The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4749-1 advisory.

    Bodong Zhao discovered a use-after-free in the Sun keyboard driver implementation in the Linux kernel. A     local attacker could use this to cause a denial of service or possibly execute arbitrary code.
    (CVE-2020-25669)

    It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds     read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash).
    (CVE-2020-27815)

    Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in the Linux kernel did not     correctly handle setting line discipline in some situations. A local attacker could use this to cause a     denial of service (system crash). (CVE-2020-27830, CVE-2020-28941)

    It was discovered that the memory management subsystem in the Linux kernel did not properly handle copy-     on-write operations in some situations. A local attacker could possibly use this to gain unintended write     access to read-only memory pages. (CVE-2020-29374)

    Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event processing backend in the Linux     kernel did not properly limit the number of events queued. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2020-29568)

    Olivier Benjamin and Pawel Wieczorkiewicz discovered a race condition the Xen paravirt block backend in     the Linux kernel, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2020-29569)

    Jann Horn discovered that the tty subsystem of the Linux kernel did not use consistent locking in some     situations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2020-29660)

    Jann Horn discovered a race condition in the tty subsystem of the Linux kernel in the locking for the     TIOCSPGRP ioctl(), leading to a use-after- free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-29661)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).

CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).

CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).

CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).

CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).

CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).

CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).

CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).

CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).

CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).

CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).

CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).

CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).

CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).

CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).

CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).

CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).

CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).

CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).

CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).

CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).

CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2689 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of     arbitrary code, privilege escalation, denial of service, or information leaks. This update is not yet     available for the armel (ARM EABI soft-float) architecture. CVE-2020-24586, CVE-2020-24587, CVE-2020-26147     Mathy Vanhoef discovered that many Wi-Fi implementations, including Linux's mac80211, did not correctly     implement reassembly of fragmented packets. In some circumstances, an attacker within range of a network     could exploit these flaws to forge arbitrary packets and/or to access sensitive data on that network.
    CVE-2020-24588 Mathy Vanhoef discovered that most Wi-Fi implementations, including Linux's mac80211, did     not authenticate the is aggregated packet header flag. An attacker within range of a network could exploit     this to forge arbitrary packets on that network. CVE-2020-25670, CVE-2020-25671, CVE-2021-23134 kiyin     () of TenCent discovered several reference counting bugs in the NFC LLCP implementation which could     lead to use-after-free. A local user could exploit these for denial of service (crash or memory     corruption) or possibly for privilege escalation. Nadav Markus and Or Cohen of Palo Alto Networks     discovered that the original fixes for these introduced a new bug that could result in use-after-free and     double-free. This has also been fixed. CVE-2020-25672 kiyin () of TenCent discovered a memory leak     in the NFC LLCP implementation. A local user could exploit this for denial of service (memory exhaustion).
    CVE-2020-26139 Mathy Vanhoef discovered that a bug in some Wi-Fi implementations, including Linux's     mac80211. When operating in AP mode, they would forward EAPOL frames from one client to another while the     sender was not yet authenticated. An attacker within range of a network could use this for denial of     service or as an aid to exploiting other vulnerabilities. CVE-2020-26558, CVE-2021-0129 Researchers at     ANSSI discovered vulnerabilities in the Bluetooth Passkey authentication method, and in Linux's     implementation of it. An attacker within range of two Bluetooth devices while they pair using Passkey     authentication could exploit this to obtain the shared secret (Passkey) and then impersonate either of the     devices to each other. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's virtual memory     management. A parent and child process initially share all their memory, but when either writes to a     shared page, the page is duplicated and unshared (copy-on-write). However, in case an operation such as     vmsplice() required the kernel to take an additional reference to a shared page, and a copy-on-write     occurs during this operation, the kernel might have accessed the wrong process's memory. For some     programs, this could lead to an information leak or data corruption. CVE-2020-36322, CVE-2021-28950 The     syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not correctly handle a FUSE     server returning invalid attributes for a file. A local user permitted to run a FUSE server could use this     to cause a denial of service (crash). The original fix for this introduced a different potential denial of     service (infinite loop in kernel space), which has also been fixed. CVE-2021-3428 Wolfgang Frisch reported     a potential integer overflow in the ext4 filesystem driver. A user permitted to mount arbitrary filesystem     images could use this to cause a denial of service (crash). CVE-2021-3483  (Zheyu Ma) reported a     bug in the nosy driver for TI PCILynx FireWire controllers, which could lead to list corruption and a use-     after-free. On a system that uses this driver, local users granted access to /dev/nosy could exploit this     to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3564, CVE-2021-3573, CVE-2021-32399 The BlockSec team discovered several race conditions in the     Bluetooth subsystem that could lead to a use-after-free or double-free. A local user could exploit these     to caue a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2021-3587 Active Defense Lab of Venustech discovered a potential null pointer dereference in the NFC     LLCP implementation. A local user could use this to cause a denial of service (crash). CVE-2021-20292 It     was discovered that the TTM buffer allocation API used by GPU drivers did not handle allocation failures     in the way that most drivers expected, resulting in a double-free on failure. A local user on a system     using one of these drivers could possibly exploit this to cause a denial of service (crash or memory     corruption) or for privilege escalation. The API has been changed to match driver expectations.
    CVE-2021-23133 Or Cohen of Palo Alto Networks discovered a race condition in the SCTP implementation,     which can lead to list corruption. A local user could exploit this to cause a denial of service (crash or     memory corruption) or possibly for privilege escalation. CVE-2021-28660 It was discovered that the     rtl8188eu WiFi driver did not correctly limit the length of SSIDs copied into scan results. An attacker     within WiFi range could use this to cause a denial of service (crash or memory corruption) or possibly to     execute code on a vulnerable system. CVE-2021-28688 (XSA-371) It was discovered that the original fix for     CVE-2021-26930 (XSA-365) introduced a potential resource leak. A malicious guest could presumably exploit     this to cause a denial of service (resource exhaustion) within the host. CVE-2021-28964 Zygo Blaxell     reported a race condition in the Btrfs driver which can lead to an assertion failure. On systems using     Btrfs, a local user could exploit this to cause a denial of service (crash). CVE-2021-28971 Vince Weaver     reported a bug in the performance event handler for Intel PEBS. A workaround for a hardware bug on Intel     CPUs codenamed Haswell and earlier could lead to a null pointer dereference. On systems with the affected     CPUs, if users are permitted to access performance events, a local user may exploit this to cause a denial     of service (crash). By default, unprivileged users do not have access to performance events, which     mitigates this issue. This is controlled by the kernel.perf_event_paranoid sysctl. CVE-2021-29154 It was     discovered that the Extended BPF (eBPF) JIT compiler for x86_64 generated incorrect branch instructions in     some cases. On systems where eBPF JIT is enabled, users could exploit this to execute arbitrary code in     the kernel. By default, eBPF JIT is disabled, mitigating this issue. This is controlled by the     net.core.bpf_jit_enable sysctl. CVE-2021-29265 The syzbot tool found a race condition in the USB/IP host     (server) implementation which can lead to a null pointer dereference. On a system acting as a USB/IP host,     a client can exploit this to cause a denial of service (crash). CVE-2021-29647 The syzbot tool found an     information leak in the Qualcomm IPC Router (qrtr) implementation. This protocol is not enabled in     Debian's official kernel configurations. CVE-2021-29650 It was discovered that a data race in the     netfilter subsystem could lead to a null pointer dereference during replacement of a table. A local user     with CAP_NET_ADMIN capability in any user namespace could use this to cause a denial of service (crash).
    By default, unprivileged users cannot create user namespaces, which mitigates this issue. This is     controlled by the kernel.unprivileged_userns_clone sysctl. CVE-2021-30002 Arnd Bergmann and the syzbot     tool found a memory leak in the Video4Linux (v4l) subsystem. A local user permitted to access video     devices (by default, any member of the video group) could exploit this to cause a denial of service     (memory exhaustion). CVE-2021-31916 Dan Carpenter reported incorrect parameter validation in the device-     mapper (dm) subsystem, which could lead to a heap buffer overrun. However, only users with CAP_SYS_ADMIN     capability (i.e. root-equivalent) could trigger this bug, so it did not have any security impact in this     kernel version. CVE-2021-33034 The syzbot tool found a bug in the Bluetooth subsystem that could lead to a     use-after-free. A local user could use this to cause a denial of service (crash or memory corruption) or     possibly for privilege escalation. For Debian 9 stretch, these problems have been fixed in version     4.9.272-1. This update additionally includes many more bug fixes from stable updates 4.9.259-4.9.272     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further     information about Debian LTS security advisories, how to apply these updates to your system and frequently     asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
147568	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0736-1)	Nessus	SuSE Local Security Checks	2021/3/10	2024/1/10	high
147983	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4749-1)	Nessus	Ubuntu Local Security Checks	2021/3/23	2024/8/27	high
148509	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:1175-1)	Nessus	SuSE Local Security Checks	2021/4/14	2024/1/4	high
150985	Debian DLA-2689-1 : linux - LTS security update	Nessus	Debian Local Security Checks	2021/6/24	2025/9/24	high

検出

プラグインの検索

high

high

high

high