The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1266-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated.

    The following security bugs were fixed:

    - CVE-2022-28356: Fixed a refcount bug in llc_ui_bind and llc_ui_autobind which could allow an     unprivileged user to execute a DoS. (bnc#1197391)
    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel.
    (bnc#1198031)
    - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel.
    (bnc#1198032)
    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel.
    (bnc#1198033)
    - CVE-2022-0812: Fixed an incorrect header size calculations which could lead to a memory leak.
    (bsc#1196639)
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock. (bsc#1197331)
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
    - CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw     allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a     local privilege escalation. (bnc#1197462)
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file. (bnc#1197366)
    - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-     after-free. (bnc#1196973)
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory. (bsc#1196830)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1256-1 advisory.

    The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-28356: Fixed a refcount leak bug in net/llc/af_llc.c (bnc#1197391).
    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution (bsc#1197227).
    - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel     (bnc#1198032).
    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel     (bnc#1198033).
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel     (bnc#1198031).
    - CVE-2022-0812: Fixed an incorrect header size calculations in xprtrdma (bsc#1196639).
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock (bsc#1197331).
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c (bsc#1196761).
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device (bsc#1196836).
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file (bnc#1197366).
    - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-     after-free (bsc#1196973).
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers (bsc#1196488).
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could trigger crash the system or corrupt system memory (bsc#1196830).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1163-1 advisory.

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not     properly update bounds while handling the mov32 instruction, which allows local users to obtain     potentially sensitive address information, aka a pointer leak. (CVE-2021-45402)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an     attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
    (CVE-2022-1198)

  - A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating     amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free     vulnerability. (CVE-2022-1199)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not     validated and might be manipulated by the host for out-of-array access. (CVE-2022-27223)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1283-1 advisory.

    The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock. (bsc#1197331)
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file. (bnc#1197366)
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory. (bsc#1196830)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1270-1 advisory.

    The SUSE Linux Enterprise 12 SP3 kernel was updated.

    The following security bugs were fixed:

    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock. (bsc#1197331)
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file. (bnc#1197366)
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory. (bsc#1196830)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0339 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2020-27820:
    A vulnerability was found in Linux kernel, where a use-after-frees in nouveau/'s postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver).

    CVE-2021-0920:
    In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel

    CVE-2021-20321:
    A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.

    CVE-2021-22543:
    An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation.

    CVE-2021-38160:
    ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.

    CVE-2021-38199:
    fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which     allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for     those servers to be unreachable during trunking detection.

    CVE-2021-45868:
    In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file.

    CVE-2022-0617:
    A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.

    CVE-2022-0850:
    A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace.

    CVE-2022-20421:
    In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free.
    This could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-239630375References: Upstream kernel

    CVE-2022-2196:
    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution     attacks.L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or     IBPBafter running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code     execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2     or past commit2e7eab81425a

    CVE-2022-2639:
    An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system.

    CVE-2022-29581:
    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions.

    CVE-2022-3567:
    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability.

    CVE-2022-3586:
    A flaw was found in the Linux kernels networking code. A use-after-free was found in the way the     sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and     freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a     denial of service.

    CVE-2022-4129:
    A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service.

    CVE-2022-41858:
    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information.

    CVE-2022-4378:
    A stack overflow flaw was found in the Linux kernel/'s SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system.

    CVE-2023-0045:
    The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176.

    We recommend upgrading past commita664ec9158eeddd75121d39c9a0758016097fa96

    CVE-2023-0394:
    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash.

    CVE-2023-1076:
    A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters.

    CVE-2023-20938:
    In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input     validation. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-257685302References: Upstream kernel

    CVE-2023-2513:
    A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors.

    CVE-2023-30456:
    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4.

    CVE-2023-31436:
    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.

    CVE-2023-32269:
    An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-     after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order     for an attacker to exploit this, the system must have netrom routing configured or the attacker must have     the CAP_NET_ADMIN capability.

    CVE-2023-35001:
    Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace

    CVE-2023-4128:
    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.

    CVE-2022-0847:
    A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system.

    CVE-2023-2269:
    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414515 advisory.

    In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001502 advisory.

    In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1255-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-28356: Fixed a refcount leak bug in net/llc/af_llc.c (bnc#1197391).
    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution (bsc#1197227).
    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel     (bnc#1198033).
    - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel     (bnc#1198032).
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel     (bnc#1198031).
    - CVE-2022-0812: Fixed an incorrect header size calculations in xprtrdma (bsc#1196639).
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock (bsc#1197331).
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c (bsc#1196761).
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device (bsc#1196836).
    - CVE-2022-0886: Fix possible buffer overflow in ESP transformation (bsc#1197131).
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file (bnc#1197366).
    - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-     after-free (bsc#1196973).
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers (bsc#1196488).
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory (bsc#1196830).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6014-1 advisory.

    Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux     kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of     service (connection termination) or inject forged data. (CVE-2020-36516)

    Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira     Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient     in some situations. A local attacker could possibly use this to expose sensitive information.
    (CVE-2021-26401)

    Jrgen Gro discovered that the Xen subsystem within the Linux kernel did not adequately limit the     number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a     driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28711,     CVE-2021-28712, CVE-2021-28713)

    Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an     integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious     ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

    It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly     handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private     clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

    It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs     in some situations. A remote attacker could possibly use this to cause a denial of service (connection     disassociation). (CVE-2021-3772)

    It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle     locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel     deadlock). (CVE-2021-4149)

    Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when     handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2021-4203)

    It was discovered that the file system quotas implementation in the Linux kernel did not properly validate     the quota block number. An attacker could use this to construct a malicious file system image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

    Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device     removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-0487)

    It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in     some situations. A privileged local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-0494)

    It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference     a null pointer in some situations. An attacker could use this to construct a malicious UDF image that,     when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

    David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some     situations. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2022-1016)

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the tty subsystem in the Linux kernel contained a race condition in certain     situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to     cause a denial of service (system crash) or expose sensitive information. (CVE-2022-1462)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-     free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-1974)

    Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context     switches from occurring during certain atomic context operations. A privileged local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1975)

    It was discovered that the HID subsystem in the Linux kernel did not properly validate inputs in certain     conditions. A local attacker with physical access could plug in a specially crafted USB device to expose     sensitive information. (CVE-2022-20132)

    It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly     verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20572, CVE-2022-2503)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel     incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this     to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

    Lucas Leong discovered that the LightNVM subsystem in the Linux kernel did not properly handle data     lengths in certain situations. A privileged attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-2991)

    It was discovered that the Intel 740 frame buffer driver in the Linux kernel contained a divide by zero     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-3061)

    Jiasheng Jiang discovered that the wm8350 charger driver in the Linux kernel did not properly deallocate     memory, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash). (CVE-2022-3111)

    It was discovered that the sound subsystem in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. An attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2022-3646)

    It was discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a     reference counting error. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36879)

    It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A     local attacker with physical access could plug in a specially crafted USB device to cause a denial of     service (memory exhaustion). (CVE-2022-3903)

    Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain     situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-39188)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset     events. A local attacker with physical access could plug in a specially crafted USB device to cause a     denial of service (kernel deadlock). (CVE-2022-4662)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data     structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a     denial of service (system crash). (CVE-2023-1095)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1267-1 advisory.

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux     Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
    (CVE-2022-0812)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1402-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-28356: Fixed a refcount bug in llc_ui_bind and llc_ui_autobind which could allow an     unprivileged user to execute a DoS. (bnc#1197391)
    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel.
    (bnc#1198033)
    - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel.
    (bnc#1198032)
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel.
    (bnc#1198031)
    - CVE-2022-0812: Fixed an incorrect header size calculations which could lead to a memory leak.
    (bsc#1196639)
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock. (bsc#1197331)
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
    - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive     information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
    - CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw     allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a     local privilege escalation. (bnc#1197462)
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file. (bnc#1197366)
    - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-     after-free. (bnc#1196973)
    -     CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042:
    Fixed multiple issues which could have lead to read/write access to memory pages or denial of service.
    These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
    - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access     could crash the system or corrupt the system memory. (bsc#1196830)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1407-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated.

    The following security bugs were fixed:

    - CVE-2022-0854: Fixed a memory leak flaw was found in the Linux kernels DMA subsystem. This flaw allowed     a local user to read random memory from the kernel space. (bnc#1196823)
    - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This     vulnerability gives an attacker a powerful primitive that can be used to both read from and write to     relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
    - CVE-2022-1199: Fixed null-ptr-deref and use-after-free vulnerabilities that allow an attacker to crash     the linux kernel by simulating Amateur Radio. (bsc#1198028)
    - CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker     to crash the linux kernel by simulating Amateur Radio. (bsc#1198027)
    - CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by     simulating Amateur Radio (bsc#1198030).
    - CVE-2022-1195: Fixed an use-after-free vulnerability which could allow a local attacker with a user     privilege to execute a denial of service. (bsc#1198029)
    - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel.
    (bnc#1198031)
    - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel.
    (bnc#1198032)
    - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel.
    (bnc#1198033)
    - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock     with buffer_mutex and mmap_lock. (bsc#1197331)
    - CVE-2022-1055: Fixed a use-after-free in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. (bnc#1197702)
    - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
    - CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw     allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a     local privilege escalation. (bnc#1197462)
    - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-     after-free if there is a corrupted quota file. (bnc#1197366)
    - CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve     (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems.
    (bnc#1197343)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an     improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of     service (DOS) due to a deadlock problem. (CVE-2021-4149)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
    (CVE-2021-45095)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159987	SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2022:1266-1)	Nessus	SuSE Local Security Checks	2022/4/20	2026/6/26	high
159990	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:1256-1)	Nessus	SuSE Local Security Checks	2022/4/20	2026/6/26	high
159698	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:1163-1)	Nessus	SuSE Local Security Checks	2022/4/13	2023/7/13	high
160056	SUSE SLES12: kernel-default / kernel-default-base / kernel-default-devel / etc (SUSE-SU-2022:1283-1)	Nessus	SuSE Local Security Checks	2022/4/21	2026/6/26	high
160066	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:1270-1)	Nessus	SuSE Local Security Checks	2022/4/21	2026/6/26	high
238807	TencentOS Server 2: kernel (TSSA-2023:0339)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/23	high
267680	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414515)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/15	medium
290603	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001502)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
159932	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:1255-1)	Nessus	SuSE Local Security Checks	2022/4/20	2025/9/24	high
174228	Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-6014-1)	Nessus	Ubuntu Local Security Checks	2023/4/13	2024/8/27	high
159938	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:1267-1)	Nessus	SuSE Local Security Checks	2022/4/20	2023/7/13	high
160223	SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:1402-1)	Nessus	SuSE Local Security Checks	2022/4/27	2026/6/26	high
160222	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:1407-1)	Nessus	SuSE Local Security Checks	2022/4/27	2026/6/26	high
160505	OracleVM 3.4 : kernel-uek (OVMSA-2022-0014)	Nessus	OracleVM Local Security Checks	2022/5/4	2023/4/25	high

检测

插件搜索

high

high

high

high

high

high

medium

medium

high

high

high

high

high

high