The version of kernel installed on the remote host is prior to 4.14.231-173.360. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1627 advisory.

    A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.
    (CVE-2019-19060)

    A bypass was found for the Spectre v1 hardening in the eBPF engine of the Linux kernel. The code in the     kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic in various     cases, including cases of different branches with different state or limits to sanitize, leading to side-     channel attacks. (CVE-2019-7308)

    A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free     which might lead to privilege escalations. (CVE-2020-25670)

    A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-     free which might lead to privilege escalations. (CVE-2020-25671)

    A memory leak vulnerability was found in Linux kernel in llcp_sock_connect. (CVE-2020-25672)

    A flaw was found in the Linux kernels eBPF verification code. By default accessing the eBPF verifier is     only accessible to privileged users with CAP_SYS_ADMIN. A flaw that triggers Integer underflow when     restricting speculative pointer arithmetic allows unprivileged local users to leak the content of kernel     memory. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-27171)

    A flaw was found in the Linux kernel. The rtw_wx_set_scan driver allows writing beyond the end of the
    ->ssid[] array. The highest threat from this vulnerability is to data confidentiality and integrity as     well system availability. (CVE-2021-28660)

    The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

    A race condition flaw was found in get_old_root in fs/btrfs/ctree.c in the Linux kernel in btrfs file-     system. This flaw allows a local attacker with a special user privilege to cause a denial of service due     to not locking an extent buffer before a cloning operation. The highest threat from this vulnerability is     to system availability. (CVE-2021-28964)

    A flaw in the Linux kernels implementation of the RPA PCI Hotplug driver for power-pc.  A user with     permissions to write to the sysfs settings for this driver can trigger a buffer overflow when writing a     new device name to the driver from userspace, overwriting data in the kernel's stack. (CVE-2021-28972)

    A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only     accessible to privileged users with CAP_SYS_ADMIN.   A local user with the ability to insert eBPF     instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-29154)

    A flaw was found in the Linux kernel. The usbip driver allows attackers to cause a denial of service (GPF)     because the stub-up sequence has race conditions during an update of the local and shared status. The     highest threat from this vulnerability is to system availability. (CVE-2021-29265)

    A flaw was found in the Linux kernel. This flaw allows attackers to obtain sensitive information from     kernel memory because of a partially uninitialized data structure. The highest threat from this     vulnerability is to confidentiality. (CVE-2021-29647)

    A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice     into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest     threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2021-3483)

    A flaw was discovered in processing setsockopt IPT_SO_SET_REPLACE (or IP6T_SO_SET_REPLACE) for 32 bit     processes on 64 bit systems. This flaw will allow local user to gain privileges or cause a DoS through     user name space. This action is usually restricted to root-privileged users but can also be leveraged if     the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS and the user is granted elevated privileges.
    (CVE-2021-22555)

    CVE-2021-22555 has been added after the original release, however it was fixed in the patch from     2021-04-20.

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_parse_conf_rsp and l2cap_parse_conf_req functions. An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.(CVE-2019-3460)

A flaw was found in the Linux kernels implementation of Logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack.
An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.(CVE-2019-3459)

A bypass was found for the Spectre v1 hardening in the eBPF engine of the Linux kernel. The code in the kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.(CVE-2019-7308)

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3931-2 advisory.

    USN-3931-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu     16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04 LTS.

    M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not properly set up all arguments to an     error handler callback used when running as a paravirtualized guest. An unprivileged attacker in a     paravirtualized guest VM could use this to cause a denial of service (guest VM crash). (CVE-2018-14678)

    It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly     handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to     cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021)

    Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound     Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2018-19824)

    Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth     implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive     information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

    Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free     vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of     service (guest VM crash). (CVE-2019-6974)

    Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux     kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a     denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

    Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux     kernel, when nested virtualization is used. A local attacker could use this to expose sensitive     information (host system memory to a guest VM). (CVE-2019-7222)

    Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against     Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

    It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg)     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-8912)

    It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors     while reading files. A local attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2019-8980)

    Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap     minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL     pointer dereference vulnerability. (CVE-2019-9213)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3930-2 advisory.

    USN-3930-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04     LTS.

    Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound     Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2018-19824)

    Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth     implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive     information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

    Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free     vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of     service (guest VM crash). (CVE-2019-6974)

    Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux     kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a     denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221)

    Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux     kernel, when nested virtualization is used. A local attacker could use this to expose sensitive     information (host system memory to a guest VM). (CVE-2019-7222)

    Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against     Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308)

    It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg)     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-8912)

    Jakub Jirasek discovered a use-after-free vulnerability in the SCTP implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2019-8956)

    It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors     while reading files. A local attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2019-8980)

    It was discovered that a use-after-free vulnerability existed in the IPMI implementation in the Linux     kernel. A local attacker with access to the IPMI character device files could use this to cause a denial     of service (system crash). (CVE-2019-9003)

    Jann Horn discovered that the SNMP NAT implementation in the Linux kernel performed insufficient ASN.1     length checks. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-9162)

    Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap     minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL     pointer dereference vulnerability. (CVE-2019-9213)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
148919	Amazon Linux 2 : kernel (ALAS-2021-1627)	Nessus	Amazon Linux Local Security Checks	2021/4/22	2026/2/24	high
124592	Amazon Linux 2 : kernel (ALAS-2019-1201)	Nessus	Amazon Linux Local Security Checks	2019/5/6	2024/5/29	medium
123445	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)	Nessus	SuSE Local Security Checks	2019/3/28	2022/5/20	high
123496	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0784-1)	Nessus	SuSE Local Security Checks	2019/3/29	2022/5/20	high
123679	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3931-2)	Nessus	Ubuntu Local Security Checks	2019/4/3	2024/8/27	high
123677	Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3930-2)	Nessus	Ubuntu Local Security Checks	2019/4/3	2024/8/27	high

検出

プラグインの検索

high

medium

high

high

high

high