The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0372-1 advisory.

  - The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a     vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. (CVE-2020-28097)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

  - In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-194696049References: Upstream kernel (CVE-2021-39657)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device     driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A     local user could use this flaw to get unauthorized access to some data. (CVE-2021-4135)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in     the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem     while the device is getting removed, leading to a privilege escalation problem. (CVE-2021-4202)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network     protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more     buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). (CVE-2022-0322)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.219-161.340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1600 advisory.

    2024-05-23: CVE-2023-1390 was added to this advisory.

    A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel. There was a race problem in     trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service     problem (DOS). This flaw could even allow a local attacker with special user  privilege to a kernel     information leak threat. (CVE-2020-27825)

    A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an     authenticated attacker could write to any block on the exported SCSI device backing store. This flaw     allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on the     backing store. The highest threat from this vulnerability is to integrity. In addition, this flaw affects     the tcmu-runner package, where the affected SCSI command is called. (CVE-2020-28374)

    A flaw leak of the file handle for parent directory in the Linux kernel's NFS3 functionality was found in     the way user calls READDIRPLUS. A local user could use this flaw to traverse to other parts of the file-     system than mounted sub-folder. (CVE-2021-3178)

    A flaw was found in the Linux kernel. A use-after-free memory flaw in the Fast Userspace Mutexes     functionality allowing a local user to crash the system or escalate their privileges on the system. The     highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2021-3347)

    A use after free flaw in the Linux kernel network block device (NBD) subsystem was found in the way user     calls an ioctl NBD_SET_SOCK at a certain point during device setup. (CVE-2021-3348)

    In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

    A remote denial of service vulnerability was found in the Linux kernel's TIPC kernel module. The while     loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue.
    Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system     to instantly spike to 100%, causing a denial of service condition. (CVE-2023-1390)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0367-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization     subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could     use this flaw to crash the system (bnc#1186207).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could     have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object (bnc#1193767).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
    - CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
    - CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
    - CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
    - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket     file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race     condition (bnc#1193727).
    - CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c     (bnc#1194087).
    - CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).
    - CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).
    - CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392)     (bsc#1193442).
    - CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
    - CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free.
    This could lead to local escalation of privilege with System execution privileges needed. User interaction     is not needed for exploitation (bnc#1192032).
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device (bsc#1179599).
    - CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
    - CVE-2021-43975: hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c     allowed an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted     length value (bnc#1192845).
    - CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version     3.17.3 may have allowed an authenticated user to potentially enable denial of service via local access     (bnc#1192877).
    - CVE-2021-43976: mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allowed an attacker (who     can connect a crafted USB device) to cause a denial of service (skb_over_panic) (bnc#1192847).
    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k' (bsc#1167162).
    - CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0371-1 advisory.

    The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
    - CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
    - CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table     (bnc#1194087).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could     have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object (bnc#1193767).
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
    - CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
    - CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
    - CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).
    - CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
    - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket     file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race     condition (bnc#1193727).
    - CVE-2021-4002: Fixed a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization     subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could     use this flaw to crash the system (bnc#1186207).
    - CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper     input validation. (bsc#1192877)
    - CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392)     (bsc#1193442).
    - CVE-2021-28714: Fixed issue with xen/netback to add rx queue stall detection (XSA-392) (bsc#1193442).
    - CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free.
    This could lead to local escalation of privilege with System execution privileges needed. User interaction     is not needed for exploitation (bnc#1192032).
    - CVE-2021-0920: Fixed use after free bug due to a race condition in unix_scm_to_skb of af_unix.c. This     could have led to local escalation of privilege with System execution privileges needed (bnc#1193731).
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bsc#1179599)
    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k'. (bsc#1167162)
    - CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001374 advisory.

    In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0363-1 advisory.

  - The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a     vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. (CVE-2020-28097)

  - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through     crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected     versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

  - In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-194696049References: Upstream kernel (CVE-2021-39657)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
    (CVE-2021-45095)

  - A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local     denial of service. (CVE-2022-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0543-1 advisory.

    The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial     of service (bnc#1195371).
    - CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback     (bnc#1187723).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
    - CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have     been exploited by a local user through crafted syscalls to escalate privileges or deny service     (bnc#1195184).
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
157929	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:0372-1)	Nessus	SuSE Local Security Checks	2022/2/12	2023/7/13	high
146631	Amazon Linux 2 : kernel (ALAS-2021-1600)	Nessus	Amazon Linux Local Security Checks	2021/2/19	2026/2/24	high
157895	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0367-1)	Nessus	SuSE Local Security Checks	2022/2/11	2026/6/26	high
157939	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0371-1)	Nessus	SuSE Local Security Checks	2022/2/12	2026/6/26	high
160118	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2022-1523)	Nessus	Huawei Local Security Checks	2022/4/25	2026/6/3	high
290564	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001374)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
157890	openSUSE 15 Security Update : kernel (openSUSE-SU-2022:0363-1)	Nessus	SuSE Local Security Checks	2022/2/11	2023/11/9	high
158225	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:0543-1)	Nessus	SuSE Local Security Checks	2022/2/22	2026/6/26	high

检测

插件搜索

high

high

high

high

high

medium

high

high