This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream. This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4680-1 advisory.

    It was discovered that debugfs in the Linux kernel as used by blktrace contained a use-after-free in some     situations. A privileged local attacker could possibly use this to cause a denial of service (system     crash). (CVE-2019-19770)

    It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-     connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to     complete authentication without pairing credentials via adjacent access. A physically proximate attacker     could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

    It was discovered that the console keyboard driver in the Linux kernel contained a race condition. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2020-25656)

    Minh Yuan discovered that the tty driver in the Linux kernel contained race conditions when handling     fonts. A local attacker could possibly use this to expose sensitive information (kernel memory).
    (CVE-2020-25668)

    Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in     scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that     depend on source port randomization. (CVE-2020-25705)

    Jinoh Kang discovered that the Xen event channel infrastructure in the Linux kernel contained a race     condition. An attacker in guest could possibly use this to cause a denial of service (dom0 crash).
    (CVE-2020-27675)

    Daniel Axtens discovered that PowerPC RTAS implementation in the Linux kernel did not properly restrict     memory accesses in some situations. A privileged local attacker could use this to arbitrarily modify     kernel memory, potentially bypassing kernel lockdown restrictions. (CVE-2020-27777)

    Minh Yuan discovered that the framebuffer console driver in the Linux kernel did not properly handle fonts     in some conditions. A local attacker could use this to cause a denial of service (system crash) or     possibly expose sensitive information (kernel memory). (CVE-2020-28974)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
146282	openSUSE Security Update : RT kernel (openSUSE-2021-242)	Nessus	SuSE Local Security Checks	2021/2/8	2023/2/9	critical
144749	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4680-1)	Nessus	Ubuntu Local Security Checks	2021/1/6	2026/6/3	high

検出

プラグインの検索

critical

high