Vulnerability   
Search   
    Search 187964 CVE descriptions
and 85075 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.704667
Category:Debian Local Security Checks
Title:Debian: Security Advisory for linux (DSA-4667-1)
Summary:The remote host is missing an update for the 'linux'; package(s) announced via the DSA-4667-1 advisory.
Description:Summary:
The remote host is missing an update for the 'linux'
package(s) announced via the DSA-4667-1 advisory.

Vulnerability Insight:
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service, or information
leak.

CVE-2020-2732
Paulo Bonzini discovered that the KVM implementation for Intel
processors did not properly handle instruction emulation for L2
guests when nested virtualization is enabled. This could allow
an L2 guest to cause privilege escalation, denial of service,
or information leaks in the L1 guest.

CVE-2020-8428
Al Viro discovered a use-after-free vulnerability in the VFS
layer. This allowed local users to cause a denial-of-service
(crash) or obtain sensitive information from kernel memory.

CVE-2020-10942
It was discovered that the vhost_net driver did not properly
validate the type of sockets set as back-ends. A local user
permitted to access /dev/vhost-net could use this to cause a stack
corruption via crafted system calls, resulting in denial of
service (crash) or possibly privilege escalation.

CVE-2020-11565
Entropy Moe reported that the shared memory filesystem (tmpfs) did
not correctly handle an mpol
mount option specifying an empty
node list, leading to a stack-based out-of-bounds write. If user
namespaces are enabled, a local user could use this to cause a
denial of service (crash) or possibly for privilege escalation.

CVE-2020-11884
Al Viro reported a race condition in memory management code for
IBM Z (s390x architecture), that can result in the kernel
executing code from the user address space. A local user could
use this for privilege escalation.

Affected Software/OS:
'linux' package(s) on Debian Linux.

Solution:
For the stable distribution (buster), these problems have been fixed in
version 4.19.98-1+deb10u1.

We recommend that you upgrade your linux packages.

CVSS Score:
6.9

CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2020-2732
Debian Security Information: DSA-4667 (Google Search)
https://www.debian.org/security/2020/dsa-4667
Debian Security Information: DSA-4698 (Google Search)
https://www.debian.org/security/2020/dsa-4698
https://bugzilla.redhat.com/show_bug.cgi?id=1805135
https://git.kernel.org/linus/07721feee46b4b248402133228235318199b05ec
https://git.kernel.org/linus/35a571346a94fb93b5b3b6a599675ef3384bc75c
https://git.kernel.org/linus/e71237d3ff1abf9f3388337cfebf53b96df2020d
https://linux.oracle.com/errata/ELSA-2020-5540.html
https://linux.oracle.com/errata/ELSA-2020-5542.html
https://linux.oracle.com/errata/ELSA-2020-5543.html
https://www.openwall.com/lists/oss-security/2020/02/25/3
https://www.spinics.net/lists/kvm/msg208259.html
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
Common Vulnerability Exposure (CVE) ID: CVE-2020-8428
http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d0cb50185ae942b03c4327be322055d622dc79f6
https://github.com/torvalds/linux/commit/d0cb50185ae942b03c4327be322055d622dc79f6
https://www.openwall.com/lists/oss-security/2020/01/28/2
http://www.openwall.com/lists/oss-security/2020/01/28/4
http://www.openwall.com/lists/oss-security/2020/02/02/1
SuSE Security Announcement: openSUSE-SU-2020:0336 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
https://usn.ubuntu.com/4318-1/
https://usn.ubuntu.com/4319-1/
https://usn.ubuntu.com/4320-1/
https://usn.ubuntu.com/4324-1/
https://usn.ubuntu.com/4325-1/
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

This is only one of 85075 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.