The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-2732: Fixed an issue affecting Intel CPUs where an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources (bsc#1163971).

CVE-2019-19338: There was an incomplete fix for an issue with Transactional Synchronisation Extensions in the KVM code (bsc#1158954).

CVE-2019-14615: An information disclosure vulnerability existed due to insufficient control flow in certain data structures for some Intel(R) Processors (bnc#1160195).

CVE-2019-14896: A heap overflow was found in the add_ie_rates() function of the Marvell Wifi Driver (bsc#1157157).

CVE-2019-14897: A stack overflow was found in the lbs_ibss_join_existing() function of the Marvell Wifi Driver (bsc#1157155).

CVE-2019-15213: A use-after-free bug caused by a malicious USB device was found in drivers/media/usb/dvb-usb/dvb-usb-init.c (bsc#1146544).

CVE-2019-16994: A memory leak existed in sit_init_net() in net/ipv6/sit.c which might have caused denial of service, aka CID-07f12b26e21a (bnc#1161523).

CVE-2019-18808: A memory leak in drivers/crypto/ccp/ccp-ops.c allowed attackers to cause a denial of service (memory consumption), aka CID-128c66429247 (bnc#1156259).

CVE-2019-19036: An issue discovered in btrfs_root_node in fs/btrfs/ctree.c allowed a NULL pointer dereference because rcu_dereference(root->node) can be zero (bnc#1157692).

CVE-2019-19045: A memory leak in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c allowed attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7 (bnc#1161522).

CVE-2019-19051: A memory leak in drivers/net/wimax/i2400m/op-rfkill.c allowed attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7 (bnc#1159024).

CVE-2019-19054: A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c allowed attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b (bnc#1161518).

CVE-2019-19066: A memory leak in drivers/scsi/bfa/bfad_attr.c allowed attackers to cause a denial of service (memory consumption), aka CID-0e62395da2bd (bnc#1157303).

CVE-2019-19318: Mounting a crafted btrfs image twice could have caused a use-after-free (bnc#1158026).

CVE-2019-19319: A slab-out-of-bounds write access could have occured when setxattr was called after mounting of a specially crafted ext4 image (bnc#1158021).

CVE-2019-19332: An out-of-bounds memory write issue was found in the way the KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could have used this flaw to crash the system (bnc#1158827).

CVE-2019-19447: Mounting a crafted ext4 filesystem image, performing some operations, and unmounting could have led to a use-after-free in fs/ext4/super.c (bnc#1158819).

CVE-2019-19523: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79 (bsc#1158823).

CVE-2019-19524: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9 (bsc#1158413).

CVE-2019-19525: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035 (bsc#1158417).

CVE-2019-19526: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098 (bsc#1158893).

CVE-2019-19527: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e (bsc#1158900).

CVE-2019-19528: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d (bsc#1158407).

CVE-2019-19529: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41 (bnc#1158381).

CVE-2019-19530: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef (bsc#1158410).

CVE-2019-19531: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver, aka CID-fc05481b2fca (bsc#1158445).

CVE-2019-19532: There were multiple out-of-bounds write bugs that can be caused by a malicious USB HID device, aka CID-d9d4b1e46d95 (bsc#1158824).

CVE-2019-19533: There was an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464 (bsc#1158834).

CVE-2019-19534: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29 (bsc#1158398).

CVE-2019-19535: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042 (bsc#1158903).

CVE-2019-19536: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0 (bsc#1158394).

CVE-2019-19537: There was a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9 (bsc#1158904).

CVE-2019-19543: There was a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c (bnc#1158427).

CVE-2019-19767: There were multiple use-after-free errors in
__ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163 (bnc#1159297).

CVE-2019-19965: There was a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5 (bnc#1159911).

CVE-2019-19966: There was a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that could have caused a denial of service, aka CID-dea37a972655 (bnc#1159841).

CVE-2019-20054: There was a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e (bnc#1159910).

CVE-2019-20095: Several memory leaks were found in drivers/net/wireless/marvell/mwifiex/cfg80211.c, aka CID-003b686ace82 (bnc#1159909).

CVE-2019-20096: There was a memory leak in __feat_register_sp() in net/dccp/feat.c, aka CID-1d3ff0950e2b (bnc#1159908).

CVE-2020-7053: There was a use-after-free (write) in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka CID-7dc40713618c (bnc#1160966).

CVE-2020-8428: There was a use-after-free bug in fs/namei.c, which allowed local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9 (bnc#1162109).

CVE-2020-8648: There was a use-after-free vulnerability in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bnc#1162928).

CVE-2020-8992: An issue was discovered in ext4_protect_reserved_inode in fs/ext4/block_validity.c that allowed attackers to cause a soft lockup via a crafted journal size (bnc#1164069).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4871 advisory.

    - ieee802154: enforce CAP_NET_RAW for raw sockets (Allen Pais)  [Orabug: 30444947]  {CVE-2019-17053}
    - mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30445159]  {CVE-2019-17055}
    - net: sit: fix memory leak in sit_init_net() (Mao Wenan)  [Orabug: 30445307]  {CVE-2019-16994}
    - media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum)  [Orabug: 30490492]     {CVE-2019-15213}
    - media: cpia2_usb: first wake up, then free in disconnect (Oliver Neukum)  [Orabug: 30511742]     {CVE-2019-15215}
    - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN)  [Orabug:
    30532775]  {CVE-2019-15217}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - The bnep_sock_ioctl function in     net/bluetooth/bnep/sock.c in the Linux kernel before     2.6.39 does not ensure that a certain device field ends     with a '\0' character, which allows local users to     obtain potentially sensitive information from kernel     stack memory, or cause a denial of service (BUG and     system crash), via a BNEPCONNADD command.
    (CVE-2011-1079)

  - An issue was discovered in fs/gfs2/rgrp.c in the Linux     kernel before 4.8. A use-after-free is caused by the     functions gfs2_clear_rgrpd and read_rindex_entry.
    (CVE-2016-10905)

  - An issue was discovered in     drivers/scsi/aacraid/commctrl.c in the Linux kernel     before 4.13. There is potential exposure of kernel stack     memory because aac_get_hba_info does not initialize the     hbainfo structure. (CVE-2017-18550)

  - An issue was discovered in the Linux kernel before     4.14.11. A double free may be caused by the function     allocate_trace_buffer in the file kernel/trace/trace.c.
    (CVE-2017-18595)

  - Improper invalidation for page table updates by a     virtual guest operating system for multiple Intel(R)     Processors may allow an authenticated user to     potentially enable denial of service of the host system     via local access. (CVE-2018-12207)

  - An issue was discovered in the Linux kernel before 4.20.
    There is a race condition in smp_task_timedout() and     smp_task_done() in drivers/scsi/libsas/sas_expander.c,     leading to a use-after-free. (CVE-2018-20836)

  - An issue was discovered in the Linux kernel before     4.18.7. In create_qp_common in     drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp     was never initialized, resulting in a leak of stack     memory to userspace. (CVE-2018-20855)

  - An issue was discovered in fs/xfs/xfs_super.c in the     Linux kernel before 4.18. A use after free exists,     related to xfs_fs_fill_super failure. (CVE-2018-20976)

  - In the tun subsystem in the Linux kernel before 4.13.14,     dev_get_valid_name is not called before     register_netdevice. This allows local users to cause a     denial of service (NULL pointer dereference and panic)     via an ioctl(TUNSETIFF) call with a dev name containing     a / character. This is similar to CVE-2013-4343.
    (CVE-2018-7191)

  - Insufficient access control in subsystem for Intel (R)     processor graphics in 6th, 7th, 8th and 9th Generation     Intel(R) Core(TM) Processor Families; Intel(R)     Pentium(R) Processor J, N, Silver and Gold Series;
    Intel(R) Celeron(R) Processor J, N, G3900 and G4900     Series; Intel(R) Atom(R) Processor A and E3900 Series;
    Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100     Processor Families may allow an authenticated user to     potentially enable denial of service via local access.
    (CVE-2019-0154)

  - Insufficient access control in a subsystem for Intel (R)     processor graphics in 6th, 7th, 8th and 9th Generation     Intel(R) Core(TM) Processor Families; Intel(R)     Pentium(R) Processor J, N, Silver and Gold Series;
    Intel(R) Celeron(R) Processor J, N, G3900 and G4900     Series; Intel(R) Atom(R) Processor A and E3900 Series;
    Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and     E-2200 Processor Families; Intel(R) Graphics Driver for     Windows before 26.20.100.6813 (DCH) or 26.20.100.6812     and before 21.20.x.5077 (aka15.45.5077), i915 Linux     Driver for Intel(R) Processor Graphics before versions     5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may     allow an authenticated user to potentially enable     escalation of privilege via local access.
    (CVE-2019-0155)

  - TSX Asynchronous Abort condition on some CPUs utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. (CVE-2019-11135)

  - The Linux kernel before 5.1-rc5 allows page->_refcount     reference count overflow, with resultant use-after-free     issues, if about 140 GiB of RAM exists. This is related     to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - The do_hidp_sock_ioctl function in     net/bluetooth/hidp/sock.c in the Linux kernel before     5.0.15 allows a local user to obtain potentially     sensitive information from kernel stack memory via a     HIDPCONNADD command, because a name field may not end     with a '\0' character. (CVE-2019-11884)

  - ** DISPUTED ** An issue was discovered in     drm_load_edid_firmware in     drivers/gpu/drm/drm_edid_load.c in the Linux kernel     through 5.1.5. There is an unchecked kstrdup of fwstr,     which might allow an attacker to cause a denial of     service (NULL pointer dereference and system crash).
    NOTE: The vendor disputes this issues as not being a     vulnerability because kstrdup() returning NULL is     handled sufficiently and there is no chance for a NULL     pointer dereference. (CVE-2019-12382)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/dvb-usb/dvb-usb-     init.c driver. (CVE-2019-15213)

  - An issue was discovered in xfs_setattr_nonsize in     fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS     partially wedges when a chgrp fails on account of being     out of disk quota. xfs_setattr_nonsize is failing to     unlock the ILOCK after the xfs_qm_vop_chown_reserve call     fails. This is primarily a local DoS attack vector, but     it might result as well in remote DoS if the XFS     filesystem is exported for instance via NFS.
    (CVE-2019-15538)

  - In the Linux kernel before 5.1.13, there is a memory     leak in drivers/scsi/libsas/sas_expander.c when SAS     expander discovery fails. This will cause a BUG and     denial of service. (CVE-2019-15807)

  - An issue was discovered in the Linux kernel before     5.0.1. There is a memory leak in     register_queue_kobjects() in net/core/net-sysfs.c, which     will cause denial of service. (CVE-2019-15916)

  - An issue was discovered in the Linux kernel before     5.0.4. The 9p filesystem did not protect i_size_write()     properly, which causes an i_size_read() infinite loop     and denial of service on SMP systems. (CVE-2019-16413)

  - An issue was discovered in write_tpt_entry in     drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel     through 5.3.2. The cxgb4 driver is directly calling     dma_map_single (a DMA function) from a stack variable.
    This could allow an attacker to trigger a Denial of     Service, exploitable if this driver is used on an     architecture for which this stack/DMA interaction has     security relevance. (CVE-2019-17075)

  - The SCTP socket buffer used by a userspace application     is not accounted by the cgroups subsystem. An attacker     can use this flaw to cause a denial of service attack.
    Kernel 3.10.x and 4.18.x branches are believed to be     vulnerable. (CVE-2019-3874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - The bnep_sock_ioctl function in     net/bluetooth/bnep/sock.c in the Linux kernel before     2.6.39 does not ensure that a certain device field ends     with a '\0' character, which allows local users to     obtain potentially sensitive information from kernel     stack memory, or cause a denial of service (BUG and     system crash), via a BNEPCONNADD command.
    (CVE-2011-1079)

  - An issue was discovered in fs/gfs2/rgrp.c in the Linux     kernel before 4.8. A use-after-free is caused by the     functions gfs2_clear_rgrpd and read_rindex_entry.
    (CVE-2016-10905)

  - An issue was discovered in     drivers/scsi/aacraid/commctrl.c in the Linux kernel     before 4.13. There is potential exposure of kernel stack     memory because aac_get_hba_info does not initialize the     hbainfo structure. (CVE-2017-18550)

  - An issue was discovered in the Linux kernel before     4.14.11. A double free may be caused by the function     allocate_trace_buffer in the file kernel/trace/trace.c.
    (CVE-2017-18595)

  - Improper invalidation for page table updates by a     virtual guest operating system for multiple Intel(R)     Processors may allow an authenticated user to     potentially enable denial of service of the host system     via local access. (CVE-2018-12207)

  - An issue was discovered in the Linux kernel before 4.20.
    There is a race condition in smp_task_timedout() and     smp_task_done() in drivers/scsi/libsas/sas_expander.c,     leading to a use-after-free. (CVE-2018-20836)

  - An issue was discovered in the Linux kernel before     4.18.7. In create_qp_common in     drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp     was never initialized, resulting in a leak of stack     memory to userspace. (CVE-2018-20855)

  - An issue was discovered in fs/xfs/xfs_super.c in the     Linux kernel before 4.18. A use after free exists,     related to xfs_fs_fill_super failure. (CVE-2018-20976)

  - In the tun subsystem in the Linux kernel before 4.13.14,     dev_get_valid_name is not called before     register_netdevice. This allows local users to cause a     denial of service (NULL pointer dereference and panic)     via an ioctl(TUNSETIFF) call with a dev name containing     a / character. This is similar to CVE-2013-4343.
    (CVE-2018-7191)

  - Insufficient access control in subsystem for Intel (R)     processor graphics in 6th, 7th, 8th and 9th Generation     Intel(R) Core(TM) Processor Families; Intel(R)     Pentium(R) Processor J, N, Silver and Gold Series;
    Intel(R) Celeron(R) Processor J, N, G3900 and G4900     Series; Intel(R) Atom(R) Processor A and E3900 Series;
    Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100     Processor Families may allow an authenticated user to     potentially enable denial of service via local access.
    (CVE-2019-0154)

  - Insufficient access control in a subsystem for Intel (R)     processor graphics in 6th, 7th, 8th and 9th Generation     Intel(R) Core(TM) Processor Families; Intel(R)     Pentium(R) Processor J, N, Silver and Gold Series;
    Intel(R) Celeron(R) Processor J, N, G3900 and G4900     Series; Intel(R) Atom(R) Processor A and E3900 Series;
    Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and     E-2200 Processor Families; Intel(R) Graphics Driver for     Windows before 26.20.100.6813 (DCH) or 26.20.100.6812     and before 21.20.x.5077 (aka15.45.5077), i915 Linux     Driver for Intel(R) Processor Graphics before versions     5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may     allow an authenticated user to potentially enable     escalation of privilege via local access.
    (CVE-2019-0155)

  - TSX Asynchronous Abort condition on some CPUs utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. (CVE-2019-11135)

  - The Linux kernel before 5.1-rc5 allows page->_refcount     reference count overflow, with resultant use-after-free     issues, if about 140 GiB of RAM exists. This is related     to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - The do_hidp_sock_ioctl function in     net/bluetooth/hidp/sock.c in the Linux kernel before     5.0.15 allows a local user to obtain potentially     sensitive information from kernel stack memory via a     HIDPCONNADD command, because a name field may not end     with a '\0' character. (CVE-2019-11884)

  - ** DISPUTED ** An issue was discovered in     drm_load_edid_firmware in     drivers/gpu/drm/drm_edid_load.c in the Linux kernel     through 5.1.5. There is an unchecked kstrdup of fwstr,     which might allow an attacker to cause a denial of     service (NULL pointer dereference and system crash).
    NOTE: The vendor disputes this issues as not being a     vulnerability because kstrdup() returning NULL is     handled sufficiently and there is no chance for a NULL     pointer dereference. (CVE-2019-12382)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/dvb-usb/dvb-usb-     init.c driver. (CVE-2019-15213)

  - An issue was discovered in xfs_setattr_nonsize in     fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS     partially wedges when a chgrp fails on account of being     out of disk quota. xfs_setattr_nonsize is failing to     unlock the ILOCK after the xfs_qm_vop_chown_reserve call     fails. This is primarily a local DoS attack vector, but     it might result as well in remote DoS if the XFS     filesystem is exported for instance via NFS.
    (CVE-2019-15538)

  - In the Linux kernel before 5.1.13, there is a memory     leak in drivers/scsi/libsas/sas_expander.c when SAS     expander discovery fails. This will cause a BUG and     denial of service. (CVE-2019-15807)

  - An issue was discovered in the Linux kernel before     5.0.1. There is a memory leak in     register_queue_kobjects() in net/core/net-sysfs.c, which     will cause denial of service. (CVE-2019-15916)

  - An issue was discovered in the Linux kernel before     5.0.4. The 9p filesystem did not protect i_size_write()     properly, which causes an i_size_read() infinite loop     and denial of service on SMP systems. (CVE-2019-16413)

  - An issue was discovered in write_tpt_entry in     drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel     through 5.3.2. The cxgb4 driver is directly calling     dma_map_single (a DMA function) from a stack variable.
    This could allow an attacker to trigger a Denial of     Service, exploitable if this driver is used on an     architecture for which this stack/DMA interaction has     security relevance. (CVE-2019-17075)

  - The SCTP socket buffer used by a userspace application     is not accounted by the cgroups subsystem. An attacker     can use this flaw to cause a denial of service attack.
    Kernel 3.10.x and 4.18.x branches are believed to be     vulnerable. (CVE-2019-3874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before     5.2.3. There is a use-after-free caused by a malicious     USB device in the     drivers/media/usb/dvb-usb/dvb-usb-init.c     driver.(CVE-2019-15213)

  - An issue was discovered in the Linux kernel before     5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/cpia2/cpia2_usb.c     driver.(CVE-2019-15215)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a NULL pointer dereference caused by a     malicious USB device in the     drivers/media/usb/zr364xx/zr364xx.c     driver.(CVE-2019-15217)

  - An issue was discovered in the Linux kernel before     5.1.8. There is a double-free caused by a malicious USB     device in the drivers/usb/misc/rio500.c     driver.(CVE-2019-15212)

  - An issue was discovered in the Linux kernel before     5.0.14. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/yurex.c     driver.(CVE-2019-15216)

  - An issue was discovered in drivers/scsi/qedi/qedi_dbg.c     in the Linux kernel before 5.1.12. In the qedi_dbg_*     family of functions, there is an out-of-bounds     read.(CVE-2019-15090)

  - An issue was discovered in the Linux kernel before     5.0.9. There is a NULL pointer dereference for a cd     data structure if alloc_disk fails in     drivers/block/paride/pf.c.(CVE-2019-15923)

  - An issue was discovered in the Linux kernel before     5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an     out-of-bounds read because data structures are     incompletely updated after a change from smb30 to     smb21.(CVE-2019-15918)

  - An issue was discovered in the Linux kernel before     5.0.9. There is a NULL pointer dereference for a pf     data structure if alloc_disk fails in     drivers/block/paride/pf.c.(CVE-2019-15922)

  - An issue was discovered in the Linux kernel before     5.2.3. Out of bounds access exists in the functions     ath6kl_wmi_pstream_timeout_event_rx and     ath6kl_wmi_cac_event_rx in the file     drivers/net/wireless/ath/ath6kl/wmi.c.(CVE-2019-15926)

  - An issue was discovered in the Linux kernel before     5.0.11. fm10k_init_module in     drivers/net/ethernet/intel/fm10k/fm10k_main.c has a     NULL pointer dereference because there is no -ENOMEM     upon an alloc_workqueue failure.(CVE-2019-15924)

  - A buffer overflow flaw was found, in versions from     2.6.34 to 5.2.x, in the way Linux kernel's vhost     functionality that translates virtqueue buffers to     IOVs, logged the buffer descriptors during migration. A     privileged guest user able to pass descriptors with     invalid length to the host when migration is underway,     could use this flaw to increase their privileges on the     host.(CVE-2019-14835)

  - In the Linux kernel through 5.2.14 on the powerpc     platform, a local user can read vector registers of     other users' processes via an interrupt. To exploit the     venerability, a local user starts a transaction (via     the hardware transactional memory instruction tbegin)     and then accesses vector registers. At some point, the     vector registers will be corrupted with the values from     a different local Linux process, because MSR_TM_ACTIVE     is misused in     arch/powerpc/kernel/process.c.(CVE-2019-15031)

  - In the Linux kernel through 5.2.14 on the powerpc     platform, a local user can read vector registers of     other users' processes via a Facility Unavailable     exception. To exploit the venerability, a local user     starts a transaction (via the hardware transactional     memory instruction tbegin) and then accesses vector     registers. At some point, the vector registers will be     corrupted with the values from a different local Linux     process because of a missing     arch/powerpc/kernel/process.c check.(CVE-2019-15030)

  - There is heap-based buffer overflow in kernel, all     versions up to, excluding 5.3, in the marvell wifi chip     driver in Linux kernel, that allows local users to     cause a denial of service(system crash) or possibly     execute arbitrary code.(CVE-2019-14816)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-14815)

  - There is heap-based buffer overflow in Linux kernel,     all versions up to, excluding 5.3, in the marvell wifi     chip driver in Linux kernel, that allows local users to     cause a denial of service(system crash) or possibly     execute arbitrary code.(CVE-2019-14814)

  - drivers/net/wireless/ath/ath10k/usb.c in the Linux     kernel through 5.2.8 has a NULL pointer dereference via     an incomplete address in an endpoint     descriptor.(CVE-2019-15099)

  - drivers/net/wireless/ath/ath6kl/usb.c in the Linux     kernel through 5.2.9 has a NULL pointer dereference via     an incomplete address in an endpoint     descriptor.(CVE-2019-15098)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
134293	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:0584-1)	Nessus	SuSE Local Security Checks	2020/3/6	2024/3/25	critical
131917	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4871)	Nessus	Oracle Linux Local Security Checks	2019/12/10	2026/2/9	low
132490	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0264)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2024/4/2	high
132499	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0266)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2024/4/2	high
131474	EulerOS Virtualization for ARM 64 3.0.3.0 : kernel (EulerOS-SA-2019-2309)	Nessus	Huawei Local Security Checks	2019/12/3	2024/4/9	critical

検出

プラグインの検索

critical

low

high

high

critical