The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013255 advisory.

    base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through     5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1769 advisory.

    [4.18.0-193.el8.OL8]
    - Oracle Linux certificates (Alexey Petrenko)
    - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list      (olkmod_signing_key.pem) [Orabug: 29539237]
    - Update x509.genkey [Orabug: 24817676]

    [4.18.0-193.el8]
    - [kvm] KVM: PPC: Book3S HV: Use __gfn_to_pfn_memslot in HPT page fault handler     (Sam Bobroff) [1815491]
    - [net] tcp: also NULL skb->dev when copy was needed (Florian Westphal) [1775961     ]
    - [net] tcp: ensure skb->dev is NULL before leaving TCP stack (Florian Westphal)      [1775961]

    [4.18.0-192.el8]
    - [drm] drm/bochs: downgrade pci_request_region failure from error to warning (D     ave Airlie) [1804735]
    - [drm] drm/bochs: deinit bugfix (Dave Airlie) [1804735]
    - [fs] gfs2: fix O_EXCL|O_CREAT handling on cold dcache (Andrew Price) [1811787]
    - [net] esp: remove the skb from the chain when its enqueued in cryptd_wq (Xin     Long) [1807909]
    - [powerpc] powerpc/nvdimm: set target_node properly (Diego Domingos) [1815038]

    [4.18.0-191.el8]
    - [netdrv] net/mlx5e: Dont clear the whole vf config when switching modes (moha     mad meib) [1814350]
    - [fs] fuse: fix stack use after return (Miklos Szeredi) [1814666]

    [4.18.0-190.el8]
    - [powerpc] powerpc/pseries: Avoid NULL pointer dereference when drmem is unavai     lable (David Hildenbrand) [1812874]
    - [x86] kvm/svm: PKU not currently supported (Wei Huang) [1789159]
    - [x86] Remove the unsupported check for Cooper Lake (David Arcari) [1813921]

    [4.18.0-189.el8]
    - [netdrv] net/mlx5e: Show/set Rx network flow classification rules on ul rep (A     laa Hleihel) [1795156 1794280]
    - [netdrv] net/mlx5e: Init ethtool steering for representors (Alaa Hleihel) [179     5156 1794280]
    - [netdrv] net/mlx5e: Show/set Rx flow indir table and RSS hash key on ul rep (A     laa Hleihel) [1795156 1794280]
    - [netdrv] net/mlx5e: Introduce root ft concept for representors netdevs (Alaa H     leihel) [1795156 1794280]
    - [netdrv] net/mlx5: E-Switch, Use vport metadata matching only when mandatory (     Alaa Hleihel) [1795156]
    - [nvme] nvme: log additional message for controller status (David Milburn) [175     2952]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2019-0154: An unprotected read access to i915     registers has been fixed that could have been abused to     facilitate a local denial-of-service attack.
    (bsc#1135966)

  - CVE-2019-0155: A privilege escalation vulnerability has     been fixed in the i915 module that allowed batch buffers     from user mode to gain super user privileges.
    (bsc#1135967)

  - CVE-2019-16231: drivers/net/fjes/fjes_main.c did not     check the alloc_workqueue return value, leading to a     NULL pointer dereference (bnc#1150466).

  - CVE-2019-18805: There was a net/ipv4/tcp_input.c signed     integer overflow in tcp_ack_update_rtt() when userspace     writes a very large integer to     /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial     of service or possibly unspecified other impact, aka     CID-19fad20d15a6 (bnc#1156187).

  - CVE-2019-17055: base_sock_create in     drivers/isdn/mISDN/socket.c in the AF_ISDN network     module did not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21 (bnc#1152782).

  - CVE-2019-11135: Aborting an asynchronous TSX operation     on Intel CPUs with Transactional Memory support could be     used to facilitate sidechannel information leaks out of     microarchitectural buffers, similar to the previously     described 'Microarchitectural Data Sampling' attack.

    The Linux kernel was supplemented with the option to     disable TSX operation altogether (requiring CPU     Microcode updates on older systems) and better flushing     of microarchitectural buffers (VERW).

    The set of options available is described in our TID at     https://www.suse.com/support/kb/doc/?id=7024251

  - CVE-2018-12207: Untrusted virtual machines on Intel CPUs     could exploit a race condition in the Instruction Fetch     Unit of the Intel CPU to cause a Machine Exception     during Page Size Change, causing the CPU core to be     non-functional.

    The Linux Kernel kvm hypervisor was adjusted to avoid     page size changes in executable pages by splitting /     merging huge pages into small pages as needed.

    More information can be found on     https://www.suse.com/support/kb/doc/?id=7023735

  - CVE-2019-10220: Added sanity checks on the pathnames     passed to the user space. (bsc#1144903).

The following non-security bugs were fixed :

  - ALSA: bebob: Fix prototype of helper function to return     negative value (bsc#1051510).

  - ALSA: bebob: fix to detect configured source of sampling     clock for Focusrite Saffire Pro i/o series (git-fixes).

  - ALSA: firewire-motu: add support for MOTU 4pre     (bsc#1111666).

  - ALSA: hda/ca0132 - Fix possible workqueue stall     (bsc#1155836).

  - ALSA: hda/realtek - Add support for ALC623     (bsc#1051510).

  - ALSA: hda/realtek - Fix 2 front mics of codec 0x623     (bsc#1051510).

  - ALSA: timer: Fix incorrectly assigned timer instance     (git-fixes).

  - ALSA: timer: Fix mutex deadlock at releasing card     (bsc#1051510).

  - ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB     Interface (bsc#1051510).

  - ALSA: usb-audio: Disable quirks for BOSS Katana     amplifiers (bsc#1111666).

  - ALSA: usb-audio: Fix copy&paste error in the validator     (bsc#1111666).

  - arm64: Add decoding macros for CP15_32 and CP15_64 traps     (jsc#ECO-561).

  - arm64: Add part number for Neoverse N1 (jsc#ECO-561).

  - arm64: Add silicon-errata.txt entry for ARM erratum     1188873 (jsc#ECO-561).

  - arm64: Add support for new control bits CTR_EL0.DIC and     CTR_EL0.IDC (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Apply ARM64_ERRATUM_1188873 to Neoverse-N1     (jsc#ECO-561).

  - arm64: arch_timer: Add workaround for ARM erratum     1188873 (jsc#ECO-561).

  - arm64: arch_timer: avoid unused function warning     (jsc#ECO-561).

  - arm64: compat: Add CNTFRQ trap handler (jsc#ECO-561).

  - arm64: compat: Add CNTVCT trap handler (jsc#ECO-561).

  - arm64: compat: Add condition code checks and IT advance     (jsc#ECO-561).

  - arm64: compat: Add cp15_32 and cp15_64 handler arrays     (jsc#ECO-561).

  - arm64: compat: Add separate CP15 trapping hook     (jsc#ECO-561).

  - arm64: compat: Workaround Neoverse-N1 #1542419 for     compat user-space (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpu_errata: Remove     ARM64_MISMATCHED_CACHE_LINE_SIZE     (jsc#ECO-561,jsc#SLE-10671).

  - arm64/cpufeature: Convert hook_lock to raw_spin_lock_t     in cpu_enable_ssbs() (jsc#ECO-561).

  - arm64: cpufeature: ctr: Fix cpu capability check for     late CPUs (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpufeature: Detect SSBS and advertise to     userspace (jsc#ECO-561).

  - arm64: cpufeature: Fix handling of CTR_EL0.IDC field     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpufeature: Trap CTR_EL0 access only where it is     necessary (jsc#ECO-561,jsc#SLE-10671).

  - arm64: cpu: Move errata and feature enable callbacks     closer to callers (jsc#ECO-561).

  - arm64: entry: Allow handling of undefined instructions     from EL1 (jsc#ECO-561).

  - arm64: errata: Hide CTR_EL0.DIC on systems affected by     Neoverse-N1 #1542419 (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Fake the IminLine size on systems affected by     Neoverse-N1 #1542419 (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Fix mismatched cache line size detection     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Fix silly typo in comment (jsc#ECO-561).

  - arm64: fix SSBS sanitization (jsc#ECO-561).

  - arm64: force_signal_inject: WARN if called from kernel     context (jsc#ECO-561).

  - arm64: Force SSBS on context switch (jsc#ECO-561).

  - arm64: Handle erratum 1418040 as a superset of erratum     1188873 (jsc#ECO-561).

  - arm64: Introduce sysreg_clear_set() (jsc#ECO-561).

  - arm64: kill change_cpacr() (jsc#ECO-561).

  - arm64: kill config_sctlr_el1() (jsc#ECO-561).

  - arm64: KVM: Add invalidate_icache_range helper     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: KVM: PTE/PMD S2 XN bit definition     (jsc#ECO-561,jsc#SLE-10671).

  - arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT     (jsc#ECO-561).

  - arm64: move SCTLR_EL(1,2) assertions to <asm/sysreg.h>     (jsc#ECO-561).

  - arm64: Restrict ARM64_ERRATUM_1188873 mitigation to     AArch32 (jsc#ECO-561).

  - arm64: ssbd: Add support for PSTATE.SSBS rather than     trapping to EL3 (jsc#ECO-561).

  - arm64: ssbd: Drop #ifdefs for PR_SPEC_STORE_BYPASS     (jsc#ECO-561).

  - arm: KVM: Add optimized PIPT icache flushing     (jsc#ECO-561,jsc#SLE-10671).

  - ath10k: assign 'n_cipher_suites = 11' for WCN3990 to     enable WPA3 (bsc#1111666).

  - brcmfmac: sdio: Disable auto-tuning around commands     expected to fail (bsc#1111666).

  - brcmfmac: sdio: Do not tune while the card is off     (bsc#1111666).

  - can: dev: call netif_carrier_off() in register_candev()     (bsc#1051510).

  - config: arm64: enable erratum 1418040 and 1542419

  - dmaengine: bcm2835: Print error in case setting DMA mask     fails (bsc#1051510).

  - dmaengine: imx-sdma: fix size check for sdma     script_number (bsc#1051510).

  - drm/amd/display: fix odm combine pipe reset     (bsc#1111666).

  - drm/amdgpu: fix memory leak (bsc#1111666).

  - drm/amdgpu/powerplay/vega10: allow undervolting in p7     (bsc#1111666).

  - drm/i915: Add gen9 BCS cmdparsing (bsc#1135967)

  - drm/i915: Add gen9 BCS cmdparsing (bsc#1135967)

  - drm/i915: Add support for mandatory cmdparsing     (bsc#1135967)

  - drm/i915: Add support for mandatory cmdparsing     (bsc#1135967)

  - drm/i915: Allow parsing of unsized batches (bsc#1135967)

  - drm/i915: Allow parsing of unsized batches (bsc#1135967)

  - drm/i915/cmdparser: Add support for backward jumps     (bsc#1135967)

  - drm/i915/cmdparser: Add support for backward jumps     (bsc#1135967)

  - drm/i915/cmdparser: Ignore Length operands during     (bsc#1135967)

  - drm/i915/cmdparser: Ignore Length operands during     command matching (bsc#1135967)

  - drm/i915/cmdparser: Use explicit goto for error paths     (bsc#1135967)

  - drm/i915/cmdparser: Use explicit goto for error paths     (bsc#1135967)

  - drm/i915/cml: Add second PCH ID for CMP (bsc#1111666).

  - drm/i915: Disable Secure Batches for gen6+

  - drm/i915: Disable Secure Batches for gen6+ (bsc#1135967)

  - drm/i915/gen8+: Add RC6 CTX corruption WA (bsc#1135967)

  - drm/i915/gen8+: Add RC6 CTX corruption WA (bsc#1135967)

  - drm/i915/gtt: Add read only pages to gen8_pte_encode     (bsc#1135967)

  - drm/i915/gtt: Disable read-only support under GVT     (bsc#1135967)

  - drm/i915/gtt: Read-only pages for insert_entries on bdw     (bsc#1135967)

  - drm/i915/ilk: Fix warning when reading emon_status with     no output (bsc#1111666).

  - drm/i915: Lower RM timeout to avoid DSI hard hangs     (bsc#1135967)

  - drm/i915: Lower RM timeout to avoid DSI hard hangs     (bsc#1135967)

  - drm/i915: Prevent writing into a read-only object via a     GGTT mmap (bsc#1135967)

  - drm/i915: Remove Master tables from cmdparser

  - drm/i915: Remove Master tables from cmdparser     (bsc#1135967)

  - drm/i915: Rename gen7 cmdparser tables (bsc#1135967)

  - drm/i915: Rename gen7 cmdparser tables (bsc#1135967)

  - drm/i915: Support ro ppgtt mapped cmdparser shadow     (bsc#1135967)

  - drm/i915: Support ro ppgtt mapped cmdparser shadow     buffers (bsc#1135967)

  - drm/msm/dpu: handle failures while initializing displays     (bsc#1111666).

  - hyperv: set nvme msi interrupts to unmanaged     (jsc#SLE-8953, jsc#SLE-9221, jsc#SLE-4941, bsc#1119461,     bsc#1119465, bsc#1138190, bsc#1154905).

  - IB/core: Add mitigation for Spectre V1 (bsc#1155671)

  - integrity: prevent deadlock during digsig verification     (bsc#1090631).

  - irqchip/gic-v3-its: Fix command queue pointer comparison     bug (jsc#ECO-561).

  - irqchip/gic-v3-its: Fix LPI release for Multi-MSI     devices (jsc#ECO-561).

  - irqchip/gic-v3-its: Fix misuse of GENMASK macro     (jsc#ECO-561).

  - iwlwifi: do not panic in error path on non-msix systems     (bsc#1155692).

  - iwlwifi: exclude GEO SAR support for 3168 (bsc#1111666).

  - iwlwifi: exclude GEO SAR support for 3168 (git-fixes).

  - iwlwifi: fw: do not send GEO_TX_POWER_LIMIT command to     FW version 36 (bsc#1111666).

  - kabi protect enum RDMA_DRIVER_EFA (jsc#SLE-4805)

  - kABI workaround for drm_vma_offset_node readonly field     addition (bsc#1135967)

  - kABI workaround for mmc_host retune_crc_disable flag     addition (bsc#1111666).

  - KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully     disabled and !vhe (jsc#ECO-561).

  - KVM: arm/arm64: Clean dcache to PoC when changing PTE     due to CoW (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Detangle kvm_mmu.h from kvm_hyp.h     (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Drop vcpu parameter from guest cache     maintenance operartions (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Limit icache invalidation to prefetch     aborts (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Only clean the dcache on translation     fault (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Preserve Exec permission across R/W     permission faults (jsc#ECO-561,jsc#SLE-10671).

  - KVM: arm/arm64: Split dcache/icache flushing     (jsc#ECO-561,jsc#SLE-10671).

  - KVM: vmx, svm: always run with EFER.NXE=1 when shadow     paging is active (bsc#1117665).

  - md/raid0: avoid RAID0 data corruption due to layout     confusion (bsc#1140090).

  - md/raid0: fix warning message for parameter     default_layout (bsc#1140090).

  - mmc: core: Add sdio_retune_hold_now() and     sdio_retune_release() (bsc#1111666).

  - mmc: core: API to temporarily disable retuning for SDIO     CRC errors (bsc#1111666).

  - Move upstreamed CA0132 fix into sorted section

  - net: openvswitch: free vport unless register_netdevice()     succeeds (git-fixes).

  - phylink: fix kernel-doc warnings (bsc#1111666).

  - power: supply: max14656: fix potential use-after-free     (bsc#1051510).

  - RDMA/efa: Add Amazon EFA driver (jsc#SLE-4805)

  - RDMA/hns: Add reset process for function-clear     (bsc#1155061).

  - RDMA/hns: Remove the some magic number (bsc#1155061).

  - RDMA/restrack: Track driver QP types in resource tracker     (jsc#SLE-4805)

  - Revert 'ALSA: hda: Flush interrupts on disabling'     (bsc#1051510).

  - Revert synaptics-rmi4 patch due to regression     (bsc#1155982) Also blacklisting it

  - rpm/kernel-subpackage-spec: Mention debuginfo in the     subpackage description (bsc#1149119).

  - s390: add support for IBM z15 machines (bsc#1152696     LTC#181731).

  - s390/cpumsf: Check for CPU Measurement sampling     (bsc#1153681 LTC#181855).

  - s390: fix setting of mio addressing control (bsc#1152665     LTC#181729).

  - s390/pci: add mio_enabled attribute (bsc#1152665     LTC#181729).

  - s390/pci: correctly handle MIO opt-out (bsc#1152665     LTC#181729).

  - s390/pci: deal with devices that have no support for MIO     instructions (bsc#1152665 LTC#181729).

  - s390/pci: fix MSI message data (bsc#1152697 LTC#181730).

  - sc16is7xx: Fix for 'Unexpected interrupt: 8'     (bsc#1051510).

  - sched/fair: Avoid divide by zero when rebalancing     domains (bsc#1096254).

  - scsi: lpfc: Limit xri count for kdump environment     (bsc#1154124).

  - scsi: qla2xxx: Add error handling for PLOGI ELS     passthrough (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Capture FW dump on MPI heartbeat stop     event (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Check for MB timeout while capturing     ISP27/28xx FW dump (bsc#1143706 bsc#1082635     bsc#1123034).

  - scsi: qla2xxx: Do command completion on abort timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: do not use zero for FC4_PRIORITY_NVME     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Dual FCP-NVMe target port support     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix a dma_pool_free() call (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix device connect issues in P2P     configuration (bsc#1143706 bsc#1082635 bsc#1154526     bsc#1048942).

  - scsi: qla2xxx: Fix double scsi_done for abort path     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix driver unload hang (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix memory leak when sending I/O fails     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix N2N link reset (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix N2N link up fail (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix partial flash write of MBI     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix SRB leak on switch command timeout     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Fix stale mem access on driver unload     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Fix unbound sleep in fcport delete path     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: fixup incorrect usage of host_byte     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Improve logging for scan thread     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Initialized mailbox to prevent driver     load failure (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: initialize fc4_type_priority (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Optimize NPIV tear down process     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Remove an include directive (bsc#1143706     bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: remove redundant assignment to pointer     host (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: qla2xxx: Set remove flag for all VP (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Silence fwdump template message     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: stop timer in shutdown path (bsc#1143706     bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.20-k     (bsc#1143706 bsc#1082635 bsc#1123034).

  - scsi: qla2xxx: Update driver version to 10.01.00.21-k     (bsc#1143706 bsc#1082635 bsc#1154526 bsc#1048942).

  - scsi: sd: Ignore a failure to sync cache due to lack of     authorization (git-fixes).

  - scsi: storvsc: Add ability to change scsi queue depth     (bsc#1155021).

  - scsi: zfcp: fix reaction on bit error threshold     notification (bsc#1154956 LTC#182054).

  - serial: fix kernel-doc warning in comments     (bsc#1051510).

  - serial: mctrl_gpio: Check for NULL pointer     (bsc#1051510).

  - serial: uartlite: fix exit path NULL pointer     (bsc#1051510).

  - staging: rtl8188eu: fix null dereference when kzalloc     fails (bsc#1051510).

  - supporte.conf: add efivarfs to kernel-default-base     (bsc#1154858).

  - tracing: Get trace_array reference for available_tracers     files (bsc#1156429).

  - usb: gadget: Reject endpoints with 0 maxpacket value     (bsc#1051510).

  - usb: gadget: udc: atmel: Fix interrupt storm in FIFO     mode (bsc#1051510).

  - usb: handle warm-reset port requests on hub resume     (bsc#1051510).

  - usb: ldusb: fix control-message timeout (bsc#1051510).

  - usb: ldusb: fix ring-buffer locking (bsc#1051510).

  - usb: serial: whiteheat: fix line-speed endianness     (bsc#1051510).

  - usb: serial: whiteheat: fix potential slab corruption     (bsc#1051510).

  - usb-storage: Revert commit 747668dbc061 ('usb-storage:
    Set virt_boundary_mask to avoid SG overflows')     (bsc#1051510).

  - wil6210: fix freeing of rx buffers in EDMA mode     (bsc#1111666).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-19081: Fixed a memory leak in the nfp_flower_spawn_vnic_reprs() could have allowed attackers to cause a denial of service (bsc#1157045).

CVE-2019-19080: Fixed four memory leaks in the nfp_flower_spawn_phy_reprs() could have allowed attackers to cause a denial of service (bsc#1157044).

CVE-2019-19052: Fixed a memory leak in the gs_can_open() which could have led to denial of service (bsc#1157324).

CVE-2019-19067: Fixed multiple memory leaks in acp_hw_init (bsc#1157180).

CVE-2019-19060: Fixed a memory leak in the adis_update_scan_mode() which could have led to denial of service (bsc#1157178).

CVE-2019-19049: Fixed a memory leak in unittest_data_add (bsc#1157173).

CVE-2019-19075: Fixed a memory leak in the ca8210_probe() which could have led to denial of service by triggering ca8210_get_platform_data() failures (bsc#1157162).

CVE-2019-19058: Fixed a memory leak in the alloc_sgtable() which could have led to denial of service by triggering alloc_page() failures (bsc#1157145).

CVE-2019-19074: Fixed a memory leak in the ath9k_wmi_cmd() function which could have led to denial of service (bsc#1157143).

CVE-2019-19073: Fixed multiple memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c which could have led to denial of service by triggering wait_for_completion_timeout() failures (bsc#1157070).

CVE-2019-19083: Fixed multiple memory leaks in *clock_source_create() functions which could have led to denial of service (bsc#1157049).

CVE-2019-19082: Fixed multiple memory leaks in *create_resource_pool() which could have led to denial of service (bsc#1157046).

CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() which might have led denial of service (bsc#1149448).

CVE-2019-0154: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable denial of service via local access (bsc#1135966).

CVE-2019-0155: Fixed an improper access control in subsystem for Intel (R) processor graphics whichs may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135967).

CVE-2019-16231: Fixed a NULL pointer dereference due to lack of checking the alloc_workqueue return value (bsc#1150466).

CVE-2019-18805: Fixed an integer overflow in tcp_ack_update_rtt() leading to a denial of service or possibly unspecified other impact (bsc#1156187).

CVE-2019-17055: Enforced CAP_NET_RAW in the AF_ISDN network module to restrict unprivileged users to create a raw socket (bsc#1152782).

CVE-2019-16995: Fixed a memory leak in hsr_dev_finalize() which may have caused denial of service (bsc#1152685).

CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903)

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's kvm hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15030, CVE-2019-15031: On the powerpc platform, a local user could read vector registers of other users' processes via an interrupt (bsc#1149713).

CVE-2019-18683: An issue was discovered in drivers/media/platform/vivid. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free (bnc#1155897).

CVE-2019-18809: A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559 (bnc#1156258).

CVE-2019-19078: A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2 (bnc#1157032).

CVE-2019-18660: The Linux kernel on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c (bnc#1157038).

CVE-2019-14895: A heap-based buffer overflow was discovered in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1157158).

CVE-2019-19065: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e (bnc#1157191).

CVE-2019-19057: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e (bnc#1157193).

CVE-2019-19056: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932 (bnc#1157197).

CVE-2019-19063: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113 (bnc#1157298).

CVE-2019-19046: A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c allow attackers to cause a denial of service (bsc#1157304).

CVE-2019-19068: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6 (bnc#1157307).

CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042 (bnc#1157333).

CVE-2019-19227: In the AppleTalk subsystem, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122 (bnc#1157678).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.01, has kernel packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Linux kernel's NFS     implementation, all versions 3.x and all versions 4.x up     to 4.20. An attacker, who is able to mount an exported     NFS filesystem, is able to trigger a null pointer     dereference by using an invalid NFS sequence. This can     panic the machine and deny access to the NFS server. Any     outstanding disk writes to the NFS server will be lost.
    (CVE-2018-16871)

  - ieee802154_create in net/ieee802154/socket.c in the     AF_IEEE802154 network module in the Linux kernel through     5.3.2 does not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-e69dbd4619e7. (CVE-2019-17053)

  - base_sock_create in drivers/isdn/mISDN/socket.c in the     AF_ISDN network module in the Linux kernel through 5.3.2     does not enforce CAP_NET_RAW, which means that     unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21. (CVE-2019-17055)

  - The flow_dissector feature in the Linux kernel 4.3     through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because     the auto flowlabel of a UDP IPv6 packet relies on a     32-bit hashrnd value as a secret, and because jhash     (instead of siphash) is used. The hashrnd value remains     the same starting from boot time, and can be inferred by     an attacker. This affects net/core/flow_dissector.c and     related code. (CVE-2019-18282)

  - An issue was discovered in net/ipv4/sysctl_net_ipv4.c in     the Linux kernel before 5.0.11. There is a     net/ipv4/tcp_input.c signed integer overflow in     tcp_ack_update_rtt() when userspace writes a very large     integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading     to a denial of service or possibly unspecified other     impact, aka CID-19fad20d15a6. (CVE-2019-18805)

  - A memory leak in the mlx5_fpga_conn_create_cq() function     in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c     in the Linux kernel before 5.3.11 allows attackers to     cause a denial of service (memory consumption) by     triggering mlx5_vector2eqn() failures, aka     CID-c8c2a057fdc7. (CVE-2019-19045)

  - ** DISPUTED ** A memory leak in the     nl80211_get_ftm_responder_stats() function in     net/wireless/nl80211.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service     (memory consumption) by triggering nl80211hdr_put()     failures, aka CID-1399c59fa929. NOTE: third parties     dispute the relevance of this because it occurs on a     code path where a successful allocation has already     occurred. (CVE-2019-19055)

  - A memory leak in the bnxt_re_create_srq() function in     drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial     of service (memory consumption) by triggering copy to     udata failures, aka CID-4a9d46a9fe14. (CVE-2019-19077)

  - In the Linux kernel before 5.3.9, there are multiple     out-of-bounds write bugs that can be caused by a     malicious USB device in the Linux kernel HID drivers,     aka CID-d9d4b1e46d95. This affects drivers/hid/hid-     axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c,     drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c,     drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-     microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-     tmff.c, and drivers/hid/hid-zpff.c. (CVE-2019-19532)

  - In the Linux kernel before 5.3.11, there is an info-leak     bug that can be caused by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka     CID-f7a1337f0d29. (CVE-2019-19534)

  - In the Linux kernel 5.4.0-rc2, there is a use-after-free     (read) in the __blk_add_trace function in     kernel/trace/blktrace.c (which is used to fill out a     blk_io_trace structure and place it in a per-cpu sub-     buffer). (CVE-2019-19768)

  - A memory leak in the kernel_read_file function in     fs/exec.c in the Linux kernel through 4.20.11 allows     attackers to cause a denial of service (memory     consumption) by triggering vfs_read failures.
    (CVE-2019-8980)

  - A NULL pointer dereference flaw was found in the Linux     kernel's SELinux subsystem in versions before 5.7. This     flaw occurs while importing the Commercial IP Security     Option (CIPSO) protocol's category bitmap into the     SELinux extensible bitmap via the'     ebitmap_netlbl_import' routine. While processing the     CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security     attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue     leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This     flaw allows a remote network user to crash the system     kernel, resulting in a denial of service.
    (CVE-2020-10711)

  - In the Linux kernel through 5.6.7 on the s390 platform,     code execution may occur because of a race condition, as     demonstrated by code in enable_sacf_uaccess in     arch/s390/lib/uaccess.c that fails to protect against a     concurrent page table upgrade, aka CID-3f777e19d171. A     crash could also occur. (CVE-2020-11884)

  - An issue was discovered in the Linux kernel before     5.6.5. There is a use-after-free in block/bfq-iosched.c     related to bfq_idle_slice_timer_body. (CVE-2020-12657)

  - A flaw was discovered in the way that the KVM hypervisor     handled instruction emulation for an L2 guest when     nested virtualisation is enabled. Under some     circumstances, an L2 guest may trick the L0 guest into     accessing sensitive L1 resources that should be     inaccessible to the L2 guest. (CVE-2020-2732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12-SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#1146519).

CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

CVE-2019-13272: Fixed a mishandled the recording of the credentials of a process that wants to create a ptrace relationship, which allowed local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker).
(bnc#1140671).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious USB device (bnc#1146361).

CVE-2019-15924: A a NULL pointer dereference has been fixed in the drivers/net/ethernet/intel/fm10k module (bnc#1149612).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15926: An out-of-bounds access was fixed in the drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer module (bnc#1149522).

CVE-2019-15666: There was an out-of-bounds array access in the net/xfrm module that could cause denial of service (bnc#1148394).

CVE-2017-18379: An out-of-boundary access was fixed in the drivers/nvme/target module (bnc#1143187).

CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by a malicious USB device (bnc#1146519 1146524).

CVE-2019-15220: A use-after-free issue was fixed that could be caused by a malicious USB device (bnc#1146519 1146526).

CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by a malicious USB device (bnc#1146519 1146529).

CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi chip driver. That issue allowed local users to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146512).

CVE-2019-14815: A missing length check while parsing WMM IEs was fixed (bsc#1146512, bsc#1146514, bsc#1146516).

CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver was fixed. Local users would have abused this issue to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146516).

CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket option, an attacker could control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. (bnc#1145477)

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was fixed (bnc#1146378).

CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe was fixed (bsc#1146378).

CVE-2019-15239: A incorrect patch to net/ipv4 was fixed. By adding to a write queue between disconnection and re-connection, a local attacker could trigger multiple use-after-free conditions. This could result in kernel crashes or potentially in privilege escalation.
(bnc#1146589)

CVE-2019-15212: A double-free issue was fixed in drivers/usb driver (bnc#1146391).

CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc (bnc#1146584).

CVE-2019-15211: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/v4l2-core driver (bnc#1146519).

CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).

CVE-2019-15214: An a use-after-free issue in the sound subsystem was fixed (bnc#1146519).

CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device was fixed in the drivers/media/usb/siano driver (bnc#1146413).

CVE-2019-15215: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).

CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver (bnc#1146285).

CVE-2017-18551: An out-of-bounds write was fixed in the drivers/i2c driver (bnc#1146163).

CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4062 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free in sound/core/timer.c (CVE-2019-19807)

    * kernel: out of bounds write in function i2c_smbus_xfer_emulated in drivers/i2c/i2c-core-smbus.c     (CVE-2017-18551)

    * kernel: race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c     leads to use-after-free (CVE-2018-20836)

    * kernel: out of bounds write in i2c driver leads to local escalation of privilege (CVE-2019-9454)

    * kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

    Space precludes documenting all of the security fixes in this advisory. See the descriptions of the     remaining security fixes in the related Knowledge Article:

    https://access.redhat.com/articles/5442481

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.0.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4850 advisory.

    - vhost: make sure log_num < in_num (yongduan)  [Orabug: 30312787]  {CVE-2019-14835}
    - vhost: block speculation of translated descriptors (Michael S. Tsirkin)  [Orabug: 30312787]     {CVE-2019-14835}
    - net: hsr: fix memory leak in hsr_dev_finalize() (Mao Wenan)  [Orabug: 30444853]  {CVE-2019-16995}
    - ieee802154: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30444946]  {CVE-2019-17053}
    - mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30445158]  {CVE-2019-17055}
    - net: sit: fix memory leak in sit_init_net() (Mao Wenan)  [Orabug: 30445305]  {CVE-2019-16994}
    - media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum)  [Orabug: 30490491]     {CVE-2019-15213}
    - media: cpia2_usb: first wake up, then free in disconnect (Oliver Neukum)  [Orabug: 30511741]     {CVE-2019-15215}
    - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN)  [Orabug:
    30532774]  {CVE-2019-15217}
    - x86/tsx: Add config options to set tsx=on|off|auto (Michal Hocko)  [Orabug: 30517133]  {CVE-2019-11135}
    - x86/speculation/taa: Add documentation for TSX Async Abort (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/tsx: Add 'auto' option to the tsx= cmdline parameter (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/speculation/taa: Add mitigation for TSX Async Abort (Kanth Ghatraju)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/cpu: Add a 'tsx=' cmdline option with TSX disabled by default (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/cpu: Add a helper function x86_read_arch_cap_msr() (Pawan Gupta)  [Orabug: 30517133]     {CVE-2019-11135}
    - x86/msr: Add the IA32_TSX_CTRL MSR (Pawan Gupta)  [Orabug: 30517133]  {CVE-2019-11135}
    - kvm: x86: mmu: Recovery of shattered NX large pages (Junaid Shahid)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: Add helper function for creating VM worker threads (Junaid Shahid)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini)  [Orabug: 30517059]     {CVE-2018-12207}
    - KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: x86: Do not release the page inside mmu_set_spte() (Junaid Shahid)  [Orabug: 30517059]     {CVE-2018-12207}
    - x86/cpu: Add Tremont to the cpu vulnerability whitelist (Pawan Gupta)  [Orabug: 30517059]     {CVE-2018-12207}
    - x86: Add ITLB_MULTIHIT bug infrastructure (Pawan Gupta)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Move mapping_level_dirty_bitmap() call in mapping_level() (Takuya Yoshikawa)  [Orabug:
    30517059]  {CVE-2018-12207}
    - Revert 'KVM: x86: use the fast way to invalidate all pages' (Sean Christopherson)  [Orabug: 30517059]     {CVE-2018-12207}
    - kvm: Convert kvm_lock to a mutex (Junaid Shahid)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Simplify force_pt_level calculation code in FNAME(page_fault)() (Takuya Yoshikawa)     [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Make force_pt_level bool (Takuya Yoshikawa)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Remove unused parameter parent_pte from kvm_mmu_get_page() (Takuya Yoshikawa)  [Orabug:
    30517059]  {CVE-2018-12207}
    - KVM: x86: extend usage of RET_MMIO_PF_* constants (Paolo Bonzini)  [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Make mmu_set_spte() return emulate value (Takuya Yoshikawa)  [Orabug: 30517059]     {CVE-2018-12207}
    - KVM: x86: MMU: Move parent_pte handling from kvm_mmu_get_page() to link_shadow_page() (Takuya Yoshikawa)     [Orabug: 30517059]  {CVE-2018-12207}
    - KVM: x86: MMU: Move initialization of parent_ptes out from kvm_mmu_alloc_page() (Takuya Yoshikawa)     [Orabug: 30517059]  {CVE-2018-12207}
    - i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA (Jeremy Compostella)  [Orabug:
    30210503]  {CVE-2017-18551}
    - net-sysfs: Fix mem leak in netdev_register_kobject (YueHaibing)  [Orabug: 30350263]  {CVE-2019-15916}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4186-1 advisory.

    Stephan van Schaik, Alyssa Milburn, Sebastian sterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,     Cristiano Giuffrida, Giorgi Maisuradze, Moritz Lipp, Michael Schwarz, Daniel Gruss, and Jo Van Bulck     discovered that Intel processors using Transactional Synchronization Extensions (TSX) could expose memory     contents previously stored in microarchitectural buffers to a malicious process that is executing on the     same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11135)

    It was discovered that the Intel i915 graphics chipsets allowed userspace to modify page table entries via     writes to MMIO from the Blitter Command Streamer and expose kernel memory information. A local attacker     could use this to expose sensitive information or possibly elevate privileges. (CVE-2019-0155)

    Deepak Gupta discovered that on certain Intel processors, the Linux kernel did not properly perform     invalidation on page table updates by virtual guest operating systems. A local attacker in a guest VM     could use this to cause a denial of service (host system crash). (CVE-2018-12207)

    It was discovered that the Intel i915 graphics chipsets could cause a system hang when userspace performed     a read from GT memory mapped input output (MMIO) when the product is in certain low power states. A local     attacker could use this to cause a denial of service. (CVE-2019-0154)

    Hui Peng discovered that the Atheros AR6004 USB Wi-Fi device driver for the Linux kernel did not properly     validate endpoint descriptors returned by the device. A physically proximate attacker could use this to     cause a denial of service (system crash). (CVE-2019-15098)

    It was discovered that a buffer overflow existed in the 802.11 Wi-Fi configuration interface for the Linux     kernel when handling beacon settings. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-16746)

    Ori Nimron discovered that the AX25 network protocol implementation in the Linux kernel did not properly     perform permissions checks. A local attacker could use this to create a raw socket. (CVE-2019-17052)

    Ori Nimron discovered that the IEEE 802.15.4 Low-Rate Wireless network protocol implementation in the     Linux kernel did not properly perform permissions checks. A local attacker could use this to create a raw     socket. (CVE-2019-17053)

    Ori Nimron discovered that the Appletalk network protocol implementation in the Linux kernel did not     properly perform permissions checks. A local attacker could use this to create a raw socket.
    (CVE-2019-17054)

    Ori Nimron discovered that the modular ISDN network protocol implementation in the Linux kernel did not     properly perform permissions checks. A local attacker could use this to create a raw socket.
    (CVE-2019-17055)

    Ori Nimron discovered that the Near field Communication (NFC) network protocol implementation in the Linux     kernel did not properly perform permissions checks. A local attacker could use this to create a raw     socket. (CVE-2019-17056)

    Nico Waisman discovered that a buffer overflow existed in the Realtek Wi-Fi driver for the Linux kernel     when handling Notice of Absence frames. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2019-17666)

    Maddie Stone discovered that the Binder IPC Driver implementation in the Linux kernel contained a use-     after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2019-2215)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
308094	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013255)	Nessus	Unity Linux Local Security Checks	2026/4/21	2026/4/21	low
181001	Oracle Linux 8 : kernel (ELSA-2020-1769)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/2/9	critical
131061	openSUSE Security Update : the Linux Kernel (openSUSE-2019-2507)	Nessus	SuSE Local Security Checks	2019/11/15	2024/4/11	critical
131833	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:3200-1)	Nessus	SuSE Local Security Checks	2019/12/9	2024/4/5	critical
138766	NewStart CGSL MAIN 6.01 : kernel Multiple Vulnerabilities (NS-SA-2020-0030)	Nessus	NewStart CGSL Local Security Checks	2020/7/21	2021/1/14	critical
130949	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2949-1)	Nessus	SuSE Local Security Checks	2019/11/13	2023/1/19	critical
141026	RHEL 7 : kernel-rt (RHSA-2020:4062)	Nessus	Red Hat Local Security Checks	2020/9/29	2024/11/7	high
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
131174	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4850)	Nessus	Oracle Linux Local Security Checks	2019/11/21	2026/2/9	high
130966	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4186-1)	Nessus	Ubuntu Local Security Checks	2019/11/13	2024/8/27	critical

检测

插件搜索

low

critical

critical

critical

critical

critical

high

critical

critical

high

critical