The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-347.el9 build changelog.

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-     Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of     user-supplied sizes for the MSG_CRYPTO message type. (CVE-2021-43267)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0984-1 advisory.

  - A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and     bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special     privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel     versions prior to 5.16 rc2. (CVE-2021-4001)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges     because of a heap out-of-bounds write. This is related to nf_tables_offload. (CVE-2022-25636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5207-1 advisory.

    Nadav Amit discovered that the hugetlb implementation in the Linux kernel did not perform TLB flushes     under certain conditions. A local attacker could use this to leak or alter data from other processes that     use huge pages. (CVE-2021-4002)

    It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-     only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

    Luo Likang discovered that the FireDTV Firewire driver in the Linux kernel did not properly perform bounds     checking in some situations. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2021-42739)

    It was discovered that the TIPC Protocol implementation in the Linux kernel did not properly validate     MSG_CRYPTO messages in some situations. An attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2021-43267)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414546 advisory.

    A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and     bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special     privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel     versions prior to 5.16 rc2.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0197-1 advisory.

    The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local     privilege escalation (bsc#1194517).
    - CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux     kernel that occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared     memory object (bnc#1193767).
    - CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower     privileged ones that could lead to privilege escalation (bsc#1194302).
    - CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
    - CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free     memory corruption (bsc#1194529)
    - CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix     domain socket file handlers in the way users call close() and fget() simultaneously and can potentially     trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges     on the system. (bnc#1193727).
    - CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
    - CVE-2021-45485: The IPv6 implementation in net/ipv6/output_core.c had an information leak because of     certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can     typically choose among many IPv6 source addresses (bnc#1194094).
    - CVE-2021-45486: The IPv4 implementation in net/ipv4/route.c had an information leak because the hash     table is very small (bnc#1194087).
    - CVE-2021-4001: A race condition was found in the Linux kernel's ebpf verifier between     bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a     local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space.
    (bnc#1192990).
    - CVE-2021-28715: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming     data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to     process them. There are some measures taken for avoiding to pile up too much data, but those can be     bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new     packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. ()
    - CVE-2021-28714: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming     data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to     process them. There are some measures taken for avoiding to pile up too much data, but those can be     bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new     packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing (bnc#1193442).
    - CVE-2021-28713: Rogue backends can cause DoS of guests via high frequency events. Xen offers the ability     to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'. Running PV     backends in driver domains has one primary security advantage: if a driver domain gets compromised, it     doesn't have the privileges to take over the system. However, a malicious driver domain could try to     attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due     to trying to service interrupts for elongated amounts of time. (bsc#1193440)
    - CVE-2021-28712: Rogue backends can cause DoS of guests via high frequency events. Xen offers the ability     to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'. Running PV     backends in driver domains has one primary security advantage: if a driver domain gets compromised, it     doesn't have the privileges to take over the system. However, a malicious driver domain could try to     attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due     to trying to service interrupts for elongated amounts of time. (bsc#1193440)
    - CVE-2021-28711: Rogue backends can cause DoS of guests via high frequency events. Xen offers the ability     to run PV backends in regular unprivileged guests, typically referred to as 'driver domains'. Running PV     backends in driver domains has one primary security advantage: if a driver domain gets compromised, it     doesn't have the privileges to take over the system. However, a malicious driver domain could try to     attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due     to trying to service interrupts for elongated amounts of time (bnc#1193440).
    - CVE-2020-27825: A use-after-free flaw was found in kernel/trace/ring_buffer.c. There was a race problem     in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service     problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel     information leak threat (bnc#1179960).
    - CVE-2021-43975: hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c     allowed an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted     length value (bnc#1192845).
    - CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version     3.17.3 may have allowed an authenticated user to potentially enable denial of service via local access     (bnc#1192877).
    - CVE-2021-43976: mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allowed an attacker (who     can connect a crafted USB device) to cause a denial of service (skb_over_panic) (bnc#1192847).
    - CVE-2021-4002: Incorrect TLBs flushing after huge_pmd_unshare could lead to exposing hugepages to other     users (bsc#1192946).
    - CVE-2020-27820: A use-after-frees in nouveau's postclose() handler could happen if removing device (that     is not common to remove video card physically without power-off, but same happens if 'unbind' the driver)     (bnc#1179599).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.162-86.275. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-093 advisory.

    A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

    A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

    A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

    A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and     bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special     privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. (CVE-2021-4001)

    A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix NULL ptr dereference on VSI filter sync (CVE-2021-47184)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix memory ordering between normal and ordered work functions (CVE-2021-47189)

    In the Linux kernel, the following vulnerability has been resolved:

    perf bpf: Avoid memory leak from perf_env__insert_btf() (CVE-2021-47190)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: sysfs: Fix hang when device state is set via sysfs (CVE-2021-47192)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: free q_vectors before queues in iavf_disable_vf (CVE-2021-47201)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (CVE-2021-47203)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (CVE-2021-47217)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: Fix out of bound access for corrupted isofs image (CVE-2021-47478)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Put LLD module refcnt after SCSI device is released (CVE-2021-47480)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix possible double-free in regcache_rbtree_exit() (CVE-2021-47483)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: fix memleak in ttm_transfered_destroy (CVE-2021-47490)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: sanity check for maxpacket (CVE-2021-47495)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: Fix flipped sign in tls_err_abort() calls (CVE-2021-47496)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0079-1 advisory.

    The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter     drivers that may have allowed an authenticated user to potentially enable denial of service via local     access. (bnc#1182404)
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bnc#1179599)
    - CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages.  (bsc#1193442)
    - CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that could allow     an authenticate user to cause a denial of service (bnc#1192877).
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)
    - CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source     addresses. (bsc#1194094)
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c.
    (bnc#1194087).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.82-83.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-049 advisory.

    A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

    A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

    A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

    A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and     bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special     privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. (CVE-2021-4001)

    A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

    A flaw heap buffer overflow in the Linux kernel's AMD Radeon graphics card driver was found in the way     user writes some malicious data to the AMD GPU Display Driver Debug Filesystem (to the VGA sub-directory     of the /sys/kernel/debug/ directory). A local user could use this flaw to crash the system or escalate     their privileges on the system. (CVE-2021-42327)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix NULL ptr dereference on VSI filter sync (CVE-2021-47184)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: check for null after calling kmemdup (CVE-2021-47186)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix memory ordering between normal and ordered work functions (CVE-2021-47189)

    In the Linux kernel, the following vulnerability has been resolved:

    perf bpf: Avoid memory leak from perf_env__insert_btf() (CVE-2021-47190)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() (CVE-2021-47191)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: sysfs: Fix hang when device state is set via sysfs (CVE-2021-47192)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (CVE-2021-47197)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: free q_vectors before queues in iavf_disable_vf (CVE-2021-47201)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: Fix NULL pointer dereferences in of_thermal_ functions (CVE-2021-47202)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (CVE-2021-47203)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (CVE-2021-47217)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: fix NULL-pointer dereference when hashtab allocation fails (CVE-2021-47218)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() (CVE-2021-47219)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix possible UAF when remounting r/o a mmp-protected file system (CVE-2021-47342)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value (CVE-2021-47451)

    In the Linux kernel, the following vulnerability has been resolved:

    can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459)

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: fix data corruption after conversion from inline format (CVE-2021-47460)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: fix a race between writeprotect and exit_mmap() (CVE-2021-47461)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix possible null-pointer dereference in audit_filter_rules (CVE-2021-47464)

    In the Linux kernel, the following vulnerability has been resolved:

    mm, slub: fix potential memoryleak in kmem_cache_open() (CVE-2021-47466)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() (CVE-2021-47473)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: Fix out of bound access for corrupted isofs image (CVE-2021-47478)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Put LLD module refcnt after SCSI device is released (CVE-2021-47480)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix possible double-free in regcache_rbtree_exit() (CVE-2021-47483)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: fix memleak in ttm_transfered_destroy (CVE-2021-47490)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: khugepaged: skip huge page collapse for special files (CVE-2021-47491)

    In the Linux kernel, the following vulnerability has been resolved:

    mm, thp: bail out early in collapse_file for writeback page (CVE-2021-47492)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: sanity check for maxpacket (CVE-2021-47495)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: Fix flipped sign in tls_err_abort() calls (CVE-2021-47496)

    A use-after-free flaw was found in the Linux kernel's Ext4 File System in how a user triggers several file     operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2023-1252)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0131-1 advisory.

  - Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version     1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
    (CVE-2020-24504)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]     Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. (CVE-2021-28714) (CVE-2021-28714, CVE-2021-28715)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640) (CVE-2021-4002)

  - In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a     crafted device) to trigger an out-of-bounds write via a crafted length value. (CVE-2021-43975)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	2024/2/29	2026/6/3	critical
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	2021/7/22	2026/3/23	high
159339	SUSE SLES15 Security Update : kernel (Live Patch 9 for SLE 15 SP3) (SUSE-SU-2022:0984-1)	Nessus	SuSE Local Security Checks	2022/3/30	2026/6/3	high
156482	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5207-1)	Nessus	Ubuntu Local Security Checks	2022/1/6	2024/8/28	critical
266946	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414546)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/15	medium
157144	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0197-1)	Nessus	SuSE Local Security Checks	2022/1/27	2026/6/26	high
214927	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-093)	Nessus	Amazon Linux Local Security Checks	2025/2/4	2026/1/26	high
156760	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:0079-1)	Nessus	SuSE Local Security Checks	2022/1/15	2026/6/26	high
190033	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-049)	Nessus	Amazon Linux Local Security Checks	2024/2/6	2026/2/26	high
156904	openSUSE 15 Security Update : kernel (openSUSE-SU-2022:0131-1)	Nessus	SuSE Local Security Checks	2022/1/20	2023/11/20	high

检测

插件搜索

critical

high

high

critical

medium

high

high

high

high

high