According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through     5.2.13. nbd_genl_status in drivers/block/nbd.c does not     check the nla_nest_start_noflag return     value.(CVE-2019-16089)

  - A vulnerability was found in Linux Kernel where     refcount leak in llcp_sock_bind() causing     use-after-free which might lead to privilege     escalations.(CVE-2020-25670)

  - A vulnerability was found in Linux Kernel, where a     refcount leak in llcp_sock_connect() causing     use-after-free which might lead to privilege     escalations.(CVE-2020-25671)

  - A memory leak vulnerability was found in Linux kernel     in llcp_sock_connect(CVE-2020-25672)

  - An out-of-bounds (OOB) memory write flaw was found in     list_devices in drivers/md/dm-ioctl.c in the     Multi-device driver module in the Linux kernel before     5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access     to out-of-bounds memory leading to a system crash or a     leak of internal kernel information. The highest threat     from this vulnerability is to system     availability.(CVE-2021-31916)

  - An issue was discovered in fs/fuse/fuse_i.h in the     Linux kernel before 5.11.8. A 'stall on CPU' can occur     because a retry loop continually finds the same bad     inode, aka CID-775c5033a0d1.(CVE-2021-28950)

  - Use After Free vulnerability in nfc sockets in the     Linux Kernel before 5.12.4 allows local attackers to     elevate their privileges. In typical configurations,     the issue can only be triggered by a privileged local     user with the CAP_NET_RAW capability.(CVE-2021-23134)

  - An issue was discovered in the Linux kernel through     5.11.x. kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic,     leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from     kernel memory. Specifically, for sequences of pointer     arithmetic operations, the pointer modification     performed by the first operation is not correctly     accounted for when restricting subsequent     operations.(CVE-2021-29155)

  - The bpf verifier in the Linux kernel did not properly     handle mod32 destination register truncation when the     source register was known to be 0. A local attacker     with the ability to load bpf programs could use this     gain out-of-bounds reads in kernel memory leading to     information disclosure (kernel memory), and possibly     out-of-bounds writes that could potentially lead to     code execution. This issue was addressed in the     upstream kernel in commit 9b00f1b78809 ('bpf: Fix     truncation handling for mod32 dst reg wrt zero') and in     Linux stable kernels 5.11.2, 5.10.19, and     5.4.101.(CVE-2021-3444)

  - The Linux kernel before 5.11.14 has a use-after-free in     cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the     CIPSO and CALIPSO refcounting for the DOI definitions     is mishandled, aka CID-ad5d07f4a9cd. This leads to     writing an arbitrary value.(CVE-2021-33033)

  - kernel/bpf/verifier.c in the Linux kernel through     5.12.1 performs undesirable speculative loads, leading     to disclosure of stack content via side-channel     attacks, aka CID-801c6058d14a. The specific concern is     not protecting the BPF stack area against speculative     loads. Also, the BPF stack can contain uninitialized     data that might represent sensitive information     previously operated on by the kernel.(CVE-2021-31829)

  - net/bluetooth/hci_request.c in the Linux kernel through     5.12.2 has a race condition for removal of the HCI     controller.(CVE-2021-32399)

  - In the Linux kernel before 5.12.4,     net/bluetooth/hci_event.c has a use-after-free when     destroying an hci_chan, aka CID-5c4c8c954409. This     leads to writing an arbitrary value.(CVE-2021-33034)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1975-1 advisory.

  - An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse()     fails in aa_audit_rule_init() in security/apparmor/audit.c. (CVE-2019-18814)

  - In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function     (related to include/trace/events/lock.h). (CVE-2019-19769)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free     which might lead to privilege escalations. (CVE-2020-25670)

  - A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-     free which might lead to privilege escalations. (CVE-2020-25671)

  - A memory leak vulnerability was found in Linux kernel in llcp_sock_connect (CVE-2020-25672)

  - A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak     and eventually hanging-up the system. (CVE-2020-25673)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-     of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects     pointer types that do not define a ptr_limit. (CVE-2020-27170)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error     (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to     side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory,     aka CID-10d2bb2e6b1d. (CVE-2020-27171)

  - An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users     can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
    (CVE-2020-27673)

  - A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the     ability to set extended attributes to panic the system, causing memory corruption or escalating     privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27815)

  - An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel     version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to     gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information.
    The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-35519)

  - An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a     set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52.
    (CVE-2020-36310)

  - An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a     denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering     many encrypted regions), aka CID-7be74942f184. (CVE-2020-36311)

  - An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a     kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d. (CVE-2020-36312)

  - An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka     CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system     crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as     CVE-2021-28950. (CVE-2020-36322)

  - An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in     the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local     user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system availability. (CVE-2021-20268)

  - Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to     elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local     user with the CAP_NET_RAW capability. (CVE-2021-23134)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the     netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of     changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior     of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.
    (CVE-2021-28038)

  - An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in     drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka     CID-20c40794eb85. This is a related issue to CVE-2019-2308. (CVE-2021-28375)

  - rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6     allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases,     CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may     have situations in which a drivers/staging issue is relevant to their own customer base. (CVE-2021-28660)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A stall on CPU can occur     because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1. (CVE-2021-28950)

  - An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device     driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This     has been fixed in 5.12-rc4.) (CVE-2021-28952)

  - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer     before a cloning operation, aka CID-dbcc7d57bffc. (CVE-2021-28964)

  - In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some     Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS     status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. (CVE-2021-28971)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer     arithmetic operations, the pointer modification performed by the first operation is not correctly     accounted for when restricting subsequent operations. (CVE-2021-29155)

  - An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in     the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment     size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is     enabled, aka CID-d8861bab48b6. (CVE-2021-29264)

  - An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in     drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up     sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
    (CVE-2021-29265)

  - An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows     attackers to obtain sensitive information from kernel memory because of a partially uninitialized data     structure, aka CID-50535249f624. (CVE-2021-29647)

  - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    (CVE-2021-29650)

  - An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
    (CVE-2021-30002)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

  - The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when     the source register was known to be 0. A local attacker with the ability to load bpf programs could use     this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and     possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in     the upstream kernel in commit 9b00f1b78809 (bpf: Fix truncation handling for mod32 dst reg wrt zero) and     in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101. (CVE-2021-3444)

  - A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice     into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest     threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions     before kernel 5.12-rc6 are affected (CVE-2021-3483)

  - The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size     was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel     and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee (bpf, ringbuf: Deny     reserve of buffers larger than ringbuf) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. It was introduced via 457f44363a88 (bpf: Implement BPF ring buffer and verifier     support for it) (v5.8-rc1). (CVE-2021-3489)

  - The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly     update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and     therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e (bpf: Fix alu32 const     subreg bound tracking on bitwise operations) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 (bpf: Verifier, do     explicit ALU32 bounds tracking) (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 (bpf:Fix a     verifier failure with xor) ( 5.10-rc1). (CVE-2021-3490)

  - The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the     PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem.
    This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was     addressed via commit d1f82808877b (io_uring: truncate lengths larger than MAX_RW_COUNT on provide     buffers) (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was     introduced in ddf0322db79c (io_uring: add IORING_OP_PROVIDE_BUFFERS) (v5.7-rc1). (CVE-2021-3491)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4356 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):
    * kernel: out-of-bounds reads in pinctrl subsystem (CVE-2020-0427)
    * kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24502)
    * kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24503)
    * kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers     (CVE-2020-24504)
    * kernel: Fragmentation cache not cleared on reconnection (CVE-2020-24586)
    * kernel: Reassembling fragments encrypted under different keys (CVE-2020-24587)
    * kernel: wifi frame payload being parsed incorrectly as an L2 frame (CVE-2020-24588)
    * kernel: Forwarding EAPOL from unauthenticated wifi client (CVE-2020-26139)
    * kernel: accepting plaintext data frames in protected networks (CVE-2020-26140)
    * kernel: not verifying TKIP MIC of fragmented frames (CVE-2020-26141)
    * kernel: accepting fragmented plaintext frames in protected networks (CVE-2020-26143)
    * kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header (CVE-2020-26144)
    * kernel: accepting plaintext broadcast fragments as full frames (CVE-2020-26145)
    * kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777)
    * kernel: locking inconsistency in tty_io.c and tty_jobctrl.c can lead to a read-after-free     (CVE-2020-29660)
    * kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function via a long SSID value     (CVE-2020-36158)
    * kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt()  (CVE-2020-36386)
    * kernel: Improper access control in BlueZ may allow information disclosure vulnerability. (CVE-2021-0129)
    * kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c (CVE-2021-3348)
    * kernel: Linux kernel eBPF RINGBUF map oversized allocation (CVE-2021-3489)
    * kernel: double free in bluetooth subsystem when the HCI device initialization fails (CVE-2021-3564)
    * kernel: use-after-free in function hci_sock_bound_ioctl() (CVE-2021-3573)
    * kernel: eBPF 32-bit source register truncation on div/mod (CVE-2021-3600)
    * kernel: DoS in rb_per_cpu_empty() (CVE-2021-3679)
    * kernel: Mounting overlayfs inside an unprivileged user namespace can reveal files (CVE-2021-3732)
    * kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() (CVE-2021-20194)
    * kernel: Race condition in sctp_destroy_sock list_del (CVE-2021-23133)
    * kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode     (CVE-2021-28950)
    * kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c (CVE-2021-28971)
    * kernel: protection can be bypassed to leak content of kernel memory (CVE-2021-29155)
    * kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c (CVE-2021-29646)
    * kernel: lack a full memory barrier may lead to DoS (CVE-2021-29650)
    * kernel: local escalation of privileges in handling of eBPF programs (CVE-2021-31440)
    * kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak     content of kernel memory (CVE-2021-31829)
    * kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic     operations by BPF verifier (CVE-2021-33200)
    * kernel: reassembling encrypted fragments with non-consecutive packet numbers (CVE-2020-26146)
    * kernel: reassembling mixed encrypted/plaintext fragments (CVE-2020-26147)
    * kernel: the copy-on-write implementation can grant unintended write access because of a race condition     in a THP mapcount check (CVE-2020-29368)
    * kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 (CVE-2021-3635)
    * kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)
    * kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure (CVE-2021-20239)
    * kernel: out of bounds array access in drivers/md/dm-ioctl.c (CVE-2021-31916)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.35-31.135. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-001 advisory.

    2024-05-23: CVE-2021-46972 was added to this advisory.

    2024-05-23: CVE-2021-46974 was added to this advisory.

    2024-05-23: CVE-2021-46909 was added to this advisory.

    2024-04-25: CVE-2021-46922 was added to this advisory.

    2024-04-25: CVE-2021-46912 was added to this advisory.

    2024-04-25: CVE-2021-46908 was added to this advisory.

    2024-04-25: CVE-2021-46914 was added to this advisory.

    2024-04-25: CVE-2021-46971 was added to this advisory.

    2024-03-13: CVE-2021-46915 was added to this advisory.

    2024-03-13: CVE-2021-46904 was added to this advisory.

    2024-03-13: CVE-2021-46905 was added to this advisory.

    A use-after-free flaw was found in the Linux kernel's NFC LLCP protocol implementation in the way the user     performs manipulation with an unknown input for the llcp_sock_bind() function. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2020-25670)

    A use-after-free flaw was found in the Linux kernel's NFC LLCP protocol implementation in the way the user     triggers the llcp_sock_connect() function. This flaw allows a local user to crash the system.
    (CVE-2020-25671)

    A memory leak in the Linux kernel's NFC LLCP protocol implementation was found in the way a user triggers     the llcp_sock_connect() function. This flaw allows a local user to starve the resources, causing a denial     of service. (CVE-2020-25672)

    A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak     and eventually hanging-up the system. (CVE-2020-25673)

    A use-after-free flaw was found in the Linux kernel's SCTP socket functionality that triggers a race     condition. This flaw allows a local user to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-23133)

    A vulnerability was discovered in retrieve_ptr_limit in kernel/bpf/verifier.c in the Linux kernel     mechanism to mitigate speculatively out-of-bounds loads (Spectre mitigation). In this flaw a local,     special user privileged (CAP_SYS_ADMIN) BPF program running on affected systems may bypass the protection,     and execute speculatively out-of-bounds loads from the kernel memory. This can be abused to extract     contents of kernel memory via side-channel. (CVE-2021-29155)

    A flaw was found in the Linux kernel's eBPF verification code. By default, accessing the eBPF verifier is     only accessible to privileged users with CAP_SYS_ADMIN. This flaw allows a local user who can insert eBPF     instructions, to use the eBPF verifier to abuse a spectre-like flaw and infer all system memory. The     highest threat from this vulnerability is to confidentiality. (CVE-2021-31829)

    The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size     was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel     and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee (bpf, ringbuf: Deny     reserve of buffers larger than ringbuf) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. It was introduced via 457f44363a88 (bpf: Implement BPF ring buffer and verifier     support for it) (v5.8-rc1). (CVE-2021-3489)

    The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly     update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and     therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e (bpf: Fix alu32 const     subreg bound tracking on bitwise operations) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 (bpf: Verifier, do     explicit ALU32 bounds tracking) (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 (bpf:Fix a     verifier failure with xor) ( 5.10-rc1). (CVE-2021-3490)

    A flaw was found in the Linux kernel.  The io_uring PROVIDE_BUFFERS operation allowed the MAX_RW_COUNT     limit to be bypassed, which led to negative values being used in mem_rw when reading /proc/<PID>/mem. The     highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2021-3491)

    A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API,     is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-     of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.
    (CVE-2021-3501)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hso: fix null-ptr-deref during tty device unregistration

    Multiple ttys try to claim the same the minor number causing a doubleunregistration of the same device.
    The first unregistration succeedsbut the next one results in a null-ptr-deref.

    The get_free_serial_index() function returns an available minor numberbut doesn't assign it immediately.
    The assignment is done by the callerlater. But before this assignment, calls to     get_free_serial_index()would return the same minor number.

    Fix this by modifying get_free_serial_index to assign the minor numberimmediately after one is found to be     and rename it to obtain_minor()to better reflect what it does. Similary, rename set_serial_by_index()to     release_minor() and modify it to free up the minor number of thegiven hso_serial. Every obtain_minor()     should have correspondingrelease_minor() call. (CVE-2021-46904)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hso: fix NULL-deref on disconnect regression

    Commit 8a12f8836145 (net: hso: fix null-ptr-deref during tty deviceunregistration) fixed the racy minor     allocation reported by syzbot, butintroduced an unconditional NULL-pointer dereference on every     disconnectinstead.

    Specifically, the serial device table must no longer be accessed afterthe minor has been released by     hso_serial_tty_unregister(). (CVE-2021-46905)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Use correct permission flag for mixed signed bounds arithmetic

    We forbid adding unknown scalars with mixed signed bounds due to thespectre v1 masking mitigation. Hence     this also needs bypass_spec_v1flag instead of allow_ptr_leaks. (CVE-2021-46908)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: footbridge: fix PCI interrupt mapping (CVE-2021-46909)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Make tcp_allowed_congestion_control readonly in non-init netns (CVE-2021-46912)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbe: fix unbalanced device enable/disable in suspend/resume (CVE-2021-46914)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_limit: avoid possible divide error in nft_limit_init

    div_u64() divides u64 by u32.

    nft_limit_init() wants to divide u64 by u64, use the appropriatemath function (div64_u64)

    divide error: 0000 [#1] PREEMPT SMP KASANCPU: 1 PID: 8390 Comm: syz-executor188 Not tainted     5.12.0-rc4-syzkaller #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google     01/01/2011RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]RIP: 0010:div_u64     include/linux/math64.h:127 [inline]RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85Code:
    ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3 45     89 ed 31 d2 4c 89 f0 <49> f7 f5 49 89 c6 e8 d3 9e 22 fa 48 8d 7d 48 48 b8 00 00 00 00 00RSP:
    0018:ffffc90009447198 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000200000000000 RCX:
    0000000000000000RDX: 0000000000000000 RSI: ffffffff875152e6 RDI: 0000000000000003RBP: ffff888020f80908     R08: 0000200000000000 R09: 0000000000000000R10: ffffffff875152d8 R11: 0000000000000000 R12:
    ffffc90009447270R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000FS:
    000000000097a300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0:
    0000000080050033CR2: 00000000200001c4 CR3: 0000000026a52000 CR4: 00000000001506e0DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400Call Trace:nf_tables_newexpr net/netfilter/nf_tables_api.c:2675     [inline]nft_expr_init+0x145/0x2d0 net/netfilter/nf_tables_api.c:2713nft_set_elem_expr_alloc+0x27/0x280     net/netfilter/nf_tables_api.c:5160nf_tables_newset+0x1997/0x3150     net/netfilter/nf_tables_api.c:4321nfnetlink_rcv_batch+0x85a/0x21b0     net/netfilter/nfnetlink.c:456nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:580     [inline]nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:598netlink_unicast_kernel     net/netlink/af_netlink.c:1312 [inline]netlink_unicast+0x533/0x7d0     net/netlink/af_netlink.c:1338netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927sock_sendmsg_nosec     net/socket.c:654 [inline]sock_sendmsg+0xcf/0x120 net/socket.c:674____sys_sendmsg+0x6e8/0x810     net/socket.c:2350___sys_sendmsg+0xf3/0x170 net/socket.c:2404__sys_sendmsg+0xe5/0x1b0     net/socket.c:2433do_syscall_64+0x2d/0x70     arch/x86/entry/common.c:46entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2021-46915)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: trusted: Fix TPM reservation for seal/unseal (CVE-2021-46922)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Fix unconditional security_locked_down() call (CVE-2021-46971)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry (CVE-2021-46972)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix masking negation logic upon negative dst register (CVE-2021-46974)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
152308	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-2246)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	high
152388	Photon OS 3.0: Linux PHSA-2021-3.0-0278	Nessus	PhotonOS Local Security Checks	2021/8/10	2025/8/22	high
151730	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:1975-1)	Nessus	SuSE Local Security Checks	2021/7/16	2023/1/17	critical
155219	RHEL 8 : kernel (RHSA-2021:4356)	Nessus	Red Hat Local Security Checks	2021/11/11	2025/8/15	high
160443	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-001)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2024/12/11	high

检测

插件搜索

high

high

critical

high

high