The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0169-1 advisory.
A read-after-free memory flaw was found in the Linux kernel’s garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)
A memory leak vulnerability was found in the Linux kernel’s eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4135)
A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. (CVE-2021-4149)
An unprivileged write to the file handler flaw in the Linux kernel’s control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system. (CVE-2021-4197)
A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem. (CVE-2021-4202)
In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn’t properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)
In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small. (CVE-2021-45486)
nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace. (CVE-2021-46283)
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)
A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# SUSE update advisory SUSE-SU-2022:0169-1. The text itself
# is copyright (C) SUSE.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(157087);
script_version("1.8");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/14");
script_cve_id(
"CVE-2021-4083",
"CVE-2021-4135",
"CVE-2021-4149",
"CVE-2021-4197",
"CVE-2021-4202",
"CVE-2021-45485",
"CVE-2021-45486",
"CVE-2021-46283",
"CVE-2022-0185",
"CVE-2022-0322"
);
script_xref(name:"SuSE", value:"SUSE-SU-2022:0169-1");
script_name(english:"SUSE SLES15 Security Update : kernel (SUSE-SU-2022:0169-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in
the SUSE-SU-2022:0169-1 advisory.
- A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket
file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race
condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)
- A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device
driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A
local user could use this flaw to get unauthorized access to some data. (CVE-2021-4135)
- A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an
improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of
service (DOS) due to a deadlock problem. (CVE-2021-4149)
- An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces
subsystem was found in the way users have access to some less privileged process that are controlled by
cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of
control groups. A local user could use this flaw to crash the system or escalate their privileges on the
system. (CVE-2021-4197)
- A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in
the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem
while the device is getting removed, leading to a privilege escalation problem. (CVE-2021-4202)
- In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information
leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based
attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)
- In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak
because the hash table is very small. (CVE-2021-45486)
- nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to
cause a denial of service (NULL pointer dereference and general protection fault) because of the missing
initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own
namespace. (CVE-2021-46283)
- A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem
Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in
case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local
user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to
legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)
- A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network
protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more
buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1065729");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1071995");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1154353");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1154492");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1156395");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1167773");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1176447");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1176774");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1177437");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1190256");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1191271");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1191929");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1192931");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193255");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193328");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193660");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193669");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193727");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193901");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193927");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194001");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194027");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194087");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194094");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194302");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194493");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194516");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194517");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194518");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194529");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194578");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194580");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194584");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194586");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194587");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194589");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194590");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194591");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194592");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194888");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194953");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1194985");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-4083");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-4135");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-4149");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-4197");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-4202");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-45485");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-45486");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-46283");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-0185");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2022-0322");
# https://lists.suse.com/pipermail/sle-security-updates/2022-January/010060.html
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8bea4669");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-0185");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2021/12/25");
script_set_attribute(attribute:"patch_publication_date", value:"2022/01/25");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/01/26");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-azure");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-azure-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-devel-azure");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-source-azure");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-syms-azure");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"SuSE Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item("Host/SuSE/release");
if (isnull(os_release) || os_release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
var os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15', 'SUSE (' + os_ver + ')');
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);
var service_pack = get_kb_item("Host/SuSE/patchlevel");
if (isnull(service_pack)) service_pack = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(3)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES15 SP3", os_ver + " SP" + service_pack);
var pkgs = [
{'reference':'kernel-azure-5.3.18-150300.38.37.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-public-cloud-release-15.3']},
{'reference':'kernel-azure-devel-5.3.18-150300.38.37.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-public-cloud-release-15.3']},
{'reference':'kernel-devel-azure-5.3.18-150300.38.37.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-public-cloud-release-15.3']},
{'reference':'kernel-source-azure-5.3.18-150300.38.37.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-public-cloud-release-15.3']},
{'reference':'kernel-syms-azure-5.3.18-150300.38.37.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sle-module-public-cloud-release-15.3']}
];
var ltss_caveat_required = FALSE;
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var exists_check = NULL;
var rpm_spec_vers_cmp = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (reference && _release) {
if (exists_check) {
var check_flag = 0;
foreach var check (exists_check) {
if (!rpm_exists(release:_release, rpm:check)) continue;
check_flag++;
}
if (!check_flag) continue;
}
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-azure / kernel-azure-devel / kernel-devel-azure / etc');
}
Vendor | Product | Version | CPE |
---|---|---|---|
novell | suse_linux | kernel-azure | p-cpe:/a:novell:suse_linux:kernel-azure |
novell | suse_linux | kernel-azure-devel | p-cpe:/a:novell:suse_linux:kernel-azure-devel |
novell | suse_linux | kernel-devel-azure | p-cpe:/a:novell:suse_linux:kernel-devel-azure |
novell | suse_linux | kernel-source-azure | p-cpe:/a:novell:suse_linux:kernel-source-azure |
novell | suse_linux | kernel-syms-azure | p-cpe:/a:novell:suse_linux:kernel-syms-azure |
novell | suse_linux | 15 | cpe:/o:novell:suse_linux:15 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4135
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4149
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4197
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4202
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45485
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45486
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46283
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0185
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0322
www.nessus.org/u?8bea4669
bugzilla.suse.com/1065729
bugzilla.suse.com/1071995
bugzilla.suse.com/1154353
bugzilla.suse.com/1154492
bugzilla.suse.com/1156395
bugzilla.suse.com/1167773
bugzilla.suse.com/1176447
bugzilla.suse.com/1176774
bugzilla.suse.com/1177437
bugzilla.suse.com/1190256
bugzilla.suse.com/1191271
bugzilla.suse.com/1191929
bugzilla.suse.com/1192931
bugzilla.suse.com/1193255
bugzilla.suse.com/1193328
bugzilla.suse.com/1193660
bugzilla.suse.com/1193669
bugzilla.suse.com/1193727
bugzilla.suse.com/1193901
bugzilla.suse.com/1193927
bugzilla.suse.com/1194001
bugzilla.suse.com/1194027
bugzilla.suse.com/1194087
bugzilla.suse.com/1194094
bugzilla.suse.com/1194302
bugzilla.suse.com/1194493
bugzilla.suse.com/1194516
bugzilla.suse.com/1194517
bugzilla.suse.com/1194518
bugzilla.suse.com/1194529
bugzilla.suse.com/1194578
bugzilla.suse.com/1194580
bugzilla.suse.com/1194584
bugzilla.suse.com/1194586
bugzilla.suse.com/1194587
bugzilla.suse.com/1194589
bugzilla.suse.com/1194590
bugzilla.suse.com/1194591
bugzilla.suse.com/1194592
bugzilla.suse.com/1194888
bugzilla.suse.com/1194953
bugzilla.suse.com/1194985
www.suse.com/security/cve/CVE-2021-4083
www.suse.com/security/cve/CVE-2021-4135
www.suse.com/security/cve/CVE-2021-4149
www.suse.com/security/cve/CVE-2021-4197
www.suse.com/security/cve/CVE-2021-4202
www.suse.com/security/cve/CVE-2021-45485
www.suse.com/security/cve/CVE-2021-45486
www.suse.com/security/cve/CVE-2021-46283
www.suse.com/security/cve/CVE-2022-0185
www.suse.com/security/cve/CVE-2022-0322