远程 Debian 10 主机上安装的程序包受到 dla-3173 公告中提及的多个漏洞影响。

  - 在 Linux 内核的 fs/inode.c:inode_init_owner() 函数逻辑中发现一个漏洞，当目录是 SGID 且属于特定群组，并可由非此群组成员的用户写入时，本地用户可借此漏洞创建具有非预定群组所有权、并且具有群组执行和 SGID 权限位集的 XFS file-system 文件，这会导致在不应授权的情况下授予过多的权限。此漏洞与之前的 CVE-2018-13405 类似，现增加了缺失的 XFS 补丁。(CVE-2021-4037)

  - Linux 内核中发现缺陷。现有 KVM SEV API 存在漏洞，允许非根（主机）用户级应用程序通过在支持安全加密虚拟化 (SEV) 的 AMD CPU 中创建机密客户机 VM 实例，导致主机内核崩溃。(CVE-2022-0171)

  - 在 fs/ext4/namei.c 中发现一个释放后使用缺陷：Linux 内核的文件系统子组件中的 dx_insert_block()。具有用户特权的本地攻击者可利用此缺陷造成拒绝服务。
    (CVE-2022-1184)

  - 在用户强制 ath9k_htc_wait_for_target 函数因某些输入消息而失败的方式中，在 Linux 内核的 Atheros 无线适配器驱动程序中发现一个释放后使用缺陷。本地用户可利用此缺陷导致系统崩溃或可能升级其系统权限。(CVE-2022-1679)

  - 在 binder.c 的 binder_inc_ref_for_node 中，可能存在因释放后使用而损坏内存的方式。
    这可能会导致本地特权提升，且无需其他执行特权。无需用户交互即可利用漏洞。产品：Android 版本：Android 内核 Android ID：
    A-239630375 参照：上游内核 (CVE-2022-20421)

  - 在 armv8_deprecated.c 的 emulation_proc_handler 中，存在一种可能因争用条件而损坏内存的方法。这可能会导致本地特权提升，且无需其他执行特权。无需用户交互即可利用漏洞。产品：Android 版本：Android 内核 Android ID：A-237540956 参照：上游内核 (CVE-2022-20422)

  - 尝试设置 SynIC IRQ 时，在 Linux 内核的 KVM 中发现缺陷。此问题可使行为不当的 VMM 写入 SYNIC/STIMER MSR，从而导致空指针取消引用。此缺陷允许主机上的非特权本地攻击者发出特定的 ioctl 调用，从而造成可导致拒绝服务的内核 oops 情况。(CVE-2022-2153)

  - 在 Linux 内核的 nf_conntrack_irc 中发现一个问题，其中消息处理可能混淆并且未正确匹配消息。当用户使用配置有 nf_conntrack_irc 的未加密 IRC 时，可能会绕过防火墙。(CVE-2022-2663)

  - 在用户使用大于映射的 max_entries 的密钥调用 bpf_tail_call 函数的方式中，在 Linux 内核的 BPF 子系统中发现一个越界内存读取缺陷。本地用户可利用此缺陷，在未经授权的情况下获取某些数据。(CVE-2022-2905)

  - 当同时发生多个 xfrm_probe_algs 调用时，发现 Linux 内核中用于转换数据包的 IP 框架（XFRM 子系统）存在争用情形。此缺陷让本地攻击者可通过执行越界读取并将其复制到套接字中来触发越界写入，或泄漏内核堆内存。(CVE-2022-3028)

  - 在 i740 驱动程序中发现 Linux 内核缺陷。Userspace 程序可通过 ioctl() 接口向驱动程序传递任何值。驱动程序不检查“pixclock”的值，因此可能导致除零错误。(CVE-2022-3061)

  - Linux 内核的 io_uring 中存在释放后使用。Signalfd_poll() 和 binder_poll() 使用生命周期为当前任务的 waitqueue。它将在释放队列之前向所有等待程序发送 POLLFREE 通知。遗憾的是，io_uring 轮询未处理 POLLFREE。如果使用 io_uring 轮询轮询并且 waitqueue 被释放，则可允许发生释放后使用问题。我们建议升级过去的提交 fc78b2fc21f10c4c9c4d5d659a685710ffa63659 (CVE-2022-3176)

  - 在 Linux 内核声音子系统中发现一个因不当锁定而导致的争用条件缺陷。这个缺陷可在处理 SNDCTL_DSP_SYNC ioctl 时导致空指针取消引用。有权限的本地用户（根用户或“audio”群组成员）可利用此缺陷导致系统崩溃，从而导致拒绝服务情况 (CVE-2022-3303)

  - 在 Linux 内核的网络节点中发现一个缺陷。在将相同 SKB 排入队列（并释放）到子 qdisc 中之后，sch_sfb enqueue 函数使用套接字缓冲区 (SKB) cb 字段的方式存在释放后使用。本地非特权用户可利用此缺陷导致系统崩溃，从而造成拒绝服务。(CVE-2022-3586)

  - 在 Linux 内核中发现一个漏洞。已将此漏洞归类为“有问题”。受影响的是组件 nilfs2 的文件 fs/nilfs2/inode.c 的函数 nilfs_bmap_lookup_at_level。执行操作可导致空指针取消引用。可以远程发起攻击。建议应用补丁修复此问题。此漏洞的标识符为 VDB-211920。(CVE-2022-3621)

  - 在 Linux 内核中发现一个漏洞。已将此漏洞归类为“危急”。这会影响组件 IPsec 的文件 net/core/devlink.c 的函数 devlink_param_set/devlink_param_get。此操纵漏洞可导致释放后使用。建议应用补丁修复此问题。此漏洞获派的标识符为 VDB-211929。(CVE-2022-3625)

  - 在 Linux 内核中发现一个漏洞。已将此漏洞声明为“有问题”。此漏洞会影响组件 IPsec 的文件 net/vmw_vsock/af_vsock.c 的 vsock_connect 函数。此操纵漏洞会导致内存泄漏。建议应用补丁修复此问题。此漏洞获派的标识符为 VDB-211930。(CVE-2022-3629)

  - 在 Linux 内核中发现一个归类为“存在问题”的漏洞。受影响的是组件 IPsec 的文件 net/can/j1939/transport.c 的函数 j1939_session_destroy。此操纵漏洞会导致内存泄漏。建议应用补丁修复此问题。此漏洞的标识符为 VDB-211932。(CVE-2022-3633)

  - 在 Linux 内核中发现一个归类为“危急”的漏洞。受此问题影响的是组件 IPsec 的文件 drivers/atm/idt77252.c 的函数 tst_timer。此操纵漏洞可导致释放后使用。建议应用补丁修复此问题。此漏洞获派的标识符为 VDB-211934。(CVE-2022-3635)

  - 在 Linux 内核中发现一个归类为“存在问题”的漏洞。此问题会影响组件 BPF 的文件 fs/nilfs2/segment.c 的函数 nilfs_attach_log_writer。此操纵漏洞会导致内存泄漏。攻击可从远程发起。建议应用补丁修复此问题。此漏洞获派的标识符为 VDB-211961。(CVE-2022-3646)

  - 在 Linux 内核中发现一个漏洞。已将此漏洞归类为“有问题”。受影响的是组件 BPF 的文件  fs/nilfs2/inode.c 的函数 nilfs_new_inode。此操纵漏洞可导致释放后使用。可以远程发起攻击。建议应用补丁修复此问题。
    此漏洞的标识符为 VDB-211992。(CVE-2022-3649)

  - 在 Linux 内核 5.19 之前版本的 include/asm-generic/tlb.h 中发现一个问题。由于存在争用情形（unmap_mapping_range 与 munmap），设备驱动程序可在页面仍有过时 TLB 条目时将其释放。只有在使用 VM_PFNMAP VMA 的情况下，才会发生此问题。(CVE-2022-39188)

  - 在版本低于 5.19.6 的 Linux 内核的 net/netfilter/nf_tables_api.c 中发现问题。绑定到已绑定的链时可发生拒绝服务。(CVE-2022-39190)

  - 在 Linux 内核 5.19 之前的版本中发现问题。在 drivers/video/fbdev/pxa3xx-gcu.c 的 pxa3xx_gcu_write 中，count 参数存在 size_t 与 int 类型冲突，攻击者可借此造成整数溢出并绕过大小检查。之后，因为它会被用作 copy_from_user() 的第三个参数，所以可能发生堆溢出。(CVE-2022-39842)

  - 在 Linux 内核 5.19.8 及之前的所有版本中发现一个问题，drivers/firmware/efi/capsule-loader.c 中存在争用情形，可导致释放后使用攻击。(CVE-2022-40307)

  - 在版本低于 5.13.3 之前的 Linux 内核的 mm/mremap.c 中，存在通过过时 TLB 的释放后使用，因为在 PUD 移动期间未保持 rmap 锁定。(CVE-2022-41222)

  - 在 Linux 内核 5.19.16 之前的版本中发现问题。能够注入 WLAN 帧的攻击者可导致 net/mac80211/scan.c 中的 ieee80211_bss_info_update 函数发生缓冲区溢出。(CVE-2022-41674)

  - 解析 5.19.16 之前的 Linux 内核 5.2 至 5.19.x 版本中的多 BSSID 元素时，mac80211 堆栈中存在一个释放后使用漏洞，攻击者（能够注入 WLAN 帧）可导致内核崩溃并可能执行代码。(CVE-2022-42719)

  - 5.19.16 之前的 Linux 内核 5.1 至 5.19.x 版本中，在 mac80211 堆栈进行多 BSS 处理时存在多种引用计数错误，本地攻击者（能够注入 WLAN 帧）可导致释放后使用情况并可能执行代码。(CVE-2022-42720)

  - 5.19.16 之前的 Linux 内核 5.1 至 5.19.x 版本中，在 mac80211 堆栈进行 BSS 处理时存在一个列表管理错误，本地攻击者（能够注入 WLAN 帧）可能会损坏已链接的列表，从而可能执行代码。(CVE-2022-42721)

  - 在 5.19.16 之前的 Linux 内核 5.8 至 5.19.x 版本中，能够将 WLAN 帧注入 mac80211 堆栈的本地攻击者可对 P2P 设备的信标保护造成空指针取消引用拒绝服务攻击。 (CVE-2022-42722)

  在低于 5.19.15 版本和低于 6.0.1 的 6.x 版本的 Linux 内核中，usbmon 中的 drivers/usb/mon/mon_bin.c 允许用户空间客户端损坏监视器的内部内存。(CVE-2022-43750)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 20.04 LTS / 22.04 LTS 主机上安装的程序包受到 USN-5792-2 公告中提及的多个漏洞的影响。

  - Linux 内核中发现缺陷。现有 KVM SEV API 存在漏洞，允许非根（主机）用户级应用程序通过在支持安全加密虚拟化 (SEV) 的 AMD CPU 中创建机密客户机 VM 实例，导致主机内核崩溃。(CVE-2022-0171)

  - 在 binder.c 的 binder_inc_ref_for_node 中，可能存在因释放后使用而损坏内存的方式。
    这可能会导致本地权限提升，且无需其他执行权限。无需用户交互即可利用漏洞。产品：Android 版本：Android 内核 Android ID：
    A-239630375 参考：上游内核 (CVE-2022-20421)

  - 在 Linux 内核的 nf_conntrack_irc 中发现一个问题，其中消息处理可能混淆并且未正确匹配消息。当用户使用配置有 nf_conntrack_irc 的未加密 IRC 时，可能会绕过防火墙。(CVE-2022-2663)

  - 在 i740 驱动程序中发现 Linux 内核缺陷。Userspace 程序可通过 ioctl() 接口向驱动程序传递任何值。驱动程序不检查“pixclock”的值，因此可能导致除零错误。(CVE-2022-3061)

  - 在 Linux 内核声音子系统中发现一个因不当锁定而导致的争用条件缺陷。这个缺陷可在处理 SNDCTL_DSP_SYNC ioctl 时导致空指针取消引用。有权限的本地用户（根用户或“audio”群组成员）可利用此缺陷导致系统崩溃，从而导致拒绝服务情况 (CVE-2022-3303)

  - 在 Linux 内核的网络节点中发现一个缺陷。在将相同 SKB 排入队列（并释放）到子 qdisc 中之后，sch_sfb enqueue 函数使用套接字缓冲区 (SKB) cb 字段的方式存在释放后使用。本地非特权用户可利用此缺陷导致系统崩溃，从而造成拒绝服务。(CVE-2022-3586)

  - 在 Linux 内核中发现一个归类为“存在问题”的漏洞。此问题会影响组件 BPF 的文件 fs/nilfs2/segment.c 的函数 nilfs_attach_log_writer。此操纵漏洞会导致内存泄漏。攻击可从远程发起。建议应用补丁修复此问题。此漏洞获派的标识符为 VDB-211961。(CVE-2022-3646)

  - 在 Linux 内核中发现一个漏洞。已将此漏洞归类为“有问题”。受影响的是组件 BPF 的文件 fs/nilfs2/inode.c 的函数 nilfs_new_inode。操纵此漏洞可导致释放后使用。可以远程发起攻击。建议应用补丁修复此问题。
    此漏洞的标识符为 VDB-211992。(CVE-2022-3649)

  - 在 Linux 内核 5.19 之前版本的 include/asm-generic/tlb.h 中发现一个问题。由于存在争用情形（unmap_mapping_range 与 munmap），设备驱动程序可在页面仍有过时 TLB 条目时将其释放。只有在使用 VM_PFNMAP VMA 的情况下，才会发生此问题。(CVE-2022-39188)

  - 在 Linux 内核 5.19 之前的版本中发现问题。在 drivers/video/fbdev/pxa3xx-gcu.c 的 pxa3xx_gcu_write 中，count 参数存在 size_t 与 int 类型冲突，攻击者可借此造成整数溢出并绕过大小检查。之后，因为它会被用作 copy_from_user() 的第三个参数，所以可能发生堆溢出。注意：最初的发现者对于是否可能发生溢出存在争议。(CVE-2022-39842)

  - 在 Linux 内核 5.19.8 及之前的所有版本中发现一个问题，drivers/firmware/efi/capsule-loader.c 中存在争用情形，可导致释放后使用攻击。(CVE-2022-40307)

  - 在低于 5.19.2 的 Linux 内核版本中发现释放后使用缺陷。此问题发生在 drivers/staging/rtl8712/rtl8712_cmd.c 的 cmd_hdl_filter 中，攻击者可借此发起本地拒绝服务攻击并获得权限升级。(CVE-2022-4095)

  在低于 5.19.15 版本和低于 6.0.1 的 6.x 版本的 Linux 内核中，usbmon 中的 drivers/usb/mon/mon_bin.c 允许用户空间客户端损坏监视器的内部内存。(CVE-2022-43750)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 kernel-generic 版本低于 5.15.80/5.15.80_smp。因此，如公告 SSA:2022-333-01 所述，其会受到多个漏洞影响。

    Slackware 15.0 可使用新的内核程序包修复安全问题。

Tenable 已直接从 kernel-generic 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-0171 advisory.

  - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c function in     RPCRDMA_HDRLEN_MIN (7) (in rpcrdma_max_call_header_size, rpcrdma_max_reply_header_size). This flaw allows     an attacker with normal user privileges to leak kernel information. (CVE-2022-0812)

  - kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak     (CVE-2022-1012)

  - No description is available for this CVE. (CVE-2022-1198)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A use-after-free flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in the     way a user connects with the protocol. This flaw allows a local user to crash the system. (CVE-2022-1204)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414510 advisory.

    A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-150 advisory.

    A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

    An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505)

    A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user     creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2022-2585)

    A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in     the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the     time of table deletion, possibly leading to local privilege escalation. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    A firewall flaw that can bypass the Linux kernel's Netfilter functionality was found in how a user handles     unencrypted IRC with nf_conntrack_irc configured. This flaw allows a remote user to gain unauthorized     access to the system. (CVE-2022-2663)

    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition. (CVE-2022-3303)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    A flaw was found in the x86 KVM subsystem in kvm_steal_time_set_preempted in arch/x86/kvm/x86.c in the     Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are     mishandled in certain KVM_VCPU_PREEMPTED situations. (CVE-2022-39189)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

    An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. (CVE-2022-39842)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0002 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-4037:
    A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS.

    CVE-2022-0171:
    A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV).

    CVE-2022-1679:
    A use-after-free flaw was found in the Linux kernel?s Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system.

    CVE-2022-2585:
    A use-after-free flaw was found in the Linux kernel?s POSIX CPU timers functionality in the way a user     creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user     to crash or potentially escalate their privileges on the system.

    CVE-2022-2586:
    A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in     the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the     time of table deletion, possibly leading to local privilege escalation.

    CVE-2022-2588:
    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem.

    CVE-2022-2602:
    A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects     in at least one schema, the ability to lure or wait for an administrator to create or update an affected     extension in that schema, and the ability to lure or wait for a victim to use the object targeted in     CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to     run arbitrary code as the victim role, which may be a superuser.

    CVE-2022-26373:
    Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access.

    CVE-2022-2663:
    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured.

    CVE-2022-2905:
    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data.

    CVE-2022-2978:
    A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function     security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use     this flaw to crash the system or potentially escalate their privileges on the system.

    CVE-2022-3028:
    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket.

    CVE-2022-3061:
    Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error.

    CVE-2022-3169:
    A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request     of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting     in a PCIe link disconnect.

    CVE-2022-3176:
    There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a     waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before     the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free     to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We     recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659

    CVE-2022-3435:
    A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability.

    CVE-2022-3521:
    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier     assigned to this vulnerability.

    CVE-2022-3524:
    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability.

    CVE-2022-3534:
    A vulnerability classified as critical has been found in Linux Kernel. Affected is the function     btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to     use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability     is VDB-211032.

    CVE-2022-3535:
    A vulnerability classified as problematic was found in Linux Kernel. Affected by this vulnerability is the     function mvpp2_dbgfs_port_init of the file drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c of the     component mvpp2. The manipulation leads to memory leak. It is recommended to apply a patch to fix this     issue. The identifier VDB-211033 was assigned to this vulnerability.

    CVE-2022-3542:
    A memory leak flaw was found in bnx2x_tpa_stop in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c in the     bnx2x sub-component in the Linux Kernel. This flaw may allow a local attacker to cause a denial of     service.

    CVE-2022-3545:
    A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability.

    CVE-2022-3564:
    A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087.

    CVE-2022-3565:
    A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue     is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     of this vulnerability is VDB-211088.

    CVE-2022-3566:
    A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability.

    CVE-2022-3567:
    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability.

    CVE-2022-3586:
    A flaw was found in the Linux kernel?s networking code. A use-after-free was found in the way the sch_sfb     enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed)     into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of     service.

    CVE-2022-3594:
    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The     manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to     apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363.

    CVE-2022-3621:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function     nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads     to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a     patch to fix this issue. The identifier of this vulnerability is VDB-211920.

    CVE-2022-3623:
    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability.

    CVE-2022-3625:
    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability.

    CVE-2022-3628:
    A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges.

    CVE-2022-3629:
    A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects     the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. It     is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this     vulnerability.

    CVE-2022-3633:
    A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function     j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is     recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932.

    CVE-2022-3635:
    A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue     is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation     leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the     identifier assigned to this vulnerability.

    CVE-2022-3646:
    A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects     the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The     manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a     patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability.

    CVE-2022-3649:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function     nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211992.

    CVE-2022-36946:
    nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len.

    CVE-2022-39189:
    An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations.

    CVE-2022-39190:
    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain.

    CVE-2022-39842:
    ** DISPUTED ** An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can     actually happen.

    CVE-2022-40307:
    An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free.

    CVE-2022-40768:
    drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information     from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.

    CVE-2022-41222:
    mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move.

    CVE-2022-41674:
    An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.

    CVE-2022-42719:
    A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through     5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and     potentially execute code.

    CVE-2022-42720:
    Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code.

    CVE-2022-42721:
    A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code.

    CVE-2022-42722:
    In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices.

    CVE-2022-42895:
    There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req     function which can be used to leak kernel pointers remotely. We recommend upgrading past commit     https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e     https://www.google.com/url

    CVE-2022-42896:
    There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url

    CVE-2022-43750:
    drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory.

    CVE-2022-4378:
    A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
166822	Debian DLA-3173-1：linux-5.10 - LTS 安全更新	Nessus	Debian Local Security Checks	2022/11/2	2025/1/22	high
169726	Ubuntu 20.04 LTS / 22.04 LTS：Linux 内核漏洞 (USN-5792-2)	Nessus	Ubuntu Local Security Checks	2023/1/10	2024/8/27	high
168270	Slackware Linux 15.0 kernel-generic 中存在多个漏洞 (SSA:2022-333-01)	Nessus	Slackware Local Security Checks	2022/11/29	2025/9/30	high
173106	Amazon Linux 2023：bpftool、kernel、kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/8/22	high
173551	CBL Mariner 2.0 Security Update: kernel (CVE-2022-0171)	Nessus	MarinerOS Local Security Checks	2023/3/28	2023/3/28	medium
163565	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2134)	Nessus	Huawei Local Security Checks	2022/7/29	2023/1/6	high
267615	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414510)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/15	medium
166127	Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-150)	Nessus	Amazon Linux Local Security Checks	2022/10/14	2024/12/11	high
236648	Alibaba Cloud Linux 3 : 0002: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0002)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/9/23	high
187326	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2025/9/25	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	2021/9/7	2025/10/16	high
502982	Siemens SIMATIC Devices Linux Kernel Incomplete Cleanup (CVE-2022-0171)	Tenable OT Security	Tenable.ot	2025/2/25	2025/10/29	medium

检测

插件搜索

high

high

high

high

medium

high

medium

high

high

high

high

medium