According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

  - No description is available for this CVE. (CVE-2022-1198)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1255-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-28356: Fixed a refcount leak bug in net/llc/af_llc.c (bnc#1197391).
    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution (bsc#1197227).
    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel     (bnc#1198033).
    - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel     (bnc#1198032).
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel     (bnc#1198031).
    - CVE-2022-0812: Fixed an incorrect header size calculations in xprtrdma (bsc#1196639).
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock (bsc#1197331).
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c (bsc#1196761).
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device (bsc#1196836).
    - CVE-2022-0886: Fix possible buffer overflow in ESP transformation (bsc#1197131).
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file (bnc#1197366).
    - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-     after-free (bsc#1196973).
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers (bsc#1196488).
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory (bsc#1196830).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1267-1 advisory.

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux     Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
    (CVE-2022-0812)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1402-1 advisory.

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux     Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
    (CVE-2022-0812)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2721-1 advisory.

  - In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak,     aka CID-28ebeb8db770. (CVE-2020-15393)

  - A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of     ttys could lead to a use-after-free. (CVE-2020-36557)

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004475 advisory.

    Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5096 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's     virtual memory management. A parent and child process initially share all their memory, but when either     writes to a shared page, the page is duplicated and unshared (copy-on-write). However, in case an     operation such as vmsplice() required the kernel to take an additional reference to a shared page, and a     copy-on-write occurs during this operation, the kernel might have accessed the wrong process's memory. For     some programs, this could lead to an information leak or data corruption. This issue was already fixed for     most architectures, but not on MIPS and System z. This update corrects that. CVE-2020-36322,     CVE-2021-28950 The syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not     correctly handle a FUSE server returning invalid attributes for a file. A local user permitted to run a     FUSE server could use this to cause a denial of service (crash). The original fix for this introduced a     different potential denial of service (infinite loop in kernel space), which has also been fixed.
    CVE-2021-3640 Lin Ma discovered a race condiiton in the Bluetooth protocol implementation that can lead to     a use-after-free. A local user could exploit this to cause a denial of service (memory corruption or     crash) or possibly for privilege escalation. CVE-2021-3744, CVE-2021-3764 minihanshen reported bugs in the     ccp driver for AMD Cryptographic Coprocessors that could lead to a resource leak. On systems using this     driver, a local user could exploit this to cause a denial of service. CVE-2021-3752 Likang Luo of NSFOCUS     Security Team discovered a flaw in the Bluetooth L2CAP implementation that can lead to a user-after-free.
    A local user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-3760, CVE-2021-4202 Lin Ma discovered race conditions in the NCI (NFC     Controller Interface) driver, which could lead to a use-after-free. A local user could exploit this to     cause a denial of service (memory corruption or crash) or possibly for privilege escalation. This driver     is not enabled in Debian's official kernel configurations. CVE-2021-3772 A flaw was found in the SCTP     protocol implementation, which would allow a networked attacker to break an SCTP association. The attacker     would only need to know or guess the IP addresses and ports for the association. CVE-2021-4002 It was     discovered that hugetlbfs, the virtual filesystem used by applications to allocate huge pages in RAM, did     not flush the CPU's TLB in one case where it was necessary. In some circumstances a local user would be     able to read and write huge pages after they are freed and reallocated to a different process. This could     lead to privilege escalation, denial of service or information leaks. CVE-2021-4083 Jann Horn reported a     race condition in the local (Unix) sockets garbage collector, that can lead to use-after-free. A local     user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-4135 A flaw was found in the netdevsim driver which would lead to an     information leak. This driver is not enabled in Debian's official kernel configurations. CVE-2021-4155     Kirill Tkhai discovered a data leak in the way the XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for     a size increase of files with unaligned size. A local attacker can take advantage of this flaw to leak     data on the XFS filesystem. CVE-2021-4203 Jann Horn reported a race condition in the local (Unix) sockets     implementation that can lead to a use-after-free. A local user could exploit this to leak sensitive     information from the kernel. CVE-2021-20317 It was discovered that the timer queue structure could become     corrupt, leading to waiting tasks never being woken up. A local user with certain privileges could exploit     this to cause a denial of service (system hang). CVE-2021-20321 A race condition was discovered in the     overlayfs filesystem driver. A local user with access to an overlayfs mount and to its underlying upper     directory could exploit this for privilege escalation. CVE-2021-20322 An information leak was discovered     in the IPv4 implementation. A remote attacker could exploit this to quickly discover which UDP ports a     system is using, making it easier for them to carry out a DNS poisoning attack against that system.
    CVE-2021-22600 The syzbot tool found a flaw in the packet socket (AF_PACKET) implementation which could     lead to incorrectly freeing memory. A local user with CAP_NET_RAW capability (in any user namespace) could     exploit this for denial of service (memory corruption or crash) or possibly for privilege escalation.
    CVE-2021-28711, CVE-2021-28712, CVE-2021-28713 (XSA-391) Juergen Gross reported that malicious PV backends     can cause a denial of service to guests being serviced by those backends via high frequency events, even     if those backends are running in a less privileged environment. CVE-2021-28714, CVE-2021-28715 (XSA-392)     Juergen Gross discovered that Xen guests can force the Linux netback driver to hog large amounts of kernel     memory, resulting in denial of service. CVE-2021-38300 Piotr Krysiuk discovered a flaw in the classic BPF     (cBPF) JIT compiler for MIPS architectures. A local user could exploit this to excute arbitrary code in     the kernel. This issue is mitigated by setting sysctl net.core.bpf_jit_enable=0, which is the default. It     is *not* mitigated by disabling unprivileged use of eBPF. CVE-2021-39685 Szymon Heidrich discovered a     buffer overflow vulnerability in the USB gadget subsystem, resulting in information disclosure, denial of     service or privilege escalation. CVE-2021-39686 A race condition was discovered in the Android binder     driver, that could lead to incorrect security checks. On systems where the binder driver is loaded, a     local user could exploit this for privilege escalation. CVE-2021-39698 Linus Torvalds reported a flaw in     the file polling implementation, which could lead to a use-after-free. A local user could exploit this for     denial of service (memory corruption or crash) or possibly for privilege escalation. CVE-2021-39713 The     syzbot tool found a race condition in the network scheduling subsystem which could lead to a use-after-     free. A local user could exploit this for denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-41864 An integer overflow was discovered in the Extended BPF (eBPF)     subsystem. A local user could exploit this for denial of service (memory corruption or crash), or possibly     for privilege escalation. This can be mitigated by setting sysctl kernel.unprivileged_bpf_disabled=1,     which disables eBPF use by unprivileged users. CVE-2021-42739 A heap buffer overflow was discovered in the     firedtv driver for FireWire-connected DVB receivers. A local user with access to a firedtv device could     exploit this for denial of service (memory corruption or crash), or possibly for privilege escalation.
    CVE-2021-43389 The Active Defense Lab of Venustech discovered a flaw in the CMTP subsystem as used by     Bluetooth, which could lead to an out-of-bounds read and object type confusion. A local user with     CAP_NET_ADMIN capability in the initial user namespace could exploit this for denial of service (memory     corruption or crash), or possibly for privilege escalation. CVE-2021-43975 Brendan Dolan-Gavitt reported a     flaw in the hw_atl_utils_fw_rpc_wait() function in the aQuantia AQtion ethernet device driver which can     result in denial of service or the execution of arbitrary code. CVE-2021-43976 Zekun Shen and Brendan     Dolan-Gavitt discovered a flaw in the mwifiex_usb_recv() function of the Marvell WiFi-Ex USB Driver. An     attacker able to connect a crafted USB device can take advantage of this flaw to cause a denial of     service. CVE-2021-44733 A race condition was discovered in the Trusted Execution Environment (TEE)     subsystem for Arm processors, which could lead to a use-after-free. A local user permitted to access a TEE     device could exploit this for denial of service (memory corruption or crash) or possibly for privilege     escalation. CVE-2021-45095 It was discovered that the Phone Network protocol (PhoNet) driver has a     reference count leak in the pep_sock_accept() function. CVE-2021-45469 Wenqing Liu reported an out-of-     bounds memory access in the f2fs implementation if an inode has an invalid last xattr entry. An attacker     able to mount a specially crafted image can take advantage of this flaw for denial of service.
    CVE-2021-45480 A memory leak flaw was discovered in the __rds_conn_create() function in the RDS (Reliable     Datagram Sockets) protocol subsystem. CVE-2022-0001 (INTEL-SA-00598) Researchers at VUSec discovered that     the Branch History Buffer in Intel processors can be exploited to create information side channels with     speculative execution. This issue is similar to Spectre variant 2, but requires additional mitigations on     some processors. This can be exploited to obtain sensitive information from a different security context,     such as from user-space to the kernel, or from a KVM guest to the kernel. CVE-2022-0002 (INTEL-SA-00598)     This is a similar issue to CVE-2022-0001, but covers exploitation within a security context, such as from     JIT-compiled code in a sandbox to hosting code in the same process. This can be partly mitigated by     disabling eBPF for unprivileged users with the sysctl: kernel.unprivileged_bpf_disabled=2. This update     does that by default. CVE-2022-0322 Eiichi Tsukata discovered a flaw in the sctp_make_strreset_req()     function in the SCTP network protocol implementation which can result in denial of service. CVE-2022-0330     Sushma Venkatesh Reddy discovered a missing GPU TLB flush in the i915 driver, resulting in denial of     service or privilege escalation. CVE-2022-0435 Samuel Page and Eric Dumazet reported a stack overflow in     the networking module for the Transparent Inter-Process Communication (TIPC) protocol, resulting in denial     of service or potentially the execution of arbitrary code. CVE-2022-0487 A use-after-free was discovered     in the MOXART SD/MMC Host Controller support driver. This flaw does not impact the Debian binary packages     as CONFIG_MMC_MOXART is not set. CVE-2022-0492 Yiqi Sun and Kevin Wang reported that the cgroup-v1     subsystem does not properly restrict access to the release-agent feature. A local user can take advantage     of this flaw for privilege escalation and bypass of namespace isolation. CVE-2022-0617 butt3rflyh4ck     discovered a NULL pointer dereference in the UDF filesystem. A local user that can mount a specially     crafted UDF image can use this flaw to crash the system. CVE-2022-0644 Hao Sun reported a missing check     for file read permission in the finit_module() and kexec_file_load() system calls. The security impact of     this is unclear, since these system calls are usually only available to the root user. CVE-2022-22942 It     was discovered that wrong file file descriptor handling in the VMware Virtual GPU driver (vmwgfx) could     result in information leak or privilege escalation. CVE-2022-24448 Lyu Tao reported a flaw in the NFS     implementation in the Linux kernel when handling requests to open a directory on a regular file, which     could result in a information leak. CVE-2022-24959 A memory leak was discovered in the     yam_siocdevprivate() function of the YAM driver for AX.25, which could result in denial of service.
    CVE-2022-25258 Szymon Heidrich reported the USB Gadget subsystem lacks certain validation of interface OS     descriptor requests, resulting in memory corruption. CVE-2022-25375 Szymon Heidrich reported that the     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command, resulting in information leak     from kernel memory. For the oldstable distribution (buster), these problems have been fixed in version     4.19.232-1. This update additionally includes many more bug fixes from stable updates 4.19.209-4.19.232     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
163167	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2022-2110)	Nessus	Huawei Local Security Checks	2022/7/14	2023/10/18	high
245142	Linux Distros Unpatched Vulnerability : CVE-2021-39713	Nessus	Misc.	2025/8/7	2026/1/14	high
159932	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:1255-1)	Nessus	SuSE Local Security Checks	2022/4/20	2025/9/24	high
159938	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:1267-1)	Nessus	SuSE Local Security Checks	2022/4/20	2023/7/13	high
160223	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:1402-1)	Nessus	SuSE Local Security Checks	2022/4/27	2023/7/13	high
163994	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:2721-1)	Nessus	SuSE Local Security Checks	2022/8/10	2023/7/14	high
204077	Photon OS 3.0: Linux PHSA-2022-3.0-0350	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
290201	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004475)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
158761	Debian DSA-5096-1 : linux - security update	Nessus	Debian Local Security Checks	2022/3/9	2025/9/25	high

检测

插件搜索

high

high

high

high

high

high

high

high

high