The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2416-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local     provilege escalation. (bsc#1188116)
    - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root     privileges. (bsc#1188062)
    - CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local     privilege escalation. (bsc#1187215)
    - CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the     system or possibly escalate their privileges on the system. (bsc#1187585)
    - CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation.
    (bsc#1187050)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2427-1 advisory.

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. (CVE-2020-36386)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This     could lead to local information disclosure in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476     (CVE-2021-0605)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

  - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

  - net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from     kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693)

  - To fix this vulnerability, update the affected packages: linux linux-esx (CVE-2021-3609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2427-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local     provilege escalation. (bsc#1188116)
    - CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary     kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
    - CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the     kernel with System execution privileges needed. (bsc#1187601)
    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187595)
    - CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
    - CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive     information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
    - CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to     potentially enable information disclosure via adjacent access. (bnc#1186463)
    - CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
    - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-     SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
    - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root     privileges. (bsc#1188062)
    - CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local     privilege escalation. (bsc#1187215)
    - CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation.
    (bsc#1187050)
    - CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2451-1 advisory.

    The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local     provilege escalation. (bsc#1188116)
    - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root     privileges. (bsc#1188062)
    - CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local     privilege escalation. (bsc#1187215)
    - CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the     kernel with System execution privileges needed. (bsc#1187601)
    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187595)
    - CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive     information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
    - CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation.
    (bsc#1187050)
    - CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to     potentially enable information disclosure via adjacent access. (bsc#1186463)
    - CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
    - CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
    - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-     SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)
    - CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller.
    (bsc#1184611)
    - CVE-2021-33034: Fixed an issue in net/bluetooth/hci_event.c where a use-after-free leads to writing an     arbitrary value. (bsc#1186111)
    - CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients     even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi     networks to launch denial-of-service attacks against connected clients and made it easier to exploit other     vulnerabilities in connected clients. (bsc#1186062)
    - CVE-2021-23134: Fixed a use After Free vulnerability in nfc sockets which allows local attackers to     elevate their privileges. (bsc#1186060)
    - CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network     packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP,     or GCMP. (bsc#1185859)
    - CVE-2020-26141: Fixed a flaw that could allows an adversary to inject and possibly decrypt packets in     WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bsc#1185987)
    - CVE-2020-26145: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an     adversary to inject arbitrary network packets. (bsc#1185860)
    - CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device     sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862)
    - CVE-2020-26147: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an     adversary to inject packets and/or exfiltrate selected fragments when another device sends fragmented     frames. (bsc#1185987)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2538-1 advisory.

    This update for the Linux Kernel 4.12.14-150_72 fixes several issues.

    The following security issues were fixed:

    - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root     privileges. (bsc#1188062)
    - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local     provilege escalation. (bsc#1188116)
    - CVE-2020-36385: Fixed a use-after-free vulnerability reached via the ctx_list in some ucma_migrate_id     situations where ucma_close is called. (bnc#1187050)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4597 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4770 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Bring in upstream serial kernel patch (BZ#2007936)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4798 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4971 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4798 advisory.

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4056 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

    * kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers()     of hid-input.c (CVE-2021-0512)

    * kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE) (CVE-2021-3656)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [HPE 8.3 bug] No EDAC MC0 message with one-DIMM two-processor configuration under RHEL8.3 (BZ#1982182)

    * mlx: devlink port function shows all zero hw_addr (BZ#1986837)

    * net/sched: act_mirred: allow saving the last chain processed on xmit path (BZ#1992230)

    * RHEL8.3 - System hang and / or r/o fs during SVC/v5k/v7k maintenance with ibmvfc (BZ#1993892)

    * RHEL8.1 Snapshot3 - PVT:940:virt:4TB:LPM operation failed by returning HSCLA2CF, HSCL365C SRC's - Linux     partition suspend timeout (-> documentation/Linux Alert through LTC bug 182549) (BZ#1993952)

    * RHEL8.4 - benchTableRepDMLAsyncBarrier regresses by 34% on RHEL8.4 on POWER9 compared to RHEL8.2     (performance) (BZ#1997431)

    * [panic] call trace: ice_probe+0x238/0x10f0 [ice] (BZ#1997539)

    * [ice, PTP] ice: fix GPIO 1PPS signal  (BZ#1997572)

    * Fix locality handling in the tpm_tis driver (BZ#1998219)

    * [ice, PTP]: fix Tx queue iteration for Tx timestamp enablement (BZ#2000128)

    * PCI passthrough with NVidia GPU Invalid device 0003:01:00.0 iommu_group file     /sys/bus/pci/devices/0003:01:00.0/iommu_group is not a symlink (BZ#2000602)

    * [DELL 8.4 BUG] - System Hangs at Dell Logo When Boot to OS(e1000e with wrong GbE checksum) (BZ#2002335)

    * RHEL8.4 - kernel: Fix hanging ioctl caused by wrong msg counter (BZ#2002635)

    * kernel: get_timespec64 does not ignore padding in compat syscalls (BZ#2003569)

    * [mlx5] eth0: hw csum failure (BZ#2005980)

    * xlog_grant_head_wait() does not return and system hangs (BZ#2007413)

    * panic while breaking a lease/delegation after user mode helper invocation (BZ#2010331)

    * Lockd invalid cast to nlm_lockowner (BZ#2010820)

    * [xfstests generic/388] XFS: Assertion failed: 0, file: fs/xfs/xfs_mount.c, line: 1218 (BZ#2011919)

    Enhancement(s):

    * [Intel 8.5 FEAT] ice: Enable PTP Support (BZ#1998220)

    * [Intel 8.5 FEAT] ice: Enable GPIO/SDP Support (BZ#1998221)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2426-1 advisory.

    The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps     and adopt further exploitations. (bsc#1186666)
    - CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the     kernel with System execution privileges needed. (bsc#1187601)
    - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege     with no additional execution privileges needed. (bsc#1187595)
    - CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary     kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
    - CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive     information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
    - CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to     potentially enable information disclosure via adjacent access (bnc#1186463).
    - CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where     ucma_close is called (bnc#1187050).
    - CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1     (bnc#1179610, bnc#1186463).
    - CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4687 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak     and eventually hanging-up the system. (CVE-2020-25673)

  - The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a     vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. (CVE-2020-28097)

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. (CVE-2020-36386)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This     could lead to local information disclosure in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476     (CVE-2021-0605)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

  - net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from     kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AOS installed on the remote host is prior to 5.20.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.3 advisory.

  - xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and     watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows     remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory     corruption) via a crafted XML document. (CVE-2016-4658)

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

  - A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2643-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c     (bsc#1188876).
    - CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS     memory corruption via rtas_args.nargs (bsc#1188838).
    - CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory     corruption due to a use after free. This could lead to local escalation of privilege with System execution     privileges needed. (bsc#1176724).
    - CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038).
    - CVE-2021-22543: Fixed an improper handling of VM_IO|VM_PFNMAP vmas in KVM that allows users to start and     control a VM to read/write random pages of memory and can result in local privilege escalation.
    (bnc#1186482)
    - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root     privileges. (bsc#1188062)
    - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local     provilege escalation. (bsc#1188116)
    - CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local     privilege escalation. (bsc#1187215)
    - CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the     system or possibly escalate their privileges on the system. (bsc#1187585)
    - CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation.
    (bsc#1187050)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
151873	SUSE SLED12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2416-1)	Nessus	SuSE Local Security Checks	2021/7/21	2026/6/25	high
151935	openSUSE 15 Security Update : kernel (openSUSE-SU-2021:2427-1)	Nessus	SuSE Local Security Checks	2021/7/22	2025/10/6	high
151989	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2427-1)	Nessus	SuSE Local Security Checks	2021/7/22	2026/6/25	high
152055	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2451-1)	Nessus	SuSE Local Security Checks	2021/7/23	2026/6/25	high
152116	SUSE SLES15: kernel-livepatch-4_12_14-150_72-default / etc (SUSE-SU-2021:2538-1)	Nessus	SuSE Local Security Checks	2021/7/28	2026/6/25	high
155149	RHEL 8 : kpatch-patch (RHSA-2021:4597)	Nessus	Red Hat Local Security Checks	2021/11/11	2024/11/8	high
155684	RHEL 7 : kernel (RHSA-2021:4770)	Nessus	Red Hat Local Security Checks	2021/11/23	2024/11/7	high
155688	RHEL 7 : kpatch-patch (RHSA-2021:4798)	Nessus	Red Hat Local Security Checks	2021/11/23	2024/11/8	high
155927	RHEL 7 : kpatch-patch (RHSA-2021:4971)	Nessus	Red Hat Local Security Checks	2021/12/8	2024/11/7	high
208560	CentOS 7 : kpatch-patch (RHSA-2021:4798)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	high
154834	RHEL 8 : kernel (RHSA-2021:4056)	Nessus	Red Hat Local Security Checks	2021/11/2	2025/3/6	high
151996	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2021:2426-1)	Nessus	SuSE Local Security Checks	2021/7/22	2026/6/25	high
155376	RHEL 8 : kernel (RHSA-2021:4687)	Nessus	Red Hat Local Security Checks	2021/11/17	2024/11/7	high
153703	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-2530)	Nessus	Huawei Local Security Checks	2021/9/27	2025/10/6	high
230248	Linux Distros Unpatched Vulnerability : CVE-2020-36385	Nessus	Misc.	2025/3/5	2026/7/17	high
164611	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.3)	Nessus	Misc.	2022/9/1	2026/7/24	high
152481	SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2021:2643-1)	Nessus	SuSE Local Security Checks	2021/8/11	2026/6/25	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high