The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1783790425 advisory.

  - A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint     information for further use in traditional network attacks. (CVE-2021-3773)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Free buffers when a used     dynamic event is removed After 65536 dynamic events have been added and removed, the type field of the     event then uses the first type number that is available (not currently used by other events). A type     number is the identifier of the binary blobs in the tracing ring buffer (known as events) to map them to     logic that can parse the binary blob. The issue is that if a dynamic event (like a kprobe event) is traced     and is in the ring buffer, and then that event is removed (because it is dynamic, which means it can be     created and destroyed), if another dynamic event is created that has the same number that new event's     logic on parsing the binary blob will be used. To show how this can be an issue, the following can crash     the kernel: # cd /sys/kernel/tracing # for i in `seq 65536`; do echo 'p:kprobes/foo do_sys_openat2     $arg1:u32' > kprobe_events # done For every iteration of the above, the writing to the kprobe_events will     remove the old event and create a new one (with the same format) and increase the type number to the next     available on until the type number reaches over 65535 which is the max number for the 16 bit type. After     it reaches that number, the logic to allocate a new number simply looks for the next available number.
    When an dynamic event is removed, that number is then available to be reused by the next dynamic event     created. That is, once the above reaches the max number, the number assigned to the event in that loop     will remain the same. Now that means deleting one dynamic event and created another will reuse the     previous events type number. This is where bad things can happen. After the above loop finishes, the     kprobes/foo event which reads the do_sys_openat2 function call's first parameter as an integer. # echo 1 >     kprobes/foo/enable # cat /etc/passwd > /dev/null # cat trace cat-2211 [005] .... 2007.849603: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849620: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849838: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849880: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 # echo 0 > kprobes/foo/enable Now if we delete the kprobe and     create a new one that reads a string: # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' >     kprobe_events And now we can the trace: # cat trace sendmail-1942 [002] ..... 530.136320: foo:
    (do_sys_openat2+0x0/0x240) arg1= cat-2046 [004] ..... 530.930817: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.930961: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.934278: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.934563: foo: (do_sys_openat2+0x0/0x240)     arg1= ---truncated--- (CVE-2022-49006)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix wild-memory-access in     register_synth_event() In register_synth_event(), if set_synth_event_print_fmt() failed, then both     trace_remove_event_call() and unregister_trace_event() will be called, which means the trace_event_call     will call __unregister_trace_event() twice. As the result, the second unregister will causes the wild-     memory-access. register_synth_event set_synth_event_print_fmt failed trace_remove_event_call event_remove     if call->event.funcs then __unregister_trace_event (first call) unregister_trace_event
    __unregister_trace_event (second call) Fix the bug by avoiding to call the second
    __unregister_trace_event() by checking if the first one is called. general protection fault, probably for     non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN PTI KASAN: maybe wild-memory-access in range     [0xdead000000000120-0xdead000000000127] CPU: 0 PID: 3807 Comm: modprobe Not tainted     6.1.0-rc1-00186-g76f33a7eedb4 #299 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:unregister_trace_event+0x6e/0x280 Code:
    00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 0e 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08     4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 e2 01 00 00 49 89 2c 24 48 85 ed 74 28 e8 7a 9b RSP:
    0018:ffff88810413f370 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffff888105d050b0 RCX: 0000000000000000     RDX: 1bd5a00000000024 RSI: ffff888119e276e0 RDI: ffffffff835a8b20 RBP: dead000000000100 R08:
    0000000000000000 R09: fffffbfff0913481 R10: ffffffff8489a407 R11: fffffbfff0913480 R12: dead000000000122     R13: ffff888105d050b8 R14: 0000000000000000 R15: ffff888105d05028 FS: 00007f7823e8d540(0000)     GS:ffff888119e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    00007f7823e7ebec CR3: 000000010a058002 CR4: 0000000000330ef0 DR0: 0000000000000000 DR1: 0000000000000000     DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK>
    __create_synth_event+0x1e37/0x1eb0 create_or_delete_synth_event+0x110/0x250     synth_event_run_command+0x2f/0x110 test_gen_synth_cmd+0x170/0x2eb [synth_event_gen_test]     synth_event_gen_test_init+0x76/0x9bc [synth_event_gen_test] do_one_initcall+0xdb/0x480     do_init_module+0x1cf/0x680 load_module+0x6a50/0x70a0 __do_sys_finit_module+0x12f/0x1c0     do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2022-49799)

  - In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double     ata_host_put() in ata_tport_add() In the error path in ata_tport_add(), when calling put_device(),     ata_tport_release() is called, it will put the refcount of 'ap->host'. And then ata_host_put() is called     again, the refcount is decreased to 0, ata_host_release() is called, all ports are freed and set to null.
    When unbinding the device after failure, ata_host_stop() is called to release the resources, it leads a     null-ptr-deref(), because all the ports all freed and null. Unable to handle kernel NULL pointer     dereference at virtual address 0000000000000008 CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G     E 6.1.0-rc3+ #8 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
    ata_host_stop+0x3c/0x84 [libata] lr : release_nodes+0x64/0xd0 Call trace: ata_host_stop+0x3c/0x84 [libata]     release_nodes+0x64/0xd0 devres_release_all+0xbc/0x1b0 device_unbind_cleanup+0x20/0x70     really_probe+0x158/0x320 __driver_probe_device+0x84/0x120 driver_probe_device+0x44/0x120
    __driver_attach+0xb4/0x220 bus_for_each_dev+0x78/0xdc driver_attach+0x2c/0x40 bus_add_driver+0x184/0x240     driver_register+0x80/0x13c __pci_register_driver+0x4c/0x60 ahci_pci_driver_init+0x30/0x1000 [ahci] Fix     this by removing redundant ata_host_put() in the error path. (CVE-2022-49826)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.162-141.675. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-025 advisory.

    A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

    Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC     interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It     appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol     headers are all contained within the linear section of the SKB and some NICs behave badly if this is not     the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x)     though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with     split headers, netback will forward those violating above mentioned assumption to the networking core,     resulting in said misbehavior. (CVE-2022-3643)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42328)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42329)

    A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix preallocation discarding at indirect extent boundary (CVE-2022-48946)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Initialize mailbox message for VF reset (CVE-2022-48949)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid use-after-free in ip6_fragment() (CVE-2022-48956)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netfront: Fix NULL sring after live migration (CVE-2022-48969)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Get user_ns from in_skb in unix_diag_get_exact(). (CVE-2022-48970)

    In the Linux kernel, the following vulnerability has been resolved:

    mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (CVE-2022-48972)

    In the Linux kernel, the following vulnerability has been resolved:

    can: af_can: fix NULL pointer dereference in can_rcv_filter (CVE-2022-48977)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix shift-out-of-bounds in hid_report_raw_event (CVE-2022-48978)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/shmem-helper: Remove errant put in error path (CVE-2022-48981)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/gup: fix gup_pud_range() for dax (CVE-2022-48986)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-dv-timings.c: fix too strict blanking sanity checks (CVE-2022-48987)

    In the Linux kernel, the following vulnerability has been resolved:

    memcg: fix possible use-after-free in memcg_write_event_control() (CVE-2022-48988)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (CVE-2022-48991)

    In the Linux kernel, the following vulnerability has been resolved:

    char: tpm: Protect tpm_pm_suspend with locks (CVE-2022-48997)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference (CVE-2022-48999)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in has_external_pci() (CVE-2022-49000)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (CVE-2022-49002)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free buffers when a used dynamic event is removed (CVE-2022-49006)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (CVE-2022-49007)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix memory leak in sctp_stream_outq_migrate() (CVE-2022-49013)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: Fix use-after-free in tun_detach() (CVE-2022-49014)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hsr: Fix potential use-after-free (CVE-2022-49015)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: re-fetch skb cb after tipc_msg_validate (CVE-2022-49017)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: fix null-ptr-deref while probe() failed (CVE-2022-49021)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix use-after-free when reverting termination table (CVE-2022-49025)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix error handling in iavf_init_module() (CVE-2022-49027)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: Fix resource leak in ixgbevf_init_module() (CVE-2022-49028)

    In the Linux kernel, the following vulnerability has been resolved:

    libbpf: Handle size overflow for ringbuf mmap (CVE-2022-49030)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (CVE-2022-49033)

    A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux     kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root.
    Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in     9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in     788d0824269bef539fe31a785b1517882eafed93. (CVE-2023-1295)

    A null pointer dereference issue was found in the can protocol in net/can/af_can.c in the Linux Kernel.
    ml_priv may not be initialized in the receive path of CAN frames. This issue could allow a local user to     crash the system or cause a denial of service. (CVE-2023-2166)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.226-129.415. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-071 advisory.

    A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request     of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting     in a PCIe link disconnect. (CVE-2022-3169)

    A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

    In the Linux kernel, the following vulnerability has been resolved:

    char: tpm: Protect tpm_pm_suspend with locks (CVE-2022-48997)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference (CVE-2022-48999)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (CVE-2022-49002)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free buffers when a used dynamic event is removed (CVE-2022-49006)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (CVE-2022-49007)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix memory leak in sctp_stream_outq_migrate() (CVE-2022-49013)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: Fix use-after-free in tun_detach() (CVE-2022-49014)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hsr: Fix potential use-after-free (CVE-2022-49015)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: fix null-ptr-deref while probe() failed (CVE-2022-49021)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix use-after-free when reverting termination table (CVE-2022-49025)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (CVE-2022-49033)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: check overflow when iterating ATTR_RECORDs (CVE-2022-49762)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: fix use-after-free in ntfs_attr_find() (CVE-2022-49763)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Check sb_bsize_shift after reading superblock (CVE-2022-49769)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: avoid putting the realm twice when decoding snaps fails (CVE-2022-49770)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: fix misbehavior if list_versions races with module loading (CVE-2022-49771)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: enforce a consistent minimal mtu (CVE-2022-49776)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: i8042 - fix leaking of platform device on module removal (CVE-2022-49777)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case (CVE-2022-49779)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (CVE-2022-49780)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (CVE-2022-49787)

    In the Linux kernel, the following vulnerability has been resolved:

    misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix null pointer dereference in ftrace_add_mod() (CVE-2022-49802)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: use after free in drbd_create_device() (CVE-2022-49811)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: close race conditions on sk_receive_queue (CVE-2022-49814)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-transport: fix double ata_host_put() in ata_tport_add() (CVE-2022-49826)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (CVE-2022-49832)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free bug of ns_writer on remount (CVE-2022-49834)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (CVE-2022-49840)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: core: Fix use-after-free in snd_soc_exit() (CVE-2022-49842)

    In the Linux kernel, the following vulnerability has been resolved:

    can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix deadlock in nilfs_count_free_blocks() (CVE-2022-49850)

    In the Linux kernel, the following vulnerability has been resolved:

    net: macvlan: fix memory leaks of macvlan_common_newlink (CVE-2022-49853)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (CVE-2022-49862)

    In the Linux kernel, the following vulnerability has been resolved:

    can: af_can: fix NULL pointer dereference in can_rx_register() (CVE-2022-49863)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (CVE-2022-49865)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() (CVE-2022-49869)

    In the Linux kernel, the following vulnerability has been resolved:

    capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (CVE-2022-49870)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: Fix memory leaks of napi_get_frags (CVE-2022-49871)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: fix panic on frag_list with mixed head alloc types (CVE-2022-49872)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hyperv: fix possible memory leak in mousevsc_probe() (CVE-2022-49874)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues (CVE-2022-49877)

    A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
    (CVE-2023-26607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-6966 advisory.

    - net: stmmac: dwmac-tegra: Read iommu stream id from device tree (Izabela Bakollari) [RHEL-75649]     {CVE-2025-21663}
    - net: stmmac: Fix zero-division error when disabling tc cbs (Izabela Bakollari) [RHEL-63931]     {CVE-2024-49977}
    - scsi: qla2xxx: Fix use after free on unload (Ewan D. Milne) [RHEL-75828] {CVE-2024-56623}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1782148320 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in     ngene_command_config_free_buf() Fix an 11-year old bug in ngene_command_config_free_buf() while addressing     the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16: warning:
    '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject     'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25:
    warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced     subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] The problem is that the     original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue     FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because     memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is     FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also,     the name of the function ngene_command_config_free_buf() suggests that the actual intention is to     ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function     ngene_command_config_buf(), above). Fix this by enclosing those 6 members of struct     FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the     destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy(). This also helps     with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the     FORTIFY_SOURCE routines on memcpy(). (CVE-2021-47288)

  - In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in     controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl     readiness for AER submission. This may lead to a use-after-free condition that was observed with nvme-tcp.
    The race condition may happen in the following scenario: 1. driver executes its reset_ctrl_work 2. ->     nvme_stop_ctrl - flushes ctrl async_event_work 3. ctrl sends AEN which is received by the host, which in     turn schedules AEN handling 4. teardown admin queue (which releases the queue socket) 5. AEN processed,     submits another AER, calling the driver to submit 6. driver attempts to send the cmd ==> use-after-free In     order to fix that, add ctrl state check to validate the ctrl is actually able to accept the AER     submission. This addresses the above race in controller resets because the driver during teardown should:
    1. change ctrl state to RESETTING 2. flush async_event_work (as well as other async work elements) So     after 1,2, any other AER command will find the ctrl state to be RESETTING and bail out without submitting     the AER. (CVE-2022-48790)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for     aborted TMF sas_task Currently a use-after-free may occur if a TMF sas_task is aborted before we handle     the IO completion in mpi_ssp_completion(). The abort occurs due to timeout. When the timeout occurs, the     SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task(). However,     if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix     this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this     pointer is cleared. (CVE-2022-48791)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Free buffers when a used     dynamic event is removed After 65536 dynamic events have been added and removed, the type field of the     event then uses the first type number that is available (not currently used by other events). A type     number is the identifier of the binary blobs in the tracing ring buffer (known as events) to map them to     logic that can parse the binary blob. The issue is that if a dynamic event (like a kprobe event) is traced     and is in the ring buffer, and then that event is removed (because it is dynamic, which means it can be     created and destroyed), if another dynamic event is created that has the same number that new event's     logic on parsing the binary blob will be used. To show how this can be an issue, the following can crash     the kernel: # cd /sys/kernel/tracing # for i in `seq 65536`; do echo 'p:kprobes/foo do_sys_openat2     $arg1:u32' > kprobe_events # done For every iteration of the above, the writing to the kprobe_events will     remove the old event and create a new one (with the same format) and increase the type number to the next     available on until the type number reaches over 65535 which is the max number for the 16 bit type. After     it reaches that number, the logic to allocate a new number simply looks for the next available number.
    When an dynamic event is removed, that number is then available to be reused by the next dynamic event     created. That is, once the above reaches the max number, the number assigned to the event in that loop     will remain the same. Now that means deleting one dynamic event and created another will reuse the     previous events type number. This is where bad things can happen. After the above loop finishes, the     kprobes/foo event which reads the do_sys_openat2 function call's first parameter as an integer. # echo 1 >     kprobes/foo/enable # cat /etc/passwd > /dev/null # cat trace cat-2211 [005] .... 2007.849603: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849620: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849838: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 cat-2211 [005] .... 2007.849880: foo:
    (do_sys_openat2+0x0/0x130) arg1=4294967196 # echo 0 > kprobes/foo/enable Now if we delete the kprobe and     create a new one that reads a string: # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' >     kprobe_events And now we can the trace: # cat trace sendmail-1942 [002] ..... 530.136320: foo:
    (do_sys_openat2+0x0/0x240) arg1= cat-2046 [004] ..... 530.930817: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.930961: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.934278: foo: (do_sys_openat2+0x0/0x240)     arg1=     cat-2046 [004] ..... 530.934563: foo: (do_sys_openat2+0x0/0x240)     arg1= ---truncated--- (CVE-2022-49006)

  - In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of     raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array     rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid     metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being     requested, that number can be different from the current number of members for existing raid sets as     defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed -     raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 ->     raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the     potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the     rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix     validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up     raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was     verified to pass all LVM2 RAID tests (with KASAN enabled). (CVE-2022-49674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4131-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
    - CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
    - CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
    - CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
    - CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
    - CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
    - CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
    - CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
    - CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
    - CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
    - CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
    - CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
    - CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
    - CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor     (bsc#1230715).
    - CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
    - CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
    - CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
    - CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links     (bsc#1231197).
    - CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6     (bsc#1231200).
    - CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
    - CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
    - CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
    - CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
    - CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
    - CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
    - CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition     (bsc#1232145).
    - CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
    - CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
    - CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
    - CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
    - CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
    - CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
    - CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
    - CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
    - CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
    - CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
237324	RHEL 9 : kernel (RHSA-2025:6966)	Nessus	Red Hat Local Security Checks	2025/5/27	2025/10/28	critical
352893	CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1783790425)	Nessus	CentOS Local Security Checks	2026/9/30	2026/10/1	critical
170472	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-025)	Nessus	Amazon Linux Local Security Checks	2023/1/24	2026/2/26	high
200364	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-071 (ALASKERNEL-5.4-2024-071)	Nessus	Amazon Linux Local Security Checks	2024/6/11	2026/6/4	high
236896	EulerOS Virtualization 2.12.1 : kernel (EulerOS-SA-2025-1547)	Nessus	Huawei Local Security Checks	2025/5/17	2025/9/25	critical
237030	Oracle Linux 9 : kernel (ELSA-2025-6966)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2026/2/9	critical
353232	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1782148320)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high
212537	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:4131-1)	Nessus	SuSE Local Security Checks	2024/12/12	2026/6/26	high

检测

插件搜索

critical

critical

high

high

critical

critical

high

high