リモート Redhat Enterprise Linux 8 ホストに、RHSA-2025:9581 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    kernel-rt パッケージは、リアルタイム Linux カーネルを提供します。これにより、適切に設定することを高度に要求されるシステムの微調整が可能になります。

    セキュリティ修正プログラム:

    * カーネルcifscifs_get_root() でマウントが失敗した場合の二重解放の競合を修正しますCVE-2022-48919

    * カーネルsecurity/keykey_task_permission の slab-out-of-bounds を修正しますCVE-2024-50301

    * カーネルidpfidpf_vc_core_init エラーパスを修正しますCVE-2024-53064

    * カーネル: ndisc: ndisc_alloc_skb() の RCU 保護を使用 (CVE-2025-21764)

    影響、CVSS スコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されている CVE のページを参照してください。

Tenable は、前述の記述ブロックを Red Hat Enterprise Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモート Redhat Enterprise Linux 8 ホストに、RHSA-2025:9580 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    カーネルパッケージには、Linux オペレーティングシステムのコアである Linux カーネルが含まれています。

    セキュリティ修正プログラム:

    * kernel: cifs: cifs_get_root() でマウントが失敗した場合の二重解放競合を修正 (CVE-2022-48919)

    * kernel: security/keys: key_task_permission の slab-out-of-bounds を修正 (CVE-2024-50301)

    * kernel: idpf: idpf_vc_core_init のエラーパスを修正 (CVE-2024-53064)

    * カーネル: ndisc: ndisc_alloc_skb() の RCU 保護を使用 (CVE-2025-21764)

    影響、CVSS スコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されている CVE のページを参照してください。

Tenable は、前述の記述ブロックを Red Hat Enterprise Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの SUSE Linux SLES15/ SLES_SAP15 / openSUSE 15 ホストには、SUSE-SU-2024:3190-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    SUSE Linux Enterprise 15 SP5 Azure カーネルが更新され、さまざまなセキュリティバグ修正が行われています。

    次のセキュリティバグを修正しました。

    - CVE-2024-44947: 最新の状態に設定する前に、EOF を超えたページコンテンツを初期化します (bsc#1229454)。
    - CVE-2024-36936: メモリの受け入れ中にタッチソフトがロックアップします (bsc#1225773)。
    - CVE-2022-48706: IFCVF init が失敗した場合に適切なクリーンアップを行います (bsc#1225524)。
    - CVE-2024-43883: 新しい参照を取得する前に参照をドロップしません (bsc#1229707)。
    - CVE-2024-41062: sock recv cb とリリースを同期します (bsc#1228576)。
    - CVE-2024-43861: not ip パケットのメモリリークを修正します (bsc#1229500)。
    - CVE-2023-52489: memory_section->usage へのアクセス競合を修正します (bsc#1221326)。
    - CVE-2024-43893: ゼロ除算を回避するためにゼロに対する uartclk をチェックします (bsc#1229759)。
    - CVE-2024-43821: null ポインターデリファレンスの可能性を修正 (bsc#1229315)。
    - CVE-2024-43900: load_firmware_cb() でメモリ解放後使用 (use-after-free) を回避します (bsc#1229756)。
    - CVE-2024-44938: dbDiscardAG の領域外シフトを修正します (bsc#1229792)。
    - CVE-2024-44939: dtInsertEntry の null ポインターデリファレンスを修正します (bsc#1229820)。
    - CVE-2024-41087: エラー時の二重解放を修正します (CVE-2024-41087、bsc#1228466)。
    - CVE-2024-42277: sprd_iommu_hw_en の NULL デリファレンスを回避します (bsc#1229409)。
    - CVE-2024-43902: 変数を渡す前に null チェッカーを追加します (bsc#1229767)。
    - CVE-2024-43904: 逆参照の前に「stream」および「plane」に null チェックを追加します (bsc#1229768)
    - CVE-2024-43880: 構造体 objagg_ops で削除されたメトッドを元に戻します (bsc#1229481)。
    - CVE-2024-43884: pair_device() にエラー処理を追加します (bsc#1229739)
    - CVE-2024-43899: dcn20_resource.c の NULL ポインターデリファレンスを修正します (bsc#1229754)。
    - CVE-2022-48920: flushoncommit を使用する際に、トランザクションコミットの警告を取り除きます (bsc#1229658)。
    - CVE-2023-52906: 失敗した属性検証中の警告を修正します (bsc#1229527)。
    - CVE-2024-43882: perm チェックと set-uid/gid 使用の間の ToCToU を修正しました。(bsc#1229503)
    - CVE-2024-43866: シャットダウンコールバックで常にヘルスをドレインします (bsc#1229495)。
    - CVE-2024-26812: Struct virqfd kABI の回避策 (bsc#1222808)。
    - CVE-2022-48912: __nf_register_net_hook() のメモリ解放後使用 (use-after-free) を修正します (bsc#1229641)
    - CVE-2024-27010: デバイス再帰のミラー化されたデッドロックを修正します (bsc#1223720)。
    - CVE-2022-48906: 再送信の数が多い場合、DATA_FIN タイムアウトを適切に設定します (bsc#1229605)
    - CVE-2024-42155: 保護された安全なキーのコピーをワイプします (bsc#1228733)。
    - CVE-2024-42156: 失敗時にクリアキー構造のコピーをワイプします (bsc#1228722)。
    - CVE-2023-52899: axi_chan_handle_err 関数に vd の例外保護処理を追加します (bsc#1229569)。
    - CVE-2024-42158: kfree_Sensitive() を使用して、Coccinelle 警告を修正します (bsc#1228720)。
    - CVE-2024-26631: ipv6_mc_down/mld_ifc_work のデータ競合を修正します (bsc#1221630)。
    - CVE-2024-43873: vhost/vsock: seqpacket_allow を常に初期化 (bsc#1229488)
    - CVE-2024-40905: __fib6_drop_pcpu_from() の潜在的な競合を修正します (bsc#1227761)
    - CVE-2024-39489: seg6_hmac_init_algo のメモリリークを修正します (bsc#1227623)
    - CVE-2021-47106: nft_set_catchall_destroy() のメモリ解放後使用 (use-after-free) を修正します (bsc#1220962)
    - CVE-2021-47517: 合体割り込みが ethtool を介して設定されたときのパニックを修正します (bsc#1225428)。
    - CVE-2024-36489: tls_init の欠落したメモリバリアを修正します (bsc#1226874)
    - CVE-2024-41020: fcntl/close 競合リカバリの compat パスを修正します (bsc#1228427)。
    - CVE-2024-27079: デバイスリリースの NULL ドメインを修正します (bsc#1223742)。
    - CVE-2024-35897: 保留中のベースチェーン削除のあるテーブルフラグ更新を破棄します (bsc#1224510)。
    - CVE-2024-27403: flow_offload_route_init() で const 指定子を復元します (bsc#1224415)。
    - CVE-2024-27011: パスの中止からのマップでのメモリリークを修正します (bsc#1223803)。
    - CVE-2024-43819: ucontrol VM に対するメモリ領域操作を拒否します (bsc#1229290 git-fixes)。
    - CVE-2024-26668: 整数オーバーフローを引き起こす設定を拒否します (bsc#1222335)。
    - CVE-2024-26835: フックレジスタの失敗に dormant フラグを設定します (bsc#1222967)。
    - CVE-2024-26808: inet/ingress basechain の NETDEV_UNREGISTER を処理します (bsc#1222634)。
    - CVE-2024-27016: pppoe ヘッダーを検証します (bsc#1223807)。
    - CVE-2024-35945: ISR の nullptr 例外を防止します (bsc#1224639)。
    - CVE-2023-52581: 255 を超える要素が期限切れになったときのメモリリークを修正 (bsc#1220877)。
    - CVE-2024-36013: l2cap_connect() の slab-use-after-free を修正します (bsc#1225578)。
    - CVE-2024-43837: prog_array マップで添付された freplace prog の更新を修正します (bsc#1229297)。
    - CVE-2024-42291: FDIR フィルターの数に VF ごとの制限を追加します (bsc#1229374)。
    - CVE-2024-42268: 同期リセットリロードの欠落したロックを修正します (bsc#1229391)。
    - CVE-2024-43834: page_pool_destroy() の無効な待機コンテキストを修正します (bsc#1229314)
    - CVE-2024-36286: instance_destroy_rcu() の rcu_read_lock() を取得します (bsc#1226801)
    - CVE-2024-26851: 範囲外の bmp の長さに対する保護を追加します (bsc#1223074)
    - CVE-2024-42157: 失敗時に機密データをワイプします (bsc#1228727 CVE-2024-42157 git-fixes)。
    - CVE-2024-26677: e7870cf13d20 をブラックリストに追加する (「rxrpc: 参照シリアル番号を設定しないように ACK の遅延を修正する」) (bsc#1222387)
    - CVE-2024-36009: ブラックリスト 467324bcfe1a (「ax25: netdev refcount の問題を修正します」) (bsc#1224542)
    - CVE-2023-52859: pmu の登録が失敗した場合のメモリ解放後使用 (Use After Free) を修正します (bsc#1225582)。
    - CVE-2024-42280: hfcmulti_tx() のメモリ解放後使用 (use-after-free) を修正します (bsc#1229388)
    - CVE-2024-42284: エラー時に tipc_udp_addr2str() からゼロ以外の値を返します (bsc#1229382)
    - CVE-2024-42283: ダンプされた nexthops のすべてのフィールドを初期化 (bsc#1229383)
    - CVE-2024-42312: 常に i_uid/i_gid を初期化します (bsc#1229357)
    - CVE-2024-43854: メディアに書き込む前に、整合性バッファをゼロに初期化します (bsc#1229345)
    - CVE-2024-42322: ip_vs_add_service の pe を適切にデリファレンスします (bsc#1229347)
    - CVE-2024-42301: 配列の領域外のリスクを修正します (bsc#1229407)。
    - CVE-2024-42318: cred_transfer の制限を見失わないようにします (bsc#1229351)。
    - CVE-2024-26669: チェーンテンプレートのオフロードを修正します (bsc#1222350)。
    - CVE-2023-52889: sock 作成中に skb を受信する際の null ポインターデリファレンスを修正します (bsc#1229287,)。
    - CVE-2022-48645: enetc_set_psfp() を共通 enetc_set_features() の外に移動します (bsc#1223508)。
    - CVE-2024-41007: tcp_rtx_probe0_timed_out() で符号付き演算を使用します (bsc#1227863)。
    - CVE-2024-36933: 適切な mac_offset を使用して、nsh_gso_segment() の gso skb をアンワインドします (bsc#1225832)。
    - CVE-2024-42295: nilfs_btnode_create_block() の一貫性のない状態を処理します (bsc#1229370)。
    - CVE-2024-42319: devm_mbox_controller_register() を devm_pm_runtime_enable() の後に移動します (bsc#1229350)。
    - CVE-2024-43860: ノード値が NULL の場合にメモリ領域をスキップします (bsc#1229319)。
    - CVE-2024-43831: 無効なデコーダー vsi を処理します (bsc#1229309)。
    - CVE-2024-43849: locator_addr をメイン mutex で保護します (bsc#1229307)。
    - CVE-2024-43841: const コンテキストで strlen() を使用しません (bsc#1229304)。
    - CVE-2024-43839: bna_tcb および bna_ccb 構造体の「name」バッファサイズを調整します (bsc#1229301)。
    - CVE-2024-41088: xmit が失敗したときの無限ループを修正します (bsc#1228469)。
    - CVE-2024-42281: gso_size をダウングレードする際のセグメントの問題を修正します (bsc#1229386)。
    - CVE-2024-42271: iucv_sock_close() のメモリ解放後使用 (use-after-free) を修正しました。(bsc#1229400)
    - CVE-2024-41080: io_register_iowq_max_workers() の潜在的なデッドロックを修正します (bsc#1228616)。
    - CVE-2024-42246: xs_tcp_setup_socket で接続エラーが発生した場合に備えて、EPERM を再マップします (bsc#1228989)。
    - CVE-2024-42232: delayed_work() と ceph_monc_stop() の間の競合を修正しました。(bsc#1228959)
    - CVE-2024-26735: 潜在的なメモリ解放後使用 (use-after-free) および null-ptr-deref を修正します (bsc#1222372)。
    - CVE-2024-42106: 構造体 inet_diag_req_v2 のパディングフィールドを初期化します (bsc#1228493)。
    - CVE-2024-38662: 変異 sockmap/sockhash に対する検証機能のチェックをカバーします (bsc#1226885)。
    - CVE-2024-42110: ntb_netdev_rx_handler() を __netif_rx() から netif_rx() を呼び出すように移動します (bsc#1228501)。
    - CVE-2024-42247: 整列されていない 64 ビットメモリアクセスを回避します (bsc#1228988)。
    - CVE-2022-48865: ベアラーを有効にする際のカーネルパニックを修正します (bsc#1228065)。
    - CVE-2023-52498: コアシステム全体の PM コードの潜在的なデッドロックを修正 (bsc#1221269)。
    - CVE-2024-41068: 失敗時の sclp_init() クリーンアップを修正します (bsc#1228579)。
    - CVE-2022-48808: DSA マスターデバイスがシャットダウンでバインドを解除する際のパニックを修正します (bsc#1227958)。
    - CVE-2024-42095: RX FIFO レベルチェックで Errata i2310 を修正します (bsc#1228446)。
    - CVE-2024-40978: debugfs 属性を読み取る際のクラッシュを修正します (bsc#1227929)。
    - CVE-2024-42107: PTP が無効の場合は extts を処理しません (bsc#1228494)。
    - CVE-2024-42139: extts の不適切な処理を修正します (bsc#1228503)。
    - CVE-2024-42148: 複数の UBSAN array-index-out-of-bounds を修正します (bsc#1228487)。
    - CVE-2024-42142: E スイッチ、必要に応じて入力 ACL を作成します (bsc#1228491)。
    - CVE-2024-42162: NIC 統計の読み取り時に停止したキューのアカウント (bsc#1228706)。
    - CVE-2024-42082: __xdp_reg_mem_model() から WARN() を削除します (bsc#1228482)。
    - CVE-2024-41042: nft_chain_validate を優先します (bsc#1228526)。
    - CVE-2023-3610: ローカルの権限昇格に悪用される可能性のある、nf_tables コンポーネントのメモリ解放後使用 (Use After Free) の脆弱性を修正しました (bsc#1213580)。
    - CVE-2024-42228: amdgpu_vce_cs_reloc を呼び出す際に初期化されていない値 * サイズを使用します (bsc#1228667)。
    - CVE-2024-40995: tcf_idr_check_alloc() の潜在的な無限ループを修正します (bsc#1227830)。
    - CVE-2024-38602: ax25_dev_device_down() の繰り返しコードをマージします (git-fixes CVE-2024-38602 bsc#1226613)。
    - CVE-2024-38554: net_device の参照カウント漏洩の問題を修正します (bsc#1226742)。
    - CVE-2024-36929: fraglist GSO skbs に対して skb_copy(_expand)  を拒否します (bsc#1225814)。
    - CVE-2024-41009: ringbuf で予約を過剰に実行する問題を修正します (bsc#1228020)。
    - CVE-2024-27024: rds_conn_connect_if_down の警告を修正します (bsc#1223777)。


Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの SUSE Linux SLES15 / SLES_SAP15 ホストには、SUSE-SU-2024:3499-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    SUSE Linux Enterprise 15 SP2 カーネルが更新され、さまざまなセキュリティバグ修正が行われています。

    次のセキュリティバグを修正しました。

    - CVE-2022-48791: 中止された TMF sas_task のメモリ解放後使用 (Use After Free) を修正します (bsc#1228002)
    - CVE-2024-44947: 最新の状態に設定する前に、EOF を超えたページコンテンツを初期化します (bsc#1229454)。
    - CVE-2022-48919: cifs_get_root() でマウントが失敗した場合の二重解放競合を修正します (bsc#1229657)。
    - CVE-2023-52854: padata_free_shell() の refcnt 処理を修正します (bsc#1225584)。
    - CVE-2024-43883: 新しい参照を取得する前に参照をドロップしません (bsc#1229707)。
    - CVE-2024-41062: sock recv cb とリリースを同期します (bsc#1228576)。
    - CVE-2024-43861: not ip パケットのメモリリークを修正します (bsc#1229500)。
    - CVE-2024-43882: perm チェックと set-uid/gid 使用の間の ToCToU を修正しました。(bsc#1229503)
    - CVE-2022-48912: __nf_register_net_hook() のメモリ解放後使用 (use-after-free) を修正します (bsc#1229641)
    - CVE-2022-48872: マップのメモリ解放後使用 (Use After Free) の競合状態を修正します (bsc#1229510)。
    - CVE-2022-48873: creater_process および device_release でマップを削除しません (bsc#1229512)。
    - CVE-2024-42271: iucv_sock_close() のメモリ解放後使用 (use-after-free) を修正しました。(bsc#1229400)
    - CVE-2024-42232: delayed_work() と ceph_monc_stop() の間の競合を修正しました。(bsc#1228959)
    - CVE-2022-48686: ダイジェストエラーを検出する際の UAF を修正 (bsc#1223948)。


Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9581 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: cifs: fix double free race when mount fails in cifs_get_root() (CVE-2022-48919)

    * kernel: security/keys: fix slab-out-of-bounds in key_task_permission (CVE-2024-50301)

    * kernel: idpf: fix idpf_vc_core_init error path (CVE-2024-53064)

    * kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9580 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: cifs: fix double free race when mount fails in cifs_get_root() (CVE-2022-48919)

    * kernel: security/keys: fix slab-out-of-bounds in key_task_permission (CVE-2024-50301)

    * kernel: idpf: fix idpf_vc_core_init error path (CVE-2024-53064)

    * kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.106-102.504. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-012 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' (CVE-2021-46937)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/dbgfs: protect targets destructions with kdamond_lock (CVE-2021-47088)

    A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2022-0500)

    A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

    A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

    A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle return with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23037)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23038)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23039)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23040)

    Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23042)

    The Amazon Linux kernel now enables, by default, a software mitigation for this issue, on all ARM-based     EC2 instance types. (CVE-2022-23960)

    An out-of-bounds (OOB) memory access flaw was found in nft_fwd_dup_netdev_offload in     net/netfilter/nf_dup_netdev.c in the netfilter subcomponent in the Linux kernel due to a heap out-of-     bounds write problem. This flaw allows a local attacker with a user account on the system to gain access     to out-of-bounds memory, leading to a system crash or a privilege escalation threat. (CVE-2022-25636)

    A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

    In the Linux kernel, the following vulnerability has been resolved:

    watch_queue: Fix filter limit check (CVE-2022-48847)

    In the Linux kernel, the following vulnerability has been resolved:

    net-sysfs: add check for netdevice being present to speed_show (CVE-2022-48850)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix kernel-infoleak for SCTP sockets (CVE-2022-48855)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix a race on command flush flow (CVE-2022-48858)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix kernel panic when enabling bearer (CVE-2022-48865)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: ensure we call ipv6_mc_down() at most once (CVE-2022-48910)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: fix possible use-after-free (CVE-2022-48911)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: fix use-after-free in __nf_register_net_hook() (CVE-2022-48912)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/netfront: destroy queues before real_num_tx_queues is zeroed (CVE-2022-48914)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Fix TZ_GET_TRIP NULL pointer dereference (CVE-2022-48915)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix double free race when mount fails in cifs_get_root() (CVE-2022-48919)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: int340x: fix memory leak in int3400_notify() (CVE-2022-48924)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Do not change route.addr.src_addr outside state checks (CVE-2022-48925)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ib_srp: Fix a deadlock (CVE-2022-48930)

    In the Linux kernel, the following vulnerability has been resolved:

    configfs: fix a race in configfs_{,un}register_subsystem() (CVE-2022-48931)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix memory leak during stateful obj update (CVE-2022-48933)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: add a schedule point in io_add_buffers() (CVE-2022-48937)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Add schedule points in batch ops (CVE-2022-48939)

    In the Linux kernel, the following vulnerability has been resolved:

    hwmon: Handle failure to register sensor with thermal zone correctly (CVE-2022-48942)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: make apf token non-zero to fix bug (CVE-2022-48943)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: initialize registers in nft_do_chain() (CVE-2022-49293)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3190-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
    - CVE-2024-36936: Touch soft lockup during memory accept (bsc#1225773).
    - CVE-2022-48706: Do proper cleanup if IFCVF init fails (bsc#1225524).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2023-52489: Fix race in accessing memory_section->usage (bsc#1221326).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43821: Fix a possible null pointer dereference (bsc#1229315).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).
    - CVE-2024-44939: fix null ptr deref in dtInsertEntry (bsc#1229820).
    - CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
    - CVE-2024-42277: Avoid NULL deref in sprd_iommu_hw_en (bsc#1229409).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2024-43904: Add null checks for 'stream' and 'plane' before dereferencing (bsc#1229768)
    - CVE-2024-43880: Put back removed metod in struct objagg_ops (bsc#1229481).
    - CVE-2024-43884: Add error handling to pair_device() (bsc#1229739)
    - CVE-2024-43899: Fix null pointer deref in dcn20_resource.c (bsc#1229754).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2023-52906: Fix warning during failed attribute validation (bsc#1229527).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
    - CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
    - CVE-2024-27010: Fix mirred deadlock on device recursion (bsc#1223720).
    - CVE-2022-48906: Correctly set DATA_FIN timeout when number of retransmits is large (bsc#1229605)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2024-42156: Wipe copies of clear-key structures on failure (bsc#1228722).
    - CVE-2023-52899: Add exception protection processing for vd in axi_chan_handle_err function     (bsc#1229569).
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-26631: Fix data-race in ipv6_mc_down / mld_ifc_work (bsc#1221630).
    - CVE-2024-43873: Always initialize seqpacket_allow (bsc#1229488)
    - CVE-2024-40905: Fix possible race in __fib6_drop_pcpu_from() (bsc#1227761)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2021-47106: Fix use-after-free in nft_set_catchall_destroy() (bsc#1220962)
    - CVE-2021-47517: Fix panic when interrupt coaleceing is set via ethtool (bsc#1225428).
    - CVE-2024-36489: Fix missing memory barrier in tls_init (bsc#1226874)
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-27079: Fix NULL domain on device release (bsc#1223742).
    - CVE-2024-35897: Discard table flag update with pending basechain deletion (bsc#1224510).
    - CVE-2024-27403: Restore const specifier in flow_offload_route_init() (bsc#1224415).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-26835: Set dormant flag on hook register failure (bsc#1222967).
    - CVE-2024-26808: Handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
    - CVE-2024-27016: Validate pppoe header (bsc#1223807).
    - CVE-2024-35945: Prevent nullptr exceptions on ISR (bsc#1224639).
    - CVE-2023-52581: Fix memleak when more than 255 elements expired (bsc#1220877).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-43837: Fix updating attached freplace prog in prog_array map (bsc#1229297).
    - CVE-2024-42291: Add a per-VF limit on number of FDIR filters (bsc#1229374).
    - CVE-2024-42268: Fix missing lock on sync reset reload (bsc#1229391).
    - CVE-2024-43834: Fix invalid wait context of page_pool_destroy() (bsc#1229314)
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727 CVE-2024-42157 git-fixes).
    - CVE-2024-26677: Blacklist e7870cf13d20 ('rxrpc: Fix delayed ACKs to not set the reference serial     number') (bsc#1222387)
    - CVE-2024-36009: Blacklist 467324bcfe1a ('ax25: Fix netdev refcount issue') (bsc#1224542)
    - CVE-2023-52859: Fix use-after-free when register pmu fails (bsc#1225582).
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42283: Initialize all fields in dumped nexthops (bsc#1229383)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42318: Do not lose track of restrictions on cred_transfer (bsc#1229351).
    - CVE-2024-26669: Fix chain template offload (bsc#1222350).
    - CVE-2023-52889: Fix null pointer deref when receiving skb during sock creation (bsc#1229287,).
    - CVE-2022-48645: Move enetc_set_psfp() out of the common enetc_set_features() (bsc#1223508).
    - CVE-2024-41007: Use signed arithmetic in tcp_rtx_probe0_timed_out() (bsc#1227863).
    - CVE-2024-36933: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (bsc#1225832).
    - CVE-2024-42295: Handle inconsistent state in nilfs_btnode_create_block() (bsc#1229370).
    - CVE-2024-42319: Move devm_mbox_controller_register() after devm_pm_runtime_enable() (bsc#1229350).
    - CVE-2024-43860: Skip over memory region when node value is NULL (bsc#1229319).
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-43849: Protect locator_addr with the main mutex (bsc#1229307).
    - CVE-2024-43841: Do not use strlen() in const context (bsc#1229304).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2024-41088: Fix infinite loop when xmit fails (bsc#1228469).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-41080: Fix possible deadlock in io_register_iowq_max_workers() (bsc#1228616).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-26735: Fix possible use-after-free and null-ptr-deref (bsc#1222372).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42247: Avoid unaligned 64-bit memory accesses (bsc#1228988).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2023-52498: Fix possible deadlocks in core system-wide PM code (bsc#1221269).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2022-48808: Fix panic when DSA master device unbinds on shutdown (bsc#1227958).
    - CVE-2024-42095: Fix Errata i2310 with RX FIFO level check (bsc#1228446).
    - CVE-2024-40978: Fix crash while reading debugfs attribute (bsc#1227929).
    - CVE-2024-42107: Do not process extts if PTP is disabled (bsc#1228494).
    - CVE-2024-42139: Fix improper extts handling (bsc#1228503).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42142: E-switch, Create ingress ACL when needed (bsc#1228491).
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-41042: Prefer nft_chain_validate (bsc#1228526).
    - CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local     privilege escalation (bsc#1213580).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2024-40995: Fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
    - CVE-2024-38602: Merge repeat codes in ax25_dev_device_down() (git-fixes CVE-2024-38602 bsc#1226613).
    - CVE-2024-38554: Fix reference count leak issue of net_device (bsc#1226742).
    - CVE-2024-36929: Reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
    - CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).
    - CVE-2024-27024: Fix WARNING in rds_conn_connect_if_down (bsc#1223777).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3252-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-35965: Fix not validating setsockopt user input (bsc#1224579).
    - CVE-2024-35933: Fixed a build regression (bsc#1224640).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2024-43863: Fix a deadlock in dma buf fence polling (bsc#1229497)
    - CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
    - CVE-2024-43907: Fix the null pointer dereference in apply_state_adjust_rules (bsc#1229787).
    - CVE-2024-43905: Fix the null pointer dereference for vega10_hwmgr (bsc#1229784).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2022-48910: Ensure we call ipv6_mc_down() at most once (bsc#1229632)
    - CVE-2023-52893: Fix null-deref in gsmi_get_variable (bsc#1229535)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2022-48875: Initialize struct pn533_out_arg properly (bsc#1229516).
    - CVE-2023-52907: Wait for out_urb's completion in pn533_usb_send_frame() (bsc#1229526).
    - CVE-2024-43871: Fix memory leakage caused by driver API devm_free_percpu() (bsc#1229490)
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-43872: Fix soft lockup under heavy CEQE load (bsc#1229489)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB     (bsc#1228709).
    - CVE-2024-42236: Prevent OOB read/write in usb_string_copy() (bsc#1228964).
    - CVE-2024-42244: Fix crash on resume (bsc#1228967).
    - CVE-2024-43879: Handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (bsc#1229482).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-41012: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727 CVE-2024-42157 git-fixes).
    - CVE-2021-47341: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio (bsc#1224923).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2022-48769: Avoid EFIv2 runtime services on Apple x86 machines (bsc#1226629).
    - CVE-2024-43856: Fix call order in dmam_free_coherent (bsc#1229346).
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-40984: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.' (bsc#1227820).
    - CVE-2024-26677: Blacklist e7870cf13d20 ('rxrpc: Fix delayed ACKs to not set the reference serial     number') (bsc#1222387)
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-42310: Fix null pointer dereference in cdv_intel_lvds_get_modes (bsc#1229358)
    - CVE-2024-42309: Fix null pointer dereference in psb_intel_lvds_get_modes (bsc#1229359)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42285: Fix a use-after-free related to destroying CM IDs (bsc#1229381)
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-38618: Set lower bound of start tick time (bsc#1226754).
    - CVE-2024-41035: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (bsc#1228485)
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2023-52708: Fix error handling in mmc_spi_probe() (bsc#1225483).
    - CVE-2021-47549: Fix UAF in sata_fsl_port_stop when rmmod sata_fsl (bsc#1225508).
    - CVE-2021-47373: Fix potential VPE leak on error (bsc#1225190).
    - CVE-2021-47425: Fix resource leak in reconfiguration device addition (bsc#1225223).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-41098: Fix null pointer dereference on error (bsc#1228467).
    - CVE-2021-4440: Drop USERGS_SYSRET64 paravirt call (bsc#1227069).
    - CVE-2022-48786: Remove vsock from connected table when connect is interrupted by a signal (bsc#1227996).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-35915: Fix uninit-value in nci_dev_up and nci_ntf_packet (git-fixes CVE-2024-35915     bsc#1224479).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-42090: Fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (bsc#1228449).
    - CVE-2024-42101: Fix null pointer dereference in nouveau_connector_get_modes (bsc#1228495).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2021-47257: Fix null deref in parse dev addr (bsc#1224896).
    - CVE-2022-48751: Transitional solution for clcsock race issue (bsc#1226653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3499-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-48791: Fix use-after-free for aborted TMF sas_task (bsc#1228002)
    - CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
    - CVE-2022-48919: Fix double free race when mount fails in cifs_get_root() (bsc#1229657).
    - CVE-2023-52854: Fix refcnt handling in padata_free_shell() (bsc#1225584).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)
    - CVE-2022-48872: Fix use-after-free race condition for maps (bsc#1229510).
    - CVE-2022-48873: Do not remove map on creater_process and device_release (bsc#1229512).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986522 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix double free race when mount fails in cifs_get_root()

    When cifs_get_root() fails during cifs_smb3_do_mount() we call     deactivate_locked_super() which eventually will call delayed_free() which     will free the context.
    In this situation we should not proceed to enter the out: section in     cifs_smb3_do_mount() and free the same resources a second time.

    [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60     [Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0

    [Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G           OE     5.17.0-rc3+ #4     [Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS     Hyper-V UEFI Release v4.0 12/17/2019     [Thu Feb 10 12:59:06 2022] Call Trace:
    [Thu Feb 10 12:59:06 2022]  <IRQ>     [Thu Feb 10 12:59:06 2022]  dump_stack_lvl+0x5d/0x78     [Thu Feb 10 12:59:06 2022]  print_address_description.constprop.0+0x24/0x150     [Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60     [Thu Feb 10 12:59:06 2022]  kasan_report.cold+0x7d/0x117     [Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60     [Thu Feb 10 12:59:06 2022]  __asan_load8+0x86/0xa0     [Thu Feb 10 12:59:06 2022]  rcu_cblist_dequeue+0x32/0x60     [Thu Feb 10 12:59:06 2022]  rcu_core+0x547/0xca0     [Thu Feb 10 12:59:06 2022]  ? call_rcu+0x3c0/0x3c0     [Thu Feb 10 12:59:06 2022]  ? __this_cpu_preempt_check+0x13/0x20     [Thu Feb 10 12:59:06 2022]  ? lock_is_held_type+0xea/0x140     [Thu Feb 10 12:59:06 2022]  rcu_core_si+0xe/0x10     [Thu Feb 10 12:59:06 2022]  __do_softirq+0x1d4/0x67b     [Thu Feb 10 12:59:06 2022]  __irq_exit_rcu+0x100/0x150     [Thu Feb 10 12:59:06 2022]  irq_exit_rcu+0xe/0x30     [Thu Feb 10 12:59:06 2022]  sysvec_hyperv_stimer0+0x9d/0xc0     ...
    [Thu Feb 10 12:59:07 2022] Freed by task 58179:
    [Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50     [Thu Feb 10 12:59:07 2022]  kasan_set_track+0x25/0x30     [Thu Feb 10 12:59:07 2022]  kasan_set_free_info+0x24/0x40     [Thu Feb 10 12:59:07 2022]  ____kasan_slab_free+0x137/0x170     [Thu Feb 10 12:59:07 2022]  __kasan_slab_free+0x12/0x20     [Thu Feb 10 12:59:07 2022]  slab_free_freelist_hook+0xb3/0x1d0     [Thu Feb 10 12:59:07 2022]  kfree+0xcd/0x520     [Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0x149/0xbe0 [cifs]     [Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]     [Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140     [Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0     [Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210     [Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0     [Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae

    [Thu Feb 10 12:59:07 2022] Last potentially related work creation:
    [Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50     [Thu Feb 10 12:59:07 2022]  __kasan_record_aux_stack+0xb6/0xc0     [Thu Feb 10 12:59:07 2022]  kasan_record_aux_stack_noalloc+0xb/0x10     [Thu Feb 10 12:59:07 2022]  call_rcu+0x76/0x3c0     [Thu Feb 10 12:59:07 2022]  cifs_umount+0xce/0xe0 [cifs]     [Thu Feb 10 12:59:07 2022]  cifs_kill_sb+0xc8/0xe0 [cifs]     [Thu Feb 10 12:59:07 2022]  deactivate_locked_super+0x5d/0xd0     [Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0xab9/0xbe0 [cifs]     [Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]     [Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140     [Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0     [Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210     [Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0     [Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
240508	RHEL 8：kernel-rt（RHSA-2025:9581）	Nessus	Red Hat Local Security Checks	2025/6/25	2025/8/15	high
240521	RHEL 8: kernel (RHSA-2025:9580)	Nessus	Red Hat Local Security Checks	2025/6/25	2025/8/15	high
206957	SUSE SLES15 / openSUSE 15 セキュリティ更新 : kernel (SUSE-SU-2024:3190-1)	Nessus	SuSE Local Security Checks	2024/9/11	2025/9/24	high
160433	Amazon Linux 2kernel、 --advisory ALAS2KERNEL-5。10-2022-012 ALASKERNEL-5.10-2022-012	Nessus	Amazon Linux Local Security Checks	2022/5/2	2025/10/8	high
207959	SUSE SLES15 セキュリティ更新 : kernel (SUSE-SU-2024:3499-1)	Nessus	SuSE Local Security Checks	2024/10/1	2025/9/24	high
240508	RHEL 8 : kernel-rt (RHSA-2025:9581)	Nessus	Red Hat Local Security Checks	2025/6/25	2025/8/15	high
240521	RHEL 8 : kernel (RHSA-2025:9580)	Nessus	Red Hat Local Security Checks	2025/6/25	2025/8/15	high
160433	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-012 (ALASKERNEL-5.10-2022-012)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2025/10/8	high
206957	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:3190-1)	Nessus	SuSE Local Security Checks	2024/9/11	2025/9/24	high
207332	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:3252-1)	Nessus	SuSE Local Security Checks	2024/9/17	2025/9/24	high
207959	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:3499-1)	Nessus	SuSE Local Security Checks	2024/10/1	2025/9/24	high
268570	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986522)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/15	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high