遠端 CentOS Linux 7 主機上安裝的套件受到 RHSA-2022:7337 公告中提及的多個弱點影響。

  - 拒絕原因：請勿使用此候選版本編號。ConsultIDs：無。原因：此候選版本的 CNA 未使用候選版本。備註：無。(CVE-2022-23816)

  - 分支預測器中的別名可能造成部分 AMD 處理器預測錯誤的分支類型，這可能導致資訊洩漏。(CVE-2022-23825)

  - 據發現，Linux 核心中的 cls_route 篩選器實作在釋放舊的篩選器時，如果其控點的值是 0，則不會將其從雜湊表中移除。(CVE-2022-2588)

  - 某些 Intel(R) 處理器在內容之間不透明地共用回傳預測器目標，這讓授權使用者可以透過本機存取權造成資訊洩漏。(CVE-2022-26373)

  - VMware ESXi 含有 Return-Stack-Buffer-Underflow (CVE-2022-29901、CVE-2022-28693、CVE-2022-26373) 和 Branch Type Confusion (CVE-2022-23816、CVE-2022-23825) 弱點，這是由於其使用 Intel 和 AMD 處理器所致。VMware 已將這些問題的安全性提高到中等嚴重性範圍，最高 CVSSv3 基本分數為 5.6。(CVE-2022-28693)

  - 在某些依賴微架構的情況下，錯誤訓練的傳回指令分支預測允許使用者執行任意推測程式碼。(CVE-2022-29900)

  - 第 6 至 8 代 Intel 微處理器受到新的 Spectre 變體影響，該變體能夠略過核心中的 retpoline 緩解措施造成任意資料洩漏。具有非特權使用者存取權的攻擊者可劫持傳回指令，在某些依賴微架構的情況下執行任意推測程式碼。(CVE-2022-29901)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 8 主機中安裝的套件受到 ELSA-2022-9591 公告中提及的多個弱點影響。

  - Linux 核心可允許本機攻擊者在系統上執行任意程式碼，這是由 bad_flp_intr 函式中的並行釋放後使用缺陷所造成。透過執行特製的程式，攻擊者可惡意利用此弱點，在系統上執行任意程式碼或造成拒絕服務情形。(CVE-2022-1652)

  - 第 6 至 8 代 Intel 微處理器受到新的 Spectre 變體影響，該變體能夠略過核心中的 retpoline 緩解措施造成任意資料洩漏。具有非特權使用者存取權的攻擊者可劫持傳回指令，在某些依賴微架構的情況下執行任意推測程式碼。(CVE-2022-29901)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 7/8 主機中安裝的套件受到 ELSA-2022-9709 公告中提及的多個弱點影響。

  - 第 6 至 8 代 Intel 微處理器受到新的 Spectre 變體影響，該變體能夠略過核心中的 retpoline 緩解措施造成任意資料洩漏。具有非特權使用者存取權的攻擊者可劫持傳回指令，在某些依賴微架構的情況下執行任意推測程式碼。(CVE-2022-29901)

  - 嘗試設定 SynIC IRQ 時，在 Linux 核心的 KVM 中發現一個缺陷。此問題可讓行為不當的 VMM 寫入 SYNIC/STIMER MSR，進而造成 NULL 指標解除參照。此缺陷允許主機上無權限的本機攻擊者發出特定的 ioctl 呼叫，進而造成可導致拒絕服務的核心 oops 情形。(CVE-2022-2153)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 8 主機中安裝的套件受到 ELSA-2022-7110 公告中提及的多個弱點影響。

  - 在 Linux 核心 net/key/af_key.c 的 pfkey_register 函式中發現一個弱點。無權限的本機使用者可利用此缺陷取得核心記憶體的存取權，進而導致系統當機或內部核心資訊洩漏。(CVE-2022-1353)

  - 核心：cls_route 篩選器實作中的釋放後使用弱點可能導致權限提升 (CVE-2022-2588)

  - 在 Linux 核心的 drivers/scsi/scsi_ioctl.c 的 scsi_ioctl 函式中發現一個核心資訊洩漏缺陷。此缺陷允許具有特殊使用者權限 (CAP_SYS_ADMIN 或 CAP_SYS_RAWIO) 的本機攻擊者破壞機密性。(CVE-2022-0494)

  - 分支預測器中的別名可能造成部分 AMD 處理器預測錯誤的分支類型，這可能導致資訊洩漏。(CVE-2022-23825)

  - 在某些依賴微架構的情況下，錯誤訓練的傳回指令分支預測允許使用者執行任意推測程式碼。(CVE-2022-29900)

  - 第 6 至 8 代 Intel 微處理器受到新的 Spectre 變體影響，該變體能夠略過核心中的 retpoline 緩解措施造成任意資料洩漏。具有非特權使用者存取權的攻擊者可劫持傳回指令，在某些依賴微架構的情況下執行任意推測程式碼。(CVE-2022-29901)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9591 advisory.

    - floppy: use a statically allocated error counter (Willy Tarreau)  [Orabug: 34218638]  {CVE-2022-1652}
    - x86: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit (Josh Poimboeuf)  [Orabug:
    34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Update Retpoline validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra)     [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Report AMD retbleed vulnerability (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Add magic AMD return-thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - objtool: Treat .text.__x86.* as noinstr (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Use return-thunk in asm code (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bpf: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/ftrace: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86,static_call: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86,objtool: Create .return_sites (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Undo return-thunk damage (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/kvm/vmx: Make noinstr clean (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Remove skip_r11rcx (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Fix register corruption in compat syscall (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Use PUSH_AND_CLEAR_REGS for compat (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/entry: Simplify entry_INT80_compat() (Linus Torvalds)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86,static_call: Fix __static_call_return0 for i386 (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - objtool: Default ignore INT3 for unreachable (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/alternative: Relax text_poke_bp() constraint (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - static_call,x86: Robustify trampoline patching (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c69ef9c1dd advisory.

    The 5.18.11 stable kernel update contains a number of important fixes across the tree. In addition to the     5.18.11 stable patches, this build contains the retbleed patches scheduled for 5.18.12 kernels.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9709 advisory.

    - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug:
    34480880]  {CVE-2022-2588}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Paolo Bonzini)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Thadeu Lima de Souza Cascardo)  [Orabug:
    34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt (Alexandre Chartre)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Disable RRSBA behavior (Pawan Gupta)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/exec: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM/VMX: Use TEST %REG,%REG instead of CMP     /u03/ksharma/errata_processing/work/el7uek6/db_7uek6.ELSA-2022-9709,%REG in vmenter.S (Uros Bizjak)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw (Uros Bizjak)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - kbuild/objtool: Add objtool-vmlinux.o pass (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra     (Intel))  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vmlinux: Use INT3 instead of NOP for linker fill bytes (Kees Cook)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/realmode: build with __DISABLE_EXPORTS (Ankur Arora)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bpf: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: elide references to .discard.* from .return_sites (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Support not-feature (Juergen Gross)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/features: Move RETPOLINE flags to word 11 (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Classify symbols (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Create reloc sections implicitly (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add elf_create_reloc() helper (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rework the elf_rebuild_reloc_section() logic (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Handle per arch retpoline naming (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Correctly handle retpoline thunk calls (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Support retpoline jump detection for vmlinux.o (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add 'alt_group' struct (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Clean up elf_write() condition (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add support for relocations without addends (Matt Helsley)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Rename rela to reloc (Matt Helsley)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: optimize add_dead_ends for split sections (Sami Tolvanen)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Move the IRET hack into the arch decoder (Miroslav Benes)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename elf_read() to elf_open_read() (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Constify 'struct elf *' parameters (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize !vmlinux.o again (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Better handle IRET (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/unwind_hints: define unwind_hint_save, unwind_hint_restore (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add abstraction for destination offsets (Raphael Gault)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Fix off-by-one in symbol_by_offset() (Julien Thierry)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_rela_by_dest_range() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize read_sections() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename find_containing_func() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_*() and read_symbols() (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_section_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_section_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add a statistics mode (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn_all() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Introduce validate_return() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Improve call destination function detection (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Fix clang switch table edge case (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add relocation check for alternative sections (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add is_static_jump() helper (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug: 34400675]     {CVE-2022-21505}
    - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly     Kuznetsov)  [Orabug: 34323859]  {CVE-2022-2153}
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug:
    34323859]  {CVE-2022-2153}
    - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323859]     {CVE-2022-2153}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7337 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by     its CNA. Notes: none. (CVE-2022-23816)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0. (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - VMware ESXi contains Return-Stack-Buffer-Underflow (CVE-2022-29901, CVE-2022-28693, CVE-2022-26373) and     Branch Type Confusion (CVE-2022-23816, CVE-2022-23825) vulnerabilities due to the Intel and AMD processors     it utilizes. VMware has evaluated the severity of these issues to be in the Moderate severity range with a     maximum CVSSv3 base score of 5.6. (CVE-2022-28693)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0158 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-33655:
    When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds.

    CVE-2021-33656:
    When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.

    CVE-2022-0494:
    A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality.

    CVE-2022-0500:
    A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernels BPF subsystem due to the way a user loads BTF. This flaw allows a     local user to crash or escalate their privileges on the system.

    CVE-2022-1012:
    A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem.

    CVE-2022-1184:
    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernels filesystem     sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.

    CVE-2022-1462:
    An out-of-bounds read flaw was found in the Linux kernels TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory.

    CVE-2022-1652:
    Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system.

    CVE-2022-1729:
    A use-after-free flaw was found in the Linux kernels performance events functionality. A user triggers     a race condition in setting up performance monitoring between the leading PERF_TYPE_TRACEPOINT and sub     PERF_EVENT_HARDWARE plus the PERF_EVENT_SOFTWARE using the perf_event_open() function with these three     types. This flaw allows a local user to crash the system.

    CVE-2022-1734:
    A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.

    CVE-2022-1786:
    A use-after-free flaw was found in the Linux kernels io_uring subsystem in the way a user sets up a     ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw     allows a local user to crash or escalate their privileges on the system.

    CVE-2022-1789:
    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.

    CVE-2022-1836:
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-33981. Reason: This candidate is a     reservation duplicate of CVE-2022-33981. Notes: All CVE users should reference CVE-2022-33981 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.

    CVE-2022-1966:
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a     duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.

    CVE-2022-1972:
    CVE-2022-1972 is duplicate of CVE-2022-2078, so please consider CVE-2022-2078 instead.

    CVE-2022-1974:
    A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information.

    CVE-2022-1975:
    No description is available for this CVE.

    CVE-2022-2078:
    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code.

    CVE-2022-21123:
    Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access.

    CVE-2022-21125:
    Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access.

    CVE-2022-21166:
    Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access.

    CVE-2022-21499:
    KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and     Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

    CVE-2022-21505:
    A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled

    CVE-2022-2153:
    A flaw was found in the Linux kernels KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service.

    CVE-2022-2318:
    There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges.

    CVE-2022-23816:
    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions.

    CVE-2022-2503:
    Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates.

    CVE-2022-2586:
    A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in     the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the     time of table deletion, possibly leading to local privilege escalation.

    CVE-2022-2588:
    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem.

    CVE-2022-26365:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-2639:
    An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system.

    CVE-2022-28893:
    The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets     are in the intended state.

    CVE-2022-29581:
    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions.

    CVE-2022-2959:
    A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring().
    The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper     locking when performing operations on an object. This flaw allows a local user to crash the system or     escalate their privileges on the system.

    CVE-2022-2978:
    A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function     security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use     this flaw to crash the system or potentially escalate their privileges on the system.

    CVE-2022-29900:
    Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions.

    CVE-2022-29901:
    Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions.

    CVE-2022-32250:
    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free.

    CVE-2022-32296:
    The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used.

    CVE-2022-32981:
    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers.

    CVE-2022-33740:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33741:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33742:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33743:
    network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed.

    CVE-2022-33744:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33981:
    drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.

    CVE-2022-34918:
    An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c.

    CVE-2022-36123:
    The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges.

    CVE-2022-36879:
    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

    CVE-2022-36946:
    nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
173106	Amazon Linux 2023：bpftool、kernel、kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/8/22	high
208564	CentOS 7：核心 (RHSA-2022:7337)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/10	high
163037	Oracle Linux 8：Unbreakable Enterprise 核心容器 (ELSA-2022-9591)	Nessus	Oracle Linux Local Security Checks	2022/7/12	2024/10/23	high
164141	Oracle Linux 7 / 8：Unbreakable Enterprise 核心 (ELSA-2022-9709)	Nessus	Oracle Linux Local Security Checks	2022/8/16	2024/10/23	high
166553	Oracle Linux 8：核心 (ELSA-2022-7110)	Nessus	Oracle Linux Local Security Checks	2022/10/26	2024/11/1	high
191192	CentOS 9：kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	2024/2/29	2025/7/4	critical
163037	Oracle Linux 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9591)	Nessus	Oracle Linux Local Security Checks	2022/7/12	2024/10/23	high
163090	Fedora 36 : kernel (2022-c69ef9c1dd)	Nessus	Fedora Local Security Checks	2022/7/14	2024/11/15	medium
164141	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9709)	Nessus	Oracle Linux Local Security Checks	2022/8/16	2024/10/23	high
166553	Oracle Linux 8 : kernel (ELSA-2022-7110)	Nessus	Oracle Linux Local Security Checks	2022/10/26	2024/11/1	high
208564	CentOS 7 : kernel (RHSA-2022:7337)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/10	high
187326	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2024/6/26	high
236488	Alibaba Cloud Linux 3 : 0158: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2022:0158)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	high
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	2024/2/29	2025/7/4	critical

检测

插件搜索

high

high

high

high

high

critical

high

medium

high

high

high

high

high

critical