The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7184-1 advisory.

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer     overflow vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36402)

    Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during     device removal. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-35827)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - GPU drivers;

    - I2C subsystem;

    - Network drivers;

    - Pin controllers subsystem;

    - TTY drivers;

    - USB Mass Storage drivers;

    - Framebuffer layer;

    - Ext4 file system;

    - File systems infrastructure;

    - Bluetooth subsystem;

    - Kernel init infrastructure;

    - DMA mapping infrastructure;

    - Memory management;

    - 9P file system network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - Logical Link layer;

    - MAC80211 subsystem;

    - Netfilter;

    - NFC subsystem;

    - Phonet protocol;

    - Network traffic control;

    - Wireless networking; (CVE-2024-44944, CVE-2023-52507, CVE-2024-42101, CVE-2021-47118, CVE-2024-36941,     CVE-2024-38633, CVE-2021-47086, CVE-2024-26625, CVE-2024-39301, CVE-2024-42090, CVE-2024-53057,     CVE-2024-26777, CVE-2024-36946, CVE-2024-42153, CVE-2024-40912, CVE-2024-36968, CVE-2024-43856,     CVE-2024-49967, CVE-2024-43884, CVE-2023-52509, CVE-2023-52594, CVE-2024-36270, CVE-2024-44947,     CVE-2024-45021, CVE-2024-35886, CVE-2024-40959, CVE-2021-47501, CVE-2024-38619)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1648-1 advisory.

  - Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to     elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local     user with the CAP_NET_RAW capability. (CVE-2021-23134)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the     ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map.
    ha->vp_map was freed in qla2x00_mem_alloc(), and again freed in function qla2x00_mem_free(ha). Assign NULL     to vp_map and kfree take care of NULL. (CVE-2024-26930)

  - In the Linux kernel, the following vulnerability has been resolved: netlabel: fix out-of-bounds memory     accesses There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in     netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward. As a FYI     for anyone backporting this patch to kernels prior to v4.8, you'll want to apply the netlbl_bitmap_walk()     patch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8. (CVE-2019-25160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1646-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
    - CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
    - CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
    - CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
    - CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq     (bsc#1220554).
    - CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
    - CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
    - CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
    - CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs     (bsc#1220521).
    - CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
    - CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand()  (bsc#1220536).
    - CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
    - CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
    - CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
    - CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
    - CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s     (bsc#1220743).
    - CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
    - CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
    - CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en     (bsc#1220794).
    - CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
    - CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
    - CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
    - CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
    - CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
    - CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
    - CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed     (bsc#1220742).
    - CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure _after_  sync'ing     SRCU (bsc#1220745).
    - CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
    - CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
    - CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
    - CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic     (bsc#1220846).
    - CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm     (bsc#1221532).
    - CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm     (bsc#1221541).
    - CVE-2021-47114: Fixed a data corruption by fallocate in ocfs2 (bsc#1221548).
    - CVE-2021-47117: Fixed a crash in ext4_es_cache_extent as ext4_split_extent_at failed in ext4     (bsc#1221575).
    - CVE-2021-47118: Fixed an use-after-free in init task's struct pid in pid (bsc#1221605).
    - CVE-2021-47119: Fixed a memory leak in ext4_fill_super in ext4 (bsc#1221608).
    - CVE-2021-47138: Fixed an out-of-bound memory access during clearing filters in cxgb4 (bsc#1221934).
    - CVE-2021-47141: Fixed a null pointer dereference on priv->msix_vectors when driver is unloaded in gve     (bsc#1221949).
    - CVE-2021-47142: Fixed an use-after-free on ttm->sg in drm/amdgpu (bsc#1221952).
    - CVE-2021-47143: Fixed possible corruption in net/smc after failed device_add() (bsc#1221988).
    - CVE-2021-47149: Fixed a potential null pointer deref in fmvj18x_get_hwinfo() (bsc#1221972).
    - CVE-2021-47150: Fixed the potential memory leak in fec_enet_init() (bsc#1221973).
    - CVE-2021-47153: Fixed wrongly generated interrupt on bus reset in i2c/i801 (bsc#1221969).
    - CVE-2021-47161: Fixed a resource leak in an error handling path in the error handling path of the probe     function in spi spi-fsl-dspi (bsc#1221966).
    - CVE-2021-47162: Fixed a possible memory leak in tipc_buf_append (bsc#1221977).
    - CVE-2021-47165: Fixed shutdown crash when component not probed in drm/meson (bsc#1221965).
    - CVE-2021-47166: Fixed a data corruption of pg_bytes_written in nfs_do_recoalesce() in nfs (bsc#1221998).
    - CVE-2021-47167: Fixed an oopsable condition in __nfs_pageio_add_request() in nfs (bsc#1221991).
    - CVE-2021-47168: Fixed an incorrect limit in filelayout_decode_layout() in nfs (bsc#1222002).
    - CVE-2021-47169: Fixed a NULL pointer dereference in rp2_probe in serial rp2 (bsc#1222000).
    - CVE-2021-47171: Fixed a memory leak in smsc75xx_bind in net usb (bsc#1221994).
    - CVE-2021-47173: Fixed a memory leak in uss720_probe in misc/uss720 (bsc#1221993).
    - CVE-2021-47177: Fixed a sysfs leak in alloc_iommu() in iommu/vt-d (bsc#1221997).
    - CVE-2021-47179: Fixed a NULL pointer dereference in pnfs_mark_matching_lsegs_return() in nfsv4     (bsc#1222001).
    - CVE-2021-47180: Fixed a memory leak in nci_allocate_device nfcmrvl_disconnect in nfc nci (bsc#1221999).
    - CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()     (bsc#1222660).
    - CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).
    - CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145,     bsc#1222664).
    - CVE-2021-47184: Fixed NULL pointer dereference on VSI filter sync (bsc#1222666).
    - CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
    - CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work     functions in btrfs (bsc#1222706).
    - CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions in thermal (bsc#1222878)
    - CVE-2021-47205: Unregistered clocks/resets when unbinding in sunxi-ng (bsc#1222888).
    - CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).
    - CVE-2021-47211: Fixed a null pointer dereference on pointer cs_desc in usb-audio (bsc#1222869).
    - CVE-2022-0487: Fixed use-after-free in moxart_remove in moxart-mmc (bsc#1194516).
    - CVE-2022-48619: Fixed a denial-of-service issue in drivers/input/input.c (bsc#1218220).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
    - CVE-2022-48701: Fixed an out-of-bounds bug in __snd_usb_parse_audio_interface() (bsc#1223921).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).
    - CVE-2023-52488: Fixed serial/sc16is7xx convert from _raw_ to _noinc_ regmap functions for FIFO     (bsc#1221162).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).
    - CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).
    - CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).
    - CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).
    - CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).
    - CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from     userspace (bsc#1221825).
    - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).
    - CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).
    - CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).
    - CVE-2023-52644: Stop/wake correct queue in DMA Tx path when QoS is disabled in b43 (bsc#1222961).
    - CVE-2023-52650: Added missing check for of_find_device_by_node() (bsc#1223770)
    - CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
    - CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()     (bsc#1218336).
    - CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in     net/netfilter/nf_conntrack_netlink.c (bsc#1218479).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
    - CVE-2024-24855: Fixed a null pointer dereference due to race condition in scsi device driver in     lpfc_unregister_fcf_rescan() function (bsc#1219618).
    - CVE-2024-24861: Fixed an overflow due to race condition in media/xc4000 device driver in xc4000     xc4000_get_frequency() function (bsc#1219623).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
    - CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).
    - CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
    - CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
    - CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
    - CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677)
    - CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449)
    - CVE-2024-26747: Fixed a NULL pointer issue with USB parent module's reference (bsc#1222609).
    - CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).
    - CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt     (bsc#1222720).
    - CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)
    - CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()     (bsc#1222613).
    - CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found()     (bsc#1222618).
    - CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
    - CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
    - CVE-2024-26779: Fixed a race condition on enabling fast-xmit in mac80211 (bsc#1222772).
    - CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).
    - CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).
    - CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them     (bsc#1222624).
    - CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).
    - CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
    - CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
    - CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
    - CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).
    - CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).
    - CVE-2024-26859: Prevent access to a freed page in page_pool in bnx2x (bsc#1223049).
    - CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
    - CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
    - CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
    - CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
    - CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
    - CVE-2024-26922: Validated the parameters of bo mapping operations more clearly (bsc#1223315).
    - CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
    - CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
    - CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
    - CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
    - CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
    - CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).
    - CVE-2024-27072: Removed useless locks in usbtv_video_free() (bsc#1223837).
    - CVE-2024-27073: Fixed a memory leak in budget_av_attach() (bsc#1223843).
    - CVE-2024-27074: Fixed a memory leak in go7007_load_encoder() (bsc#1223844).
    - CVE-2024-27075: Avoided stack overflow warnings with clang (bsc#1223842).
    - CVE-2024-27078: Fixed a memory leak in tpg_alloc() (bsc#1223781).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12606 advisory.

    - isdn: mISDN: netjet: Fix crash in nj_probe: (Zheyu Ma)  [Orabug: 36940405]  {CVE-2021-47284}
    - tracing: Restructure trace_clock_global() to never block (Steven Rostedt (VMware))  [Orabug: 36940388]     {CVE-2021-46939}
    - udf: Fix NULL pointer dereference in udf_symlink function (Arturo Giusti)  [Orabug: 36806640]     {CVE-2021-47353}
    - media: pvrusb2: fix use after free on context disconnection (Ricardo B. Marliere)  [Orabug: 36802294]     {CVE-2023-52445}
    - vt: fix memory overlapping when deleting chars in the buffer (Yangxi Xiang)  [Orabug: 36802212]     {CVE-2022-48627}
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Daniel Starke)  [Orabug: 36678070]     {CVE-2024-36016}
    - netfilter: nftables: exthdr: fix 4-byte stack OOB write (Florian Westphal)  [Orabug: 36654631]     {CVE-2023-52628}
    - dm: call the resume method on internal suspend (Mikulas Patocka)  [Orabug: 36544879]  {CVE-2024-26880}
    - net/bnx2x: Prevent access to a freed page in page_pool (Thinh Tran)  [Orabug: 36544783]     {CVE-2024-26859}
    - x86, relocs: Ignore relocations in .notes section (Kees Cook)  [Orabug: 36531115]  {CVE-2024-26816}
    - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter (Ryosuke Yasuoka)  [Orabug: 36531057]     {CVE-2024-26805}
    - fbdev: savage: Error out if pixclock equals zero (Fullway Wang)  [Orabug: 36530913]  {CVE-2024-26778}
    - ext4: fix double-free of blocks due to wrong extents moved_len (Baokun Li)  [Orabug: 36530519]     {CVE-2024-26704}
    - sr9800: Add check for usbnet_get_endpoints (Chen Ni)  [Orabug: 36530183]  {CVE-2024-26651}
    - llc: Drop support for ETH_P_TR_802_2. (Kuniyuki Iwashima)  [Orabug: 36530047]  {CVE-2024-26635}
    - netfilter: nf_tables: Reject tables of unsupported family (Phil Sutter)  [Orabug: 36192155]     {CVE-2023-6040}
    - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Minsuk Kang)     [Orabug: 36802321]  {CVE-2023-52594}
    - batman-adv: Avoid infinite loop trying to resize local TT (Sven Eckelmann)  [Orabug: 36643464]     {CVE-2024-35982}
    - Bluetooth: Fix memory leak in hci_req_sync_complete() (Dmitry Antipov)  [Orabug: 36643456]     {CVE-2024-35978}
    - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Harshit Mogalapalli)  [Orabug: 36643323]     {CVE-2024-35944}
    - fbmon: prevent division by zero in fb_videomode_from_videomode() (Roman Smirnov)  [Orabug: 36643194]     {CVE-2024-35922}
    - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (Wenchao Hao)  [Orabug:
    36901390]  {CVE-2023-52809}
    - net: usb: fix memory leak in smsc75xx_bind (Pavel Skripkin)  [Orabug: 36802200]  {CVE-2021-47171}
    - i2c: i801: Don't generate an interrupt on bus reset (Jean Delvare)  [Orabug: 36792714]  {CVE-2021-47153}
    - pid: take a reference when initializing cad_pid (Mark Rutland)  [Orabug: 36792687]  {CVE-2021-47118}
    - drm/vmwgfx: Fix invalid reads in fence signaled events (Zack Rusin)  [Orabug: 36691531]     {CVE-2024-36960}
    - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Adam Goldman)  [Orabug: 36683507]     {CVE-2024-36950}
    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (Saurav Kashyap)  [Orabug:
    36683370]  {CVE-2024-36919}
    - net: fix out-of-bounds access in ops_init (Thadeu Lima de Souza Cascardo)  [Orabug: 36683115]     {CVE-2024-36883}
    - netfilter: nf_tables: disallow timeout for anonymous sets (Pablo Neira Ayuso)  [Orabug: 36654625]     {CVE-2023-52620}
    - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan)  [Orabug: 36654606]     {CVE-2023-52574}
    - tcp: do not accept ACK of bytes we never sent (Eric Dumazet)  [Orabug: 36806731]  {CVE-2023-52881}
    - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Miko Larsson)  [Orabug: 36806698]     {CVE-2023-52703}
    - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Herbert Xu)  [Orabug: 36806668]     {CVE-2023-52615}
    - mISDN: fix possible use-after-free in HFC_cleanup() (Zou Wei)  [Orabug: 36806645]  {CVE-2021-47356}
    - net: ti: fix UAF in tlan_remove_one (Pavel Skripkin)  [Orabug: 36806628]  {CVE-2021-47310}
    - net: cdc_eem: fix tx fixup skb leak (Linyu Yuan)  [Orabug: 36806622]  {CVE-2021-47236}
    - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Canuelo)  [Orabug: 36802300]     {CVE-2023-52477}
    - USB: add quirk for devices with broken LPM (Alan Stern)  [Orabug: 36802300]  {CVE-2023-52477}
    - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security (Yuxuan Hu)  [Orabug: 36544991]     {CVE-2024-26903}
    - Bluetooth: Avoid potential use-after-free in hci_error_reset (Ying Hsu)  [Orabug: 36531042]     {CVE-2024-26801}
    - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Baokun Li)  [Orabug:
    36530881]  {CVE-2024-26772}
    - inet: read sk->sk_family once in inet_recv_error() (Eric Dumazet)  [Orabug: 36530348]  {CVE-2024-26679}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

    [4.1.12-124.89.4]- isdn: mISDN: netjet: Fix crash in nj_probe: (Zheyu Ma)  [Orabug: 36940405]     {CVE-2021-47284}- tracing: Restructure trace_clock_global() to never block (Steven Rostedt (VMware))     [Orabug: 36940388]  {CVE-2021-46939}- udf: Fix NULL pointer dereference in udf_symlink function (Arturo     Giusti)  [Orabug: 36806640]  {CVE-2021-47353}- media: pvrusb2: fix use after free on context disconnection     (Ricardo B. Marliere)  [Orabug: 36802294]  {CVE-2023-52445}- vt: fix memory overlapping when deleting     chars in the buffer (Yangxi Xiang)  [Orabug: 36802212]  {CVE-2022-48627}- tty: n_gsm: fix possible out-of-     bounds in gsm0_receive() (Daniel Starke)  [Orabug: 36678070]  {CVE-2024-36016}- netfilter: nftables:
    exthdr: fix 4-byte stack OOB write (Florian Westphal)  [Orabug: 36654631]  {CVE-2023-52628}- dm: call the     resume method on internal suspend (Mikulas Patocka)  [Orabug: 36544879]  {CVE-2024-26880}- net/bnx2x:
    Prevent access to a freed page in page_pool (Thinh Tran)  [Orabug: 36544783]  {CVE-2024-26859}- x86,     relocs: Ignore relocations in .notes section (Kees Cook)  [Orabug: 36531115]  {CVE-2024-26816}- netlink:
    Fix kernel-infoleak-after-free in __skb_datagram_iter (Ryosuke Yasuoka)  [Orabug: 36531057]     {CVE-2024-26805}- fbdev: savage: Error out if pixclock equals zero (Fullway Wang)  [Orabug: 36530913]     {CVE-2024-26778}- ext4: fix double-free of blocks due to wrong extents moved_len (Baokun Li)  [Orabug:
    36530519]  {CVE-2024-26704}- sr9800: Add check for usbnet_get_endpoints (Chen Ni)  [Orabug: 36530183]     {CVE-2024-26651}- llc: Drop support for ETH_P_TR_802_2. (Kuniyuki Iwashima)  [Orabug: 36530047]     {CVE-2024-26635}- netfilter: nf_tables: Reject tables of unsupported family (Phil Sutter)  [Orabug:
    36192155]  {CVE-2023-6040}[4.1.12-124.89.3]- wifi: ath9k: Fix potential array-index-out-of-bounds read in     ath9k_htc_txstatus() (Minsuk Kang)  [Orabug: 36802321]  {CVE-2023-52594}- batman-adv: Avoid infinite loop     trying to resize local TT (Sven Eckelmann)  [Orabug: 36643464]  {CVE-2024-35982}- Bluetooth: Fix memory     leak in hci_req_sync_complete() (Dmitry Antipov)  [Orabug: 36643456]  {CVE-2024-35978}- VMCI: Fix memcpy()     run-time warning in dg_dispatch_as_host() (Harshit Mogalapalli)  [Orabug: 36643323]  {CVE-2024-35944}-     fbmon: prevent division by zero in fb_videomode_from_videomode() (Roman Smirnov)  [Orabug: 36643194]     {CVE-2024-35922}[4.1.12-124.89.2]- scsi: libfc: Fix potential NULL pointer dereference in     fc_lport_ptp_setup() (Wenchao Hao)  [Orabug: 36901390]  {CVE-2023-52809}- net: usb: fix memory leak in     smsc75xx_bind (Pavel Skripkin)  [Orabug: 36802200]  {CVE-2021-47171}- i2c: i801: Don't generate an     interrupt on bus reset (Jean Delvare)  [Orabug: 36792714]  {CVE-2021-47153}- pid: take a reference when     initializing cad_pid (Mark Rutland)  [Orabug: 36792687]  {CVE-2021-47118}- drm/vmwgfx: Fix invalid reads     in fence signaled events (Zack Rusin)  [Orabug: 36691531]  {CVE-2024-36960}- firewire: ohci: mask bus     reset interrupts between ISR and bottom half (Adam Goldman)  [Orabug: 36683507]  {CVE-2024-36950}- scsi:
    bnx2fc: Remove spin_lock_bh while releasing resources after upload (Saurav Kashyap)  [Orabug: 36683370]     {CVE-2024-36919}- net: fix out-of-bounds access in ops_init (Thadeu Lima de Souza Cascardo)  [Orabug:
    36683115]  {CVE-2024-36883}- netfilter: nf_tables: disallow timeout for anonymous sets (Pablo Neira Ayuso)     [Orabug: 36654625]  {CVE-2023-52620}- team: fix null-ptr-deref when team device type is changed (Ziyang     Xuan)  [Orabug: 36654606]  {CVE-2023-52574}[4.1.12-124.89.1]- tcp: do not accept ACK of bytes we never     sent (Eric Dumazet)  [Orabug: 36806731]  {CVE-2023-52881}- net/usb: kalmia: Don't pass act_len in     usb_bulk_msg error path (Miko Larsson)  [Orabug: 36806698]  {CVE-2023-52703}- hwrng: core - Fix page fault     dead lock on mmap-ed hwrng (Herbert Xu)  [Orabug: 36806668]  {CVE-2023-52615}- mISDN: fix possible use-     after-free in HFC_cleanup() (Zou Wei)  [Orabug: 36806645]  {CVE-2021-47356}- net: ti: fix UAF in     tlan_remove_one (Pavel Skripkin)  [Orabug: 36806628]  {CVE-2021-47310}- net: cdc_eem: fix tx fixup skb     leak (Linyu Yuan)  [Orabug: 36806622]  {CVE-2021-47236}- usb: hub: Guard against accesses to uninitialized     BOS descriptors (Ricardo Canuelo)  [Orabug: 36802300]  {CVE-2023-52477}- USB: add quirk for devices with     broken LPM (Alan Stern)  [Orabug: 36802300]  {CVE-2023-52477}- Bluetooth: rfcomm: Fix null-ptr-deref in     rfcomm_check_security (Yuxuan Hu)  [Orabug: 36544991]  {CVE-2024-26903}- Bluetooth: Avoid potential use-     after-free in hci_error_reset (Ying Hsu)  [Orabug: 36531042]  {CVE-2024-26801}- ext4: avoid allocating     blocks from corrupted group in ext4_mb_find_by_goal() (Baokun Li)  [Orabug: 36530881]  {CVE-2024-26772}-     inet: read sk->sk_family once in inet_recv_error() (Eric Dumazet)  [Orabug: 36530348]  {CVE-2024-26679}-     ppp_async: limit MRU to 64K (Eric Dumazet)  [Orabug: 36530335]  {CVE-2024-26675}

Tenable has extracted the preceding description block directly from the OracleVM security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.238-182.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1685 advisory.

    A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP),     Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable     to an impersonation attack where an active attacker can impersonate the initiating device without any     previous knowledge. (CVE-2020-26558)

    A flaw was found in the Linux kernel. Improper access control in BlueZ may allow an authenticated user to     potentially enable information disclosure via adjacent access. The highest threat from this vulnerability     is to data confidentiality and integrity. (CVE-2021-0129)

    A denial-of-service (DoS) flaw was identified  in the Linux kernel due to an incorrect memory barrier in     xt_replace_table in net/netfilter/x_tables.c in the netfilter subsystem. (CVE-2021-29650)

    A flaw was found in the Linux kernel's handling of the removal of Bluetooth HCI controllers. This flaw     allows an attacker with a local account to exploit a race condition, leading to corrupted memory and     possible privilege escalation. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-32399)

    A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux     kernel, where a local attacker with an access rights could cause a denial of service problem on the system     The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in     other places. The highest threat from this vulnerability is to data integrity, confidentiality and system     availability. (CVE-2021-33034)

    In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

    A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. (CVE-2021-3564)

    A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in     the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call     hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(),     hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system     or escalate their privileges on the system. (CVE-2021-3573)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix info leak in hid_submit_ctrl

    In hid_submit_ctrl(), the way of calculating the report length doesn'ttake into account that report->size     can be zero. When running thesyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) tocalculate     transfer_buffer_length as 16384. When this urb is passed tothe usb core layer, KMSAN reports an info leak     of 16384 bytes.

    To fix this, first modify hid_report_len() to account for the zeroreport size case by using DIV_ROUND_UP     for the division. Then, call itfrom hid_submit_ctrl(). (CVE-2021-46906)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (CVE-2021-46938)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: properly indicate failure when ending a failed write request

    This patch addresses a data corruption bug in raid1 arrays using bitmaps.Without this fix, the bitmap bits     for the failed I/O end up being cleared.

    Since we are in the failure leg of raid1_end_write_request, the requesteither needs to be retried     (R1BIO_WriteError) or failed (R1BIO_Degraded). (CVE-2021-46950)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (CVE-2021-46953)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: fix stack OOB read while fragmenting IPv4 packets (CVE-2021-46955)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: Fix use-after-free with devm_spi_alloc_* (CVE-2021-46959)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Return correct error code from smb2_get_enc_key (CVE-2021-46960)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: scan: Fix a memory leak in an error handling path (CVE-2021-46985)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: avoid overflows in nft_hash_buckets() (CVE-2021-46992)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook (CVE-2021-47006)

    In the Linux kernel, the following vulnerability has been resolved:

    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

    In the Linux kernel, the following vulnerability has been resolved:

    bus: qcom: Put child node before return (CVE-2021-47054)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Clear all QP fields if creation failed (CVE-2021-47078)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed (CVE-2021-47117)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: take a reference when initializing `cad_pid` (CVE-2021-47118)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix a use-after-free (CVE-2021-47142)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not BUG_ON in link_to_fixup_dir (CVE-2021-47145)

    In the Linux kernel, the following vulnerability has been resolved:

    mld: fix panic in mld_newpack() (CVE-2021-47146)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: skb_linearize the head skb when reassembling msgs (CVE-2021-47162)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() (CVE-2021-47166)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: fix an incorrect limit in filelayout_decode_layout() (CVE-2021-47168)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix sysfs leak in alloc_iommu() (CVE-2021-47177)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst null pointer dereference (CVE-2021-47223)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in ip_mc_add1_src (CVE-2021-47238)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: synproxy: Fix out of bounds when parsing TCP options (CVE-2021-47245)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: fix race between close() and udp_abort() (CVE-2021-47248)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix memory leak in rds_recvmsg (CVE-2021-47249)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std (CVE-2021-47250)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix use-after-free in gfs2_glock_shrink_scan (CVE-2021-47254)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: make sure wait for page writeback in memory_failure (CVE-2021-47256)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix error handling of scsi_host_alloc() (CVE-2021-47258)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix use-after-free in nfs4_init_client() (CVE-2021-47259)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential NULL dereference in nfs_get_client() (CVE-2021-47260)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Correct the length check which causes memory corruption (CVE-2021-47274)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Do not blindly read the ip address in ftrace_bug() (CVE-2021-47276)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: avoid speculation-based attacks from out-of-range memslot accesses (CVE-2021-47277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix use-after-free read in drm_getunique() (CVE-2021-47280)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.129-62.227. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-004 advisory.

    A flaw was found in the Linux kernels implementation of wifi fragmentation handling. An attacker with the     ability to transmit within the wireless transmission range of an access point can abuse a flaw where     previous contents of wifi fragments can be unintentionally transmitted to another device. (CVE-2020-24586)

    A flaw was found in the Linux kernel's WiFi implementation. An attacker within the wireless range can     abuse a logic flaw in the WiFi implementation by reassembling packets from multiple fragments under     different keys, treating them as valid. This flaw allows an attacker to send a fragment under an incorrect     key, treating them as a valid fragment under the new key. The highest threat from this vulnerability is to     confidentiality. (CVE-2020-24587)

    A flaw was found in the Linux kernels wifi implementation. An attacker within wireless broadcast range can     inject custom data into the wireless communication circumventing checks on the data.  This can cause the     frame to pass checks and be considered a valid frame of a different type. (CVE-2020-24588)

    Frames used for authentication and key management between the AP and connected clients.  Some clients may     take these redirected frames masquerading as control mechanisms from the AP. (CVE-2020-26139)

    A vulnerability was found in Linux kernel's WiFi implementation.  An attacker within wireless range can     inject a control packet fragment where the kernel does not verify the Message Integrity Check     (authenticity) of fragmented TKIP frames. (CVE-2020-26141)

    A flaw was found in ath10k_htt_rx_proc_rx_frag_ind_hl in drivers/net/wireless/ath/ath10k/htt_rx.c in the     Linux kernel WiFi implementations, where it accepts a second (or subsequent) broadcast fragments even when     sent in plaintext and then process them as full unfragmented frames. The highest threat from this     vulnerability is to integrity. (CVE-2020-26145)

    A flaw was found in ieee80211_rx_h_defragment in net/mac80211/rx.c in the Linux Kernel's WiFi     implementation. This vulnerability can be abused to inject packets or exfiltrate selected fragments when     another device sends fragmented frames, and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
    The highest threat from this vulnerability is to integrity. (CVE-2020-26147)

    A flaw was found in the Linux kernel in certs/blacklist.c, When signature entries for EFI_CERT_X509_GUID     are contained in the Secure Boot Forbidden Signature Database, the entries are skipped. This can cause a     security threat and breach system integrity, confidentiality and even lead to a denial of service problem.
    (CVE-2020-26541)

    A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP),     Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable     to an impersonation attack where an active attacker can impersonate the initiating device without any     previous knowledge. (CVE-2020-26558)

    A flaw was found in the Linux kernel. Improper access control in BlueZ may allow an authenticated user to     potentially enable information disclosure via adjacent access. The highest threat from this vulnerability     is to data confidentiality and integrity. (CVE-2021-0129)

    A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VM_IO|VM_PFNMAP     VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest.
    This flaw allows users who can start and control a VM to read/write random pages of memory, resulting in     local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity,     and system availability. (CVE-2021-22543)

    A flaw was found in the Linux kernel's handling of the removal of Bluetooth HCI controllers. This flaw     allows an attacker with a local account to exploit a race condition, leading to corrupted memory and     possible privilege escalation. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-32399)

    A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux     kernel, where a local attacker with an access rights could cause a denial of service problem on the system     The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in     other places. The highest threat from this vulnerability is to data integrity, confidentiality and system     availability. (CVE-2021-33034)

    The canbus filesystem in the Linux kernel contains an information leak of kernel memory to devices on the     CAN bus network link layer.  An attacker with the ability to dump messages on the CAN bus is able to learn     of uninitialized stack values by dumbing messages on the can bus. (CVE-2021-34693)

    An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux     kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a     system crash or a leak of internal kernel information. The highest threat from this vulnerability is to     system availability. (CVE-2021-3506)

    A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. (CVE-2021-3564)

    A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in     the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call     hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(),     hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system     or escalate their privileges on the system. (CVE-2021-3573)

    A flaw was found in the Linux kernels NFC implementation, A NULL pointer dereference and BUG leading to a     denial of service can be triggered by a local unprivileged user causing a kernel panic. (CVE-2021-38208)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix info leak in hid_submit_ctrl

    In hid_submit_ctrl(), the way of calculating the report length doesn'ttake into account that report->size     can be zero. When running thesyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) tocalculate     transfer_buffer_length as 16384. When this urb is passed tothe usb core layer, KMSAN reports an info leak     of 16384 bytes.

    To fix this, first modify hid_report_len() to account for the zeroreport size case by using DIV_ROUND_UP     for the division. Then, call itfrom hid_submit_ctrl(). (CVE-2021-46906)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (CVE-2021-46938)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: properly indicate failure when ending a failed write request

    This patch addresses a data corruption bug in raid1 arrays using bitmaps.Without this fix, the bitmap bits     for the failed I/O end up being cleared.

    Since we are in the failure leg of raid1_end_write_request, the requesteither needs to be retried     (R1BIO_WriteError) or failed (R1BIO_Degraded). (CVE-2021-46950)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: efi: Use local variable for calculating final log size (CVE-2021-46951)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (CVE-2021-46953)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: fix stack OOB read while fragmenting IPv4 packets (CVE-2021-46955)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix memory leak in virtio_fs_probe() (CVE-2021-46956)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: Fix use-after-free with devm_spi_alloc_* (CVE-2021-46959)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Return correct error code from smb2_get_enc_key (CVE-2021-46960)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Do not enable irqs when handling spurious interrups (CVE-2021-46961)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() (CVE-2021-46963)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: Fix NULL pointer in flush_workqueue (CVE-2021-46981)

    In the Linux kernel, the following vulnerability has been resolved:

    kyber: fix out of bounds access when preempted (CVE-2021-46984)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: scan: Fix a memory leak in an error handling path (CVE-2021-46985)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix use-after-free in i40e_client_subtask() (CVE-2021-46991)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: avoid overflows in nft_hash_buckets() (CVE-2021-46992)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix out-of-bound access in uclamp (CVE-2021-46993)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: do asoc update earlier in sctp_sf_do_dupcook_a (CVE-2021-46999)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix inode leak on getattr error in __fh_to_dentry (CVE-2021-47000)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook (CVE-2021-47006)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Only allow init netns to set default tcp cong to a restricted algo (CVE-2021-47010)

    In the Linux kernel, the following vulnerability has been resolved:

    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Fix RX consumer index logic in the error path. (CVE-2021-47015)

    In the Linux kernel, the following vulnerability has been resolved:

    bus: qcom: Put child node before return (CVE-2021-47054)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: set debugfs_name to NULL after it is freed (CVE-2021-47058)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Stop looking for coalesced MMIO zones if the bus is destroyed (CVE-2021-47060)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Fix a memory leak in error handling paths (CVE-2021-47071)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Clear all QP fields if creation failed (CVE-2021-47078)

    In the Linux kernel, the following vulnerability has been resolved:

    neighbour: allow NUD_NOARP entries to be forced GCed (CVE-2021-47109)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Disable kvmclock on all CPUs on shutdown (CVE-2021-47110)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Teardown PV features on boot CPU as well (CVE-2021-47112)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed (CVE-2021-47117)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: take a reference when initializing `cad_pid` (CVE-2021-47118)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: magicmouse: fix NULL-deref on disconnect (CVE-2021-47120)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (CVE-2021-47126)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: skip expectations for confirmed conntrack (CVE-2021-47129)

    In the Linux kernel, the following vulnerability has been resolved:

    cxgb4: avoid accessing registers when clearing filters (CVE-2021-47138)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix a use-after-free (CVE-2021-47142)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd/amdgpu: fix refcount leak (CVE-2021-47144)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not BUG_ON in link_to_fixup_dir (CVE-2021-47145)

    In the Linux kernel, the following vulnerability has been resolved:

    mld: fix panic in mld_newpack() (CVE-2021-47146)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: fix a crash if ->get_sset_count() fails (CVE-2021-47159)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: skb_linearize the head skb when reassembling msgs (CVE-2021-47162)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: wait and exit until all work queues are done (CVE-2021-47163)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() (CVE-2021-47166)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (CVE-2021-47167)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: fix an incorrect limit in filelayout_decode_layout() (CVE-2021-47168)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: usbfs: Don't WARN about excessively large memory allocations (CVE-2021-47170)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix sysfs leak in alloc_iommu() (CVE-2021-47177)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst refcnt when egressing (CVE-2021-47222)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst null pointer dereference (CVE-2021-47223)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Immediately reset the MMU context when the SMM flag is cleared (CVE-2021-47230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in ip_mc_add1_src (CVE-2021-47238)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: synproxy: Fix out of bounds when parsing TCP options (CVE-2021-47245)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix page reclaim for dead peer hairpin (CVE-2021-47246)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: fix race between close() and udp_abort() (CVE-2021-47248)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix memory leak in rds_recvmsg (CVE-2021-47249)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std (CVE-2021-47250)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix use-after-free in gfs2_glock_shrink_scan (CVE-2021-47254)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: LAPIC: Restore guard to prevent illegal APIC register access (CVE-2021-47255)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: make sure wait for page writeback in memory_failure (CVE-2021-47256)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix error handling of scsi_host_alloc() (CVE-2021-47258)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix use-after-free in nfs4_init_client() (CVE-2021-47259)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential NULL dereference in nfs_get_client() (CVE-2021-47260)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/mlx5: Fix initializing CQ fragments buffer (CVE-2021-47261)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message (CVE-2021-47262)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ipoib: Fix warning caused by destroying non-initial netns (CVE-2021-47266)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Correct the length check which causes memory corruption (CVE-2021-47274)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Do not blindly read the ip address in ftrace_bug() (CVE-2021-47276)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: avoid speculation-based attacks from out-of-range memslot accesses (CVE-2021-47277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix use-after-free read in drm_getunique() (CVE-2021-47280)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3618 advisory.

    * kernel: Marvin vulnerability side-channel leakage in the RSA decryption     operation (CVE-2023-6240)
    * kernel: Information disclosure in vhost/vhost.c:vhost_new_msg()     (CVE-2024-0340)
    * kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
    * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
    * kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
    * kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer     that cause loop forever (CVE-2024-26603)
    * kernel: use after free in i2c (CVE-2019-25162)
    * kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
    * kernel: media: dvbdev: Fix memory leak in dvb_media_device_free()     (CVE-2020-36777)
    * kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors     (CVE-2023-52477)
    * kernel: mtd: require write permissions for locking and badblock ioctls     (CVE-2021-47055)
    * kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump     (CVE-2024-26615)
    * kernel: vt: fix memory overlapping when deleting chars in the buffer     (CVE-2022-48627)
    * kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
    * kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu()     (CVE-2023-52565)
    * kernel: net: bridge: data races indata-races in br_handle_frame_finish()     (CVE-2023-52578)
    * kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg     (CVE-2023-52528)
    * kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
    * kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
    * kernel: pid: take a reference when initializing `cad_pid` (CVE-2021-47118)
    * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags     (CVE-2023-52610)
    * kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set     with timeout (CVE-2024-26643)
    * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag     (CVE-2024-26642)
    * kernel: i2c: i801: Don't generate an interrupt on bus reset     (CVE-2021-47153)
    * kernel: xhci: handle isoc Babble and Buffer Overrun events properly     (CVE-2024-26659)
    * kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
    * kernel: wifi: mac80211: fix race condition on enabling fast-xmit     (CVE-2024-26779)
    * kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter     (CVE-2024-26744)
    * kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
    * kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc     (CVE-2021-47185)
    * kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak     (CVE-2024-26901)
    * kernel: RDMA/srpt: Do not register event handler until srpt device is fully     setup (CVE-2024-26872)
    * kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
    * kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
    * kernel: USB: core: Fix deadlock in usb_deauthorize_interface()     (CVE-2024-26934)
    * kernel: USB: core: Fix deadlock in port disable sysfs attribute     (CVE-2024-26933)
    * kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection()     (CVE-2024-26993)
    * kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
    * kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command     (CVE-2024-27059)
    * kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)
    * kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)
    * kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)
    * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
    * kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()     (CVE-2023-52594)
    * kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7183-1 advisory.

    Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-     confusion error. A physically proximate remote attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

    Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly     initialize memory in some situations. A physically proximate remote attacker could use this to expose     sensitive information (kernel memory). (CVE-2020-12352)

    Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly     handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically     proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2020-24490)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer     overflow vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36402)

    Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during     device removal. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-35827)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - GPU drivers;

    - I2C subsystem;

    - Network drivers;

    - Pin controllers subsystem;

    - TTY drivers;

    - USB Mass Storage drivers;

    - Framebuffer layer;

    - Ext4 file system;

    - File systems infrastructure;

    - Bluetooth subsystem;

    - Kernel init infrastructure;

    - DMA mapping infrastructure;

    - Memory management;

    - 9P file system network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - Logical Link layer;

    - MAC80211 subsystem;

    - Netfilter;

    - NFC subsystem;

    - Phonet protocol;

    - Network traffic control;

    - Wireless networking; (CVE-2024-44947, CVE-2023-52594, CVE-2024-35886, CVE-2024-38633, CVE-2023-52509,     CVE-2024-26625, CVE-2024-36946, CVE-2024-45021, CVE-2024-36270, CVE-2021-47118, CVE-2024-43884,     CVE-2024-36941, CVE-2024-38619, CVE-2021-47501, CVE-2024-49967, CVE-2024-42090, CVE-2024-40912,     CVE-2024-36968, CVE-2024-53057, CVE-2023-52507, CVE-2024-42101, CVE-2021-47086, CVE-2024-42153,     CVE-2024-40959, CVE-2024-26777, CVE-2024-44944, CVE-2024-43856, CVE-2024-39301)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程 AlmaLinux 8 主机存在安装的程序包该程序包受到公告 ALSA-2024:3618 中提及的多个漏洞的影响。

    * 内核：RSA 解密操作中的 Marvin 漏洞边信道泄漏 (CVE-2023-6240)
    * 内核：vhost/vhost.c:vhost_new_msg() 中存在信息泄露 (CVE-2024-0340)
    * 内核：不受信任的 VMM 可触发 int80 syscall 处理 (CVE-2024-25744)
    * 内核：i2c：i801：修复区块进程调用事务 (CVE-2024-26593)
    * 内核：pvrusb2：修复上下文断开连接时发生的释放后使用漏洞 (CVE-2023-52445)
    * 内核：x86/fpu：停止依赖用户空间以防止 xsave 缓冲区中的信息出错，导致无限循环 (CVE-2024-26603)
    * 内核：i2c 中存在释放后使用漏洞 (CVE-2019-25162)
    * 内核：i2c：验证 compat ioctl 中的用户数据 (CVE-2021-46934)
    * 内核：media：dvbdev：修复 dvb_media_device_free() 中的内存泄漏 (CVE-2020-36777)
    * 内核：usb: hub：防止访问未初始化的 BOS 描述符 (CVE-2023-52477)
    * 内核：mtd：需要 locking 和 badblock ioctls 的写入权限 (CVE-2021-47055)
    * 内核：net/smc：修复 SMC-D connection dump 中的非法 rmb_desc 访问 (CVE-2024-26615)
    * 内核：vt：修复删除缓冲区中的字符时会发生内存重叠的问题 (CVE-2022-48627)
    * 内核：raid5_cache_count 中存在整数溢出漏洞 (CVE-2024-23307)
    * 内核：media: uvcvideo：uvc_query_v4l2_menu() 中存在越界读取漏洞 (CVE-2023-52565)
    * 内核：net：bridge：br_handle_frame_finish() 中的 data-races 包含数据争用问题 (CVE-2023-52578)
    * 内核：net: usb: smsc75xx：修复 __smsc75xx_read_reg 中的 uninit-value 访问漏洞 (CVE-2023-52528)
    * 内核：platform/x86：think-lmi：修复引用泄漏问题 (CVE-2023-52520)
    * 内核：RDMA/siw：修复连接失败处理漏洞 (CVE-2023-52513)
    * 内核：pid：初始化 `cad_pid` 时引用 (CVE-2021-47118)
    - 内核：net/sched：act_ct：修复 ooo frags 上的 skb 泄漏和崩溃问题 (CVE-2023-52610)
    * 内核：netfilter：nf_tables：取消绑定超时的匿名集时，将集标记为死集 (CVE-2024-26643)
    * 内核：netfilter：nf_tables：禁止为匿名集添加超时标记 (CVE-2024-26642)
    * 内核：i2c：i801：不要在总线重置时生成中断 (CVE-2021-47153)
    * 内核：xhci：正确处理 isoc Babble 和缓冲区溢出事件 (CVE-2024-26659)
    * 内核：hwmon：(coretemp) 修复越界内存访问漏洞 (CVE-2024-26664)
    * 内核：wifi: mac80211：修复启用 fast-xmit 时的争用条件问题 (CVE-2024-26779)
    * 内核：RDMA/srpt：支持指定 srpt_service_guid 参数 (CVE-2024-26744)
    * 内核：RDMA/qedr：修复 qedr_create_user_qp 错误流 (CVE-2024-26743)
    * 内核：tty：tty_buffer：修复 flush_to_ldisc 中的 softlockup (CVE-2021-47185)
    * 内核：do_sys_name_to_handle()：使用 kzalloc() 修复 kernel-infoleak (CVE-2024-26901)
    * 内核：RDMA/srpt：在 srpt 设备完全设置之前，不要注册事件处理程序 (CVE-2024-26872)
    * 内核：usb: ulpi：修复 debugfs 目录泄漏问题 (CVE-2024-26919)
    * 内核：usb: xhci：在 xhci_map_urb_for_dma 中添加错误处理 (CVE-2024-26964)
    * 内核：USB: core：修复 usb_deauthorize_interface() 中的死锁 (CVE-2024-26934)
    * 内核：USB：core：修复端口禁用 sysfs 属性中的死锁 (CVE-2024-26933)
    * 内核：fs: sysfs：修复 sysfs_break_active_protection() 中的引用泄漏问题 (CVE-2024-26993)
    * 内核：fat：修复 nostale filehandles 存在未初始化域问题 (CVE-2024-26973)
    * 内核：USB：usb-storage：防止 isd200_ata_command 中的除 0 错误 (CVE-2024-27059)
    * 内核：net:emac/emac-mac：修复 emac_mac_tx_buf_send 中的释放后使用漏洞 (CVE-2021-47013)
    * 内核：net: usb：修复 smsc75xx_bind 中的内存泄漏问题 (CVE-2021-47171)
    * 内核：powerpc/pseries：修复 papr_get_attr() 中潜在的内存泄漏问题 (CVE-2022-48669)
    * 内核：uio：修复 uio_open 中的释放后使用漏洞 (CVE-2023-52439)
    * 内核：wifi：ath9k：修复 ath9k_htc_txstatus() 中潜在的 array-index-out-of-bounds 读取问题 (CVE-2023-52594)
    * 内核：wifi：rt2x00：硬件重置时重新启动信标队列 (CVE-2023-52595)

Tenable 已直接从 AlmaLinux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的内核版本低于 4.14.238-182.421。因此，该软件受到 ALAS2-2021-1685 公告中提及的多个漏洞影响。

    在 bluez 中发现一个漏洞，蓝牙核心规范的安全简单配对 (SSP)、安全连接 (SC) 和 LE 安全连接 (LESC) 中使用的密码输入协议容易受到假冒攻击，主动攻击者可以在事先不知情的情况下冒充启动设备。(CVE-2020-26558)

    在 Linux 内核中发现一个缺陷。BlueZ 中存在访问控制不当问题，使经过身份验证的用户可以通过邻近访问造成信息泄露。此漏洞最主要的威胁对象是数据机密性和完整性。(CVE-2021-0129)

    在 Linux 内核中发现了一个拒绝服务 (DoS) 缺陷，这是由于 netfilter 子系统中  net/netfilter/x_tables.c 的 xt_replace_table 中存在错误的内存屏障。(CVE-2021-29650)

    在 Linux 内核处理 Bluetooth HCI 控制器删除的过程中发现缺陷。此缺陷允许具有本地帐户的攻击者利用争用情形，导致内存损坏并可能提升特权。此漏洞最大的威胁在于机密性、完整性，以及系统可用性。(CVE-2021-32399)

    在 Linux 内核的蓝牙主机控制器接口 (HCI) 的 hci_send_acl 中发现了一个释放后使用缺陷，具有访问权限的本地攻击者可在系统上造成拒绝服务问题。此问题源于对象 hchan 已在 hci_disconn_loglink_complete_evt 中释放，但仍在其他地方使用。此漏洞对数据完整性、机密性和系统可用性威胁最大。(CVE-2021-33034)

    在 Linux 内核 5.12.13 之前版本的 kernel/bpf/verifier.c 中，可能会错误地预测分支（例如，由于类型混淆），因此非特权 BPF 程序可以通过边信道攻击读取任意内存位置，亦称 CID-9183671af6db。(CVE-2021-33624)

    在用户连接恶意 HCI TTY 蓝牙设备的方式中，发现 Linux 内核 HCI 设备初始化子系统中存在双重释放内存损坏缺陷。本地用户可利用此缺陷导致系统崩溃。(CVE-2021-3564)

    在用户调用 ioct HCIUNBLOCKADDR 的方式中或触发 hci_unregister_dev() 调用以及 hci_sock_blacklist_add()、hci_sock_blacklist_del()、hci_get_conn_info()、hci_get_auth_info() 调用之一的争用情形的方式中，发现 Linux 内核 HCI 子系统的 hci_sock_bound_ioctl() 函数中存在一个释放后使用漏洞。具有特权的本地用户可利用此缺陷造成系统崩溃，或提升其在系统中的特权。(CVE-2021-3573)

    在 Linux 内核中，以下漏洞已修复：

    HID：usbhid：修复 hid_submit_ctrl 中的信息泄漏漏洞

    在 hid_submit_ctrl() 中，计算报告长度的方式未考虑 report->size 可以为零的情况。运行 syzkaller 复制器时，大小为 0 的报告会造成 hid_submit_ctrl) 将 transfer_buffer_length 计算为 16384。将此 urb 传递到 usb 核心层时，KMSAN 会报告 16384 字节的信息泄漏。

    若要修复此问题，请首先修改 hid_report_len()，通过在除法中使用 DIV_ROUND_UP 来说明报告大小为零的情况。然后，从 hid_submit_ctrl() 调用它。(CVE-2021-46906)

    在 Linux 内核中，以下漏洞已修复：

    dm rq：修复表加载失败后 dev 删除中的 blk_mq_tag_set 双重释放问题 (CVE-2021-46938)

    在 Linux 内核中，以下漏洞已修复：

    tracing：重构 trace_clock_global() 以永不阻断 (CVE-2021-46939)

    在 Linux 内核中，以下漏洞已修复：

    md/raid1：结束失败的写入请求时正确指示失败

    此补丁使用位图解决 raid1 阵列中的数据损坏缺陷。如果不进行此修复，失败的 I/O 的位图位最终会被清除。

    由于我们处于 raid1_end_write_request 的失败段中，如果不再次尝试提出请求 (R1BIO_WriteError)，则会发生失败 (R1BIO_Degraded)。(CVE-2021-46950)

    在 Linux 内核中，以下漏洞已修复：

    ACPI：GTDT：监视窗口探测失败时不损坏中断映射 (CVE-2021-46953)

    在 Linux 内核中，以下漏洞已修复：

    openvswitch：修复拆分 IPv4 数据包时的堆栈 OOB 读取问题 (CVE-2021-46955)

    在 Linux 内核中，以下漏洞已修复：

    spi：使用 devm_spi_alloc_* 修复释放后使用 (CVE-2021-46959)

    在 Linux 内核中，以下漏洞已修复：

    cifs：从 smb2_get_enc_key 返回正确的错误代码 (CVE-2021-46960)

    在 Linux 内核中，以下漏洞已修复：

    ACPI：scan：修复错误处理路径中的内存流失问题 (CVE-2021-46985)

    在 Linux 内核中，以下漏洞已修复：

    netfilter: nftables：避免 nft_hash_buckets() 中的溢出 (CVE-2021-46992)

    在 Linux 内核中，以下漏洞已修复：

    ARM：9064/1：hw_breakpoint：不要直接检查事件的 overflow_handler 挂钩 (CVE-2021-47006)

    在 Linux 内核中，以下漏洞已修复：

    net:emac/emac-mac：修复 emac_mac_tx_buf_send 中的释放后使用问题 (CVE-2021-47013)

    在 Linux 内核中，以下漏洞已修复：

    bus：qcom：在返回前放置子节点 (CVE-2021-47054)

    在 Linux 内核中，以下漏洞已修复：

    mtd：需要 locking 和 badblock ioctls 的写入权限 (CVE-2021-47055)

    在 Linux 内核中，以下漏洞已修复：

    RDMA/rxe：如果创建失败，则清除所有 QP 字段 (CVE-2021-47078)

    在 Linux 内核中，以下漏洞已修复：

    ext4：修复了 ext4_es_cache_extent 中由于 ext4_split_extent_at 失败造成的缺陷 (CVE-2021-47117)

    在 Linux 内核中，以下漏洞已修复：

    pid：初始化“cad_pid”时引用 (CVE-2021-47118)

    在 Linux 内核中，以下漏洞已修复：

    drm/amdgpu：修复一个释放后使用错误 (CVE-2021-47142)

    在 Linux 内核中，以下漏洞已修复：

    btrfs：不在 link_to_fixup_dir 中执行 BUG_ON (CVE-2021-47145)

    在 Linux 内核中，以下漏洞已修复：

    mld：修复 mld_newpack() 中的错误 (CVE-2021-47146)

    在 Linux 内核中，以下漏洞已修复：

    tipc：重组 msgs 时，使用 skb_linearize 转换头部 skb (CVE-2021-47162)

    在 Linux 内核中，以下漏洞已修复：

    NFS：不要损坏 nfs_do_recoalesce() 中的 pg_bytes_written 值 (CVE-2021-47166)

    在 Linux 内核中，以下漏洞已修复：

    NFS：修复 filelayout_decode_layout() 中的一个错误限制 (CVE-2021-47168)

    在 Linux 内核中，以下漏洞已修复：

    net: usb：修复 smsc75xx_bind 中的内存泄漏问题 (CVE-2021-47171)

    在 Linux 内核中，以下漏洞已修复：

    iommu/vt-d：修复 alloc_iommu() 中的 sysfs 泄漏 (CVE-2021-47177)

    在 Linux 内核中，以下漏洞已修复：

    net: bridge修复 vlan 隧道 dst 空指针取消引用 (CVE-2021-47223)

    在 Linux 内核中，以下漏洞已修复：

    netipv4修复 ip_mc_add1_src 中的内存泄漏 (CVE-2021-47238)

    在 Linux 内核中，以下漏洞已修复：

    netfilter：synproxy：修复解析 TCP 选项时的越界问题 (CVE-2021-47245)

    在 Linux 内核中，以下漏洞已修复：

    udp修复 close() 和 udp_abort() 之间的争用 (CVE-2021-47248)

    在 Linux 内核中，以下漏洞已修复：

    netrds修复 rds_recvmsg 中的内存泄漏 (CVE-2021-47249)

    在 Linux 内核中，以下漏洞已修复：

    netipv4修复 netlbl_cipsov4_add_std 中的内存泄漏 (CVE-2021-47250)

    在 Linux 内核中，以下漏洞已修复：

    gfs2：修复 gfs2_glock_shrink_scan 中的释放后使用问题 (CVE-2021-47254)

    在 Linux 内核中，以下漏洞已修复：

    mm/memory-failure：确保等待 memory_failure 中的页面回写 (CVE-2021-47256)

    在 Linux 内核中，以下漏洞已修复：

    scsicore修复 scsi_host_alloc() 的错误处理 (CVE-2021-47258)

    在 Linux 内核中，以下漏洞已修复：

    NFS：修复 nfs4_init_client() 中的释放后使用 (CVE-2021-47259)

    在 Linux 内核中，以下漏洞已修复：

    NFS修复 nfs_get_client() 中的潜在空取消引用 (CVE-2021-47260)

    在 Linux 内核中，以下漏洞已修复：

    tracing：修正造成内存损坏的长度检查 (CVE-2021-47274)

    在 Linux 内核中，以下漏洞已修复：

    ftrace不盲目读取 ftrace_bug() 中的 IP 地址 (CVE-2021-47276)

    在 Linux 内核中，以下漏洞已修复：

    kvm避免来自超出范围的 memslot 访问的基于推测的攻击 (CVE-2021-47277)

    在 Linux 内核中，以下漏洞已修复：

    drm：修复 drm_getunique() 中的释放后使用读取 (CVE-2021-47280)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的内核版本低于 5.4.129-62.227。因此，会受到 ALAS2KERNEL-5.4-2022-004 公告中提及的多个漏洞影响。

    在 Linux 内核的 WIFI 碎片处理实现中发现一个缺陷。能够在接入点的无线传输范围内进行传输的攻击者可滥用缺陷，于无意间将之前的 WiFi 片段内容传输至另一设备。(CVE-2020-24586)

    在 Linux 内核的 WiFi 实现中发现了一个缺陷。无线传输范围内的攻击者可以重组来自不同密钥下多个片段的数据包并将其视为有效，以此滥用 WiFi 实现中的逻辑缺陷。此缺陷允许攻击者发送错误密钥下的片段，并将之视为新密钥下的有效片段。此漏洞最主要的威胁对象是机密性。(CVE-2020-24587)

    在 Linux 内核的 WiFi 实现中发现了一个缺陷。无线广播范围内的攻击者可将自定义数据注入能避开数据检查的无线通信中。这可造成帧通过检查，并被视为不同类型的有效帧。(CVE-2020-24588)

    用于 AP 和被连接客户端之间身份验证和密钥管理的帧。某些客户端可能会将这些冒充的重定向帧视为 AP 的控制机制。(CVE-2020-26139)

    在 Linux 内核的 WiFi 实现中发现了一个漏洞。在无线范围内的攻击者可注入控制数据包片段，这时内核不会验证片段化 TKIP 帧的消息完整性检查（真实性）。(CVE-2020-26141)

    在 Linux 内核的 WiFi 实现中，发现 drivers/net/wireless/ath/ath10k/htt_rx.c 的 ath10k_htt_rx_proc_rx_frag_ind_hl 中包含一个缺陷，内核会接受第二个（或后续的）广播碎片（即使以明文发送），然后将其作为完整的未碎片化帧进行处理。此漏洞最主要的威胁对象是数据完整性。(CVE-2020-26145)

    在 Linux 内核的 WiFi 实现中，发现 net/mac80211/rx.c 的 ieee80211_rx_h_defragment 中包含一个缺陷。当其他设备发送碎片化帧且使用了 WEP、CCMP 或 GCMP 数据机密协议时，恶意用户可利用此漏洞来注入数据包和/或泄露选中的碎片。
    此漏洞最主要的威胁对象是数据完整性。(CVE-2020-26147)

    在 Linux 内核中的 certs/blacklist.c 中发现了一个缺陷。当安全启动禁止签名数据库中包含 EFI_CERT_X509_GUID 的签名条目时，系统会跳过该条目。这可造成安全威胁，并破坏系统的完整性和机密性，甚至可能导致拒绝服务问题。
    (CVE-2020-26541)

    在 bluez 中发现一个漏洞，蓝牙核心规范的安全简单配对 (SSP)、安全连接 (SC) 和 LE 安全连接 (LESC) 中使用的密码输入协议容易受到假冒攻击，主动攻击者可以在事先不知情的情况下冒充启动设备。(CVE-2020-26558)

    在 Linux 内核中发现一个缺陷。BlueZ 中存在访问控制不当问题，使经过身份验证的用户可以通过邻近访问造成信息泄露。此漏洞最主要的威胁对象是数据机密性和完整性。(CVE-2021-0129)

    在 Linux 内核的 KVM 实现中发现了一个缺陷，这是由程序对 KVM 中的 VM_IO|VM_PFNMAP vmas 处理不当造成。此问题可造成用户绕过 RO 检查，并导致页面在 VMM 和来宾机仍可访问时被释放。
    能够启动和控制 VM 的用户可以利用此缺陷来读取/写入随机内存页面，进而导致本地特权提升。此漏洞最主要的威胁对象是机密性、完整性，以及系统可用性。(CVE-2021-22543)

    在 Linux 内核处理 Bluetooth HCI 控制器删除的过程中发现缺陷。此缺陷允许具有本地帐户的攻击者利用争用情形，导致内存损坏并可能提升特权。此漏洞最大的威胁在于机密性、完整性，以及系统可用性。(CVE-2021-32399)

    在 Linux 内核的蓝牙主机控制器接口 (HCI) 的 hci_send_acl 中发现了一个释放后使用缺陷，具有访问权限的本地攻击者可在系统上造成拒绝服务问题。此问题源于对象 hchan 已在 hci_disconn_loglink_complete_evt 中释放，但仍在其他地方使用。此漏洞对数据完整性、机密性和系统可用性威胁最大。(CVE-2021-33034)

    Linux 内核中的 canbus 文件系统包含信息泄漏漏洞，内核内存中的信息会泄露给 CAN 总线网络链路层上的设备。能够在 CAN 总线上转储消息的攻击者可通过转储 can 总线上的消息来了解未初始化的堆栈值。(CVE-2021-34693)

    在 Linux 内核中 f2fs 模块的 fs/f2fs/node.c 中发现越界 (OOB) 内存访问缺陷。由于边界检查失败，本地攻击者可获取越界内存的访问权限，从而导致系统崩溃或内部内核信息泄露。此漏洞最大的威胁在于系统可用性。(CVE-2021-3506)

    在用户连接恶意 HCI TTY 蓝牙设备的方式中，发现 Linux 内核 HCI 设备初始化子系统中存在双重释放内存损坏缺陷。本地用户可利用此缺陷导致系统崩溃。(CVE-2021-3564)

    在用户调用 ioct HCIUNBLOCKADDR 的方式中或触发 hci_unregister_dev() 调用以及 hci_sock_blacklist_add()、hci_sock_blacklist_del()、hci_get_conn_info()、hci_get_auth_info() 调用之一的争用情形的方式中，发现 Linux 内核 HCI 子系统的 hci_sock_bound_ioctl() 函数中存在一个释放后使用漏洞。具有特权的本地用户可利用此缺陷造成系统崩溃，或提升其在系统中的特权。(CVE-2021-3573)

    在 Linux 内核的 NFC 实现中发现了一个缺陷，本地非特权用户可触发空指针取消引用和能够导致拒绝服务的 BUG，从而造成内核错误。(CVE-2021-38208)

    在 Linux 内核中，以下漏洞已修复：

    HID：usbhid：修复 hid_submit_ctrl 中的信息泄漏漏洞

    在 hid_submit_ctrl() 中，计算报告长度的方式未考虑 report->size 可以为零的情况。运行 syzkaller 复制器时，大小为 0 的报告会造成 hid_submit_ctrl) 将 transfer_buffer_length 计算为 16384。将此 urb 传递到 usb 核心层时，KMSAN 会报告 16384 字节的信息泄漏。

    若要修复此问题，请首先修改 hid_report_len()，通过在除法中使用 DIV_ROUND_UP 来说明报告大小为零的情况。然后，从 hid_submit_ctrl() 调用它。(CVE-2021-46906)

    在 Linux 内核中，以下漏洞已修复：

    dm rq：修复表加载失败后 dev 删除中的 blk_mq_tag_set 双重释放问题 (CVE-2021-46938)

    在 Linux 内核中，以下漏洞已修复：

    tracing：重构 trace_clock_global() 以永不阻断 (CVE-2021-46939)

    在 Linux 内核中，以下漏洞已修复：

    md/raid1：结束失败的写入请求时正确指示失败

    此补丁使用位图解决 raid1 阵列中的数据损坏缺陷。如果不进行此修复，失败的 I/O 的位图位最终会被清除。

    由于我们处于 raid1_end_write_request 的失败段中，如果不再次尝试提出请求 (R1BIO_WriteError)，则会发生失败 (R1BIO_Degraded)。(CVE-2021-46950)

    在 Linux 内核中，以下漏洞已修复：

    tpm：efi：使用本地变量计算最终日志大小 (CVE-2021-46951)

    在 Linux 内核中，以下漏洞已修复：

    ACPI：GTDT：监视窗口探测失败时不损坏中断映射 (CVE-2021-46953)

    在 Linux 内核中，以下漏洞已修复：

    openvswitch：修复拆分 IPv4 数据包时的堆栈 OOB 读取问题 (CVE-2021-46955)

    在 Linux 内核中，以下漏洞已修复：

    virtiofs：修复 virtio_fs_probe() 中的内存流失问题 (CVE-2021-46956)

    在 Linux 内核中，以下漏洞已修复：

    spi：使用 devm_spi_alloc_* 修复释放后使用 (CVE-2021-46959)

    在 Linux 内核中，以下漏洞已修复：

    cifs：从 smb2_get_enc_key 返回正确的错误代码 (CVE-2021-46960)

    在 Linux 内核中，以下漏洞已修复：

    irqchip/gic-v3：处理虚假中断时不启用 irqs (CVE-2021-46961)

    在 Linux 内核中，以下漏洞已修复：

    scsi：qla2xxx：修复 qla2xxx_mqueuecommand() 中的崩溃问题 (CVE-2021-46963)

    在 Linux 内核中，以下漏洞已修复：

    nbd：修复了 flush_workqueue 中的空指针问题 (CVE-2021-46981)

    在 Linux 内核中，以下漏洞已修复：

    kyber : 修复抢占时的越界访问 CVE-2021-46984

    在 Linux 内核中，以下漏洞已修复：

    ACPI：scan：修复错误处理路径中的内存流失问题 (CVE-2021-46985)

    在 Linux 内核中，以下漏洞已修复：

    i40e：修复 i40e_client_subtask() 中的释放后使用 (CVE-2021-46991)

    在 Linux 内核中，以下漏洞已修复：

    netfilter: nftables：避免 nft_hash_buckets() 中的溢出 (CVE-2021-46992)

    在 Linux 内核中，以下漏洞已修复：

    sched：修复 uclamp 中的越界访问问题 (CVE-2021-46993)

    在 Linux 内核中，以下漏洞已修复：

    sctp : 在 sctp_sf_do_dupcook_a 中提早执行 asoc 更新 (CVE-2021-46999)

    在 Linux 内核中，以下漏洞已修复：

    ceph：修复了 __fh_to_dentry 中的 getattr 错误的 inode 泄漏 (CVE-2021-47000)

    在 Linux 内核中，以下漏洞已修复：

    ARM：9064/1：hw_breakpoint：不要直接检查事件的 overflow_handler 挂钩 (CVE-2021-47006)

    在 Linux 内核中，以下漏洞已修复：

    net：只允许 init netns 将默认 tcp cong 设置为受限的 algo (CVE-2021-47010)

    在 Linux 内核中，以下漏洞已修复：

    net:emac/emac-mac：修复 emac_mac_tx_buf_send 中的释放后使用问题 (CVE-2021-47013)

    在 Linux 内核中，以下漏洞已修复：

    bnxt_en：修复错误路径中的 RX 使用者索引逻辑。(CVE-2021-47015)

    在 Linux 内核中，以下漏洞已修复：

    bus：qcom：在返回前放置子节点 (CVE-2021-47054)

    在 Linux 内核中，以下漏洞已修复：

    mtd：需要 locking 和 badblock ioctls 的写入权限 (CVE-2021-47055)

    在 Linux 内核中，以下漏洞已修复：

    regmap：在释放 debugfs_name 之后将其设置为空 (CVE-2021-47058)

    在 Linux 内核中，以下漏洞已修复：

    KVM：如果总线遭到破坏，则停止查找合并的 MMIO 区域 (CVE-2021-47060)

    在 Linux 内核中，以下漏洞已修复：

    uio_hv_generic：修复错误处理路径中的内存泄漏 (CVE-2021-47071)

    在 Linux 内核中，以下漏洞已修复：

    RDMA/rxe：如果创建失败，则清除所有 QP 字段 (CVE-2021-47078)

    在 Linux 内核中，以下漏洞已修复：

    neighbor：允许对 NUD_NOARP 条目强制执行 GCed (CVE-2021-47109)

    在 Linux 内核中，以下漏洞已修复：

    x86/kvm：关闭时禁用所有 CPU 上的 kvmclock (CVE-2021-47110)

    在 Linux 内核中，以下漏洞已修复：

    x86/kvm：启动 CPU 上的拆卸 PV 功能 (CVE-2021-47112)

    在 Linux 内核中，以下漏洞已修复：

    ext4：修复了 ext4_es_cache_extent 中由于 ext4_split_extent_at 失败造成的缺陷 (CVE-2021-47117)

    在 Linux 内核中，以下漏洞已修复：

    pid：初始化“cad_pid”时引用 (CVE-2021-47118)

    在 Linux 内核中，以下漏洞已修复：

    HID：magicmouse：修复断开连接时的空取消引用 (CVE-2021-47120)

    在 Linux 内核中，以下漏洞已修复：

    ipv6：修复 KASAN：fib6_nh_flush_exceptions 中的 slab-out-of-bound 读取 (CVE-2021-47126)

    在 Linux 内核中，以下漏洞已修复：

    netfilter: nft_ct：跳过已确认 conntrack 的预期 (CVE-2021-47129)

    在 Linux 内核中，以下漏洞已修复：

    cxgb4：避免在清除过滤器时访问寄存器 (CVE-2021-47138)

    在 Linux 内核中，以下漏洞已修复：

    drm/amdgpu：修复一个释放后使用错误 (CVE-2021-47142)

    在 Linux 内核中，以下漏洞已修复：

    drm/amd/amdgpu：修复引用计数泄漏 (CVE-2021-47144)

    在 Linux 内核中，以下漏洞已修复：

    btrfs：不在 link_to_fixup_dir 中执行 BUG_ON (CVE-2021-47145)

    在 Linux 内核中，以下漏洞已修复：

    mld：修复 mld_newpack() 中的错误 (CVE-2021-47146)

    在 Linux 内核中，以下漏洞已修复：

    net: dsa：修复 ->get_get_sset_count() 失败时导致的崩溃 (CVE-2021-47159)

    在 Linux 内核中，以下漏洞已修复：

    tipc：重组 msgs 时，使用 skb_linearize 转换头部 skb (CVE-2021-47162)

    在 Linux 内核中，以下漏洞已修复：

    tipc：等待并退出，直到所有工作队列完成为止 (CVE-2021-47163)

    在 Linux 内核中，以下漏洞已修复：

    NFS：不要损坏 nfs_do_recoalesce() 中的 pg_bytes_written 值 (CVE-2021-47166)

    在 Linux 内核中，以下漏洞已修复：

    NFS：修复 __nfs_pageio_add_request() 中的 Oopsable 情况 (CVE-2021-47167)

    在 Linux 内核中，以下漏洞已修复：

    NFS：修复 filelayout_decode_layout() 中的一个错误限制 (CVE-2021-47168)

    在 Linux 内核中，以下漏洞已修复：

    USB：usbfs：不对过大的内存分配发出警告 (CVE-2021-47170)

    在 Linux 内核中，以下漏洞已修复：

    net: usb：修复 smsc75xx_bind 中的内存泄漏问题 (CVE-2021-47171)

    在 Linux 内核中，以下漏洞已修复：

    iommu/vt-d：修复 alloc_iommu() 中的 sysfs 泄漏 (CVE-2021-47177)

    在 Linux 内核中，以下漏洞已修复：

    netbridge修复 vlan 隧道 dst refcnt 传出时 (CVE-2021-47222)

    在 Linux 内核中，以下漏洞已修复：

    net: bridge修复 vlan 隧道 dst 空指针取消引用 (CVE-2021-47223)

    在 Linux 内核中，以下漏洞已修复：

    KVMx86清除 SMM 标记时立即重置 MMU 上下文 (CVE-2021-47230)

    在 Linux 内核中，以下漏洞已修复：

    netipv4修复 ip_mc_add1_src 中的内存泄漏 (CVE-2021-47238)

    在 Linux 内核中，以下漏洞已修复：

    netfilter：synproxy：修复解析 TCP 选项时的越界问题 (CVE-2021-47245)

    在 Linux 内核中，以下漏洞已修复：

    net/mlx5e修复死对等发夹结构的页面回收 (CVE-2021-47246)

    在 Linux 内核中，以下漏洞已修复：

    udp修复 close() 和 udp_abort() 之间的争用 (CVE-2021-47248)

    在 Linux 内核中，以下漏洞已修复：

    netrds修复 rds_recvmsg 中的内存泄漏 (CVE-2021-47249)

    在 Linux 内核中，以下漏洞已修复：

    netipv4修复 netlbl_cipsov4_add_std 中的内存泄漏 (CVE-2021-47250)

    在 Linux 内核中，以下漏洞已修复：

    gfs2：修复 gfs2_glock_shrink_scan 中的释放后使用问题 (CVE-2021-47254)

    在 Linux 内核中，以下漏洞已修复：

    kvmLAPIC恢复保护以防止非法 APIC 寄存器访问 (CVE-2021-47255)

    在 Linux 内核中，以下漏洞已修复：

    mm/memory-failure：确保等待 memory_failure 中的页面回写 (CVE-2021-47256)

    在 Linux 内核中，以下漏洞已修复：

    scsicore修复 scsi_host_alloc() 的错误处理 (CVE-2021-47258)

    在 Linux 内核中，以下漏洞已修复：

    NFS：修复 nfs4_init_client() 中的释放后使用 (CVE-2021-47259)

    在 Linux 内核中，以下漏洞已修复：

    NFS修复 nfs_get_client() 中的潜在空取消引用 (CVE-2021-47260)

    在 Linux 内核中，以下漏洞已修复：

    IB/mlx5：修复初始化 CQ 片段缓冲区 (CVE-2021-47261)

    在 Linux 内核中，以下漏洞已修复：

    KVM：x86：确保嵌套 VM-Enter 失败跟踪点消息的活跃性 (CVE-2021-47262)

    在 Linux 内核中，以下漏洞已修复：

    RDMA/ipoib：修复因破坏非初始 netns 造成的警告 (CVE-2021-47266)

    在 Linux 内核中，以下漏洞已修复：

    tracing：修正造成内存损坏的长度检查 (CVE-2021-47274)

    在 Linux 内核中，以下漏洞已修复：

    ftrace不盲目读取 ftrace_bug() 中的 IP 地址 (CVE-2021-47276)

    在 Linux 内核中，以下漏洞已修复：

    kvm避免来自超出范围的 memslot 访问的基于推测的攻击 (CVE-2021-47277)

    在 Linux 内核中，以下漏洞已修复：

    drm：修复 drm_getunique() 中的释放后使用读取 (CVE-2021-47280)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 14.04 LTS / 16.04 LTS 主机上安装的程序包受到 USN-7183-1 公告中提及的多个漏洞的影响。

    Andy Nguyen 发现 Linux 内核的 Bluetooth L2CAP 实现中包含类型混淆错误。物理邻近的远程攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2020-12351)

    Andy Nguyen 发现 Linux 内核的 Bluetooth A2MP 实现在某些情况下未能正确初始化内存。物理邻近的远程攻击者可利用此问题暴露敏感信息（内核内存）。(CVE-2020-12352)

    Andy Nguyen 发现 Linux 内核的 Bluetooth HCI 事件数据包解析器未能正确处理某些大小的事件公告，导致基于堆的缓冲区溢出。物理邻近的远程攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2020-24490)

    Ziming Zhang 发现 Linux 内核的 VMware 虚拟 GPU DRM 驱动程序中包含整数溢出漏洞。本地攻击者可利用此问题造成拒绝服务（系统崩溃）。
    (CVE-2022-36402)

    Zheng Wang 发现 Linux 内核的 Renesas 以太网 AVB 驱动程序在删除设备期间存在释放后使用问题。特权攻击者可利用此问题造成拒绝服务（系统崩溃）。
    (CVE-2023-35827)

    在 Linux 内核中发现多个安全问题。攻击者可能利用这些问题入侵系统。此更新修正了以下子系统中的缺陷：

    - GPU 驱动程序；

    - I2C 子系统；

    - 网络驱动程序；

    - Pin 控制器子系统；

    - TTY 驱动程序；

    - USB Mass Storage 驱动程序；

    - Framebuffer 层；

    - Ext4 文件系统；

    - 文件系统基础设施；

    - 蓝牙子系统；

    - 内核 init 基础架构；

    - DMA 映射基础设施；

    - 内存管理；

    - 9P 文件系统网络协议；

    - IPv4 联网；

    - IPv6 联网；

    - 逻辑链接层；

    - MAC80211 子系统；

    - Netfilter；

    - NFC 子系统；

    - Phonet 协议；

    - 网络流量控制；

    - 无线网络；（CVE-2024-44947、CVE-2023-52594、CVE-2024-35886、CVE-2024-38633、CVE-2023-52509、CVE-2024-26625、CVE-2024-36946、CVE-2024-45021、CVE-2024-36270、CVE-2021-47118、CVE-2024-43884、CVE-2024-36941、CVE-2024-38619、CVE-2021-47501、CVE-2024-49967、CVE-2024-42090、CVE-2024-40912、CVE-2024-36968、CVE-2024-53057、CVE-2023-52507、CVE-2024-42101、CVE-2021-47086、CVE-2024-42153、CVE-2024-40959、CVE-2024-26777、CVE-2024-44944、CVE-2024-43856、CVE-2024-39301、）

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2024:3627 公告中提及的多个漏洞影响。

    kernel-rt 程序包提供 Real Time Linux Kernel，支持对具有极高确定性要求的系统进行微调。

    安全修复：

    * 内核：RSA 解密操作中的 Marvin 漏洞边信道泄漏 (CVE-2023-6240)

    * 内核：vhost/vhost.c:vhost_new_msg() 中存在信息泄露 (CVE-2024-0340)

    * 内核：不受信任的 VMM 可触发 int80 syscall 处理 (CVE-2024-25744)

    * 内核：i2c：i801：修复区块进程调用事务 (CVE-2024-26593)

    * 内核：pvrusb2：修复上下文断开连接时发生的释放后使用漏洞 (CVE-2023-52445)

    * 内核：x86/fpu：停止依赖用户空间以防止 xsave 缓冲区中的信息出错，导致无限循环 (CVE-2024-26603)

    * 内核：i2c 中存在释放后使用漏洞 (CVE-2019-25162)

    * 内核：i2c：验证 compat ioctl 中的用户数据 (CVE-2021-46934)

    * 内核：media：dvbdev：修复 dvb_media_device_free() 中的内存泄漏 (CVE-2020-36777)

    * 内核：usb: hub：防止访问未初始化的 BOS 描述符 (CVE-2023-52477)

    * 内核：mtd：需要 locking 和 badblock ioctls 的写入权限 (CVE-2021-47055)

    * 内核：net/smc：修复 SMC-D connection dump 中的非法 rmb_desc 访问 (CVE-2024-26615)

    * 内核：vt：修复删除缓冲区中的字符时会发生内存重叠的问题 (CVE-2022-48627)

    * 内核：raid5_cache_count 中存在整数溢出漏洞 (CVE-2024-23307)

    * 内核：media: uvcvideo：uvc_query_v4l2_menu() 中存在越界读取漏洞 (CVE-2023-52565)

    * 内核：net：bridge：br_handle_frame_finish() 中的 data-races 包含数据争用问题 (CVE-2023-52578)

    * 内核：net: usb: smsc75xx：修复 __smsc75xx_read_reg 中的 uninit-value 访问漏洞 (CVE-2023-52528)

    * 内核：platform/x86：think-lmi：修复引用泄漏问题 (CVE-2023-52520)

    * 内核：RDMA/siw：修复连接失败处理漏洞 (CVE-2023-52513)

    * 内核：pid：初始化 `cad_pid` 时引用 (CVE-2021-47118)

    - 内核：net/sched：act_ct：修复 ooo frags 上的 skb 泄漏和崩溃问题 (CVE-2023-52610)

    * 内核：netfilter：nf_tables：取消绑定超时的匿名集时，将集标记为死集 (CVE-2024-26643)

    * 内核：netfilter：nf_tables：禁止为匿名集添加超时标记 (CVE-2024-26642)

    * 内核：i2c：i801：不要在总线重置时生成中断 (CVE-2021-47153)

    * 内核：xhci：正确处理 isoc Babble 和缓冲区溢出事件 (CVE-2024-26659)

    * 内核：hwmon：(coretemp) 修复越界内存访问漏洞 (CVE-2024-26664)

    * 内核：wifi: mac80211：修复启用 fast-xmit 时的争用条件问题 (CVE-2024-26779)

    * 内核：RDMA/srpt：支持指定 srpt_service_guid 参数 (CVE-2024-26744)

    * 内核：RDMA/qedr：修复 qedr_create_user_qp 错误流 (CVE-2024-26743)

    * 内核：tty：tty_buffer：修复 flush_to_ldisc 中的 softlockup (CVE-2021-47185)

    * 内核：do_sys_name_to_handle()：使用 kzalloc() 修复 kernel-infoleak (CVE-2024-26901)

    * 内核：RDMA/srpt：在 srpt 设备完全设置之前，不要注册事件处理程序 (CVE-2024-26872)

    * 内核：usb: ulpi：修复 debugfs 目录泄漏问题 (CVE-2024-26919)

    * 内核：usb: xhci：在 xhci_map_urb_for_dma 中添加错误处理 (CVE-2024-26964)

    * 内核：USB: core：修复 usb_deauthorize_interface() 中的死锁 (CVE-2024-26934)

    * 内核：USB：core：修复端口禁用 sysfs 属性中的死锁 (CVE-2024-26933)

    * 内核：fs: sysfs：修复 sysfs_break_active_protection() 中的引用泄漏问题 (CVE-2024-26993)

    * 内核：fat：修复 nostale filehandles 存在未初始化域问题 (CVE-2024-26973)

    * 内核：USB：usb-storage：防止 isd200_ata_command 中的除 0 错误 (CVE-2024-27059)

    错误修复：

    * kernel-rt：将 RT 源树更新到最新的 RHEL-8.10.z kernel (JIRA:RHEL-34640)

    * kernel-rt：epoll_wait 未报告对应用程序捕获所有事件的情况 (JIRA：RHEL-23022)

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 8 主机上安装的多个程序包受到 ELSA-2024-3618 公告中提及的多个漏洞影响。

    - uio：修复 uio_open 中的释放后使用漏洞 (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439}
    - net:emac/emac-mac：修复 emac_mac_tx_buf_send 中的释放后使用漏洞 (Ken Cox) [RHEL-27316] {CVE-2021-47013}
    - wifi：brcm80211：处理 pmk_op 分配失败 (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048}
    - wifi：rtl8xxxu：为 c2hcmd_work 添加 cancel_work_sync() (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052}
    - wifi：iwlwifi：mvm：确保存在卸载 TID 队列 (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056}
    - wifi：mt76：mt7921e：修复 free_irq() 中的释放后使用漏洞 (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892}
    - wifi：ath9k：延迟执行所有的 ath9k_wmi_event_tasklet()，直到初始化完成 (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897}
    - wifi：iwlwifi：mvm：修复站点用尽时会发生崩溃的问题 (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693}
    - wifi：iwlwifi：修复双重释放缺陷 (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694}
    - wifi：ath9k：修复 ath9k_htc_txstatus() 中潜在的 array-index-out-of-bounds 读取 (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594}
    - wifi：rt2x00：当硬件重置时，信标队列会重新启动 (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595}
    - wifi：iwlwifi：修复内存损坏漏洞 (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610}
    - net/mlx5e：防止在禁用 aRFS 时发生死锁问题 (Kamal Heib) [RHEL-35041] {CVE-2024-27014}
    - net: usb：修复 smsc75xx_bind 中可能出现的释放后使用漏洞 (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}
    - net: usb：修复 smsc75xx_bind 中的内存泄漏漏洞 (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}
    - netfilter：nf_tables：解除绑定超时的匿名集时，将集标记为死集 (Phil Sutter) [RHEL-30076] {CVE-2024-26643}
    - netfilter：nf_tables：禁止具有超时标记的匿名集 (Phil Sutter) [RHEL-30080] {CVE-2024-26642}
    - md/raid5：修复 raid5_cache_count 中的原子性违规问题 (Nigel Croxon) [RHEL-27930] {CVE-2024-23307}
    - usb：ulpi：修复 debugfs 目录泄漏漏洞 (Desnes Nunes) [RHEL-33287] {CVE-2024-26919}
    - powerpc/pseries：修复 papr_get_attr() 中可能存在的内存泄露漏洞 (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669}
    - USB：usb-storage：防止 isd200_ata_command 中出现除 0 错误 (Desnes Nunes) [RHEL-35122] {CVE-2024-27059}
    - USB：core：修复 usb_deauthorize_interface() 中的死锁问题 (Desnes Nunes) [RHEL-35002] {CVE-2024-26934}
    - usb: xhci：在 xhci_map_urb_for_dma 中添加错误处理 (Desnes Nunes) [RHEL-34958] {CVE-2024-26964}
    - fs: sysfs：修复 sysfs_break_active_protection() 中的引用泄漏问题 (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993}
    - xhci：正确处理 isoc Babble 和缓冲区溢出事件 (Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
    - xhci：当 TD 中出现事务错误时，正确处理 isoc TD。(Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
    - USB：core：修复端口禁用 sysfs 属性中的死锁问题 (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
    - USB：core：添加 hub_get() 和 hub_put() 例程 (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
    - x86/coco：默认在 TDX 和 SEV 上禁用 32 位仿真 (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
    - x86：使 IA32_EMULATION 启动时间可配置 (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
    - x86/entry：使 IA32 syscalls 的可用性依赖于 ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
    - x86/elf：使 32 位进程的加载依赖于 ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
    - x86/entry：为 ignore_sysret() 重命名 (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
    - x86/cpu：不在 Intel CPU 上写入 CSTAR MSR (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
    - x86：引入 ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
    - s390/ptrace：正确处理 fpc 寄存器的设置 (Tobias Huschle) [RHEL-29106] {CVE-2023-52598}
    - net/smc：修复 SMC-D connection dump 中的非法 rmb_desc 访问问题 (Tobias Huschle) [RHEL-27746] {CVE-2024-26615}
    - wifi：mac80211：修复启用 fast-xmit 上的争用条件漏洞 (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779}
    - mtd：需要 locking 和 badblock ioctls 的写入权限 (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
    - mtd：妥善检查权限的所有写入 ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
    - pid：初始化时进行引用 (Waiman Long) [RHEL-29420] {CVE-2021-47118}
    - i2c：i801：不在总线重置时生成中断 (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153}
    - RDMA/srpt：在 srpt 设备完全设置之前，不要注册事件处理程序 ({CVE-2024-26872})
    - fat：修复 nostale 文件句柄中存在未初始化域的问题 (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973}
    - do_sys_name_to_handle()：使用 kzalloc() 修复 kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901}
    - tty: tty_buffer：修复 flush_to_ldisc 中的 softlockup 问题  (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185}
    - RDMA/srpt：支持指定 srpt_service_guid 参数 (Kamal Heib) [RHEL-31710] {CVE-2024-26744}
    - RDMA/qedr：修复 qedr_create_user_qp 错误流 (Kamal Heib) [RHEL-31714] {CVE-2024-26743}
    - hwmon：(coretemp) 修复越界内存访问问题 (David Arcari) [RHEL-31305] {CVE-2024-26664}
    - net: bridge：使用 DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
    - net：修复 netdev_stats_to_stats64() 中存在不需要的符号扩展的问题 (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
    - net：添加 atomic_long_t 至 net_device_stats 字段 (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
    - net/sched：act_ct：修复 ooo frags 上的 skb 泄漏和崩溃问题 (Xin Long) [RHEL-29467] {CVE-2023-52610}
    - net: usb: smsc75xx：修复 __smsc75xx_read_reg 中的 uninit-value 访问漏洞 (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528}
    - powerpc/mm：修复 pgtable_cache_add 中的空指针取消引用问题 (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607}
    - powerpc/lib：验证矢量运算的大小 (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606}
    - usb: hub：防止访问未初始化的 BOS 描述符 (Desnes Nunes) [RHEL-28986] {CVE-2023-52477}
    - media：uvcvideo：修复 OOB 读取问题 (Desnes Nunes) [RHEL-27940] {CVE-2023-52565}
    - media：pvrusb2：修复上下文断开连接时发生的释放后使用漏洞 (Desnes Nunes) [RHEL-26498] {CVE-2023-52445}
    - i2c: i801：修复区块进程调用事务 (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593}
    - media：dvbdev：修复 dvb_media_device_free() 中的内存泄漏漏洞 (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777}
    - i2c：修复潜在的释放后使用漏洞 (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162}
    - i2c：验证 compat ioctl 中的用户数据 (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934}
    - platform/x86：think-lmi：修复引用泄漏漏洞 (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520}
    - vhost：使用 kzalloc()，而不是 kmalloc() 和 memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340}
    - RDMA/siw：修复连接失败处理漏洞 (Kamal Heib) [RHEL-28042] {CVE-2023-52513}
    - vt：修复删除缓冲区中的字符时会发生内存重叠的问题 (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627}
    x86/fpu：停止依赖用户空间以防止 xsave 缓冲区中的信息出错 (Steve Best) [RHEL-26669] {CVE-2024-26603}
    - mptcp：修复套接字解除时的双重释放问题 (Davide Caratti) [RHEL-22773] {CVE-2024-26782}
    - crypto: akcipher - 禁用签名和解密 (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
    - crypto: akcipher - 请求回调的默认实现 (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
    - crypto: testmgr - 按密钥类型拆分 akcipher 测试 (Herbert Xu) [RHEL-17114] {CVE-2023-6240}

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Rocky Linux 8 主机上存在安装的程序包该程序包受到公告 RLSA-2024:3627 中提及的多个漏洞的影响。

    * 内核：RSA 解密操作中的 Marvin 漏洞边信道泄漏 (CVE-2023-6240)

    * 内核：vhost/vhost.c:vhost_new_msg() 中存在信息泄露 (CVE-2024-0340)

    * 内核：不受信任的 VMM 可触发 int80 syscall 处理 (CVE-2024-25744)

    * 内核：i2c：i801：修复区块进程调用事务 (CVE-2024-26593)

    * 内核：pvrusb2：修复上下文断开连接时发生的释放后使用漏洞 (CVE-2023-52445)

    * 内核：x86/fpu：停止依赖用户空间以防止 xsave 缓冲区中的信息出错，导致无限循环 (CVE-2024-26603)

    * 内核：i2c 中存在释放后使用漏洞 (CVE-2019-25162)

    * 内核：i2c：验证 compat ioctl 中的用户数据 (CVE-2021-46934)

    * 内核：media：dvbdev：修复 dvb_media_device_free() 中的内存泄漏 (CVE-2020-36777)

    * 内核：usb: hub：防止访问未初始化的 BOS 描述符 (CVE-2023-52477)

    * 内核：mtd：需要 locking 和 badblock ioctls 的写入权限 (CVE-2021-47055)

    * 内核：net/smc：修复 SMC-D connection dump 中的非法 rmb_desc 访问 (CVE-2024-26615)

    * 内核：vt：修复删除缓冲区中的字符时会发生内存重叠的问题 (CVE-2022-48627)

    * 内核：raid5_cache_count 中存在整数溢出漏洞 (CVE-2024-23307)

    * 内核：media: uvcvideo：uvc_query_v4l2_menu() 中存在越界读取漏洞 (CVE-2023-52565)

    * 内核：net：bridge：br_handle_frame_finish() 中的 data-races 包含数据争用问题 (CVE-2023-52578)

    * 内核：net: usb: smsc75xx：修复 __smsc75xx_read_reg 中的 uninit-value 访问漏洞 (CVE-2023-52528)

    * 内核：platform/x86：think-lmi：修复引用泄漏问题 (CVE-2023-52520)

    * 内核：RDMA/siw：修复连接失败处理漏洞 (CVE-2023-52513)

    * 内核：pid：初始化 `cad_pid` 时引用 (CVE-2021-47118)

    - 内核：net/sched：act_ct：修复 ooo frags 上的 skb 泄漏和崩溃问题 (CVE-2023-52610)

    * 内核：netfilter：nf_tables：取消绑定超时的匿名集时，将集标记为死集 (CVE-2024-26643)

    * 内核：netfilter：nf_tables：禁止为匿名集添加超时标记 (CVE-2024-26642)

    * 内核：i2c：i801：不要在总线重置时生成中断 (CVE-2021-47153)

    * 内核：xhci：正确处理 isoc Babble 和缓冲区溢出事件 (CVE-2024-26659)

    * 内核：hwmon：(coretemp) 修复越界内存访问漏洞 (CVE-2024-26664)

    * 内核：wifi: mac80211：修复启用 fast-xmit 时的争用条件问题 (CVE-2024-26779)

    * 内核：RDMA/srpt：支持指定 srpt_service_guid 参数 (CVE-2024-26744)

    * 内核：RDMA/qedr：修复 qedr_create_user_qp 错误流 (CVE-2024-26743)

    * 内核：tty：tty_buffer：修复 flush_to_ldisc 中的 softlockup (CVE-2021-47185)

    * 内核：do_sys_name_to_handle()：使用 kzalloc() 修复 kernel-infoleak (CVE-2024-26901)

    * 内核：RDMA/srpt：在 srpt 设备完全设置之前，不要注册事件处理程序 (CVE-2024-26872)

    * 内核：usb: ulpi：修复 debugfs 目录泄漏问题 (CVE-2024-26919)

    * 内核：usb: xhci：在 xhci_map_urb_for_dma 中添加错误处理 (CVE-2024-26964)

    * 内核：USB: core：修复 usb_deauthorize_interface() 中的死锁 (CVE-2024-26934)

    * 内核：USB：core：修复端口禁用 sysfs 属性中的死锁 (CVE-2024-26933)

    * 内核：fs: sysfs：修复 sysfs_break_active_protection() 中的引用泄漏问题 (CVE-2024-26993)

    * 内核：fat：修复 nostale filehandles 存在未初始化域问题 (CVE-2024-26973)

    * 内核：USB：usb-storage：防止 isd200_ata_command 中的除 0 错误 (CVE-2024-27059)

    错误修复：

    * kernel-rt将 RT 源树更新到最新的 Rocky Linux-8.10.z 内核 (JIRA:Rocky Linux-34640)

    * kernel-rtepoll_wait 未向应用程序报告捕获所有事件 (JIRA:Rocky Linux-23022)

Tenable 已直接从 Rocky Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Rocky Linux 8 主机上安装的多个程序包受到 RLSA-2024:3618 公告中提及的多个漏洞影响。

    * 内核：RSA 解密操作中的 Marvin 漏洞边信道泄漏 (CVE-2023-6240)

    * 内核：vhost/vhost.c:vhost_new_msg() 中存在信息泄露 (CVE-2024-0340)

    * 内核：不受信任的 VMM 可触发 int80 syscall 处理 (CVE-2024-25744)

    * 内核：i2c：i801：修复区块进程调用事务 (CVE-2024-26593)

    * 内核：pvrusb2：修复上下文断开连接时发生的释放后使用漏洞 (CVE-2023-52445)

    * 内核：x86/fpu：停止依赖用户空间以防止 xsave 缓冲区中的信息出错，导致无限循环 (CVE-2024-26603)

    * 内核：i2c 中存在释放后使用漏洞 (CVE-2019-25162)

    * 内核：i2c：验证 compat ioctl 中的用户数据 (CVE-2021-46934)

    * 内核：media：dvbdev：修复 dvb_media_device_free() 中的内存泄漏 (CVE-2020-36777)

    * 内核：usb: hub：防止访问未初始化的 BOS 描述符 (CVE-2023-52477)

    * 内核：mtd：需要 locking 和 badblock ioctls 的写入权限 (CVE-2021-47055)

    * 内核：net/smc：修复 SMC-D connection dump 中的非法 rmb_desc 访问 (CVE-2024-26615)

    * 内核：vt：修复删除缓冲区中的字符时会发生内存重叠的问题 (CVE-2022-48627)

    * 内核：raid5_cache_count 中存在整数溢出漏洞 (CVE-2024-23307)

    * 内核：media: uvcvideo：uvc_query_v4l2_menu() 中存在越界读取漏洞 (CVE-2023-52565)

    * 内核：net：bridge：br_handle_frame_finish() 中的 data-races 包含数据争用问题 (CVE-2023-52578)

    * 内核：net: usb: smsc75xx：修复 __smsc75xx_read_reg 中的 uninit-value 访问漏洞 (CVE-2023-52528)

    * 内核：platform/x86：think-lmi：修复引用泄漏问题 (CVE-2023-52520)

    * 内核：RDMA/siw：修复连接失败处理漏洞 (CVE-2023-52513)

    * 内核：pid：初始化 `cad_pid` 时引用 (CVE-2021-47118)

    - 内核：net/sched：act_ct：修复 ooo frags 上的 skb 泄漏和崩溃问题 (CVE-2023-52610)

    * 内核：netfilter：nf_tables：取消绑定超时的匿名集时，将集标记为死集 (CVE-2024-26643)

    * 内核：netfilter：nf_tables：禁止为匿名集添加超时标记 (CVE-2024-26642)

    * 内核：i2c：i801：不要在总线重置时生成中断 (CVE-2021-47153)

    * 内核：xhci：正确处理 isoc Babble 和缓冲区溢出事件 (CVE-2024-26659)

    * 内核：hwmon：(coretemp) 修复越界内存访问漏洞 (CVE-2024-26664)

    * 内核：wifi: mac80211：修复启用 fast-xmit 时的争用条件问题 (CVE-2024-26779)

    * 内核：RDMA/srpt：支持指定 srpt_service_guid 参数 (CVE-2024-26744)

    * 内核：RDMA/qedr：修复 qedr_create_user_qp 错误流 (CVE-2024-26743)

    * 内核：tty：tty_buffer：修复 flush_to_ldisc 中的 softlockup (CVE-2021-47185)

    * 内核：do_sys_name_to_handle()：使用 kzalloc() 修复 kernel-infoleak (CVE-2024-26901)

    * 内核：RDMA/srpt：在 srpt 设备完全设置之前，不要注册事件处理程序 (CVE-2024-26872)

    * 内核：usb: ulpi：修复 debugfs 目录泄漏问题 (CVE-2024-26919)

    * 内核：usb: xhci：在 xhci_map_urb_for_dma 中添加错误处理 (CVE-2024-26964)

    * 内核：USB: core：修复 usb_deauthorize_interface() 中的死锁 (CVE-2024-26934)

    * 内核：USB：core：修复端口禁用 sysfs 属性中的死锁 (CVE-2024-26933)

    * 内核：fs: sysfs：修复 sysfs_break_active_protection() 中的引用泄漏问题 (CVE-2024-26993)

    * 内核：fat：修复 nostale filehandles 存在未初始化域问题 (CVE-2024-26973)

    * 内核：USB：usb-storage：防止 isd200_ata_command 中的除 0 错误 (CVE-2024-27059)

    * 内核：net:emac/emac-mac：修复 emac_mac_tx_buf_send 中的释放后使用漏洞 (CVE-2021-47013)

    * 内核：net: usb：修复 smsc75xx_bind 中的内存泄漏问题 (CVE-2021-47171)

    * 内核：powerpc/pseries：修复 papr_get_attr() 中潜在的内存泄漏问题 (CVE-2022-48669)

    * 内核：uio：修复 uio_open 中的释放后使用漏洞 (CVE-2023-52439)

    * 内核：wifi：ath9k：修复 ath9k_htc_txstatus() 中潜在的 array-index-out-of-bounds 读取问题 (CVE-2023-52594)

    * 内核：wifi：rt2x00：硬件重置时重新启动信标队列 (CVE-2023-52595)

Tenable 已直接从 Rocky Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
213506	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-7184-1)	Nessus	Ubuntu Local Security Checks	2025/1/6	2025/1/7	high
197048	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2024:1648-1)	Nessus	SuSE Local Security Checks	2024/5/15	2024/12/27	high
197057	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1646-1)	Nessus	SuSE Local Security Checks	2024/5/15	2024/12/27	high
206463	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2024-12606)	Nessus	Oracle Linux Local Security Checks	2024/9/3	2025/9/9	high
206615	OracleVM 3.4 : kernel-uek (OVMSA-2024-0011)	Nessus	OracleVM Local Security Checks	2024/9/4	2025/1/15	high
151793	Amazon Linux 2 : kernel (ALAS-2021-1685)	Nessus	Amazon Linux Local Security Checks	2021/7/16	2025/5/22	high
160440	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-004)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2025/6/23	high
200115	AlmaLinux 8 : kernel update (Medium) (ALSA-2024:3618)	Nessus	Alma Linux Local Security Checks	2024/6/5	2024/9/9	high
213509	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-7183-1)	Nessus	Ubuntu Local Security Checks	2025/1/6	2025/1/7	high
200115	AlmaLinux 8内核更新中危 (ALSA-2024:3618)	Nessus	Alma Linux Local Security Checks	2024/6/5	2024/9/9	high
151793	Amazon Linux 2：内核 (ALAS-2021-1685)	Nessus	Amazon Linux Local Security Checks	2021/7/16	2025/5/22	high
160440	Amazon Linux 2：内核 (ALASKERNEL-5.4-2022-004)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2025/6/23	high
213509	Ubuntu 14.04 LTS / 16.04 LTS：Linux kernel 漏洞 (USN-7183-1)	Nessus	Ubuntu Local Security Checks	2025/1/6	2025/1/7	high
200116	RHEL 8：kernel-rt (RHSA-2024:3627)	Nessus	Red Hat Local Security Checks	2024/6/5	2024/11/7	high
200159	Oracle Linux 8：内核 (ELSA-2024-3618)	Nessus	Oracle Linux Local Security Checks	2024/6/6	2025/9/9	high
200568	Rocky Linux 8kernel-rt (RLSA-2024:3627)	Nessus	Rocky Linux Local Security Checks	2024/6/14	2024/9/9	high
200609	Rocky Linux 8：内核更新（中危）(RLSA-2024:3618)	Nessus	Rocky Linux Local Security Checks	2024/6/14	2024/9/9	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high