Slackware 14.2 可使用新的内核程序包修复安全问题。

セキュリティ問題を修正する新しいカーネルパッケージが、Slackware 14.2で利用可能です。

現已提供適用於 Slackware 14.2 的新核心套件，可修正多個安全性問題。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ashmem.c の calc_vm_may_flags で、権限バイパスのために、共有メモリへの任意の書き込みの可能性があります。これにより、追加の実行権限を必要とせずに、プロセス間で共有されるメモリを破損することで、ローカルの権限昇格が引き起こされる可能性があります。悪用はユーザーの操作を必要としません。製品AndroidバージョンAndroidカーネルAndroid IDA-142938932CVE-2020-0009

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

この更新は、サポートされているすべてのアーキテクチャで現在利用可能です。参照内容については、オリジナルのアドバイザリテキストが準拠しています。

Linuxカーネルに、権限昇格、サービス拒否、または情報漏えいを引き起こす可能性がある、複数の脆弱性が見つかりました。

CVE-2015-8839

ext4ファイルシステムの実装で競合状態が見つかりました。ローカルユーザーはこれを悪用して、サービス拒否（ファイルシステム破損）を引き起こす可能性があります。

CVE-2018-14610、CVE-2018-14611、CVE-2018-14612、CVE-2018-14613

GatechのSSLabのWen Xu氏は、細工されたBtrfsボリュームがクラッシュ（Oops）および/または境界外メモリアクセスを引き起こす可能性があることを報告しました。そうしたボリュームをマウントすることが可能な攻撃者がこれを利用して、サービス拒否または権限昇格を引き起こす可能性があります。

CVE-2019-5108

CiscoのMitchell Frank氏は、IEEE 802.11（WiFi）スタックがローミングのAPモードで使用されると、新しく関連づけられたステーションのローミングがステーションの認証前にトリガーされることを発見しました。APの範囲内の攻撃者がこれを利用してスイッチングテーブルに入力したり、他のステーションからのトラフィックをリダイレクトしてサービス拒否を引き起こす可能性があります。

CVE-2019-19319

Jungyeon氏は、細工されたファイルシステムにより、ext4実装がジャーナルブロックの割り当て解除または再割り当てを行う可能性があることを発見しました。ファイルシステムのマウントが許可されているユーザーはこれをサービス拒否（クラッシュ）、または権限昇格のために使用する可能性があります。

CVE-2019-19447

ext4ファイルシステムドライバーにおいて、ファイルシステムの破損によりリンクカウントがすでに0になっているinodeのリンク解除が安全に処理されていないことが判明しました。任意のext4ボリュームをマウントできる攻撃者がこれを利用して、サービス拒否（メモリ破損またはクラッシュ）を引き起こしたり、権限昇格を引き起こしたりする可能性がありました。

CVE-2019-19768

Tristan Madani氏は、Use-After-Freeを引き起こす可能性のあるblktraceデバッグ機能における競合状態を報告しました。ブロックデバイスを削除できるローカルユーザーはこれをサービス拒否（クラッシュ）、または権限昇格のために使用する可能性があります。

CVE-2019-20636

sizbotツールでは、入力サブシステムがキーコードの変更を完全には検証せず、ヒープの領域外書き込みを引き起こす可能性があることが検出されました。入力用デバイスノードまたはVTデバイスにアクセスできるローカルユーザーはこれをサービス拒否（クラッシュやメモリの破損）、または権限昇格のために使用する可能性があります。

CVE-2020-0009

Jann Horn氏は、Androidのashmemドライバーが、読み取り専用ファイルのメモリマッピング、およびその後の読み取り/書きこみ可能としての再マッピングを妨げていないと報告しました。ただし、AndroidドライバーはDebianカーネル構成では有効になっていません。

CVE-2020-0543

VU Amsterdamの研究者は、RDRANDとRDSEED命令をサポートしている一部のIntel CPUでは、これらの命令によって生成されたランダム値の一部が、後で同じ物理CPUの任意のコアで投機的に実行される可能性があることを発見しました。これらの命令のアプリケーションでの使用方法によっては、ローカルユーザーまたはVMゲストがこれを使用して、他のユーザーまたはVMから暗号化キーなどの秘密情報を取得する可能性があります。

この脆弱性は、システムファームウェア（BIOS）の一部として、またはDebianの有償アーカイブセクションのintel-microcodeパッケージを通じたマイクロコードの更新によって緩和することができます。このカーネル更新は、脆弱性のレポート、および必要でない場合に緩和を無効にするオプションのみを提供します。

CVE-2020-1749

Xiumei Mu氏は、IPv6で実行できる一部のネットワークプロトコルが、IPsec、IPcomp/IPcomp6、IPIP、IPv6 Mobilityによって使用される変換（XFRM）レイヤーをバイパスすることを報告しました。これはシステムポリシーに従い、暗号化またはルーティングされることがないため、ネットワーク上の情報が漏洩する可能性があります。

CVE-2020-2732

Paulo Bonzini氏は、ネスト化された仮想化が有効な場合、IntelプロセッサのKVM実装がL2ゲストの命令エミュレーションを適切に処理しないことを発見しました。これにより、L2ゲストがL1ゲストで権限昇格、サービス拒否、または情報漏洩を引き起こす可能性があります。

CVE-2020-8647、CVE-2020-8649

HulkRobotツールにより、vgaconドライバーで潜在的なMMIO領域外アクセスが検出されました。vgaconドライバーを使用して仮想ターミナル（/dev/tty1など）にアクセスできるローカルユーザーはこれをサービス拒否（クラッシュやメモリの破損）、または権限昇格のために使用する可能性があります。

CVE-2020-8648

sizbotツールにより、仮想ターミナルドライバーでUse-After-Freeを引き起こす可能性のある競合状態が検出されました。仮想ターミナルにアクセスできるローカルユーザーはこれをサービス拒否（クラッシュやメモリの破損）、または権限昇格のために使用する可能性があります。

CVE-2020-9383

Jordy Zmer氏は、フロッピードライバー内で静的領域外アクセスを引き起こす可能性がある不適切な範囲チェックを報告しました。フロッピードライブにアクセスできるローカルユーザーはこれをサービス拒否（クラッシュやメモリの破損）、または権限昇格のために使用する可能性があります。

CVE-2020-10690

PTPハードウェアクロックサブシステムでデバイスの有効期限が適切に管理されていないことが検出されました。ユーザープロセスで使用されている間にPTPハードウェアクロックをシステムから削除すると、Use-After-Freeが発生する可能性があります。これによるセキュリティ上の影響は不明です。

CVE-2020-10751

Dmitry Vyukov氏は、SELinuxサブシステムが複数のメッセージの検証を適切に処理しておらず、これによって権限のある攻撃者がSELinux netlink制限をバイパスする可能性があることを報告しました。

CVE-2020-10942

vhost_netドライバーが、バックエンドとして設定されたソケットのタイプを適切に検証しないことが判明しました。/dev/vhost-netへのアクセス権を付与されたローカルユーザーが、これを利用して細工されたシステムコールを介してスタック破損やサービス拒否（クラッシュ）を引き起こしたり、権限昇格を実行したりする可能性があります。

CVE-2020-11494

slcan（シリアルラインCAN）ネットワークドライバーが受信したパケットのCANヘッダーを完全に初期化せず、その結果、カーネルからユーザー空間へ、またはCANネットワーク上で情報漏洩が発生したことが判明しました。

CVE-2020-11565

Entropy Moe氏は、共有メモリファイルシステム（tmpfs）が空のノードリストを指定する「mpol」マウントオプションを正しく処理せず、スタックベースの領域外書き込みが発生することを報告しました。ユーザーの名前空間が有効な場合、ローカルユーザーはこれをサービス拒否（クラッシュ）、または権限昇格のために使用する可能性があります。

CVE-2020-11608、CVE-2020-11609、CVE-2020-11668

ov519、stv06xx、およびxirlink_pitのメディアドライバーが、USBデバイス記述子を適切に検証していないことが判明しました。特別に構築されたUSBデバイスを備えた実在のユーザーが、これをサービス拒否（クラッシュ）や権限昇格に使用する可能性があります。

CVE-2020-12114

Piotr Krysiuk氏は、ファイルシステムコア（vfs）のumountとpivot_rootの操作間の競合状態を発見しました。すべてのユーザー名前空間でCAP_SYS_ADMINを実行できるローカルユーザーは、これを使用して、サービス拒否（クラッシュ）を引き起こす可能性があります。

CVE-2020-12464

Kyungae Kim氏は、USBコアの競合状態により、Use-After-Freeが発生する可能性があることを報告しました。これを悪用する方法は明確ではありませんが、サービス拒否（クラッシュまたはメモリ破損）または権限昇格が発生する可能性があります。

CVE-2020-12652

Tom Hatskevich氏は、mptfusionストレージドライバーのバグを報告しました。ioctlハンドラーがユーザーメモリからパラメーターを2回フェッチしたため、内部データ構造の不適切なロックを引き起こす可能性がある競合状態が発生しました。/dev/mptctlにアクセスできるローカルユーザーはこれをサービス拒否（クラッシュやメモリの破損）、または権限昇格のために使用する可能性があります。

CVE-2020-12653

mwifiex WiFiドライバーがスキャンリクエストを十分に検証しなかったため、ヒープバッファオーバーフローが発生する可能性があることが判明しました。CAP_NET_ADMIN機能を使用できるローカルユーザーはこれをサービス拒否（クラッシュやメモリの破損）、または権限昇格のために使用する可能性があります。

CVE-2020-12654

mwifiex WiFiドライバーがアクセスポイント（AP）から受信したWMMパラメーターを十分に検証しなかったため、ヒープバッファオーバーフローが発生する可能性があることが判明しました。悪意のあるAPがこれを利用して、脆弱なシステムでサービス拒否（クラッシュまたはメモリ破損）を引き起こしたり、コードを実行したりする可能性があります。

CVE-2020-12769

spi-dw SPIホストドライバーが内部状態へのアクセスを適切にシリアル化していないことがわかりました。このセキュリティへの影響は不明であり、このドライバーはDebianのバイナリパッケージに含まれていません。

CVE-2020-12770

特定のエラーの場合に、sg（SCSIジェネリック）ドライバーが内部リソースを正しくリリースしないことが判明しました。sgドライバーにアクセスできるローカルユーザーがこれを悪用して、サービス拒否（リソースの枯渇）を引き起こす可能性がありました。

CVE-2020-12826

Adam Zabrocki氏は、signalサブシステムの権限チェックの弱点を報告しました。親プロセスは、終了時に子プロセスから送信される任意のシグナルを選択できますが、親が新しいプログラムを実行した場合は、デフォルトのSIGCHLDシグナルが送信されます。数日間プログラムの実行を許可されたローカルのユーザーが、このチェックをバイパスしてsetuidプログラムを実行し、その後任意の信号を送信する可能性があります。
インストールされているsetuidプログラムによっては、これがセキュリティに影響を及ぼす可能性があります。

CVE-2020-13143

Kyungae Kim氏は、USBガジェットサブシステムのヒープ領域外書き込みの可能性を報告しました。ガジェット構成ファイルシステムへの書き込みが許可されているローカルユーザーは、これをサービス拒否（クラッシュやメモリの破損）、または権限昇格のために使用する可能性があります。

Debian 8「Jessie」では、これらの問題はバージョン3.16.84-1で修正されました。

お使いの linux パッケージをアップグレードすることを推奨します。

注: Tenable Network Securityは、前述の記述ブロックを DLA セキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 ashmem.c 的 calc_vm_may_flags 中因權限繞過可能導致共用記憶體任意寫入。這可透過損毀處理程序之間共用的記憶體導致本機權限提升且不需要額外的執行權限。不需使用者互動即可惡意利用。產品Android 版本Android 核心 Android ID A-142938932 (CVE-2020-0009)

請注意，Nessus 依賴供應商報告的套件存在。

現已針對所有受支援的架構提供此更新。原始公告文字如下，僅供參考。

在 Linux 核心中發現數個弱點，這些弱點可能會導致權限提升、拒絕服務或資訊洩漏。

CVE-2015-8839

在 ext4 檔案系統實作中發現一個爭用情形。本機使用者可惡意利用此瑕疵引發拒絕服務 (檔案系統損毀)。

CVE-2018-14610、CVE-2018-14611、CVE-2018-14612、CVE-2018-14613

Gatech SSLab 的 Wen Xu 報告，特製的 Btrfs 磁碟區可能會觸發當機 (Oops) 和/或超出邊界記憶體存取。能夠裝載這個磁碟區的攻擊者可利用此弱點造成拒絕服務，或可能造成權限提升。

CVE-2019-5108

Cisco 的 Mitchell Frank 發現，在支援漫遊的 AP 模式中使用 IEEE 802.11 (WiFi) 堆疊時，會在工作站驗證之前針對新關聯的工作站觸發漫遊。AP 範圍內的攻擊者可利用此問題造成拒絕服務，方法是填寫交換表或將流量重新導向離開其他工作站。

CVE-2019-19319

Jungyeon 發現，特製的檔案系統可造成 ext4 實作解除配置或重新配置日誌區塊。能夠裝載檔案系統的使用者可利用此問題，造成拒絕服務 (當機) 或可能提升權限。

CVE-2019-19447

據發現，ext4 檔案系統驅動程式並未安全地處理因檔案系統損毀而已經具有 0 連結計數的 inode 解除連結。能夠掛載任意 ext4 磁碟區的攻擊者可利用此弱點，造成拒絕服務 (記憶體損毀或當機) 或可能提升權限。

CVE-2019-19768

Tristan Madani 報告，blktrace 偵錯工具中存在一個爭用情形，可導致釋放後使用。能夠觸發移除區塊裝置的本機使用者可利用此問題，造成拒絕服務 (當機) 或權限提升。

CVE-2019-20636

syzbot工具發現輸入子系統未完整驗證金鑰程式碼變更，其可導致堆積超出邊界寫入。可存取輸入或 VT 裝置節點的本機使用者可利用此弱點造成拒絕服務 (記憶體損毀或當機)，或可能造成權限提升。

CVE-2020-0009

Jann Horn 報告，Android ashmem 驅動程式並未防止唯讀檔案遭到記憶體對應，然後重新對應為讀寫。不過，在 Debian 核心組態中並未啟用 Android 驅動程式。

CVE-2020-0543

VU Amsterdam 的研究人員發現，在某些支援 RDRAND 和 RDSEED 指令的 Intel CPU 上，由這些指令產生的部分隨機值可能在之後在相同實體 CPU 的任何核心進行推測執行時使用。根據應用程式使用這些指令的方式而定，本機使用者或 VM 客體可利用此弱點，從其他使用者或 VM 取得敏感資訊，例如密碼編譯金鑰。

此弱點可透過微碼更新來緩解，可以作為系統韌體 (BIOS) 的一部分，也可以透過 Debian 非釋放封存區段中的 intel-microcode 套件來執行。此核心更新僅提供有關此弱點的報告，以及在不需要時停用緩解措施的選項。

CVE-2020-1749

Xiumei Mu 報告，某些可在 IPv6 上執行的網路通訊協定會繞過 IPsec、IPcomp/IPcomp6、IPIP 和 IPv6 Mobility 所使用的轉換 (XFRM) 層。這可能會造成透過網路洩漏資訊，因為系統不會根據系統原則加密或路由該資訊。

CVE-2020-2732

Paulo Bonzini 發現，啟用巢狀虛擬化時，Intel 處理器的 KVM 實作未正確處理 L2 客體的指令模擬。這可允許 L2 客體在 L1 客體中造成權限提升、拒絕服務或資訊洩漏。

CVE-2020-8647、CVE-2020-8649

Hulk Robot 工具在 vgacon 驅動程式中發現潛在的 MMIO 超出邊界存取問題。可在使用 vgacon 驅動程式的系統中存取虛擬終端 (/dev/tty1 etc.) 的本機使用者可利用此弱點，造成拒絕服務 (當機或記憶體損毀)，或可能造成權限提升。

CVE-2020-8648

syzbot 工具在虛擬終端機驅動程式中發現一個爭用情形，可導致釋放後使用。可存取虛擬終端的本機使用者可利用此弱點，造成拒絕服務 (當機或記憶體損毀)，或可能造成權限提升。

CVE-2020-9383

Jordy Zomer 報告，磁碟片驅動程式中存在不正確的範圍檢查，可導致靜態超出邊界存取。可存取磁碟片驅動程式的本機使用者可利用此弱點，造成拒絕服務 (當機或記憶體損毀)，或可能造成權限提升。

CVE-2020-10690

據發現，PTP 硬體時鍾子系統未正確管理裝置存留期。若在使用者處理程序使用 PTP 硬體時鐘的情況下將其移除，會導致釋放後使用。此弱點的安全性影響不明。

CVE-2020-10751

Dmitry Vyukov 報告，SELinux 子系統未正確處理多個訊息的驗證，有權限的攻擊者可藉此繞過 SELinux netlink 限制。

CVE-2020-10942

據發現，vhost_net 驅動程式未正確驗證設為後端的通訊端類型。有權存取 /dev/vhost-net 的本機攻擊者可利用此弱點，透過精心構建的系統呼叫造成堆疊損毀，進而導致拒絕服務或可能造成權限提升。

CVE-2020-11494

據發現，slcan (序列行 CAN) 網路驅動程式並未針對接收的封包完全初始化 CAN 標頭，進而導致核心中的資訊洩漏至使用者空間或透過 CAN 網路造成資訊洩漏。

CVE-2020-11565

Entropy Moe 報告，共用記憶體檔案系統 (tmpfs) 未正確處理指定空白節點清單的「mpol」掛載選項，進而導致堆疊型超出邊界寫入。若已啟用使用者命名空間，本機使用者即可利用此問題，造成拒絕服務 (當機) 或可能提升權限。

CVE-2020-11608、CVE-2020-11609、CVE-2020-11668

據發現，ov519、stv06xx 和 xirlink_cy 媒體驅動程式未正確驗證 USB 裝置描述符號。使用特製 USB 裝置的實際使用者可以利用此問題導致拒絕服務 (當機)，或者可能造成權限提升。

CVE-2020-12114

Piotr Krysiuk 發現，檔案系統核心 (vfs) 中的 umount 和 ivot_root 作業之間有一個爭用情形。在任何使用者名稱空間中具備 CAP_SYS_ADMIN 權限的本機使用者可利用此缺陷，造成拒絕服務 (當機)。

CVE-2020-12464

Kyungtae Kim 報告，USB 核心中有一個爭用情形，可導致釋放後使用。目前尚不清楚如何攻擊此弱點，但其可導致拒絕服務 (當機或記憶體損毀) 或權限提升。

CVE-2020-12652

Tom Hatskevich 報告 mptfusion 儲存驅動程式中有一個錯誤。ioctl 處置程式會從使用者記憶體擷取參數兩次，從而造成爭用情形，這可導致錯誤鎖定內部資料結構。可存取 /dev/mptctl 的本機使用者可利用此弱點，造成拒絕服務 (當機或記憶體損毀)，或可能造成權限提升。

CVE-2020-12653

據發現，mwifiex WiFi 驅動程式未充分驗證掃描要求，可能導致堆積緩衝區溢位。具有 CAP_NET_ADMIN 權限的本機使用者可利用此弱點造成拒絕服務 (當機或記憶體損毀) 或可能提升權限。

CVE-2020-12654

據發現，mwifiex WiFi 驅動程式未充分驗證自存取點 (AP) 接收的 WMM 參數，這可能導致堆積緩衝區溢位。惡意 AP 可利用此弱點，造成拒絕服務 (當機或記憶體損毀)，或可能在易受攻擊的系統上執行程式碼。

CVE-2020-12769

據發現，spi-dw SPI 主機驅動程式未對其內部狀態的存取正確進行序列化。此問題的安全性影響尚不清楚，Debian 的二進位套件中亦未包含此驅動程式。

CVE-2020-12770

據發現，sg (SCSI 泛型) 驅動程式未在特定錯誤情況下正確釋放內部資源。可存取 sg 裝置的本機攻擊者可利用此問題引發拒絕服務 (資源耗盡)。

CVE-2020-12826

Adam Zabrocki 報告，訊號子系統的權限檢查中有一個弱點。父處理程序可以選擇任意訊號，讓子處理程序在結束時傳送，但如果父處理程序已執行新程式，則會傳送預設的 SIGCHLD 訊號。允許執行程式數天的本機使用者可繞過此檢查，執行 setuid 程式，然後傳送任意訊號至該程式。
根據安裝的 setuid 程式而定，這可能會造成一些安全性影響。

CVE-2020-13143

Kyungtae Kim 報告，USB 小工具子系統中可能存在堆積超出邊界寫入。可寫入小工具組態檔案系統的本機使用者可利用此弱點，造成拒絕服務 (當機或記憶體損毀)，或可能造成權限提升。

針對 Debian 8「Jessie」，已在 3.16.84-1 版本中修正這些問題。

建議您升級 linux 套件。

注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel     through 5.3.12 allows a NULL pointer dereference     because rcu_dereference(root->node) can be     zero.(CVE-2019-19036)

  - An issue was discovered in the Linux kernel before     5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a     reference count is mishandled, aka     CID-a3e23f719f5c.(CVE-2019-20811)

  - In calc_vm_may_flags of ashmem.c, there is a possible     arbitrary write to shared memory due to a permissions     bypass. This could lead to local escalation of     privilege by corrupting memory shared between     processes, with no additional execution privileges     needed. User interaction is not needed for     exploitation. Product: Android Versions: Android kernel     Android ID: A-142938932(CVE-2020-0009)

  - ** DISPUTED ** An issue was discovered in the Linux     kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c     has a memory leak, aka CID-d80b64ff297e. NOTE: third     parties dispute this issue because it's a one-time leak     at the boot, the size is negligible, and it can't be     triggered at will.(CVE-2020-12768)

  - ** DISPUTED ** An issue was discovered in the Linux     kernel through 5.7.1. drivers/tty/vt/keyboard.c has an     integer overflow if k_ascii is called several times in     a row, aka CID-b86dab054059. NOTE: Members in the     community argue that the integer overflow does not lead     to a security issue in this case.(CVE-2020-13974)

  - In the Linux kernel through 5.7.6, usbtest_disconnect     in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)

  - A NULL pointer dereference flaw was found in the Linux     kernel's SELinux subsystem in versions before 5.7. This     flaw occurs while importing the Commercial IP Security     Option (CIPSO) protocol's category bitmap into the     SELinux extensible bitmap via the'     ebitmap_netlbl_import' routine. While processing the     CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security     attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue     leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This     flaw allows a remote network user to crash the system     kernel, resulting in a denial of service(     CVE-2020-10711)

  - A flaw was found in the Linux kernel's implementation     of Userspace core dumps. This flaw allows an attacker     with a local account to crash a trivial program and     exfiltrate private kernel data.(CVE-2020-10732)

  - A flaw was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further processing.(CVE-2020-10751)

  - A buffer over-read flaw was found in RH kernel versions     before 5.0 in crypto_authenc_extractkeys in     crypto/authenc.c in the IPsec Cryptographic algorithm's     module, authenc. When a payload longer than 4 bytes,     and is not following 4-byte alignment boundary     guidelines, it causes a buffer over-read threat,     leading to a system crash. This flaw allows a local     attacker with user privileges to cause a denial of     service.(CVE-2020-10769)

  - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the     NFS server) can set incorrect permissions on new     filesystem objects when the filesystem lacks ACL     support, aka CID-22cf8419f131. This occurs because the     current umask is not considered.(CVE-2020-24394)

  - The Linux kernel through 5.7.11 allows remote attackers     to make observations that help to obtain sensitive     information about the internal state of the network     RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)

  - A flaw was found in the Linux kernel's implementation     of GRO in versions before 5.2. This flaw allows an     attacker with local access to crash the     system.(CVE-2020-10720)

  - In the Linux kernel through 5.8.7, local attackers able     to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering     use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in     net/netfilter/nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a     permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between     processes, with no additional execution privileges needed. User interaction is not needed for     exploitation. Product: Android Versions: Android kernel Android ID: A-142938932 (CVE-2020-0009)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update is now available for all supported architectures. For reference the original advisory text follows.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2015-8839

A race condition was found in the ext4 filesystem implementation. A local user could exploit this to cause a denial of service (filesystem corruption).

CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613

Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes could trigger a crash (Oops) and/or out-of-bounds memory access. An attacker able to mount such a volume could use this to cause a denial of service or possibly for privilege escalation.

CVE-2019-5108

Mitchell Frank of Cisco discovered that when the IEEE 802.11 (WiFi) stack was used in AP mode with roaming, it would trigger roaming for a newly associated station before the station was authenticated. An attacker within range of the AP could use this to cause a denial of service, either by filling up a switching table or by redirecting traffic away from other stations.

CVE-2019-19319

Jungyeon discovered that a crafted filesystem can cause the ext4 implementation to deallocate or reallocate journal blocks. A user permitted to mount filesystems could use this to cause a denial of service (crash), or possibly for privilege escalation.

CVE-2019-19447

It was discovered that the ext4 filesystem driver did not safely handle unlinking of an inode that, due to filesystem corruption, already has a link count of 0. An attacker able to mount arbitrary ext4 volumes could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-19768

Tristan Madani reported a race condition in the blktrace debug facility that could result in a use-after-free. A local user able to trigger removal of block devices could possibly use this to cause a denial of service (crash) or for privilege escalation.

CVE-2019-20636

The syzbot tool found that the input subsystem did not fully validate keycode changes, which could result in a heap out-of-bounds write. A local user permitted to access the device node for an input or VT device could possibly use this to cause a denial of service (crash or memory corruption) or for privilege escalation.

CVE-2020-0009

Jann Horn reported that the Android ashmem driver did not prevent read-only files from being memory-mapped and then remapped as read-write. However, Android drivers are not enabled in Debian kernel configurations.

CVE-2020-0543

Researchers at VU Amsterdam discovered that on some Intel CPUs supporting the RDRAND and RDSEED instructions, part of a random value generated by these instructions may be used in a later speculative execution on any core of the same physical CPU. Depending on how these instructions are used by applications, a local user or VM guest could use this to obtain sensitive information such as cryptographic keys from other users or VMs.

This vulnerability can be mitigated by a microcode update, either as part of system firmware (BIOS) or through the intel-microcode package in Debian's non-free archive section. This kernel update only provides reporting of the vulnerability and the option to disable the mitigation if it is not needed.

CVE-2020-1749

Xiumei Mu reported that some network protocols that can run on top of IPv6 would bypass the Transformation (XFRM) layer used by IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result in disclosure of information over the network, since it would not be encrypted or routed according to the system policy.

CVE-2020-2732

Paulo Bonzini discovered that the KVM implementation for Intel processors did not properly handle instruction emulation for L2 guests when nested virtualization is enabled. This could allow an L2 guest to cause privilege escalation, denial of service, or information leaks in the L1 guest.

CVE-2020-8647, CVE-2020-8649

The Hulk Robot tool found a potential MMIO out-of-bounds access in the vgacon driver. A local user permitted to access a virtual terminal (/dev/tty1 etc.) on a system using the vgacon driver could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-8648

The syzbot tool found a race condition in the the virtual terminal driver, which could result in a use-after-free. A local user permitted to access a virtual terminal could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-9383

Jordy Zomer reported an incorrect range check in the floppy driver which could lead to a static out-of-bounds access. A local user permitted to access a floppy drive could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-10690

It was discovered that the PTP hardware clock subsystem did not properly manage device lifetimes. Removing a PTP hardware clock from the system while a user process was using it could lead to a use-after-free. The security impact of this is unclear.

CVE-2020-10751

Dmitry Vyukov reported that the SELinux subsystem did not properly handle validating multiple messages, which could allow a privileged attacker to bypass SELinux netlink restrictions.

CVE-2020-10942

It was discovered that the vhost_net driver did not properly validate the type of sockets set as back-ends. A local user permitted to access /dev/vhost-net could use this to cause a stack corruption via crafted system calls, resulting in denial of service (crash) or possibly privilege escalation.

CVE-2020-11494

It was discovered that the slcan (serial line CAN) network driver did not fully initialise CAN headers for received packets, resulting in an information leak from the kernel to user-space or over the CAN network.

CVE-2020-11565

Entropy Moe reported that the shared memory filesystem (tmpfs) did not correctly handle an 'mpol' mount option specifying an empty node list, leading to a stack-based out-of-bounds write. If user namespaces are enabled, a local user could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2020-11608, CVE-2020-11609, CVE-2020-11668

It was discovered that the ov519, stv06xx, and xirlink_cit media drivers did not properly validate USB device descriptors. A physically present user with a specially constructed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2020-12114

Piotr Krysiuk discovered a race condition between the umount and pivot_root operations in the filesystem core (vfs). A local user with the CAP_SYS_ADMIN capability in any user namespace could use this to cause a denial of service (crash).

CVE-2020-12464

Kyungtae Kim reported a race condition in the USB core that can result in a use-after-free. It is not clear how this can be exploited, but it could result in a denial of service (crash or memory corruption) or privilege escalation.

CVE-2020-12652

Tom Hatskevich reported a bug in the mptfusion storage drivers. An ioctl handler fetched a parameter from user memory twice, creating a race condition which could result in incorrect locking of internal data structures. A local user permitted to access /dev/mptctl could use this to cause a denial of service (crash or memory corruption) or for privilege escalation.

CVE-2020-12653

It was discovered that the mwifiex WiFi driver did not sufficiently validate scan requests, resulting a potential heap buffer overflow. A local user with CAP_NET_ADMIN capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.

CVE-2020-12654

It was discovered that the mwifiex WiFi driver did not sufficiently validate WMM parameters received from an access point (AP), resulting a potential heap buffer overflow. A malicious AP could use this to cause a denial of service (crash or memory corruption) or possibly to execute code on a vulnerable system.

CVE-2020-12769

It was discovered that the spi-dw SPI host driver did not properly serialise access to its internal state. The security impact of this is unclear, and this driver is not included in Debian's binary packages.

CVE-2020-12770

It was discovered that the sg (SCSI generic) driver did not correctly release internal resources in a particular error case. A local user permitted to access an sg device could possibly use this to cause a denial of service (resource exhaustion).

CVE-2020-12826

Adam Zabrocki reported a weakness in the signal subsystem's permission checks. A parent process can choose an arbitary signal for a child process to send when it exits, but if the parent has executed a new program then the default SIGCHLD signal is sent. A local user permitted to run a program for several days could bypass this check, execute a setuid program, and then send an arbitrary signal to it.
Depending on the setuid programs installed, this could have some security impact.

CVE-2020-13143

Kyungtae Kim reported a potential heap out-of-bounds write in the USB gadget subsystem. A local user permitted to write to the gadget configuration filesystem could use this to cause a denial of service (crash or memory corruption) or potentially for privilege escalation.

For Debian 8 'Jessie', these problems have been fixed in version 3.16.84-1.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 ashmem.c 的 calc_vm_may_flags 中可能存在因权限绕过而导致的共享内存任意写入情况。这可通过损坏进程之间共享的内存导致本地权限升级而无需其他执行权限。不需用户交互即可恶意利用。Product: Android Versions Android 内核 Android ID A-142938932 (CVE-2020-0009)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

此更新现在可用于所有受支持的架构。有关参考，请参照原始公告文本。

在 Linux 内核中发现多个可能导致权限升级、拒绝服务或信息泄漏的漏洞。

CVE-2015-8839

在 ext4 文件系统实现中发现一个争用条件。本地用户可利用此漏洞造成拒绝服务（文件系统损坏）。

CVE-2018-14610、CVE-2018-14611、CVE-2018-14612、CVE-2018-14613

Gatech SSLab 的 Wen Xu 报告称，构建的 Btrfs 卷可触发崩溃（错误）和/或越界内存访问。能够挂载此类卷的攻击者可利用此问题造成拒绝服务，或可能造成权限提升。

CVE-2019-5108

Cisco 的 Mitchell Frank 发现，在 AP 模式中使用 IEEE 802.11 (WiFi) 堆栈进行漫游时，该堆栈会在站点经过验证之前触发新关联站点的漫游。AP 范围内的攻击者可利用此漏洞造成拒绝服务，方法是填写交换表单或将从其他站点重定向流量。

CVE-2019-19319

Jungyeon 发现，构建的文件系统可导致 ext4 实现取消分配或重新分配日志块。允许挂载文件系统的用户可利用此漏洞造成拒绝服务（崩溃），或可能实现权限升级。

CVE-2019-19447

已发现 ext4 文件系统驱动程序未安全处理取消链接计数为 0 的 inode 链接的操作，该漏洞是文件系统损坏所致。能够挂载任意 ext4 卷的攻击者可利用此问题造成拒绝服务（内存损坏或崩溃）或可能用于权限升级。

CVE-2019-19768

Tristan Madani 报告称，blktrace 调试设施中存在一个争用条件，该漏洞可导致释放后使用。能够触发区块设备删除的本地用户可利用此漏洞造成拒绝服务（崩溃），或可能实现权限升级。

CVE-2019-20636

syzbot 工具发现，输入子系统未充分验证 keycode 更改，这可导致堆越界写入。有权访问输入或 VT 设备的设备节点的本地用户可能会利用此漏洞造成拒绝服务（崩溃或内存损坏），或造成权限提升。

CVE-2020-0009

Jann Horn 报告称，Android ashmem 驱动程序未阻止只读文件被内存映射，然后重新映射为读写。但是，Debian 内核配置中未启用 Android 驱动程序。

CVE-2020-0543

VU amsterdam 的研究人员发现，在某些支持 RDRAND 和 RDSEED 指令的 Intel CPU 上，这些指令生成的部分随机值可能之后在同一物理 CPU 的任何核心上用于推测执行。根据应用程序使用这些指令的方式，本地用户或 VM 客户机可利用此漏洞从其他用户或 VM 获取加密密钥等敏感信息。

此漏洞可通过微代码更新（作为系统固件 (BIOS) 的一部分或通过 Debian 的非释放存档部分中的 intel-microcode 程序包）缓解。此内核更新仅提供该漏洞的报告，以及在不需要时禁用缓解措施的选项。

CVE-2020-1749

Xiumei Mu 报告称，某些可在 IPv6 上运行的网络协议会绕过 IPsec、IPcomp/IPcomp6、IPIP 和 IPv6 Mobility 使用的转换 (XFRM) 层。这会导致通过网络泄露信息，因为它不会根据系统策略对信息进行加密或路由。

CVE-2020-2732

Paulo Bonzini 发现，在启用嵌套虚拟化时，Intel 处理器的 KVM 实现未能正确处理 L2 客户机的指令仿真。这可允许 L2 客户机在 L1 客户机中造成权限升级、拒绝服务或信息泄露。

CVE-2020-8647、CVE-2020-8649

Hulk Robot 工具发现，vgacon 驱动程序中可能存在 MMIO 越界访问。可在使用 vgacon 驱动程序的系统上访问虚拟终端 (/dev/tty1 etc.) 的本地用户会利用此漏洞造成拒绝服务（崩溃或内存损坏），或可能造成权限提升。

CVE-2020-8648

syzbot 工具发现，虚拟终端驱动程序中存在争用条件，会造成释放后使用。有权访问虚拟终端的本地用户会利用此漏洞造成拒绝服务（崩溃或内存损坏），或可能造成权限提升。

CVE-2020-9383

Jordy Zomer 报告称，软盘驱动程序中的范围检查不正确，这会导致静态越界访问。有权访问软盘驱动程序的本地用户会利用此漏洞造成拒绝服务（崩溃或内存损坏），或可能造成权限提升。

CVE-2020-10690

发现 PTP 硬件时钟子系统未妥善管理设备生命周期。在用户进程使用 PTP 硬件时钟时，将其从系统删除可能会造成释放后使用。此漏洞的安全影响尚不明确。

CVE-2020-10751

Dmitry Vyukov 报告称，SELinux 子系统未妥善处理验证多个消息，这可允许特权攻击者绕过 SELinux netlink 限制。

CVE-2020-10942

发现 vhost_net 驱动程序未正确验证设为后端的套接字类型。有权访问 /dev/vhost-net 的本地用户可利用此漏洞，通过构建的系统调用造成堆栈崩溃，进而导致拒绝服务（崩溃）或可能造成权限提升。

CVE-2020-11494

发现 slcan（串行 CAN 总线）网络驱动程序未完全初始化接收到的数据包的 CAN 标头，从而导致信息从内核泄漏到用户空间，或通过 CAN 网络泄漏。

CVE-2020-11565

Entropy Moe 报告称，共享内存文件系统 (tmpfs) 未正确处理指定空节点列表的“mpol”挂载选项，进而导致基于堆栈的越界写入。如果用户命名空间已启用，则本地用户可利用此漏洞造成拒绝服务（崩溃），或可能造成权限提升。

CVE-2020-11608、CVE-2020-11609、CVE-2020-11668

发现 ov519、stv06xx 和 xirlink_ci 媒体驱动程序未正确验证 USB 设备描述符。拥有特别制造之 USB 设备的实际存在用户可利用此漏洞造成拒绝服务（崩溃），或可能造成权限提升。

CVE-2020-12114

Piotr Krysiuk 发现文件系统核心 (vfs) 中的 umount 与 ivot_root 操作之间存在争用条件。在任何用户命名空间中具有 CAP_SYS_ADMIN 能力的本地用户可利用此漏洞造成拒绝服务（崩溃）。

CVE-2020-12464

Kyungtae Kim 报告称，USB 内核中存在争用条件，会造成释放后使用。目前尚不清楚漏洞利用方式，但利用漏洞会导致拒绝服务（崩溃或内存损坏）或权限升级。

CVE-2020-12652

Tom Hatskevich 报告称，mptfusion 存储驱动程序中存在一个错误。ioctl 处理程序从用户内存中提取了一个参数，用于创建争用条件，这会导致错误锁定内部数据结构。有权访问 /dev/mptctl 的本地用户会利用此漏洞造成拒绝服务（崩溃或内存损坏），或造成权限提升。

CVE-2020-12653

发现 mwifiex WiFi 驱动程序未充分验证扫描请求，这可能会造成堆缓冲区溢出。具有 CAP_NET_ADMIN 能力的本地用户可利用此漏洞造成拒绝服务（崩溃或内存损坏），或可能造成升级提升。

CVE-2020-12654

发现 mwifiex WiFi 驱动程序未充分验证从接入点 (AP) 收到的 VMM 参数，进而可能造成堆缓冲区溢出。恶意 AP 可能会利用此漏洞造成拒绝服务（崩溃或内存损坏），或可能在易受影响的系统上执行代码。

CVE-2020-12769

发现 spi-dw SPI 主机驱动程序未正确序列化其内部状态的访问权限。此漏洞的安全影响尚不明确，此驱动程序未包含在 Debian 的二进制程序包中。

CVE-2020-12770

发现 sg（SCSI 通用）驱动程序未能在特定的错误情况下正确释放内部资源。有权访问 sg 设备的本地用户可利用此漏洞造成拒绝服务（资源耗尽）。

CVE-2020-12826

Adam Zabrocki 报告称，信号子系统的权限检查中存在漏洞。父进程可为子进程选择在退出时要发送的任意信号，但如果父进程已执行新程序，则会发送默认 SIGCHLD 信号。有权运行程序数天的本地用户可绕过此检查，执行 setuid 程序，然后向其发送任意信号。
根据安装的 setuid 程序，这会造成一些安全影响。

CVE-2020-13143

Kyungtae Kim 报告称，USB 小工具子系统中可能存在堆越界写入。有权写入小工具配置子系统的本地用户可利用此漏洞导致拒绝服务（崩溃或内存损坏）或可能导致权限升级。

对于 Debian 8“Jessie”，已在 3.16.84-1 版本中修复这些问题。

建议您升级 linux 程序包。

注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In calc_vm_may_flags of ashmem.c, there is a possible     arbitrary write to shared memory due to a permissions     bypass. This could lead to local escalation of     privilege by corrupting memory shared between     processes, with no additional execution privileges     needed. User interaction is not needed for     exploitation. Product: Android Versions: Android kernel     Android ID: A-142938932(CVE-2020-0009)

  - A flaw was found in the Linux kernel's implementation     of Userspace core dumps. This flaw allows an attacker     with a local account to crash a trivial program and     exfiltrate private kernel data.(CVE-2020-10732)

  - An issue was discovered in the Linux kernel before     5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a     reference count is mishandled, aka     CID-a3e23f719f5c.(CVE-2019-20811)

  - go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)

  - A flaw was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further processing.(CVE-2020-10751)

  - A signal access-control issue was discovered in the     Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
    Because exec_id in include/linux/sched.h is only 32     bits, an integer overflow can interfere with a     do_notify_parent protection mechanism. A child process     can send an arbitrary signal to a parent process in a     different security domain. Exploitation limitations     include the amount of elapsed time before an integer     overflow occurs, and the lack of scenarios where     signals to a parent process present a substantial     operational threat.(CVE-2020-12826)

  - A NULL pointer dereference flaw was found in the Linux     kernel's SELinux subsystem in versions before 5.7. This     flaw occurs while importing the Commercial IP Security     Option (CIPSO) protocol's category bitmap into the     SELinux extensible bitmap via the'     ebitmap_netlbl_import' routine. While processing the     CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security     attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue     leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This     flaw allows a remote network user to crash the system     kernel, resulting in a denial of     service.(CVE-2020-10711)

  - gadget_dev_desc_UDC_store in     drivers/usb/gadget/configfs.c in the Linux kernel     through 5.6.13 relies on kstrdup without considering     the possibility of an internal '\0' value, which allows     attackers to trigger an out-of-bounds read, aka     CID-15753588bcd4.(CVE-2020-13143)

  - An issue was discovered in the Linux kernel through     5.6.11. sg_write lacks an sg_remove_request call in a     certain failure case, aka     CID-83c6f2390040.(CVE-2020-12770)

  - __btrfs_free_extent in fs/btrfs/extent-tree.c in the     Linux kernel through 5.3.12 calls btrfs_print_leaf in a     certain ENOENT case, which allows local users to obtain     potentially sensitive information about register values     via the dmesg program. NOTE: The BTRFS development team     disputes this issues as not being a vulnerability     because '1) The kernel provide facilities to restrict     access to dmesg - dmesg_restrict=1 sysctl option. So     it's really up to the system administrator to judge     whether dmesg access shall be disallowed or not. 2)     WARN/WARN_ON are widely used macros in the linux     kernel. If this CVE is considered valid this would mean     there are literally thousands CVE lurking in the kernel
    - something which clearly is not the     case.'(CVE-2019-19039)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New kernel packages are available for Slackware 14.2 to fix security issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In calc_vm_may_flags of ashmem.c, there is a possible     arbitrary write to shared memory due to a permissions     bypass. This could lead to local escalation of     privilege by corrupting memory shared between     processes, with no additional execution privileges     needed. User interaction is not needed for     exploitation. Product: Android Versions: Android kernel     Android ID: A-142938932(CVE-2020-0009)

  - A flaw was found in the Linux Kernel in versions after     4.5-rc1 in the way mremap handled DAX Huge Pages. This     flaw allows a local attacker with access to a DAX     enabled storage to escalate their privileges on the     system.(CVE-2020-10757)

  - go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)

  - In the Android kernel in F2FS driver there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with system execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2019-9445)

  - A flaw was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further processing.(CVE-2020-10751)

  - An issue was discovered in the Linux kernel before     5.4.7. The prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)

  - ** DISPUTED ** An issue was discovered in the Linux     kernel through 5.7.1. drivers/tty/vt/keyboard.c has an     integer overflow if k_ascii is called several times in     a row, aka CID-b86dab054059. NOTE: Members in the     community argue that the integer overflow does not lead     to a security issue in this case.(CVE-2020-13974)

  - An issue was discovered in the Linux kernel before     5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a     reference count is mishandled, aka     CID-a3e23f719f5c.(CVE-2019-20811)

  - A flaw was found in the prctl() function, where it can     be used to enable indirect branch speculation after it     has been disabled. This call incorrectly reports it as     being 'force disabled' when it is not and opens the     system to Spectre v2 attacks. The highest threat from     this vulnerability is to     confidentiality.(CVE-2020-10768)

  - A flaw was found in the Linux kernel's implementation     of the Enhanced IBPB (Indirect Branch Prediction     Barrier). The IBPB mitigation will be disabled when     STIBP is not available or when the Enhanced Indirect     Branch Restricted Speculation (IBRS) is available. This     flaw allows a local attacker to perform a Spectre V2     style attack when this configuration is active. The     highest threat from this vulnerability is to     confidentiality.(CVE-2020-10767)

  - A logic bug flaw was found in the Linux kernel's     implementation of SSBD. A bug in the logic handling     allows an attacker with a local account to disable SSBD     protection during a context switch when additional     speculative execution mitigations are in place. This     issue was introduced when the per task/process     conditional STIPB switching was added on top of the     existing SSBD switching. The highest threat from this     vulnerability is to confidentiality.(CVE-2020-10766)

  - A new domain bypass transient execution attack known as     Special Register Buffer Data Sampling (SRBDS) has been     found. This flaw allows data values from special     internal registers to be leaked by an attacker able to     execute code on any core of the CPU. An unprivileged,     local attacker can use this flaw to infer values     returned by affected instructions known to be commonly     used during cryptographic operations that rely on     uniqueness, secrecy, or both.(CVE-2020-0543)

  - In the Linux kernel before 5.4.16, a race condition in     tty->disc_data handling in the slip and slcan line     discipline could lead to a use-after-free, aka     CID-0ace17d56824. This affects drivers/net/slip/slip.c     and drivers/net/can/slcan.c.(CVE-2020-14416)

  - The flow_dissector feature in the Linux kernel 4.3     through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs     because the auto flowlabel of a UDP IPv6 packet relies     on a 32-bit hashrnd value as a secret, and because     jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be     inferred by an attacker. This affects     net/core/flow_dissector.c and related     code.(CVE-2019-18282)

  - The VFIO PCI driver in the Linux kernel through 5.6.13     mishandles attempts to access disabled memory     space.(CVE-2020-12888)

  - In the Linux kernel through 5.7.6, usbtest_disconnect     in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)

  - A flaw was found in the ZRAM kernel module, where a     user with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):In the Android kernel in     F2FS driver there is a possible out of bounds read due     to a missing bounds check. This could lead to local     information disclosure with system execution privileges     needed. User interaction is not needed for     exploitation.(CVE-2019-9445)In calc_vm_may_flags of     ashmem.c, there is a possible arbitrary write to shared     memory due to a permissions bypass. This could lead to     local escalation of privilege by corrupting memory     shared between processes, with no additional execution     privileges needed. User interaction is not needed for     exploitation. Product: Android Versions: Android kernel     Android ID: A-142938932(CVE-2020-0009)A new domain     bypass transient execution attack known as Special     Register Buffer Data Sampling (SRBDS) has been found.
    This flaw allows data values from special internal     registers to be leaked by an attacker able to execute     code on any core of the CPU. An unprivileged, local     attacker can use this flaw to infer values returned by     affected instructions known to be commonly used during     cryptographic operations that rely on uniqueness,     secrecy, or both.(CVE-2020-0543)A flaw was found in the     Linux kernel's implementation of the BTRFS file system.
    A local attacker, with the ability to mount a file     system, can create a use-after-free memory fault after     the file system has been unmounted. This may lead to     memory corruption or privilege     escalation.(CVE-2019-19377)A NULL pointer dereference     flaw may occur in the Linux kernel's relay_open in     kernel/relay.c. if the alloc_percpu() function is not     validated in time of failure and used as a valid     address for access. An attacker could use this flaw to     cause a denial of service.(CVE-2019-19462)A NULL     pointer dereference flaw was found in     tw5864_handle_frame function in     drivers/media/pci/tw5864/tw5864-video.c in the TW5864     Series Video media driver. The pointer 'vb' is     assigned, but not validated before its use, and can     lead to a denial of service. This flaw allows a local     attacker with special user or root privileges to crash     the system or leak internal kernel     information.(CVE-2019-20806)go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)An issue was     discovered in the Linux kernel before 5.0.6. In     rx_queue_add_kobject() and netdev_queue_add_kobject()     in net/coreet-sysfs.c, a reference count is mishandled,     aka CID-a3e23f719f5c.(CVE-2019-20811)A flaw was found     in the way the af_packet functionality in the Linux     kernel handled the retirement timer setting for     TPACKET_v3 when getting settings from the underlying     network device errors out. This flaw allows a local     user who can open the af_packet domain socket and who     can hit the error path, to use this vulnerability to     starve the system.(CVE-2019-20812)A NULL pointer     dereference flaw was found in the Linux kernel's     SELinux subsystem. This flaw occurs while importing the     Commercial IP Security Option (CIPSO) protocol's     category bitmap into the SELinux extensible bitmap via     the' ebitmap_netlbl_import' routine. While processing     the CIPSO restricted bitmap tag in the     'cipso_v4_parsetag_rbm' routine, it sets the security     attribute to indicate that the category bitmap is     present, even if it has not been allocated. This issue     leads to a NULL pointer dereference issue while     importing the same category bitmap into SELinux. This     flaw allows a remote network user to crash the system     kernel, resulting in a denial of     service.(CVE-2020-10711)A flaw was found in the Linux     kernel's SELinux LSM hook implementation, where it     anticipated the skb would only contain a single Netlink     message. The hook incorrectly validated the first     Netlink message in the skb only, to allow or deny the     rest of the messages within the skb with the granted     permissions and without further processing. At this     time, there is no known ability for an attacker to     abuse this flaw.(CVE-2020-10751)A flaw was found in the     Linux Kernel in versions after 4.5-rc1 in the way     mremap handled DAX Huge Pages. This flaw allows a local     attacker with access to a DAX enabled storage to     escalate their privileges on the     system.(CVE-2020-10757)A logic bug flaw was found in     the Linux kernel's implementation of SSBD. A bug in the     logic handling allows an attacker with a local account     to disable SSBD protection during a context switch when     additional speculative execution mitigations are in     place. This issue was introduced when the per     task/process conditional STIPB switching was added on     top of the existing SSBD switching. The highest threat     from this vulnerability is to     confidentiality.(CVE-2020-10766)A flaw was found in the     Linux kernel's implementation of the Enhanced IBPB     (Indirect Branch Prediction Barrier). The IBPB     mitigation will be disabled when STIBP is not available     or when the Enhanced Indirect Branch Restricted     Speculation (IBRS) is available. This flaw allows a     local attacker to perform a Spectre V2 style attack     when this configuration is active. The highest threat     from this vulnerability is to     confidentiality.(CVE-2020-10767)A flaw was found in the     prctl() function, where it can be used to enable     indirect branch speculation after it has been disabled.
    This call incorrectly reports it as being 'force     disabled' when it is not and opens the system to     Spectre v2 attacks. The highest threat from this     vulnerability is to confidentiality.(CVE-2020-10768)A     flaw was found in the ZRAM kernel module, where a user     with a local account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)A stack buffer overflow     issue was found in the get_raw_socket() routine of the     Host kernel accelerator for virtio net (vhost-net)     driver. It could occur while doing an     ictol(VHOST_NET_SET_BACKEND) call, and retrieving     socket name in a kernel stack variable via     get_raw_socket(). A user able to perform ioctl(2) calls     on the '/dev/vhost-net' device may use this flaw to     crash the kernel resulting in DoS     issue.(CVE-2020-10942)A flaw was found in the Linux     kernel's implementation of the pivot_root syscall. This     flaw allows a local privileged user (root outside or     root inside a privileged container) to exploit a race     condition to manipulate the reference count of the root     filesystem. To be able to abuse this flaw, the process     or user calling pivot_root must have advanced     permissions. The highest threat from this vulnerability     is to system availability.(CVE-2020-12114)A     use-after-free flaw was found in usb_sg_cancel in     drivers/usb/core/message.c in the USB core subsystem.
    This flaw allows a local attacker with a special user     or root privileges to crash the system due to a race     problem in the scatter-gather cancellation and transfer     completion in usb_sg_wait. This vulnerability can also     lead to a leak of internal kernel     information.(CVE-2020-12464)A memory overflow and data     corruption flaw were found in the Mediatek MT76 driver     module for WiFi in mt76_add_fragment in     driverset/wireless/mediatek/mt76/dma.c. An oversized     packet with too many rx fragments causes an overflow     and corruption in memory of adjacent pages. A local     attacker with a special user or root privileges can     cause a denial of service or a leak of internal kernel     information.(CVE-2020-12465)A vulnerability was found     in __mptctl_ioctl in drivers/message/fusion/mptctl.c in     Fusion MPT base driver 'mptctl' in the SCSI device     module, where an incorrect lock leads to a race     problem. This flaw allows an attacker with local access     and special user (or root) privileges to cause a denial     of service.(CVE-2020-12652)A flaw was found in the way     the mwifiex_cmd_append_vsie_tlv() in Linux kernel's     Marvell WiFi-Ex driver handled vendor specific     information elements. A local user could use this flaw     to escalate their privileges on the     system.(CVE-2020-12653)A flaw was found in the Linux     kernel. The Marvell mwifiex driver allows a remote WiFi     access point to trigger a heap-based memory buffer     overflow due to an incorrect memcpy operation. The     highest threat from this vulnerability is to data     integrity and system availability.(CVE-2020-12654)A     flaw was discovered in the XFS source in the Linux     kernel. This flaw allows an attacker with the ability     to mount an XFS filesystem, to trigger a denial of     service while attempting to sync a file located on an     XFS v5 image with crafted metadata.(CVE-2020-12655)An     out-of-bounds (OOB) memory access flaw was found in the     Network XDP (the eXpress Data Path) module in the Linux     kernel's xdp_umem_reg function in net/xdp/xdp_umem.c.
    When a user with special user privilege of     CAP_NET_ADMIN (or root) calls setsockopt to register     umem ring on XDP socket, passing the headroom value     larger than the available space in the chunk, it leads     to an out-of-bounds write, causing panic or possible     memory corruption. This flaw may lead to privilege     escalation if a local end-user is granted permission to     influence the execution of code in this     manner.(CVE-2020-12659)A vulnerability was found in     sg_write in drivers/scsi/sg.c in the SCSI generic (sg)     driver subsystem. This flaw allows an attacker with     local access and special user or root privileges to     cause a denial of service if the allocated list is not     cleaned with an invalid (Sg_fd * sfp) pointer at the     time of failure, also possibly causing a kernel     internal information leak problem.(CVE-2020-12770)An     issue was discovered in the Linux kernel through     5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c     has a deadlock if a coalescing operation     fails.(CVE-2020-12771)A flaw was found in the Linux     kernel loose validation of child/parent process     identification handling while filtering signal     handlers. A local attacker is able to abuse this flaw     to bypass checks to send any signal to a privileged     process.(CVE-2020-12826)A flaw was found in the Linux     kernel, where it allows userspace processes, for     example, a guest VM, to directly access h/w devices via     its VFIO driver modules. The VFIO modules allow users     to enable or disable access to the devices' MMIO memory     address spaces. If a user attempts to access the     read/write devices' MMIO address space when it is     disabled, some h/w devices issue an interrupt to the     CPU to indicate a fatal error condition, crashing the     system. This flaw allows a guest user or process to     crash the host system resulting in a denial of     service.(CVE-2020-12888)gadget_dev_desc_UDC_store in     drivers/usb/gadget/configfs.c in the Linux kernel     through 5.6.13 relies on kstrdup without considering     the possibility of an internal '\0' value, which allows     attackers to trigger an out-of-bounds read, aka     CID-15753588bcd4.(CVE-2020-13143)** DISPUTED ** An     issue was discovered in the Linux kernel through 5.7.1.
    drivers/tty/vt/keyboard.c has an integer overflow if     k_ascii is called several times in a row, aka     CID-b86dab054059. NOTE: Members in the community argue     that the integer overflow does not lead to a security     issue in this case.(CVE-2020-13974)A use-after-free     flaw was found in slcan_write_wakeup in     driverset/can/slcan.c in the serial CAN module slcan. A     race condition occurs when communicating with can using     slcan between the write (scheduling the transmit) and     closing (flushing out any pending queues) the SLCAN     channel. This flaw allows a local attacker with special     user or root privileges to cause a denial of service or     a kernel information leak. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14416)In the Linux kernel     through 5.7.6, usbtest_disconnect in     drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)The Linux kernel     through 5.7.11 allows remote attackers to make     observations that help to obtain sensitive information     about the internal state of the network RNG, aka     CID-f227e3ec3b5c. This is related to     drivers/char/random.c and     kernel/time/timer.c.(CVE-2020-16166)A flaw was found in     the Linux kernel's implementation of Userspace core     dumps. This flaw allows an attacker with a local     account to crash a trivial program and exfiltrate     private kernel data.(CVE-2020-10732)A flaw null pointer     dereference in the Linux kernel cgroupv2 subsystem in     versions before 5.7.10 was found in the way when reboot     the system. A local user could use this flaw to crash     the system or escalate their privileges on the     system.(CVE-2020-14356)The Linux kernel 4.9.x before     4.9.233, 4.14.x before 4.14.194, and 4.19.x before     4.19.140 has a use-after-free because skcd->no_refcnt     was not considered during a backport of a     CVE-2020-14356 patch. This is related to the cgroups     feature.(CVE-2020-25220)get_gate_page in mm/gup.c in     the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows     privilege escalation because of incorrect reference     counting (caused by gate page mishandling) of the     struct page that backs the vsyscall page. The result is     a refcount underflow. This can be triggered by any     64-bit process that can use ptrace() or     process_vm_readv(), aka     CID-9fa2dd946743.(CVE-2020-25221)In the Linux kernel     through 5.8.7, local attackers able to inject conntrack     netlink configuration could overflow a local buffer,     causing crashes or triggering use of incorrect protocol     numbers in ctnetlink_parse_tuple_filter in     net/netfilter/nf_conntrack_netlink.c, aka     CID-1cc5ef91d2ff.(CVE-2020-25211)A buffer over-read     flaw was found in RH kernel versions before 5.0 in     crypto_authenc_extractkeys in crypto/authenc.c in the     IPsec Cryptographic algorithm's module, authenc. When a     payload longer than 4 bytes, and is not following     4-byte alignment boundary guidelines, it causes a     buffer over-read threat, leading to a system crash.
    This flaw allows a local attacker with user privileges     to cause a denial of service.(CVE-2020-10769)A flaw was     found in the Linux kernel's implementation of the     invert video code on VGA consoles when a local attacker     attempts to resize the console, calling an ioctl     VT_RESIZE, which causes an out-of-bounds write to     occur. This flaw allows a local user with access to the     VGA console to crash the system, potentially escalating     their privileges on the system. The highest threat from     this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-14331)In cdev_get of char_dev.c,     there is a possible use-after-free due to a race     condition. This could lead to local escalation of     privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10Android ID:
    A-153467744(CVE-2020-0305)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):An issue was discovered in     the Linux kernel before 5.2. There is a NULL pointer     dereference in tw5864_handle_frame() in     drivers/media/pci/tw5864/tw5864-video.c, which may     cause denial of service, aka     CID-2e7682ebfc75.(CVE-2019-20806)A flaw was found in     the ZRAM kernel module, where a user with a local     account and the ability to read the     /sys/class/zram-control/hot_add file can create ZRAM     device nodes in the /dev/ directory. This read     allocates kernel memory and is not accounted for a user     that triggers the creation of that ZRAM device. With     this vulnerability, continually reading the device may     consume a large amount of system memory and cause the     Out-of-Memory (OOM) killer to activate and terminate     random userspace processes, possibly making the system     inoperable.(CVE-2020-10781)In the Linux kernel before     5.4.16, a race condition in tty->disc_data handling in     the slip and slcan line discipline could lead to a     use-after-free, aka CID-0ace17d56824. This affects     drivers/ net/slip/slip.c and drivers/     net/can/slcan.c.(CVE-2020-14416)The VFIO PCI driver in     the Linux kernel through 5.6.13 mishandles attempts to     access disabled memory space.(CVE-2020-12888)The     flow_dissector feature in the Linux kernel 4.3 through     5.x before 5.3.10 has a device tracking vulnerability,     aka CID-55667441c84f. This occurs because the auto     flowlabel of a UDP IPv6 packet relies on a 32-bit     hashrnd value as a secret, and because jhash (instead     of siphash) is used. The hashrnd value remains the same     starting from boot time, and can be inferred by an     attacker. This affects net/core/flow_dissector.c and     related code.(CVE-2019-18282)In the Linux kernel     through 5.7.6, usbtest_disconnect in     drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770.(CVE-2020-15393)An issue was     discovered in the Linux kernel before 5.0.6. In     rx_queue_add_kobject() and netdev_queue_add_kobject()     in net/core/ net-sysfs.c, a reference count is     mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)A flaw     was found in the Linux kernels SELinux LSM hook     implementation before version 5.7, where it incorrectly     assumed that an skb would only contain a single netlink     message. The hook would incorrectly only validate the     first netlink message in the skb and allow or deny the     rest of the messages within the skb with the granted     permission without further     processing.(CVE-2020-10751)In the Android kernel in     F2FS driver there is a possible out of bounds read due     to a missing bounds check. This could lead to local     information disclosure with system execution privileges     needed. User interaction is not needed for     exploitation.(CVE-2019-9445)A flaw was found in the     Linux kernel's implementation of Userspace core dumps.
    This flaw allows an attacker with a local account to     crash a trivial program and exfiltrate private kernel     data.(CVE-2020-10732)go7007_snd_init in     drivers/media/usb/go7007/snd-go7007.c in the Linux     kernel before 5.6 does not call snd_card_free for a     failure path, which causes a memory leak, aka     CID-9453264ef586.(CVE-2019-20810)Legacy pairing and     secure-connections pairing authentication in Bluetooth(r)     BR/EDR Core Specification v5.2 and earlier may allow an     unauthenticated user to complete authentication without     pairing credentials via adjacent access. An     unauthenticated, adjacent attacker could impersonate a     Bluetooth BR/EDR master or slave to pair with a     previously paired remote device to successfully     complete the authentication procedure without knowing     the link key.(CVE-2020-10135)An issue was discovered in     the Linux kernel before 5.4.7. The     prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)An issue was     discovered in the Linux kernel through 5.7.1.
    drivers/tty/vt/keyboard.c has an integer overflow if     k_ascii is called several times in a row, aka     CID-b86dab054059. NOTE: Members in the community argue     that the integer overflow does not lead to a security     issue in this case.(CVE-2020-13974)In calc_vm_may_flags     of ashmem.c, there is a possible arbitrary write to     shared memory due to a permissions bypass. This could     lead to local escalation of privilege by corrupting     memory shared between processes, with no additional     execution privileges needed. User interaction is not     needed for exploitation. Product: Android Versions:
    Android kernel Android ID: A-142938932(CVE-2020-0009)A     flaw was found in the Linux Kernel in versions after     4.5-rc1 in the way mremap handled DAX Huge Pages. This     flaw allows a local attacker with access to a DAX     enabled storage to escalate their privileges on the     system.(CVE-2020-10757)gadget_dev_desc_UDC_store in     drivers/usb/gadget/configfs.c in the Linux kernel     through 5.6.13 relies on kstrdup without considering     the possibility of an internal '\0' value, which allows     attackers to trigger an out-of-bounds read, aka     CID-15753588bcd4.(CVE-2020-13143)Incomplete cleanup     from specific special register read operations in some     Intel(R) Processors may allow an authenticated user to     potentially enable information disclosure via local     access.(CVE-2020-0543)A flaw was found in the prctl()     function, where it can be used to enable indirect     branch speculation after it has been disabled. This     call incorrectly reports it as being 'force disabled'     when it is not and opens the system to Spectre v2     attacks. The highest threat from this vulnerability is     to confidentiality.(CVE-2020-10768)A flaw was found in     the Linux kernel's implementation of the Enhanced IBPB     (Indirect Branch Prediction Barrier). The IBPB     mitigation will be disabled when STIBP is not available     or when the Enhanced Indirect Branch Restricted     Speculation (IBRS) is available. This flaw allows a     local attacker to perform a Spectre V2 style attack     when this configuration is active. The highest threat     from this vulnerability is to     confidentiality.(CVE-2020-10767)A logic bug flaw was     found in the Linux kernel's implementation of SSBD. A     bug in the logic handling allows an attacker with a     local account to disable SSBD protection during a     context switch when additional speculative execution     mitigations are in place. This issue was introduced     when the per task/process conditional STIPB switching     was added on top of the existing SSBD switching. The     highest threat from this vulnerability is to     confidentiality.(CVE-2020-10766)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
134971	Slackware 14.2：Slackware 14.2 内核 (SSA:2020-086-01)	Nessus	Slackware Local Security Checks	2020/3/27	2024/3/20	critical
134971	Slackware 14.2:Slackware 14.2カーネル（SSA: 2020-086-01）	Nessus	Slackware Local Security Checks	2020/3/27	2024/3/20	critical
134971	Slackware 14.2：Slackware 14.2 核心 (SSA:2020-086-01)	Nessus	Slackware Local Security Checks	2020/3/27	2024/3/20	critical
247223	Linux Distros のパッチ未適用の脆弱性: CVE-2020-0009	Nessus	Misc.	2025/8/10	2025/8/10	medium
137283	Debian DLA-2241-2: linux セキュリティ更新	Nessus	Debian Local Security Checks	2020/6/10	2024/3/7	high
247223	Linux Distros 未修補的弱點：CVE-2020-0009	Nessus	Misc.	2025/8/10	2025/8/10	medium
137283	Debian DLA-2241-2：linux 安全性更新	Nessus	Debian Local Security Checks	2020/6/10	2024/3/7	high
142576	EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2020-2443)	Nessus	Huawei Local Security Checks	2020/11/6	2024/2/9	high
247223	Linux Distros Unpatched Vulnerability : CVE-2020-0009	Nessus	Misc.	2025/8/10	2025/8/10	medium
137283	Debian DLA-2241-2 : linux security update	Nessus	Debian Local Security Checks	2020/6/10	2024/3/7	high
247223	Linux Distros 未修补的漏洞：CVE-2020-0009	Nessus	Misc.	2025/8/10	2025/8/10	medium
137283	Debian DLA-2241-2：linux 安全更新	Nessus	Debian Local Security Checks	2020/6/10	2024/3/7	high
144831	EulerOS Virtualization 3.0.2.6 : kernel (EulerOS-SA-2021-1056)	Nessus	Huawei Local Security Checks	2021/1/11	2024/1/30	critical
140141	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-1920)	Nessus	Huawei Local Security Checks	2020/9/2	2021/1/6	medium
134971	Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-086-01)	Nessus	Slackware Local Security Checks	2020/3/27	2024/3/20	critical
139995	EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1892)	Nessus	Huawei Local Security Checks	2020/8/28	2024/2/22	high
140328	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2020-1958)	Nessus	Huawei Local Security Checks	2020/9/8	2024/2/21	high
139137	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1807)	Nessus	Huawei Local Security Checks	2020/7/30	2024/2/27	high

检测

插件搜索

critical

critical

critical

medium

high

medium

high

high

medium

high

medium

high

critical

medium

critical

high

high

high