The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3655-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    NOTE: This update was retracted due to a NFS regression.

    The following security bugs were fixed:

    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 (bnc#1192107).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-34866: Fixed eBPF Type Confusion Privilege Escalation Vulnerability (bsc#1191645).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB     driver) mishandles invalid descriptors, aka CID-a246b4d54770. (CVE-2020-11668)

  - A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest threat from this vulnerability is to data     confidentiality and integrity. (CVE-2020-14386)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common     function in drivers/tty/n_tty.c. (CVE-2020-8648)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.20.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.2 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2021-2388)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7173 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

    * kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3371-1 advisory.

    This update for the Linux Kernel 4.12.14-150_75 fixes several issues.

    The following security issues were fixed:

    - CVE-2021-3715: Fixed a user-after-free in the Linux kernel's Traffic Control networking subsystem which     could lead to local privilege escalation. (bsc#1190350).
    - CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an     untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c     (bsc#1190118)
    - CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local     privilege escalation. (bsc#1188613)
    - CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to     local privilege escalation. (bsc#1187054).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3459-1 advisory.

    This update for the Linux Kernel 4.4.180-94_144 fixes several issues.

    The following security issues were fixed:

    - CVE-2021-3715: Fixed a user-after-free in the Linux kernel's Traffic Control networking subsystem which     could lead to local privilege escalation. (bsc#1190350).
    - CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an     untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c     (bsc#1190118)
    - CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local     privilege escalation. (bsc#1188613)
    - CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to     local privilege escalation. (bsc#1187054).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004196 advisory.

    A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3446 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers()     of hid-input.c (CVE-2021-0512)

    * kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

    * kernel: powerpc: KVM guest OS users can cause host OS memory corruption (CVE-2021-37576)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Guest kernel call trace when boot up with 4T memory and 2 vcpus (BZ#1993552)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3443 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers()     of hid-input.c (CVE-2021-0512)

    * kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

    * kernel: powerpc: KVM guest OS users can cause host OS memory corruption (CVE-2021-37576)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3972-1 advisory.

    The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have     happened in the past (jsc#SLE-22573)

      You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
    (kernel.unprivileged_bpf_disabled = 0)


    The following security bugs were fixed:

    - CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use     after free. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation (bnc#1192045).
    - CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-     ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker     with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system     crash or a leak of internal kernel information. The highest threat from this vulnerability is to system     availability (bnc#1192781).
    - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks     about UDP ports in use. (bsc#1191790)
    - CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).
    - CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in     drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state     (bnc#1188601).
    - CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and     cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent     possibility of information disclosure. (bnc#1191193)
    - CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module.
    (bsc#1190023)
    - CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local     priviledge escalation. (bnc#1190159)
    - CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
    - CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
    - CVE-2021-3772: Fixed a remote denial of service in the SCTP stack, if the attacker can spoof IP     addresses and knows the IP-addresses and port numbers being used (bnc#1190351).
    - CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect     (bsc#1108488).
    - CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace     applications (bnc#1129898).
    - CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx()     (bnc#1133374).
    - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth     stack (bsc#1188172).
    - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable     AVIC support for the L2 guest. (bsc#1189399).
    - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to     disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
    - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses     trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use     this flaw to starve the resources causing denial of service (bnc#1189057).
    - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
    - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
    - CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS     attacks (bsc#1190115).
    - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a     buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
    - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow     page, leading to a missing guest protection page fault (bnc#1189262).
    - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial     of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations     (bnc#1189291).
    - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program     that could have obtain sensitive information from kernel memory (bsc#1188983).
    - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of     arbitrary kernel memory (bsc#1188985).
    - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
    - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c     (bsc#1188876).
    - CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and     can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the     ability to start and control a VM to read/write random pages of memory and can result in local privilege     escalation (bsc#1186482).
    - CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS     memory corruption via rtas_args.nargs (bsc#1188838).
    - CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory     corruption due to a use after free. This could lead to local escalation of privilege with System execution     privileges needed. (bsc#1176724).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3640-1 advisory.

    The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 (bnc#1192107).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3655-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    NOTE: This update was retracted due to a NFS regression.

    The following security bugs were fixed:

    - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 (bnc#1192107).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-34866: Fixed eBPF Type Confusion Privilege Escalation Vulnerability (bsc#1191645).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1477-1 advisory.

    The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an     unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by     a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose     group ownership is that group. The intended behavior was that the non-member can trigger creation of a     directory (but not a plain file) whose group ownership is that group. The non-member can escalate     privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).
    - CVE-2021-33033: The Linux kernel had a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c     because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd.
    This leads to writing an arbitrary value (bnc#1186109 bnc#1188876).
    - CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a     Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of     uninitialized memory locations on the BPF stack (bnc#1188983).
    - CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a     Speculative Store Bypass side-channel attack because a certain preempting store operation did not     necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).
    - CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read     uninitialized memory (bnc#1188563 bnc#1192267).
    - CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-3772: Invalid chunks may be used to remotely remove existing associations (bsc#1190351).
    - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c     (bsc#1191958).
    - CVE-2021-41864: prealloc_elems_and_freelist in kernel/bpf/stackmap.c allowed unprivileged users to     trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: The decode_data function in drivers/net/hamradio/6pack.c had a slab out-of-bounds write.
    Input from a process that has the CAP_NET_ADMIN capability can lead to root access (bnc#1191315).
    - CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c     where local attackers were able to access the Aspeed LPC control interface could overwrite memory in the     kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison     uses values that are not memory sizes (bnc#1190479).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673     bnc#1192036).
    - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-     avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking     (bsc#1184673).
    - CVE-2021-43056: It allowed a malicious KVM guest to crash the host, when the host is running on Power8,     due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register     values (bnc#1192107).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - An out-of-bounds memory write flaw was found in how the Linux kernel's Voice Over IP H.323 connection     tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote     user to crash the system, causing a denial of service. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-14305)

  - There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common     function in drivers/tty/n_tty.c. (CVE-2020-8648)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.0.2 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2021-2388)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.20.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.3 advisory.

  - xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and     watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows     remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory     corruption) via a crafted XML document. (CVE-2016-4658)

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

  - A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155302	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3655-1)	Nessus	SuSE Local Security Checks	2021/11/12	2026/6/26	high
187322	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2023-0057)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2026/6/3	high
164568	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.2)	Nessus	Misc.	2022/9/1	2025/10/6	high
166539	RHEL 7 : kpatch-patch (RHSA-2022:7173)	Nessus	Red Hat Local Security Checks	2022/10/26	2024/11/7	high
154073	SUSE SLES15 Security Update : kernel (Live Patch 25 for SLE 15) (SUSE-SU-2021:3371-1)	Nessus	SuSE Local Security Checks	2021/10/13	2026/6/25	high
154210	SUSE SLES12 Security Update : kernel (Live Patch 39 for SLE 12 SP3) (SUSE-SU-2021:3459-1)	Nessus	SuSE Local Security Checks	2021/10/19	2026/6/25	high
288744	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004196)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/17	high
153100	RHEL 8 : kernel (RHSA-2021:3446)	Nessus	Red Hat Local Security Checks	2021/9/7	2024/11/7	high
153101	RHEL 8 : kpatch-patch (RHSA-2021:3443)	Nessus	Red Hat Local Security Checks	2021/9/7	2024/11/7	high
155959	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3972-1)	Nessus	SuSE Local Security Checks	2021/12/9	2026/6/25	high
155007	SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2021:3640-1)	Nessus	SuSE Local Security Checks	2021/11/10	2026/6/25	high
155299	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:3655-1)	Nessus	SuSE Local Security Checks	2021/11/12	2025/12/30	high
155358	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:1477-1)	Nessus	SuSE Local Security Checks	2021/11/16	2025/12/30	high
167477	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2022-0078)	Nessus	NewStart CGSL Local Security Checks	2022/11/15	2026/6/3	high
164560	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.0.2)	Nessus	Misc.	2022/9/1	2025/10/6	high
164611	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.3)	Nessus	Misc.	2022/9/1	2026/7/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high