The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0042 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2023-20592:
    A flaw was found in some of AMD CPU's due to improper or unexpected behavior of the INVD. This issue may     allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU,     potentially leading to a loss of guest virtual machine (VM) memory integrity.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-7507:02 advisory.

    * (RCVE-2023-20592)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4654-1 advisory.

  - Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to     force an out-of-bounds memory read potentially resulting in a denial of service. (CVE-2021-26345)

  - Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker     accessing ASP SRAM, potentially leading to a loss of confidentiality. (CVE-2021-46766)

  - Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write     from/to an invalid DRAM address, potentially resulting in denial-of-service. (CVE-2021-46774,     CVE-2023-20533)

  - Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM     potentially leading to arbitrary code execution. (CVE-2022-23820)

  - SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited     loss of guest memory integrity. (CVE-2022-23830)

  - A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious     hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.
    (CVE-2023-20519)

  - TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records     after memory content verification, potentially leading to loss of confidentiality or a denial of service.
    (CVE-2023-20521)

  - Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access     to expose the contents of ASP memory potentially leading to a loss of confidentiality. (CVE-2023-20526)

  - Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest     memory integrity. (CVE-2023-20566)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0979 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4575 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-27635)

    * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-40964)

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    * hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0092 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-46329:
    Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user     to potentially enable escalation of privilege via local access.

    CVE-2023-20569:
    A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlledaddress, potentially     leading to information disclosure.

    CVE-2023-20592:
    Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4665-1 advisory.

  - Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to     force an out-of-bounds memory read potentially resulting in a denial of service. (CVE-2021-26345)

  - Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker     accessing ASP SRAM, potentially leading to a loss of confidentiality. (CVE-2021-46766)

  - Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write     from/to an invalid DRAM address, potentially resulting in denial-of-service. (CVE-2021-46774,     CVE-2023-20533)

  - Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM     potentially leading to arbitrary code execution. (CVE-2022-23820)

  - SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited     loss of guest memory integrity. (CVE-2022-23830)

  - A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious     hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.
    (CVE-2023-20519)

  - TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records     after memory content verification, potentially leading to loss of confidentiality or a denial of service.
    (CVE-2023-20521)

  - Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access     to expose the contents of ASP memory potentially leading to a loss of confidentiality. (CVE-2023-20526)

  - Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest     memory integrity. (CVE-2023-20566)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0978 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3178 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    * hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3178 advisory.

    [20240415-999.32.git5da74b16.el8]
    - Rebase to latest upstream [Orabug: 36482906]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0218 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2022-46329:
    Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user     to potentially enable escalation of privilege via local access.

    CVE-2023-20592:
    A flaw was found in some of AMD CPU's due to improper or unexpected behavior of the INVD. This issue may     allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU,     potentially leading to a loss of guest virtual machine (VM) memory integrity.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8159:05 advisory.

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)
      * hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
238955	TencentOS Server 2: linux-firmware (TSSA-2024:0042)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
293451	MiracleLinux 7 : linux-firmware-20200421-82.git78c0348.el7 (AXSA:2024-7507:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
186648	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4654-1)	Nessus	SuSE Local Security Checks	2023/12/7	2023/12/7	critical
191026	RHEL 7 : linux-firmware (RHSA-2024:0979)	Nessus	Red Hat Local Security Checks	2024/2/27	2024/11/7	medium
202500	RHEL 8 : linux-firmware (RHSA-2024:4575)	Nessus	Red Hat Local Security Checks	2024/7/16	2024/11/7	medium
236256	Alibaba Cloud Linux 3 : 0092: linux-firmware (ALINUX3-SA-2024:0092)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
186646	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4665-1)	Nessus	SuSE Local Security Checks	2023/12/7	2023/12/7	critical
191018	RHEL 7 : linux-firmware (RHSA-2024:0978)	Nessus	Red Hat Local Security Checks	2024/2/26	2024/11/7	medium
197772	RHEL 8 : linux-firmware (RHSA-2024:3178)	Nessus	Red Hat Local Security Checks	2024/5/23	2025/3/6	medium
198040	Oracle Linux 8 : linux-firmware (ELSA-2024-3178)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2024/11/2	medium
226324	Linux Distros Unpatched Vulnerability : CVE-2023-20592	Nessus	Misc.	2025/3/5	2025/9/3	medium
238734	TencentOS Server 3: linux-firmware (TSSA-2024:0218)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
292870	MiracleLinux 8 : linux-firmware-20240111-121.gitb3132c18.el8 (AXSA:2024-8159:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

critical

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium