The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16231)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2019-0154: An unprotected read access to i915     registers has been fixed that could have been abused to     facilitate a local denial-of-service attack.
    (bsc#1135966)

  - CVE-2019-0155: A privilege escalation vulnerability has     been fixed in the i915 module that allowed batch buffers     from user mode to gain super user privileges.
    (bsc#1135967)

  - CVE-2019-16231: drivers/net/fjes/fjes_main.c did not     check the alloc_workqueue return value, leading to a     NULL pointer dereference (bnc#1150466).

  - CVE-2019-18805: There was a net/ipv4/tcp_input.c signed     integer overflow in tcp_ack_update_rtt() when userspace     writes a very large integer to     /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial     of service or possibly unspecified other impact, aka     CID-19fad20d15a6 (bnc#1156187).

  - CVE-2019-17055: base_sock_create in     drivers/isdn/mISDN/socket.c in the AF_ISDN network     module did not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21 (bnc#1152782).

  - CVE-2019-11135: Aborting an asynchronous TSX operation     on Intel CPUs with Transactional Memory support could be     used to facilitate sidechannel information leaks out of     microarchitectural buffers, similar to the previously     described 'Microarchitectural Data Sampling' attack.

    The Linux kernel was supplemented with the option to     disable TSX operation altogether (requiring CPU     Microcode updates on older systems) and better flushing     of microarchitectural buffers (VERW).

    The set of options available is described in our TID at     https://www.suse.com/support/kb/doc/?id=7024251

  - CVE-2018-12207: Untrusted virtual machines on Intel CPUs     could exploit a race condition in the Instruction Fetch     Unit of the Intel CPU to cause a Machine Exception     during Page Size Change, causing the CPU core to be     non-functional.

    The Linux Kernel kvm hypervisor was adjusted to avoid     page size changes in executable pages by splitting /     merging huge pages into small pages as needed.

    More information can be found on     https://www.suse.com/support/kb/doc/?id=7023735

  - CVE-2019-10220: Added sanity checks on the pathnames     passed to the user space. (bsc#1144903).

The following non-security bugs were fixed :

  - ALSA: bebob: Fix prototype of helper function to return     negative value (bsc#1051510).

  - ALSA: bebob: fix to detect configured source of sampling     clock for Focusrite Saffire Pro i/o series (git-fixes).

  - ALSA: firewire-motu: add support for MOTU 4pre     (bsc#1111666).

  - ALSA: hda/ca0132 - Fix possible workqueue stall     (bsc#1155836).

  - ALSA: hda/realtek - Add support for ALC623     (bsc#1051510).

  - ALSA: hda/realtek - Fix 2 front mics of codec 0x623     (bsc#1051510).

  - ALSA: timer: Fix incorrectly assigned timer instance     (git-fixes).

  - ALSA: timer: Fix mutex deadlock at releasing card     (bsc#1051510).

  - ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB     Interface (bsc#1051510).

  - ALSA: usb-audio: Disable quirks for BOSS Katana     amplifiers (bsc#1111666).

  - ALSA: usb-audio: Fix copy&paste error in the validator     (bsc#1111666).

  - arm64: Add decoding macros for CP15_32 and CP15_64 traps     (jsc#ECO-561).

  - arm64: Add part number for Neoverse N1 (jsc#ECO-561).

  - arm64: Add silicon-errata.txt entry for ARM erratum     1188873 (jsc#ECO-561).

  - arm64: Add support for new control bits CTR_EL0.DIC and     CTR_EL0.IDC (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Apply ARM64_ERRATUM_1188873 to Neoverse-N1     (jsc#ECO-561).

  - arm64: arch_timer: Add workaround for ARM erratum     1188873 (jsc#ECO-561).

  - arm64: arch_timer: avoid unused function warning     (jsc#ECO-561).

  - arm64: compat: Add CNTFRQ trap handler (jsc#ECO-561).

  - arm64: compat: Add CNTVCT trap handler (jsc#ECO-561).

  - arm64: compat: Add condition code checks and IT advance     (jsc#ECO-561).

  - arm64: compat: Add cp15_32 and cp15_64 handler arrays     (jsc#ECO-561).

  - arm64: compat: Add separate CP15 trapping hook     (jsc#ECO-561).

  - arm64: compat: Workaround Neoverse-N1 #1542419 for     compat user-space (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpu_errata: Remove     ARM64_MISMATCHED_CACHE_LINE_SIZE     (jsc#ECO-561,jsc#SLE-10671).

  - arm64/cpufeature: Convert hook_lock to raw_spin_lock_t     in cpu_enable_ssbs() (jsc#ECO-561).

  - arm64: cpufeature: ctr: Fix cpu capability check for     late CPUs (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpufeature: Detect SSBS and advertise to     userspace (jsc#ECO-561).

  - arm64: cpufeature: Fix handling of CTR_EL0.IDC field     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpufeature: Trap CTR_EL0 access only where it is     necessary (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpu: Move errata and feature enable callbacks     closer to callers (jsc#ECO-561).

  - arm64: entry: Allow handling of undefined instructions     from EL1 (jsc#ECO-561).

  - arm64: errata: Hide CTR_EL0.DIC on systems affected by     Neoverse-N1 #1542419 (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Fake the IminLine size on systems affected by     Neoverse-N1 #1542419 (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Fix mismatched cache line size detection     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Fix silly typo in comment (jsc#ECO-561).

  - arm64: fix SSBS sanitization (jsc#ECO-561).

  - arm64: force_signal_inject: WARN if called from kernel     context (jsc#ECO-561).

  - arm64: Force SSBS on context switch (jsc#ECO-561).

  - arm64: Handle erratum 1418040 as a superset of erratum     1188873 (jsc#ECO-561).

  - arm64: Introduce sysreg_clear_set() (jsc#ECO-561).

  - arm64: kill change_cpacr() (jsc#ECO-561).

  - arm64: kill config_sctlr_el1() (jsc#ECO-561).

  - arm64: KVM: Add invalidate_icache_range helper     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: KVM: PTE/PMD S2 XN bit definition     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT     (jsc#ECO-561).

  - arm64: move SCTLR_EL(1,2) assertions to <asm/sysreg.h>     (jsc#ECO-561).

  - arm64: Restrict ARM64_ERRATUM_1188873 mitigation to     AArch32 (jsc#ECO-561).

  - arm64: ssbd: Add support for PSTATE.SSBS rather than     trapping to EL3 (jsc#ECO-561).

  - arm64: ssbd: Drop #ifdefs for PR_SPEC_STORE_BYPASS     (jsc#ECO-561).

  - arm: KVM: Add optimized PIPT icache flushing     (jsc#ECO-561,jsc#SLE-10671).

  - ath10k: assign 'n_cipher_suites = 11' for WCN3990 to     enable WPA3 (bsc#1111666).

  - brcmfmac: sdio: Disable auto-tuning around commands     expected to fail (bsc#1111666).

  - brcmfmac: sdio: Do not tune while the card is off     (bsc#1111666).

  - can: dev: call netif_carrier_off() in register_candev()     (bsc#1051510).

  - config: arm64: enable erratum 1418040 and 1542419

  - dmaengine: bcm2835: Print error in case setting DMA mask     fails (bsc#1051510).

  - dmaengine: imx-sdma: fix size check for sdma     script_number (bsc#1051510).

  - drm/amd/display: fix odm combine pipe reset     (bsc#1111666).

  - drm/amdgpu: fix memory leak (bsc#1111666).

  - drm/amdgpu/powerplay/vega10: allow undervolting in p7     (bsc#1111666).

  - drm/i915: Add gen9 BCS cmdparsing (bsc#1135967)

  - drm/i915: Add gen9 BCS cmdparsing (bsc#1135967)

  - drm/i915: Add support for mandatory cmdparsing     (bsc#1135967)

  - drm/i915: Add support for mandatory cmdparsing     (bsc#1135967)

  - drm/i915: Allow parsing of unsized batches (bsc#1135967)

  - drm/i915: Allow parsing of unsized batches (bsc#1135967)

  - drm/i915/cmdparser: Add support for backward jumps     (bsc#1135967)

  - drm/i915/cmdparser: Add support for backward jumps     (bsc#1135967)

  - drm/i915/cmdparser: Ignore Length operands during     (bsc#1135967)

  - drm/i915/cmdparser: Ignore Length operands during     command matching (bsc#1135967)

  - drm/i915/cmdparser: Use explicit goto for error paths     (bsc#1135967)

  - drm/i915/cmdparser: Use explicit goto for error paths     (bsc#1135967)

  - drm/i915/cml: Add second PCH ID for CMP (bsc#1111666).

  - drm/i915: Disable Secure Batches for gen6+

  - drm/i915: Disable Secure Batches for gen6+ (bsc#1135967)

  - drm/i915/gen8+: Add RC6 CTX corruption WA (bsc#1135967)

  - drm/i915/gen8+: Add RC6 CTX corruption WA (bsc#1135967)

  - drm/i915/gtt: Add read only pages to gen8_pte_encode     (bsc#1135967)

  - drm/i915/gtt: Disable read-only support under GVT     (bsc#1135967)

  - drm/i915/gtt: Read-only pages for insert_entries on bdw     (bsc#1135967)

  - drm/i915/ilk: Fix warning when reading emon_status with     no output (bsc#1111666).

  - drm/i915: Lower RM timeout to avoid DSI hard hangs     (bsc#1135967)

  - drm/i915: Lower RM timeout to avoid DSI hard hangs     (bsc#1135967)

  - drm/i915: Prevent writing into a read-only object via a     GGTT mmap (bsc#1135967)

  - drm/i915: Remove Master tables from cmdparser

  - drm/i915: Remove Master tables from cmdparser     (bsc#1135967)

  - drm/i915: Rename gen7 cmdparser tables (bsc#1135967)

  - drm/i915: Rename gen7 cmdparser tables (bsc#1135967)

  - drm/i915: Support ro ppgtt mapped cmdparser shadow     (bsc#1135967)

  - drm/i915: Support ro ppgtt mapped cmdparser shadow     buffers (bsc#1135967)

  - drm/msm/dpu: handle failures while initializing displays     (bsc#1111666).

  - hyperv: set nvme msi interrupts to unmanaged     (jsc#SLE-8953, jsc#SLE-9221, jsc#SLE-4941, bsc#1119461,     bsc#1119465, bsc#1138190, bsc#1154905).

  - IB/core: Add mitigation for Spectre V1 (bsc#1155671)

  - integrity: prevent deadlock during digsig verification     (bsc#1090631).

  - irqchip/gic-v3-its: Fix command queue pointer comparison     bug (jsc#ECO-561).

  - irqchip/gic-v3-its: Fix LPI release for Multi-MSI     devices (jsc#ECO-561).

  - irqchip/gic-v3-its: Fix misuse of GENMASK macro     (jsc#ECO-561).

  - iwlwifi: do not panic in error path on non-msix systems     (bsc#1155692).

  - iwlwifi: exclude GEO SAR support for 3168 (bsc#1111666).

  - iwlwifi: exclude GEO SAR support for 3168 (git-fixes).

  - iwlwifi: fw: do not send GEO_TX_POWER_LIMIT command to     FW version 36 (bsc#1111666).

  - kabi protect enum RDMA_DRIVER_EFA (jsc#SLE-4805)

  - kABI workaround for drm_vma_offset_node readonly field     addition (bsc#1135967)

  - kABI workaround for mmc_host retune_crc_disable flag     addition (bsc#1111666).

  - KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully     disabled and !vhe (jsc#ECO-561).

  - KVM: arm/arm64: Clean dcache to PoC when changing PTE     due to CoW (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Detangle kvm_mmu.h from kvm_hyp.h     (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Drop vcpu parameter from guest cache     maintenance operartions (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Limit icache invalidation to prefetch     aborts (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Only clean the dcache on translation     fault (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Preserve Exec permission across R/W     permission faults (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Split dcache/icache flushing     (jsc#ECO-561,jsc#SLE-10671).

  - KVM: vmx, svm: always run with EFER.NXE=1 when shadow     paging is active (bsc#1117665).

  - md/raid0: avoid RAID0 data corruption due to layout     confusion (bsc#1140090).

  - md/raid0: fix warning message for parameter     default_layout (bsc#1140090).

  - mmc: core: Add sdio_retune_hold_now() and     sdio_retune_release() (bsc#1111666).

  - mmc: core: API to temporarily disable retuning for SDIO     CRC errors (bsc#1111666).

  - Move upstreamed CA0132 fix into sorted section

  - net: openvswitch: free vport unless register_netdevice()     succeeds (git-fixes).

  - phylink: fix kernel-doc warnings (bsc#1111666).

  - power: supply: max14656: fix potential use-after-free     (bsc#1051510).

  - RDMA/efa: Add Amazon EFA driver (jsc#SLE-4805)

  - RDMA/hns: Add reset process for function-clear     (bsc#1155061).

  - RDMA/hns: Remove the some magic number (bsc#1155061).

  - RDMA/restrack: Track driver QP types in resource tracker     (jsc#SLE-4805)

  - Revert 'ALSA: hda: Flush interrupts on disabling'     (bsc#1051510).

  - Revert synaptics-rmi4 patch due to regression     (bsc#1155982) Also blacklisting it

  - rpm/kernel-subpackage-spec: Mention debuginfo in the     subpackage description (bsc#1149119).

  - s390: add support for IBM z15 machines (bsc#1152696     LTC#181731).

  - s390/cpumsf: Check for CPU Measurement sampling     (bsc#1153681 LTC#181855).

  - s390: fix setting of mio addressing control (bsc#1152665     LTC#181729).

  - s390/pci: add mio_enabled attribute (bsc#1152665     LTC#181729).

  - s390/pci: correctly handle MIO opt-out (bsc#1152665     LTC#181729).

  - s390/pci: deal with devices that have no support for MIO     instructions (bsc#1152665 LTC#181729).

  - s390/pci: fix MSI message data (bsc#1152697 LTC#181730).

  - sc16is7xx: Fix for 'Unexpected interrupt: 8'     (bsc#1051510).

  - sched/fair: Avoid divide by zero when rebalancing     domains (bsc#1096254).

  - scsi: lpfc: Limit xri count for kdump environment     (bsc#1154124).

  - scsi: qla2xxx: Add error handling for PLOGI ELS     passthrough (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Capture FW dump on MPI heartbeat stop     event (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Check for MB timeout while capturing     ISP27/28xx FW dump (bsc#1143706 bsc#1082635     bsc#1123034).

  - scsi: qla2xxx: Do command completion on abort timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: do not use zero for FC4_PRIORITY_NVME     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Dual FCP-NVMe target port support     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix a dma_pool_free() call (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix device connect issues in P2P     configuration (bsc#1143706 bsc#1082635 bsc#1154526     bsc#1048942).

  - scsi: qla2xxx: Fix double scsi_done for abort path     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix driver unload hang (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix memory leak when sending I/O fails     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix N2N link reset (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix N2N link up fail (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix partial flash write of MBI     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix SRB leak on switch command timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix stale mem access on driver unload     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix unbound sleep in fcport delete path     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: fixup incorrect usage of host_byte     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Improve logging for scan thread     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Initialized mailbox to prevent driver     load failure (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: initialize fc4_type_priority (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Optimize NPIV tear down process     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Remove an include directive (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: remove redundant assignment to pointer     host (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Set remove flag for all VP (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Silence fwdump template message     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: stop timer in shutdown path (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.20-k     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.21-k     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: sd: Ignore a failure to sync cache due to lack of     authorization (git-fixes).

  - scsi: storvsc: Add ability to change scsi queue depth     (bsc#1155021).

  - scsi: zfcp: fix reaction on bit error threshold     notification (bsc#1154956 LTC#182054).

  - serial: fix kernel-doc warning in comments     (bsc#1051510).

  - serial: mctrl_gpio: Check for NULL pointer     (bsc#1051510).

  - serial: uartlite: fix exit path NULL pointer     (bsc#1051510).

  - staging: rtl8188eu: fix null dereference when kzalloc     fails (bsc#1051510).

  - supporte.conf: add efivarfs to kernel-default-base     (bsc#1154858).

  - tracing: Get trace_array reference for available_tracers     files (bsc#1156429).

  - usb: gadget: Reject endpoints with 0 maxpacket value     (bsc#1051510).

  - usb: gadget: udc: atmel: Fix interrupt storm in FIFO     mode (bsc#1051510).

  - usb: handle warm-reset port requests on hub resume     (bsc#1051510).

  - usb: ldusb: fix control-message timeout (bsc#1051510).

  - usb: ldusb: fix ring-buffer locking (bsc#1051510).

  - usb: serial: whiteheat: fix line-speed endianness     (bsc#1051510).

  - usb: serial: whiteheat: fix potential slab corruption     (bsc#1051510).

  - usb-storage: Revert commit 747668dbc061 ('usb-storage:
    Set virt_boundary_mask to avoid SG overflows')     (bsc#1051510).

  - wil6210: fix freeing of rx buffers in EDMA mode     (bsc#1111666).

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4431 advisory.

    - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875316] {CVE-2020-14385}
    - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876224] {CVE-2020-14386}
    - [net] packet: make tp_drops atomic (Hangbin Liu) [1876224] {CVE-2020-14386}
    - [kernel] Move to dual-signing to split signing keys up better (Frantisek Hrbata) [1837434]     {CVE-2020-10713}
    - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859472] {CVE-2020-14331}
    - [fs] chardev: Avoid potential use-after-free in chrdev_open() (Vladis Dronov) [1866324] {CVE-2020-0305}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4062 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free in sound/core/timer.c (CVE-2019-19807)

    * kernel: out of bounds write in function i2c_smbus_xfer_emulated in drivers/i2c/i2c-core-smbus.c     (CVE-2017-18551)

    * kernel: race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c     leads to use-after-free (CVE-2018-20836)

    * kernel: out of bounds write in i2c driver leads to local escalation of privilege (CVE-2019-9454)

    * kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

    Space precludes documenting all of the security fixes in this advisory. See the descriptions of the     remaining security fixes in the related Knowledge Article:

    https://access.redhat.com/articles/5442481

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-19081: Fixed a memory leak in the nfp_flower_spawn_vnic_reprs() could have allowed attackers to cause a denial of service (bsc#1157045).

CVE-2019-19080: Fixed four memory leaks in the nfp_flower_spawn_phy_reprs() could have allowed attackers to cause a denial of service (bsc#1157044).

CVE-2019-19052: Fixed a memory leak in the gs_can_open() which could have led to denial of service (bsc#1157324).

CVE-2019-19067: Fixed multiple memory leaks in acp_hw_init (bsc#1157180).

CVE-2019-19060: Fixed a memory leak in the adis_update_scan_mode() which could have led to denial of service (bsc#1157178).

CVE-2019-19049: Fixed a memory leak in unittest_data_add (bsc#1157173).

CVE-2019-19075: Fixed a memory leak in the ca8210_probe() which could have led to denial of service by triggering ca8210_get_platform_data() failures (bsc#1157162).

CVE-2019-19058: Fixed a memory leak in the alloc_sgtable() which could have led to denial of service by triggering alloc_page() failures (bsc#1157145).

CVE-2019-19074: Fixed a memory leak in the ath9k_wmi_cmd() function which could have led to denial of service (bsc#1157143).

CVE-2019-19073: Fixed multiple memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c which could have led to denial of service by triggering wait_for_completion_timeout() failures (bsc#1157070).

CVE-2019-19083: Fixed multiple memory leaks in *clock_source_create() functions which could have led to denial of service (bsc#1157049).

CVE-2019-19082: Fixed multiple memory leaks in *create_resource_pool() which could have led to denial of service (bsc#1157046).

CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() which might have led denial of service (bsc#1149448).

CVE-2019-0154: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable denial of service via local access (bsc#1135966).

CVE-2019-0155: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135967).

CVE-2019-16231: Fixed a NULL pointer dereference due to lack of checking the alloc_workqueue return value (bsc#1150466).

CVE-2019-18805: Fixed an integer overflow in tcp_ack_update_rtt() leading to a denial of service or possibly unspecified other impact (bsc#1156187).

CVE-2019-17055: Enforced CAP_NET_RAW in the AF_ISDN network module to restrict unprivileged users to create a raw socket (bsc#1152782).

CVE-2019-16995: Fixed a memory leak in hsr_dev_finalize() which may have caused denial of service (bsc#1152685).

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903)

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's kvm hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15030, CVE-2019-15031: On the powerpc platform, a local user could read vector registers of other users' processes via an interrupt (bsc#1149713).

CVE-2019-18683: An issue was discovered in drivers/media/platform/vivid. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free (bnc#1155897).

CVE-2019-18809: A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559 (bnc#1156258).

CVE-2019-19078: A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2 (bnc#1157032).

CVE-2019-18660: The Linux kernel on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c (bnc#1157038).

CVE-2019-14895: A heap-based buffer overflow was discovered in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1157158).

CVE-2019-19065: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e (bnc#1157191).

CVE-2019-19057: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e (bnc#1157193).

CVE-2019-19056: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932 (bnc#1157197).

CVE-2019-19063: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113 (bnc#1157298).

CVE-2019-19046: A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c allow attackers to cause a denial of service (bsc#1157304).

CVE-2019-19068: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6 (bnc#1157307).

CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042 (bnc#1157333).

CVE-2019-19227: In the AppleTalk subsystem, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122 (bnc#1157678).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.19.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.0.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2019-0154: An unprotected read access to i915     registers has been fixed that could have been abused to     facilitate a local denial-of-service attack.
    (bsc#1135966)

  - CVE-2019-0155: A privilege escalation vulnerability has     been fixed in the i915 module that allowed batch buffers     from user mode to gain super user privileges.
    (bsc#1135967)

  - CVE-2019-16231: drivers/net/fjes/fjes_main.c did not     check the alloc_workqueue return value, leading to a     NULL pointer dereference (bnc#1150466).

  - CVE-2019-18805: There was a net/ipv4/tcp_input.c signed     integer overflow in tcp_ack_update_rtt() when userspace     writes a very large integer to     /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial     of service or possibly unspecified other impact, aka     CID-19fad20d15a6 (bnc#1156187).

  - CVE-2019-17055: base_sock_create in     drivers/isdn/mISDN/socket.c in the AF_ISDN network     module did not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21 (bnc#1152782).

  - CVE-2019-16995: A memory leak exits in     hsr_dev_finalize() in net/hsr/hsr_device.c, if     hsr_add_port fails to add a port, which may cause denial     of service, aka CID-6caabe7f197d (bnc#1152685).

  - CVE-2019-11135: Aborting an asynchronous TSX operation     on Intel CPUs with Transactional Memory support could be     used to facilitate sidechannel information leaks out of     microarchitectural buffers, similar to the previously     described 'Microarchitectural Data Sampling' attack.

    The Linux kernel was supplemented with the option to     disable TSX operation altogether (requiring CPU     Microcode updates on older systems) and better flushing     of microarchitectural buffers (VERW).

    The set of options available is described in our TID at     https://www.suse.com/support/kb/doc/?id=7024251

  - CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not     check the alloc_workqueue return value, leading to a     NULL pointer dereference (bnc#1150457).

  - CVE-2018-12207: Untrusted virtual machines on Intel CPUs     could exploit a race condition in the Instruction Fetch     Unit of the Intel CPU to cause a Machine Exception     during Page Size Change, causing the CPU core to be     non-functional.

    The Linux Kernel kvm hypervisor was adjusted to avoid     page size changes in executable pages by splitting /     merging huge pages into small pages as needed.

    More information can be found on     https://www.suse.com/support/kb/doc/?id=7023735

  - CVE-2019-10220: Added sanity checks on the pathnames     passed to the user space. (bsc#1144903).

The following non-security bugs were fixed :

  - ALSA: bebob: Fix prototype of helper function to return     negative value (bsc#1051510).

  - ALSA: bebob: fix to detect configured source of sampling     clock for Focusrite Saffire Pro i/o series (git-fixes).

  - ALSA: hda: Add Elkhart Lake PCI ID (bsc#1051510).

  - ALSA: hda: Add Tigerlake/Jasperlake PCI ID     (bsc#1051510).

  - ALSA: hda/ca0132 - Fix possible workqueue stall     (bsc#1155836).

  - ALSA: hda/realtek - Add support for ALC623     (bsc#1051510).

  - ALSA: hda/realtek - Add support for ALC711     (bsc#1051510).

  - ALSA: hda/realtek - Fix 2 front mics of codec 0x623     (bsc#1051510).

  - ALSA: timer: Fix incorrectly assigned timer instance     (git-fixes).

  - ALSA: timer: Fix mutex deadlock at releasing card     (bsc#1051510).

  - arcnet: provide a buffer big enough to actually receive     packets (networking-stable-19_09_30).

  - ASoc: rockchip: i2s: Fix RPM imbalance (bsc#1051510).

  - ASoC: rsnd: Reinitialize bit clock inversion flag for     every format setting (bsc#1051510).

  - bpf: fix use after free in prog symbol exposure     (bsc#1083647).

  - btrfs: block-group: Fix a memory leak due to missing     btrfs_put_block_group() (bsc#1155178).

  - btrfs: qgroup: Always free PREALLOC META reserve in     btrfs_delalloc_release_extents() (bsc#1155179).

  - btrfs: tracepoints: Fix bad entry members of qgroup     events (bsc#1155186).

  - btrfs: tracepoints: Fix wrong parameter order for qgroup     events (bsc#1155184).

  - can: dev: call netif_carrier_off() in register_candev()     (bsc#1051510).

  - crypto: af_alg - consolidation of duplicate code     (bsc#1154737).

  - crypto: af_alg - fix race accessing cipher request     (bsc#1154737).

  - crypto: af_alg - Fix race around ctx->rcvused by making     it atomic_t (bsc#1154737).

  - crypto: af_alg - Initialize sg_num_bytes in error code     path (bsc#1051510).

  - crypto: af_alg - remove locking in async callback     (bsc#1154737).

  - crypto: af_alg - update correct dst SGL entry     (bsc#1051510).

  - crypto: af_alg - wait for data at beginning of recvmsg     (bsc#1154737).

  - crypto: algif_aead - copy AAD from src to dst     (bsc#1154737).

  - crypto: algif_aead - fix reference counting of null     skcipher (bsc#1154737).

  - crypto: algif_aead - overhaul memory management     (bsc#1154737).

  - crypto: algif_aead - skip SGL entries with NULL page     (bsc#1154737).

  - crypto: algif - return error code when no data was     processed (bsc#1154737).

  - crypto: algif_skcipher - overhaul memory management     (bsc#1154737).

  - cxgb4:Fix out-of-bounds MSI-X info array access     (networking-stable-19_10_05).

  - dmaengine: bcm2835: Print error in case setting DMA mask     fails (bsc#1051510).

  - dmaengine: imx-sdma: fix size check for sdma     script_number (bsc#1051510).

  - drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50     (bsc#1051510).

  - drm/i915: Add gen9 BCS cmdparsing (bsc#1135967)

  - drm/i915: Add support for mandatory cmdparsing     (bsc#1135967)

  - drm/i915: Allow parsing of unsized batches (bsc#1135967)

  - drm/i915/cmdparser: Add support for backward jumps     (bsc#1135967)

  - drm/i915/cmdparser: Ignore Length operands during     command matching (bsc#1135967)

  - drm/i915/cmdparser: Use explicit goto for error paths     (bsc#1135967)

  - drm/i915: Disable Secure Batches for gen6+

  - drm/i915/gen8+: Add RC6 CTX corruption WA (bsc#1135967)

  - drm/i915/gtt: Add read only pages to gen8_pte_encode     (bsc#1135967)

  - drm/i915/gtt: Disable read-only support under GVT     (bsc#1135967)

  - drm/i915/gtt: Read-only pages for insert_entries on bdw     (bsc#1135967)

  - drm/i915: Lower RM timeout to avoid DSI hard hangs     (bsc#1135967)

  - drm/i915: Prevent writing into a read-only object via a     GGTT mmap (bsc#1135967)

  - drm/i915: Remove Master tables from cmdparser

  - drm/i915: Rename gen7 cmdparser tables (bsc#1135967)

  - drm/i915: Support ro ppgtt mapped cmdparser shadow     buffers (bsc#1135967)

  - efi: cper: print AER info of PCIe fatal error     (bsc#1051510).

  - efi/memattr: Do not bail on zero VA if it equals the     region's PA (bsc#1051510).

  - efivar/ssdt: Do not iterate over EFI vars if no SSDT     override was specified (bsc#1051510).

  - HID: fix error message in hid_open_report()     (bsc#1051510).

  - HID: logitech-hidpp: do all FF cleanup in     hidpp_ff_destroy() (bsc#1051510).

  - hso: fix NULL-deref on tty open (bsc#1051510).

  - hyperv: set nvme msi interrupts to unmanaged     (jsc#SLE-8953, jsc#SLE-9221, jsc#SLE-4941, bsc#1119461,     bsc#1119465, bsc#1138190, bsc#1154905).

  - IB/core: Add mitigation for Spectre V1 (bsc#1155671)

  - ieee802154: ca8210: prevent memory leak (bsc#1051510).

  - input: synaptics-rmi4 - avoid processing unknown IRQs     (bsc#1051510).

  - integrity: prevent deadlock during digsig verification     (bsc#1090631).

  - ipv6: drop incoming packets having a v4mapped source     address (networking-stable-19_10_05).

  - ipv6: Handle missing host route in __ipv6_ifa_notify     (networking-stable-19_10_05).

  - iwlwifi: do not panic in error path on non-msix systems     (bsc#1155692).

  - iwlwifi: exclude GEO SAR support for 3168 (git-fixes).

  - kABI workaround for crypto/af_alg changes (bsc#1154737).

  - kABI workaround for drm_vma_offset_node readonly field     addition (bsc#1135967)

  - ksm: cleanup stable_node chain collapse case     (bnc#1144338).

  - ksm: fix use after free with merge_across_nodes = 0     (bnc#1144338).

  - ksm: introduce ksm_max_page_sharing per page     deduplication limit (bnc#1144338).

  - ksm: optimize refile of stable_node_dup at the head of     the chain (bnc#1144338).

  - ksm: swap the two output parameters of chain/chain_prune     (bnc#1144338).

  - KVM: vmx, svm: always run with EFER.NXE=1 when shadow     paging is active (bsc#1117665).

  - mac80211: fix txq NULL pointer dereference     (bsc#1051510).

  - mac80211: Reject malformed SSID elements (bsc#1051510).

  - md/raid0: avoid RAID0 data corruption due to layout     confusion (bsc#1140090).

  - md/raid0: fix warning message for parameter     default_layout (bsc#1140090).

  - Move upstreamed CA0132 fix into sorted section

  - netfilter: nf_nat: do not bug when mapping already     exists (bsc#1146612).

  - net: openvswitch: free vport unless register_netdevice()     succeeds (git-fixes).

  - net/phy: fix DP83865 10 Mbps HDX loopback disable     function (networking-stable-19_09_30).

  - net: qlogic: Fix memory leak in ql_alloc_large_buffers     (networking-stable-19_10_05).

  - net: qrtr: Stop rx_worker before freeing node     (networking-stable-19_09_30).

  - net/rds: Fix error handling in rds_ib_add_one()     (networking-stable-19_10_05).

  - net/rds: fix warn in rds_message_alloc_sgs     (bsc#1154848).

  - net/rds: remove user triggered WARN_ON in rds_sendmsg     (bsc#1154848).

  - net: Replace NF_CT_ASSERT() with WARN_ON()     (bsc#1146612).

  - net/sched: act_sample: do not push mac header on ip6gre     ingress (networking-stable-19_09_30).

  - net_sched: add policy validation for action attributes     (networking-stable-19_09_30).

  - net_sched: fix backward compatibility for TCA_ACT_KIND     (git-fixes).

  - net: Unpublish sk from sk_reuseport_cb before call_rcu     (networking-stable-19_10_05).

  - NFSv4.1 - backchannel request should hold ref on xprt     (bsc#1152624).

  - nl80211: fix NULL pointer dereference (bsc#1051510).

  - openvswitch: change type of UPCALL_PID attribute to     NLA_UNSPEC (networking-stable-19_09_30).

  - power: supply: max14656: fix potential use-after-free     (bsc#1051510).

  - qmi_wwan: add support for Cinterion CLS8 devices     (networking-stable-19_10_05).

  - r8152: Set macpassthru in reset_resume callback     (bsc#1051510).

  - rds: Fix warning (bsc#1154848).

  - Revert 'ALSA: hda: Flush interrupts on disabling'     (bsc#1051510).

  - Revert 'drm/radeon: Fix EEH during kexec' (bsc#1051510).

  - Revert synaptics-rmi4 patch due to regression     (bsc#1155982) Also blacklisting it

  - rpm/kernel-subpackage-spec: Mention debuginfo in the     subpackage description (bsc#1149119).

  - s390/cmf: set_schib_wait add timeout (bsc#1153509,     bsc#1153476).

  - s390/cpumsf: Check for CPU Measurement sampling     (bsc#1153681 LTC#181855).

  - sc16is7xx: Fix for 'Unexpected interrupt: 8'     (bsc#1051510).

  - sch_cbq: validate TCA_CBQ_WRROPT to avoid crash     (networking-stable-19_10_05).

  - sch_dsmark: fix potential NULL deref in dsmark_init()     (networking-stable-19_10_05).

  - sched/fair: Avoid divide by zero when rebalancing     domains (bsc#1096254).

  - sch_netem: fix a divide by zero in tabledist()     (networking-stable-19_09_30).

  - scsi: lpfc: Fix devices that do not return after devloss     followed by rediscovery (bsc#1137040).

  - scsi: lpfc: Limit xri count for kdump environment     (bsc#1154124).

  - scsi: qla2xxx: Add error handling for PLOGI ELS     passthrough (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Capture FW dump on MPI heartbeat stop     event (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Check for MB timeout while capturing     ISP27/28xx FW dump (bsc#1143706 bsc#1082635     bsc#1123034).

  - scsi: qla2xxx: Do command completion on abort timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: do not use zero for FC4_PRIORITY_NVME     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Dual FCP-NVMe target port support     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix a dma_pool_free() call (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix device connect issues in P2P     configuration (bsc#1143706 bsc#1082635 bsc#1154526     bsc#1048942).

  - scsi: qla2xxx: Fix double scsi_done for abort path     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix driver unload hang (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix memory leak when sending I/O fails     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix N2N link reset (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix N2N link up fail (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix partial flash write of MBI     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix SRB leak on switch command timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix stale mem access on driver unload     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix unbound sleep in fcport delete path     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: fixup incorrect usage of host_byte     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix wait condition in loop (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Improve logging for scan thread     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Initialized mailbox to prevent driver     load failure (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: initialize fc4_type_priority (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Optimize NPIV tear down process     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Remove an include directive (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: remove redundant assignment to pointer     host (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Set remove flag for all VP (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Silence fwdump template message     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: stop timer in shutdown path (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.20-k     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.21-k     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: sd: Ignore a failure to sync cache due to lack of     authorization (git-fixes).

  - scsi: storvsc: Add ability to change scsi queue depth     (bsc#1155021).

  - scsi: zfcp: fix reaction on bit error threshold     notification (bsc#1154956 LTC#182054).

  - serial: fix kernel-doc warning in comments     (bsc#1051510).

  - serial: mctrl_gpio: Check for NULL pointer     (bsc#1051510).

  - serial: uartlite: fix exit path NULL pointer     (bsc#1051510).

  - skge: fix checksum byte order     (networking-stable-19_09_30).

  - staging: rtl8188eu: fix null dereference when kzalloc     fails (bsc#1051510).

  - staging: wlan-ng: fix exit return when sme->key_idx >=     NUM_WEPKEYS (bsc#1051510).

  - supporte.conf: add efivarfs to kernel-default-base     (bsc#1154858).

  - tipc: fix unlimited bundling of small messages     (networking-stable-19_10_05).

  - tracing: Get trace_array reference for available_tracers     files (bsc#1156429).

  - usb: gadget: Reject endpoints with 0 maxpacket value     (bsc#1051510).

  - usb: gadget: udc: atmel: Fix interrupt storm in FIFO     mode (bsc#1051510).

  - usb: handle warm-reset port requests on hub resume     (bsc#1051510).

  - usb: ldusb: fix control-message timeout (bsc#1051510).

  - usb: ldusb: fix memleak on disconnect (bsc#1051510).

  - usb: ldusb: fix NULL-derefs on driver unbind     (bsc#1051510).

  - usb: ldusb: fix read info leaks (bsc#1051510).

  - usb: ldusb: fix ring-buffer locking (bsc#1051510).

  - usb: legousbtower: fix a signedness bug in tower_probe()     (bsc#1051510).

  - usb: legousbtower: fix memleak on disconnect     (bsc#1051510).

  - usb: serial: ti_usb_3410_5052: fix port-close races     (bsc#1051510).

  - usb: serial: whiteheat: fix line-speed endianness     (bsc#1051510).

  - usb: serial: whiteheat: fix potential slab corruption     (bsc#1051510).

  - usb-storage: Revert commit 747668dbc061 ('usb-storage:
    Set virt_boundary_mask to avoid SG overflows')     (bsc#1051510).

  - usb: udc: lpc32xx: fix bad bit shift operation     (bsc#1051510).

  - usb: usblp: fix use-after-free on disconnect     (bsc#1051510).

  - vsock: Fix a lockdep warning in __vsock_release()     (networking-stable-19_10_05).

  - x86/boot/64: Make level2_kernel_pgt pages invalid     outside kernel area (bnc#1153969).

  - x86/boot/64: Round memory hole size up to next PMD page     (bnc#1153969).

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4609 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

    * kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

    * kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

    * kernel: memory leak in ccp_run_sha_cmd() (CVE-2019-18808)

    * kernel: Denial Of Service in the __ipmi_bmc_register()  (CVE-2019-19046)

    * kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

    * Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

    * kernel: use-after-free in ext4_put_super (CVE-2019-19447)

    * kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free     (CVE-2019-19524)

    * kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

    * kernel: use-after-free in serial_ir_init_module() (CVE-2019-19543)

    * kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry (CVE-2019-19767)

    * kernel: use-after-free in debugfs_remove (CVE-2019-19770)

    * kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

    * kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

    * kernel: out-of-bounds read in in vc_do_resize (CVE-2020-8647)

    * kernel: use-after-free in n_tty_receive_buf_common (CVE-2020-8648)

    * kernel: invalid read location in vgacon_invert_region (CVE-2020-8649)

    * kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

    * kernel: SELinux netlink permission check bypass (CVE-2020-10751)

    * kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

    * kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

    * kernel: out-of-bounds write in xdp_umem_reg (CVE-2020-12659)

    * kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

    * kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

    * kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

    * kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

    * kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information     disclosure (CVE-2019-9455)

    * kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

    * kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

    * kernel: memory leak in  af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c     (CVE-2019-18809)

    * kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() (CVE-2019-19056)

    * kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

    * kernel: Two memory leaks in the rtl_usb_probe() (CVE-2019-19063)

    * kernel: A memory leak in the rtl8xxxu_submit_int_urb() (CVE-2019-19068)

    * kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for     a DoS (CVE-2019-19072)

    * kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

    * kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

    * kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

    * kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

    * kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4431 advisory.

  - In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This     could lead to local information disclosure with System execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9455)

  - In the Android kernel in the video driver there is a use after free due to a race condition. This could     lead to local escalation of privilege with no additional execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9458)

  - An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). (CVE-2019-12614)

  - An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when     hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c. (CVE-2019-15917)

  - An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function     hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.
    (CVE-2019-15925)

  - drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16231)

  - drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16233)

  - A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.
    (CVE-2019-18808)

  - A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux     kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka     CID-2289adbfa559. (CVE-2019-18809)

  - ** DISPUTED ** A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by     triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of     this because an attacker cannot realistically control this failure at probe time. (CVE-2019-19046)

  - A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in     drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-     db8fd2cde932. (CVE-2019-19056)

  - A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_report_alg() failures, aka CID-ffdde5932042. (CVE-2019-19062)

  - Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the     Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka     CID-3f9361695113. (CVE-2019-19063)

  - A memory leak in the rtl8xxxu_submit_int_urb() function in     drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers     to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka     CID-a2cdd07488e6. (CVE-2019-19068)

  - A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
    (CVE-2019-19072)

  - In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a     slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when     a large old_size value is used in a memset call, aka CID-345c0dbf3a30. (CVE-2019-19319)

  - An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way     the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of service. (CVE-2019-19332)

  - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and     unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list     in fs/ext4/super.c. (CVE-2019-19447)

  - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. (CVE-2019-19524)

  - In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device     in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464. (CVE-2019-19533)

  - In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB     device in the USB character device driver layer, aka CID-303911cfc5b9. This affects     drivers/usb/core/file.c. (CVE-2019-19537)

  - In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in     drivers/media/rc/serial_ir.c. (CVE-2019-19543)

  - fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is     used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have     unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling     of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
    (CVE-2019-19602)

  - The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors     in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka     CID-4ea99936a163. (CVE-2019-19767)

  - ** DISPUTED ** In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove     function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously     created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel     developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of     debugfs within blktrace. (CVE-2019-19770)

  - In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. (CVE-2019-20054)

  - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode     table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. (CVE-2019-20636)

  - In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to     local escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744 (CVE-2020-0305)

  - In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in     audit_data_to_entry. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-150693166References: Upstream kernel (CVE-2020-0444)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c. (CVE-2020-8647)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common     function in drivers/tty/n_tty.c. (CVE-2020-8648)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region     function in drivers/video/console/vgacon.c. (CVE-2020-8649)

  - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an     attacker with a local account to crash a trivial program and exfiltrate private kernel data.
    (CVE-2020-10732)

  - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it     incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly     only validate the first netlink message in the skb and allow or deny the rest of the messages within the     skb with the granted permission without further processing. (CVE-2020-10751)

  - A stack information leak flaw was found in s390/s390x in the Linux kernel's memory manager functionality,     where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the     kernel data. (CVE-2020-10773)

  - A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl     subsystem when reading the /proc/sys/kernel/rh_features file. This flaw allows a local user to read     uninitialized values from the kernel memory. The highest threat from this vulnerability is to     confidentiality. (CVE-2020-10774)

  - In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family     field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
    (CVE-2020-10942)

  - ** DISPUTED ** An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c     has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing,     aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability     because the issue is a bug in parsing mount options which can only be specified by a privileged user, so     triggering the bug does not grant any powers not already held.. (CVE-2020-11565)

  - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB     driver) mishandles invalid descriptors, aka CID-a246b4d54770. (CVE-2020-11668)

  - An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the     Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can     corrupt memory of adjacent pages. (CVE-2020-12465)

  - An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10.
    Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767. (CVE-2020-12655)

  - An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-     of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.
    (CVE-2020-12659)

  - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka CID-83c6f2390040. (CVE-2020-12770)

  - A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
    Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a     do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in     a different security domain. Exploitation limitations include the amount of elapsed time before an integer     overflow occurs, and the lack of scenarios where signals to a parent process present a substantial     operational threat. (CVE-2020-12826)

  - A flaw was found in the Linux kernel's futex implementation. This flaw allows a local attacker to corrupt     system memory or escalate their privileges when creating a futex on a filesystem that is about to be     unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-14381)

  - A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-25641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4060 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in sound/core/timer.c (CVE-2019-19807)

    * kernel: out of bounds write in function i2c_smbus_xfer_emulated in drivers/i2c/i2c-core-smbus.c     (CVE-2017-18551)

    * kernel: race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c     leads to use-after-free (CVE-2018-20836)

    * kernel: out of bounds write in i2c driver leads to local escalation of privilege (CVE-2019-9454)

    * kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

    Space precludes documenting all of the security fixes in this advisory. See the descriptions of the     remaining security fixes in the related Knowledge Article:

    https://access.redhat.com/articles/5442421

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4904-1 advisory.

    Ben Harris discovered that the Linux kernel would strip extended privilege attributes of files when     performing a failed unprivileged system call. A local attacker could use this to cause a denial of     service. (CVE-2015-1350)

    Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PVR USB devices in the Linux     kernel did not properly handle some error conditions. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16644)

    It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real     PID value while inside a PID namespace. A local attacker could use this to expose sensitive information.
    (CVE-2017-5967)

    Wen Xu discovered that the xfs file system implementation in the Linux kernel did not properly validate     the number of extents in an inode. An attacker could use this to construct a malicious xfs image that,     when mounted, could cause a denial of service (system crash). (CVE-2018-13095)

    It was discovered that the Fujitsu ES network device driver for the Linux kernel did not properly check     for errors in some situations, leading to a NULL pointer dereference. A local attacker could use this to     cause a denial of service. (CVE-2019-16231)

    It was discovered that the Marvell 8xxx Libertas WLAN device driver in the Linux kernel did not properly     check for errors in certain situations, leading to a NULL pointer dereference. A local attacker could     possibly use this to cause a denial of service. (CVE-2019-16232)

    It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2019-19061)

    It was discovered that a race condition existed in the floppy device driver in the Linux kernel. An     attacker with access to the floppy device could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-20261)

    Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schnherr discovered that the Xen     paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in     some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host     domain crash). (CVE-2021-26930)

    Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain     error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a     denial of service (host domain crash). (CVE-2021-26931)

    Jan Beulich discovered that the Xen netback backend in the Linux kernel did not properly handle certain     error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a     denial of service (host domain crash). (CVE-2021-28038)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In the Linux kernel     before 5.2.9, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_pro.c driver, aka     CID-ead16e53c2f0.(CVE-2019-19536)In the Linux kernel     before 5.2.9, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_fd.c driver, aka     CID-30a8beeb3042.(CVE-2019-19535)vcs_write in     drivers/tty/vt/vc_screen.c in the Linux kernel through     5.3.13 does not prevent write access to vcsu devices,     aka CID-0c9acb1af77a.(CVE-2019-19252)In the AppleTalk     subsystem in the Linux kernel before 5.1, there is a     potential NULL pointer dereference because     register_snap_client may return NULL. This will lead to     denial of service in net/appletalk/aarp.c and     net/appletalk/ddp.c, as demonstrated by     unregister_snap_client, aka     CID-9804501fa122.(CVE-2019-19227)A memory leak in the     adis_update_scan_mode() function in     drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-ab612b1daf41.(CVE-2019-19060)In the Linux kernel     before 5.3.11, there is an info-leak bug that can be     caused by a malicious USB device in the     driverset/can/usb/peak_usb/pcan_usb_core.c driver, aka     CID-f7a1337f0d29.(CVE-2019-19534)In the Linux kernel     before 5.3.11, there is a use-after-free bug that can     be caused by a malicious USB device in the     driverset/can/usb/mcba_usb.c driver, aka     CID-4d6636498c41.(CVE-2019-19529)In the Linux kernel     before 5.3.9, there is a use-after-free bug that can be     caused by a malicious USB device in the     driversfc/pn533/usb.c driver, aka     CID-6af3aa57a098.(CVE-2019-19526)In the Linux kernel     before 5.3.6, there is a use-after-free bug that can be     caused by a malicious USB device in the     driverset/ieee802154/atusb.c driver, aka     CID-7fd25e6fc035.(CVE-2019-19525)In the Linux kernel     before 5.3.9, there are multiple out-of-bounds write     bugs that can be caused by a malicious USB device in     the Linux kernel HID drivers, aka CID-d9d4b1e46d95.
    This affects drivers/hid/hid-axff.c,     drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c,     drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c,     drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c,     drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c,     drivers/hid/hid-tmff.c, and     drivers/hid/hid-zpff.c.(CVE-2019-19532)In the Linux     kernel before 5.2.10, there is a use-after-free bug     that can be caused by a malicious USB device in the     drivers/hid/usbhid/hiddev.c driver, aka     CID-9c09b214f30e.(CVE-2019-19527)** DISPUTED ** The     Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is     enabled and ia32_aout is loaded, allows local users to     bypass ASLR on setuid a.out programs (if any exist)     because install_exec_creds() is called too late in     load_aout_binary() in fs/binfmt_aout.c, and thus the     ptrace_may_access() check has a race condition when     reading /proc/pid/stat. NOTE: the software maintainer     disputes that this is a vulnerability because ASLR for     a.out format executables has never been     supported.(CVE-2019-11191)In the Linux kernel before     5.3.12, there is a use-after-free bug that can be     caused by a malicious USB device in the     drivers/input/ff-memless.c driver, aka     CID-fa3a5a1880c9.(CVE-2019-19524)driverset/wireless/mar     vell/libertas/if_sdio.c in the Linux kernel 5.2.14 does     not check the alloc_workqueue return value, leading to     a NULL pointer     dereference.(CVE-2019-16232)driverset/fjes/fjes_main.c     in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer     dereference.(CVE-2019-16231)** DISPUTED **     drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux     kernel 5.2.14 does not check the alloc_workqueue return     value, leading to a NULL pointer dereference. NOTE: The     security community disputes this issues as not being     serious enough to be deserving a CVE     id.(CVE-2019-16229)Linux kernel CIFS implementation,     version 4.9.0 is vulnerable to a relative paths     injection in directory entry lists.(CVE-2019-10220)A     heap overflow flaw was found in the Linux kernel, all     versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi     chip driver. The vulnerability allows a remote attacker     to cause a system crash, resulting in a denial of     service, or execute arbitrary code. The highest threat     with this vulnerability is with the availability of the     system. If code execution occurs, the code will run     with the permissions of root. This will affect both     confidentiality and integrity of files on the     system.(CVE-2019-14901)The Linux kernel before 5.4.2     mishandles ext4_expand_extra_isize, as demonstrated by     use-after-free errors in __ext4_expand_extra_isize and     ext4_xattr_set_entry, related to fs/ext4/inode.c and     fs/ext4/super.c, aka CID-4ea99936a163.(CVE-2019-19767)A     heap-based buffer overflow was discovered in the Linux     kernel, all versions 3.x.x and 4.x.x before 4.18.0, in     Marvell WiFi chip driver. The flaw could occur when the     station attempts a connection negotiation during the     handling of the remote devices country settings. This     could allow the remote device to cause a denial of     service (system crash) or possibly execute arbitrary     code.(CVE-2019-14895)Linux Kernel could allow a local     authenticated attacker to obtain sensitive information,     caused by a Transaction Asynchronous Abort (TAA) h/w     issue in KVM. By sending a specially-crafted request,     an attacker could exploit this vulnerability to obtain     sensitive information, and use this information to     launch further attacks against the affected     system.(CVE-2019-19338)TSX Asynchronous Abort condition     on some CPUs utilizing speculative execution may allow     an authenticated user to potentially enable information     disclosure via a side channel with local     access.(CVE-2019-11135)An out-of-bounds memory write     issue was found in the Linux Kernel, version 3.13     through 5.4, in the way the Linux kernel's KVM     hypervisor handled the 'KVM_GET_EMULATED_CPUID'     ioctl(2) request to get CPUID features emulated by the     KVM hypervisor. A user or process able to access the     '/dev/kvm' device could use this flaw to crash the     system, resulting in a denial of     service.(CVE-2019-19332)kernel/sched/fair.c in the     Linux kernel before 5.3.9, when cpu.cfs_quota_us is     used (e.g., with Kubernetes), allows attackers to cause     a denial of service against non-cpu-bound applications     by generating a workload that triggers unwanted slice     expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen     with benign workloads, it is possible that an attacker     could calculate how many stray requests are required to     force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and     ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of     the kernel it only causes mismanagement of application     execution.)(CVE-2019-19922)A stack-based buffer     overflow was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. An attacker     is able to cause a denial of service (system crash) or,     possibly execute arbitrary code, when a STA works in     IBSS mode (allows connecting stations together without     the use of an AP) and connects to another     STA.(CVE-2019-14897)A heap-based buffer overflow     vulnerability was found in the Linux kernel, version     kernel-2.6.32, in Marvell WiFi chip driver. A remote     attacker could cause a denial of service (system crash)     or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)In the Linux kernel     through 5.4.6, there are information leaks of     uninitialized memory to a USB device in the     driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,     aka CID-da2311a6385c.(CVE-2019-19947)In the Linux     kernel before 5.1, there is a memory leak in
    __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)mwifiex_tm_cmd in     driverset/wireless/marvell/mwifiex/cfg80211.c in the     Linux kernel before 5.1.6 has some error-handling cases     that did not free allocated hostcmd memory, aka     CID-003b686ace82. This will cause a memory leak and     denial of service.(CVE-2019-20095)An exploitable     denial-of-service vulnerability exists in the Linux     kernel prior to mainline 5.3. An attacker could exploit     this vulnerability by triggering AP to send IAPP     location updates for stations before the required     authentication process has completed. This could lead     to different denial-of-service scenarios, either by     causing CAM table attacks, or by leading to traffic     flapping if faking already existing clients in other     nearby APs of the same wireless infrastructure. An     attacker can forge Authentication and Association     Request packets to trigger this     vulnerability.(CVE-2019-5108)In a Linux KVM guest that     has PV TLB enabled, a process in the guest kernel may     be able to read memory locations from another process     in the same guest. This problem is limit to the host     running linux kernel 4.10 with a guest running linux     kernel 4.16 or later. The problem mainly affects AMD     processors but Intel CPUs cannot be ruled     out.(CVE-2019-3016)fsamei.c in the Linux kernel before     5.5 has a may_create_in_sticky use-after-free, which     allows local users to cause a denial of service (OOPS)     or possibly obtain sensitive information from kernel     memory, aka CID-d0cb50185ae9. One attack vector may be     an open system call for a UNIX domain socket, if the     socket is being moved to a new parent directory and its     old parent directory is being     removed.(CVE-2020-8428)There is a use-after-free     vulnerability in the Linux kernel through 5.5.2 in the     n_tty_receive_buf_common function in     drivers/tty_tty.c.(CVE-2020-8648)An issue was     discovered in the Linux kernel through 5.5.6. set_fdc     in drivers/block/floppy.c leads to a wait_til_ready     out-of-bounds read because the FDC index is not checked     for errors before assigning it, aka     CID-2e90ca68b0d2.(CVE-2020-9383)There is a     use-after-free vulnerability in the Linux kernel     through 5.5.2 in the vgacon_invert_region function in     drivers/video/console/vgacon.c.(CVE-2020-8649)There is     a use-after-free vulnerability in the Linux kernel     through 5.5.2 in the vc_do_resize function in     drivers/tty/vt/vt.c.(CVE-2020-8647)In the Linux kernel     5.0.21, mounting a crafted ext4 filesystem image,     performing some operations, and unmounting can lead to     a use-after-free in ext4_put_super in fs/ext4/super.c,     related to dump_orphan_list in     fs/ext4/super.c.(CVE-2019-19447)A flaw was discovered     in the way that the KVM hypervisor handled instruction     emulation for an L2 guest when nested virtualisation is     enabled. Under some circumstances, an L2 guest may     trick the L0 guest into accessing sensitive L1     resources that should be inaccessible to the L2     guest.(CVE-2020-2732)In the Linux kernel before 5.3.11,     sound/core/timer.c has a use-after-free caused by     erroneous code refactoring, aka CID-e7af6307a8a5. This     is related to snd_timer_open and     snd_timer_close_locked. The timeri variable was     originally intended to be for a newly created timer     instance, but was used for a different purpose after     refactoring.(CVE-2019-19807)In the Linux kernel     5.4.0-rc2, there is a use-after-free (read) in the
    __blk_add_trace function in kernel/trace/blktrace.c     (which is used to fill out a blk_io_trace structure and     place it in a per-cpu sub-buffer).(CVE-2019-19768)In     the Linux kernel 5.0.21, mounting a crafted f2fs     filesystem image can cause a NULL pointer dereference     in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This     is related to F2FS_P_SB in     fs/f2fs/f2fs.h.(CVE-2019-19815)** DISPUTED **
    __btrfs_free_extent in fs/btrfs/extent-tree.c in the     Linux kernel through 5.3.12 calls btrfs_print_leaf in a     certain ENOENT case, which allows local users to obtain     potentially sensitive information about register values     via the dmesg program. NOTE: The BTRFS development team     disputes this issues as not being a vulnerability     because '1) The kernel provide facilities to restrict     access to dmesg - dmesg_restrict=1 sysctl option. So     it's really up to the system administrator to judge     whether dmesg access shall be disallowed or not. 2)     WARN/WARN_ON are widely used macros in the linux     kernel. If this CVE is considered valid this would mean     there are literally thousands CVE lurking in the kernel
    - something which clearly is not the     case.'(CVE-2019-19039)ext4_empty_dir in fs/ext4amei.c     in the Linux kernel through 5.3.12 allows a NULL     pointer dereference because     ext4_read_dirblock(inode,0,DIRENT_HTREE) can be     zero.(CVE-2019-19037)btrfs_root_node in     fs/btrfs/ctree.c in the Linux kernel through 5.3.12     allows a NULL pointer dereference because     rcu_dereference(root->node) can be     zero.(CVE-2019-19036)In the Linux kernel 4.19.83, there     is a use-after-free (read) in the debugfs_remove     function in fs/debugfs/inode.c (which is used to remove     a file or directory in debugfs that was previously     created with a call to another debugfs function such as     debugfs_create_file).(CVE-2019-19770)An issue was     discovered in slc_bump in driverset/can/slcan.c in the     Linux kernel through 5.6.2. It allows attackers to read     uninitialized can_frame data, potentially containing     sensitive information from kernel stack memory, if the     configuration lacks CONFIG_INIT_STACK_ALL, aka     CID-b9258a2cece4.(CVE-2020-11494)An issue was     discovered in the Linux kernel through 5.6.2.
    mpol_parse_str in mm/mempolicy.c has a stack-based     out-of-bounds write because an empty nodelist is     mishandled during mount option parsing, aka     CID-aa9f7d5172fa.(CVE-2020-11565)A flaw was found in     the Linux kernel's implementation of some networking     protocols in IPsec, such as VXLAN and GENEVE tunnels     over IPv6. When an encrypted tunnel is created between     two hosts, the kernel isn't correctly routing tunneled     data over the encrypted link rather sending the data     unencrypted. This would allow anyone in between the two     endpoints to read the traffic unencrypted. The main     threat from this vulnerability is to data     confidentiality.(CVE-2020-1749)An issue was discovered     in the stv06xx subsystem in the Linux kernel before     5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and     drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c     mishandle invalid descriptors, as demonstrated by a     NULL pointer dereference, aka     CID-485b06aadb93.(CVE-2020-11609)An issue was     discovered in the Linux kernel before 5.6.1.
    drivers/media/usb/gspca/ov519.c allows NULL pointer     dereferences in ov511_mode_init_regs and     ov518_mode_init_regs when there are zero endpoints, aka     CID-998912346c0d.(CVE-2020-11608)In the Linux kernel     before 5.4.12, drivers/input/input.c has out-of-bounds     writes via a crafted keycode table, as demonstrated by     input_set_keycode, aka     CID-cb222aed03d7.(CVE-2019-20636)In the Linux kernel     before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c     (aka the Xirlink camera USB driver) mishandles invalid     descriptors, aka CID-a246b4d54770.(CVE-2020-11668)An     issue was discovered in the Linux kernel through 5.6.2.
    mpol_parse_str in mm/mempolicy.c has a stack-based     out-of-bounds write because an empty nodelist is     mishandled during mount option parsing, aka     CID-aa9f7d5172fa.(CVE-2020-0067)An issue was discovered     in the Linux kernel before 5.2 on the powerpc platform.
    arch/powerpc/kernel/idle_book3s.S does not have     save/restore functionality for PNV_POWERSAVE_AMR,     PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka     CID-53a712bae5dd.(CVE-2020-11669)A flaw was found in     the Linux kernelaEUR?s implementation of GRO. This flaw     allows an attacker with local access to crash the     system.(CVE-2020-10720)A flaw was found in the Linux     kernel's implementation of the invert video code on VGA     consoles when a local attacker attempts to resize the     console, calling an ioctl VT_RESIZE, which causes an     out-of-bounds write to occur. This flaw allows a local     user with access to the VGA console to crash the     system, potentially escalating their privileges on the     system. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system     availability.(CVE-2020-14331)An out-of-bounds (OOB)     memory access flaw was found in ttm_put_pages in     drivers/gpu/drm/ttm/ttm_page_alloc.c in the Linux     kernel's graphics module. Incrementing the page pointer     for huge pages was not in sync with the reference     counter, and this could lead to an out-of-bounds access     or a denial of service. This flaw allows a local     attacker with special user privileges (or root) to     cause memory exploitation.(CVE-2019-19927)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
222461	Linux Distros Unpatched Vulnerability : CVE-2019-16231	Nessus	Misc.	2025/3/4	2026/4/28	medium
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	2022/9/1	2025/7/22	critical
131061	openSUSE Security Update : the Linux Kernel (openSUSE-2019-2507)	Nessus	SuSE Local Security Checks	2019/11/15	2024/4/11	critical
180891	Oracle Linux 8 : kernel (ELSA-2020-4431)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/2/9	high
141026	RHEL 7 : kernel-rt (RHSA-2020:4062)	Nessus	Red Hat Local Security Checks	2020/9/29	2024/11/7	high
131833	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3200-1)	Nessus	SuSE Local Security Checks	2019/12/9	2024/4/5	critical
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
131057	openSUSE Security Update : the Linux Kernel (openSUSE-2019-2503)	Nessus	SuSE Local Security Checks	2019/11/15	2024/4/11	critical
142382	RHEL 8 : kernel-rt (RHSA-2020:4609)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	high
157698	AlmaLinux 8 : kernel (ALSA-2020:4431)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	high
141057	RHEL 7 : kernel (RHSA-2020:4060)	Nessus	Red Hat Local Security Checks	2020/9/30	2024/11/7	high
148498	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4904-1)	Nessus	Ubuntu Local Security Checks	2021/4/14	2024/8/27	high
136239	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2020-1536)	Nessus	Huawei Local Security Checks	2020/5/1	2024/3/13	critical
135525	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2020-1396)	Nessus	Huawei Local Security Checks	2020/4/15	2023/4/25	critical

检测

插件搜索

medium

critical

critical

high

high

critical

critical

critical

critical

high

high

high

high

critical

critical