The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3655-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    NOTE: This update was retracted due to a NFS regression.

    The following security bugs were fixed:

    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 (bnc#1192107).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-34866: Fixed eBPF Type Confusion Privilege Escalation Vulnerability (bsc#1191645).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3675-1 advisory.

    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-34866: Fixed eBPF Type Confusion Privilege Escalation Vulnerability (bsc#1191645).
    - CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called without checking for the     NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 (bnc#1192107).
    - CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in     drivers/isdn/capi/kcapi.c (bnc#1191958).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3723-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Real Time kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program     that could have obtain sensitive information from kernel memory (bsc#1188983).
    - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of     arbitrary kernel memory (bsc#1188985).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).
    - CVE-2021-37159: Fixed use-after-free and a double free in hso_free_net_device in drivers/net/usb/hso.c     when unregister_netdev is called without checking for the NETREG_REGISTERED state (bnc#1188601).
    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux     kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite     memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a     certain comparison uses values that are not memory sizes. (CVE-2021-42252)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3969-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have     happened in the past (jsc#SLE-22573)       You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
      (kernel.unprivileged_bpf_disabled = 0)

    - CVE-2018-3639: Fixed a speculative execution that may allow unauthorized disclosure of information to an     attacker with local user access via a side-channel analysis. (bsc#1087082)
    - CVE-2021-20320: Fix a bug that allows a local attacker with special user privilege can circumvent the     verifier and may lead to a confidentiality problem. (bsc#1190601)
    - CVE-2021-0941: Fixed A missing sanity check to the current MTU check that may allow a local attacker     with special user privilege to gain access to out-of-bounds memory leading to a system crash or a leak of     internal kernel information. (bnc#1192045)
    - CVE-2021-31916: Fixed a bound check failure that could allows an attacker with special user     (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of     internal kernel information, or a privilege escalation problem. (bnc#1192781)
    - CVE-2021-20322: Fixed a bug that provides to an attacker the ability to quickly scan open UDP ports.
    (bsc#1191790)
    - CVE-2021-3772: Fixed an issue that would allow a blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (bsc#1190351)
    - CVE-2021-34981: Fixed an issue that allows an attacker with a local account to escalate privileges when     CAPI (ISDN) hardware connection fails. (bsc#1191961)
    - CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect     (bsc#1108488).
    - CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace     applications (bnc#1129898).
    - CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx()     (bnc#1133374).
    - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
    - CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and     cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent     possibility of information disclosure. (bnc#1191193)
    - CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and     can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the     ability to start and control a VM to read/write random pages of memory and can result in local privilege     escalation (bsc#1186482).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program     that could have obtain sensitive information from kernel memory (bsc#1188983).
    - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of     arbitrary kernel memory (bsc#1188985).
    - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth     stack (bsc#1188172).
    - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable     AVIC support for the L2 guest. (bsc#1189399).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to     disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
    - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c     (bsc#1188876).
    - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses     trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use     this flaw to starve the resources causing denial of service (bnc#1189057).
    - CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in     drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state     (bnc#1188601).
    - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
    - CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
    - CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module.
    (bsc#1190023)
    - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
    - CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS     memory corruption via rtas_args.nargs (bsc#1188838).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
    - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a     buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
    - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow     page, leading to a missing guest protection page fault (bnc#1189262).
    - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial     of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations     (bnc#1189291).
    - CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local     priviledge escalation. (bnc#1190159)
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3640-1 advisory.

    The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 (bnc#1192107).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3655-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    NOTE: This update was retracted due to a NFS regression.

    The following security bugs were fixed:

    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 (bnc#1192107).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-34866: Fixed eBPF Type Confusion Privilege Escalation Vulnerability (bsc#1191645).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1477-1 advisory.

    The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an     unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by     a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose     group ownership is that group. The intended behavior was that the non-member can trigger creation of a     directory (but not a plain file) whose group ownership is that group. The non-member can escalate     privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).
    - CVE-2021-33033: The Linux kernel had a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c     because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd.
    This leads to writing an arbitrary value (bnc#1186109 bnc#1188876).
    - CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a     Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of     uninitialized memory locations on the BPF stack (bnc#1188983).
    - CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a     Speculative Store Bypass side-channel attack because a certain preempting store operation did not     necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).
    - CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read     uninitialized memory (bnc#1188563 bnc#1192267).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-3772: Invalid chunks may be used to remotely remove existing associations (bsc#1190351).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-41864: prealloc_elems_and_freelist in kernel/bpf/stackmap.c allowed unprivileged users to     trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: The decode_data function in drivers/net/hamradio/6pack.c had a slab out-of-bounds write.
    Input from a process that has the CAP_NET_ADMIN capability can lead to root access (bnc#1191315).
    - CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c     where local attackers were able to access the Aspeed LPC control interface could overwrite memory in the     kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison     uses values that are not memory sizes (bnc#1190479).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673     bnc#1192036).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-43056: It allowed a malicious KVM guest to crash the host, when the host is running on Power8,     due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register     values (bnc#1192107).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5162-1 advisory.

    Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform     size validations on incoming packets in some situations. An attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2021-3655)

    It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly     deallocate memory in some error conditions. A local attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

    It was discovered that the Aspeed Low Pin Count (LPC) Bus Controller implementation in the Linux kernel     did not properly perform boundary checks in some situations, allowing out-of-bounds write access. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. In     Ubuntu, this issue only affected systems running armhf kernels. (CVE-2021-42252)

    Jann Horn discovered that the SELinux subsystem in the Linux kernel did not properly handle subjective     credentials for tasks in some situations. On systems where SELinux has been enabled, a local attacker     could possibly use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2021-43057)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5161-1 advisory.

    Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform     size validations on incoming packets in some situations. An attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2021-3655)

    It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly     deallocate memory in some error conditions. A local attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

    It was discovered that the Aspeed Low Pin Count (LPC) Bus Controller implementation in the Linux kernel     did not properly perform boundary checks in some situations, allowing out-of-bounds write access. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. In     Ubuntu, this issue only affected systems running armhf kernels. (CVE-2021-42252)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3972-1 advisory.

    The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have     happened in the past (jsc#SLE-22573)

      You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
    (kernel.unprivileged_bpf_disabled = 0)


    The following security bugs were fixed:

    - CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use     after free. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation (bnc#1192045).
    - CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-     ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker     with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system     crash or a leak of internal kernel information. The highest threat from this vulnerability is to system     availability (bnc#1192781).
    - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks     about UDP ports in use. (bsc#1191790)
    - CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).
    - CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in     drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state     (bnc#1188601).
    - CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and     cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent     possibility of information disclosure. (bnc#1191193)
    - CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module.
    (bsc#1190023)
    - CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local     priviledge escalation. (bnc#1190159)
    - CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
    - CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
    - CVE-2021-3772: Fixed a remote denial of service in the SCTP stack, if the attacker can spoof IP     addresses and knows the IP-addresses and port numbers being used (bnc#1190351).
    - CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect     (bsc#1108488).
    - CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace     applications (bnc#1129898).
    - CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx()     (bnc#1133374).
    - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth     stack (bsc#1188172).
    - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable     AVIC support for the L2 guest. (bsc#1189399).
    - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to     disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
    - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses     trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use     this flaw to starve the resources causing denial of service (bnc#1189057).
    - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
    - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
    - CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS     attacks (bsc#1190115).
    - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a     buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
    - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow     page, leading to a missing guest protection page fault (bnc#1189262).
    - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial     of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations     (bnc#1189291).
    - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program     that could have obtain sensitive information from kernel memory (bsc#1188983).
    - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of     arbitrary kernel memory (bsc#1188985).
    - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
    - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c     (bsc#1188876).
    - CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and     can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the     ability to start and control a VM to read/write random pages of memory and can result in local privilege     escalation (bsc#1186482).
    - CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS     memory corruption via rtas_args.nargs (bsc#1188838).
    - CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory     corruption due to a use after free. This could lead to local escalation of privilege with System execution     privileges needed. (bsc#1176724).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155302	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3655-1)	Nessus	SuSE Local Security Checks	2021/11/12	2026/6/26	high
155467	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3675-1)	Nessus	SuSE Local Security Checks	2021/11/17	2026/6/26	high
155577	SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2021:3723-1)	Nessus	SuSE Local Security Checks	2021/11/18	2026/6/25	high
248040	Linux Distros Unpatched Vulnerability : CVE-2021-42252	Nessus	Misc.	2025/8/11	2026/7/17	high
155930	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3969-1)	Nessus	SuSE Local Security Checks	2021/12/8	2026/6/26	high
155007	SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2021:3640-1)	Nessus	SuSE Local Security Checks	2021/11/10	2026/6/25	high
155299	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:3655-1)	Nessus	SuSE Local Security Checks	2021/11/12	2025/12/30	high
155358	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:1477-1)	Nessus	SuSE Local Security Checks	2021/11/16	2025/12/30	high
155751	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5162-1)	Nessus	Ubuntu Local Security Checks	2021/12/1	2024/8/27	high
155752	Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5161-1)	Nessus	Ubuntu Local Security Checks	2021/12/1	2024/8/27	high
203838	Photon OS 3.0: Linux PHSA-2021-3.0-0316	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
155959	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3972-1)	Nessus	SuSE Local Security Checks	2021/12/9	2026/6/25	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high