixed a potential heap overflow in mem_rw(). This vulnerability is related to the     PROVIDE_BUFFERS operation, which allowed the MAX_RW_COUNT limit to be bypassed (bsc#1185642).
    - CVE-2021-32399: Fixed a race condition when removing the HCI controller (bnc#1184611).
    - CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after     (re)connecting to a network. Under the right circumstances this can be abused to inject arbitrary network     packets and/or exfiltrate user data (bnc#1185859).
    - CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same     key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames     and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862).
    - CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and     Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is     authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of     802.11n), an adversary can abuse this to inject arbitrary network packets. (bnc#1185861)
    - CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments, even though some of     them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected     fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality     protocol is used (bnc#1185859).
    - CVE-2020-26145: An issue was discovered with Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2,     and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and     process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (bnc#1185860)
    - CVE-2020-26141: An issue was discovered in the ALFA driver for AWUS036H, where the Message Integrity     Check (authenticity) of fragmented TKIP frames was not verified. An adversary can abuse this to inject and     possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
    (bnc#1185987)
    - CVE-2021-29650: Fixed an issue with the netfilter subsystem that allowed attackers to cause a denial of     service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory     barrier upon the assignment of a new table value (bnc#1184208).
    - CVE-2021-29155: Fixed an issue that was discovered in kernel/bpf/verifier.c that performs undesirable     out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer     arithmetic operations, the pointer modification performed by the first operation was not correctly     accounted for when restricting subsequent operations (bnc#1184942).
    - CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination     register truncation when the source register was known to be 0 leading to out of bounds read     (bsc#1184170).
    - CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).
    - CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive     information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).
    - CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a     denial of service due to race conditions during an update of the local and shared status (bsc#1184167).
    - CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed     attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).
    - CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from     userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).
    - CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash     because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).
    - CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a     denial of service (bsc#1184193).
    - CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).
    - CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).
    - CVE-2021-28375: Fixed an issue in fastrpc_internal_invoke which did not prevent user applications from     sending kernel RPC messages (bsc#1183596).
    - CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors     such as failed memory allocations (bsc#1183022).
    - CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated     with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).
    - CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).
    - CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the     iscsi_transport structure (bsc#1182716).
    - CVE-2020-35519: Fixed an out-of-bounds memory access  was found in x25_bind (bsc#1183696).
    - CVE-2020-27815: Fixed an issue in JFS filesystem  where could have allowed an attacker to execute code     (bsc#1179454).
    - CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic,     leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from     kernel memory (bsc#1183775).
    - CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain     sensitive information from kernel memory (bsc#1183686).
    - CVE-2019-19769: Fixed a use-after-free in the perf_trace_lock_acquire function (bsc#1159280 ).
    - CVE-2019-18814: Fixed a use-after-free when aa_label_parse() fails in aa_audit_rule_init()     (bsc#1156256).
    - CVE-2021-3483: Fixed a use-after-free in nosy.c (bsc#1184393).
    - CVE-2021-30002: Fixed a memory leak for large arguments in video_usercopy (bsc#1184120).
    - CVE-2021-29154: Fixed incorrect computation of branch displacements, allowing arbitrary code execution     (bsc#1184391).
    - CVE-2021-28950: Fixed an issue in fs/fuse/fuse_i.h due to a retry loop continually was finding the same     bad inode (bsc#1184194).
    - CVE-2021-28952: Fixed a buffer overflow in the soundwire device driver, triggered when an unexpected     port ID number is encountered. (bnc#1184197).
    - CVE-2021-20268: Fixed an out-of-bounds access flaw in the implementation of the eBPF code verifier. This     flaw allowed a local user to crash the system or possibly escalate their privileges. (bnc#1183077)
    - CVE-2020-27673: Fixed a vulnerability with xen, where guest OS users could cause a denial of service     (host OS hang) via a high rate of events to dom0 (bnc#1177411).
    - CVE-2020-36312: Fixed a memory leak upon a kmalloc failure (bsc#1184509 ).
    - CVE-2020-36311: Fixed a denial of service (soft lockup) by triggering destruction of a large SEV VM     (bsc#1184511).
    - CVE-2020-36310: Fixed infinite loop for certain nested page faults (bsc#1184512).
    - CVE-2021-3489: Fixed an issue where the eBPF RINGBUF bpf_ringbuf_reserve did not check that the     allocated size was smaller than the ringbuf size (bnc#1185640).
    - CVE-2021-3490: Fixed an issue where the eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) did     not update the 32-bit bounds (bnc#1185641 bnc#1185796 ).
    - CVE-2020-36322: Fixed an issue was discovered in FUSE filesystem implementation which could have caused     a system crash (bsc#1184211).
    - CVE-2020-25670, CVE-2020-25671, CVE-2020-25672, CVE-2020-25673: Fixed multiple bugs in NFC subsytem     (bsc#1178181).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1977-1 advisory.

  - An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse()     fails in aa_audit_rule_init() in security/apparmor/audit.c. (CVE-2019-18814)

  - In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function     (related to include/trace/events/lock.h). (CVE-2019-19769)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free     which might lead to privilege escalations. (CVE-2020-25670)

  - A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-     free which might lead to privilege escalations. (CVE-2020-25671)

  - A memory leak vulnerability was found in Linux kernel in llcp_sock_connect (CVE-2020-25672)

  - A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak     and eventually hanging-up the system. (CVE-2020-25673)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-     of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects     pointer types that do not define a ptr_limit. (CVE-2020-27170)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error     (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to     side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory,     aka CID-10d2bb2e6b1d. (CVE-2020-27171)

  - An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
    (CVE-2020-27673)

  - A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the     ability to set extended attributes to panic the system, causing memory corruption or escalating     privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27815)

  - An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel     version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to     gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information.
    The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-35519)

  - An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a     set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52.
    (CVE-2020-36310)

  - An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a     denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering     many encrypted regions), aka CID-7be74942f184. (CVE-2020-36311)

  - An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a     kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d. (CVE-2020-36312)

  - An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka     CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system     crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as     CVE-2021-28950. (CVE-2020-36322)

  - An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in     the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local     user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system availability. (CVE-2021-20268)

  - Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to     elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local     user with the CAP_NET_RAW capability. (CVE-2021-23134)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the     netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of     changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior     of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.
    (CVE-2021-28038)

  - An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in     drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka     CID-20c40794eb85. This is a related issue to CVE-2019-2308. (CVE-2021-28375)

  - rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6     allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases,     CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may     have situations in which a drivers/staging issue is relevant to their own customer base. (CVE-2021-28660)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A stall on CPU can occur     because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1. (CVE-2021-28950)

  - An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device     driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This     has been fixed in 5.12-rc4.) (CVE-2021-28952)

  - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer     before a cloning operation, aka CID-dbcc7d57bffc. (CVE-2021-28964)

  - In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some     Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS     status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. (CVE-2021-28971)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer     arithmetic operations, the pointer modification performed by the first operation is not correctly     accounted for when restricting subsequent operations. (CVE-2021-29155)

  - An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in     the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment     size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is     enabled, aka CID-d8861bab48b6. (CVE-2021-29264)

  - An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in     drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up     sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
    (CVE-2021-29265)

  - An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows     attackers to obtain sensitive information from kernel memory because of a partially uninitialized data     structure, aka CID-50535249f624. (CVE-2021-29647)

  - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    (CVE-2021-29650)

  - An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
    (CVE-2021-30002)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

  - The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when     the source register was known to be 0. A local attacker with the ability to load bpf programs could use     this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and     possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in     the upstream kernel in commit 9b00f1b78809 (bpf: Fix truncation handling for mod32 dst reg wrt zero) and     in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101. (CVE-2021-3444)

  - A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice     into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest     threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions     before kernel 5.12-rc6 are affected (CVE-2021-3483)

  - The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size     was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel     and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee (bpf, ringbuf: Deny     reserve of buffers larger than ringbuf) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. It was introduced via 457f44363a88 (bpf: Implement BPF ring buffer and verifier     support for it) (v5.8-rc1). (CVE-2021-3489)

  - The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly     update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and     therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e (bpf: Fix alu32 const     subreg bound tracking on bitwise operations) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 (bpf: Verifier, do     explicit ALU32 bounds tracking) (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 (bpf:Fix a     verifier failure with xor) ( 5.10-rc1). (CVE-2021-3490)

  - The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the     PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem.
    This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was     addressed via commit d1f82808877b (io_uring: truncate lengths larger than MAX_RW_COUNT on provide     buffers) (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was     introduced in ddf0322db79c (io_uring: add IORING_OP_PROVIDE_BUFFERS) (v5.7-rc1). (CVE-2021-3491)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
151205	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2021:2208-1)	Nessus	SuSE Local Security Checks	2021/7/1	2026/6/25	high
151986	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2421-1)	Nessus	SuSE Local Security Checks	2021/7/22	2026/6/25	high
149407	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-4948-1)	Nessus	Ubuntu Local Security Checks	2021/5/12	2024/8/28	high
247842	Linux Distros Unpatched Vulnerability : CVE-2021-3491	Nessus	Misc.	2025/8/11	2026/7/17	high
150687	SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2021:1899-1)	Nessus	SuSE Local Security Checks	2021/6/10	2026/6/25	high
151280	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:0947-1)	Nessus	SuSE Local Security Checks	2021/7/2	2023/12/11	high
149411	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-4949-1)	Nessus	Ubuntu Local Security Checks	2021/5/12	2024/8/27	high
150901	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:1977-1)	Nessus	SuSE Local Security Checks	2021/6/21	2026/6/25	critical
151756	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:1977-1)	Nessus	SuSE Local Security Checks	2021/7/16	2023/1/17	critical

检测

插件搜索

high

high

high

high

high

high

high

critical

critical