The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2831-1 advisory.

  - In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON     condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a     type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing     memory corruption. (CVE-2023-1077)

  - A use-after-free flaw was found in the Linux kernel's core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 (coredump: Use the vma snapshot in fill_files_note) not     applied yet, then kernel could be affected. (CVE-2023-1249)

  - A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
    We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

  - In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to     a logic error in the code. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-260821414References: Upstream kernel (CVE-2023-21102)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

  - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

  - A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and     font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds     occurs leading to undefined behavior and possible denial of service. (CVE-2023-3161)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw     allows a local user to crash the system. (CVE-2023-3357)

  - A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue     could allow a local user to crash the system. (CVE-2023-3358)

  - A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a     hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for     5.15 stable). (CVE-2023-3389)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c. (CVE-2023-35823)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in     renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. (CVE-2023-35828)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in     drivers/staging/media/rkvdec/rkvdec.c. (CVE-2023-35829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6421:25 advisory.

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)
      * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE     (CVE-2023-3610)
      * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)
      * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()     (CVE-2023-4004)
      * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-     free (CVE-2023-4147)
      * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)
      * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)
      * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)
      * hw: amd: Cross-Process Information Leak (CVE-2023-20593)
      * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6079-1 advisory.

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer     dereference in some situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-4842)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could     use this to cause a denial of service (system crash). (CVE-2022-48423)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer     lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a     denial of service (system crash). (CVE-2023-0210)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in     some situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2023-1652)

    It was discovered that the ARM64 EFI runtime services implementation in the Linux kernel did not properly     manage concurrency calls. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-21102)

    It was discovered that a race condition existed in Adreno GPU DRM driver in the Linux kernel, leading to a     double-free vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-21106)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained     a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23454)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     the size of attributes when parsing MFT. A local attacker could possibly use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-26544)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6091-1 advisory.

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer     dereference in some situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-4842)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could     use this to cause a denial of service (system crash). (CVE-2022-48423)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer     lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a     denial of service (system crash). (CVE-2023-0210)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in     some situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2023-1652)

    It was discovered that the ARM64 EFI runtime services implementation in the Linux kernel did not properly     manage concurrency calls. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-21102)

    It was discovered that a race condition existed in Adreno GPU DRM driver in the Linux kernel, leading to a     double-free vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-21106)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained     a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23454)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     the size of attributes when parsing MFT. A local attacker could possibly use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-26544)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2809-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-     SSP A-MSDU frames to inject arbitrary network packets (bsc#1185861).
    - CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks     (bsc#1206992).
    - CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
    - CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
    - CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
    - CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an     attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
    - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
    - CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with     capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount     into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system     (bsc#1209615).
    - CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause     system crashes (bsc#1207168).
    - CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
    - CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the     io_uring subcomponent (bsc#1207521).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
    - CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption     (bsc#1208600).
    - CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash     the system (bsc#1209039).
    - CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
    - CVE-2023-1583: Fixed a NULL pointer dereference in io_file_bitmap_get in io_uring/filetable.c     (bsc#1209637).
    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779, bsc#1198400).
    - CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul     in fs/nfsd/nfs4proc.c (bsc#1209788).
    - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could     use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
    - CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a     local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).
    - CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
    - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
    - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
    - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands,     compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
    - CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-     wrapper.S (bsc#1212155).
    - CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c     (bsc#1211654).
    - CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c     in RDMA (bsc#1210629).
    - CVE-2023-2235: Fixed a use-after-free vulnerability in the Performance Events system that could have     been exploited to achieve local privilege escalation (bsc#1210986).
    - CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting     in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
    - CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
    - CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
    - CVE-2023-23001: Fixed misinterpretation of regulator_get return value in drivers/scsi/ufs/ufs-mediatek.c     (bsc#1208829).
    - CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
    - CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
    - CVE-2023-23454: Fixed a type confusion bug in the CBQ network scheduler which could lead to a use-after-     free (bsc#1207036).
    - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type     confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid     classification results) (bsc#1207125).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
    - CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
    - CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
    - CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some     Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable     escalation of privilege via local access (bsc#1211263).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/uetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28866: Fixed an out-of-bounds access in net/bluetooth/hci_sync.c because amp_init1[] and     amp_init2[] are supposed to have an intentionally invalid element, but did not (bsc#1209780).
    - CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or     Spectre-BHB, for the new hw AmpereOne (bsc#1211855, bsc#1205153).
    - CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks     for CR0 and CR4 (bsc#1210294).
    - CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove     (bsc#1210329).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed     local attackers to crash the system at device disconnect (bsc#1212129).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
    - CVE-2023-3220: Fixed a NULL pointer dereference flaw in dpu_crtc_atomic_check in     drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() (bsc#1212556).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).
    - CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver     (bsc#1212606).
    - CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the     vmwgfx driver (bsc#1211593).
    - CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the     vmwgfx driver (bsc#1211595).
    - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via     TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
    - CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
    - CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in     drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
    - CVE-2023-35829: Fixed a use-after-free flaw in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c     (bsc#1212495).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001730 advisory.

    In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to     a logic error in the code. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-260821414References: Upstream kernel

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5091 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE     (CVE-2023-3610)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

    * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

    * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free     (CVE-2023-4147)

    * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593)

    * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.2.z3 Batch (BZ#2228482)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5069 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (5.14.0).

    Security Fix(es):

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE     (CVE-2023-3610)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

    * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

    * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free     (CVE-2023-4147)

    * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593)

    * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [Intel 9.3 BUG] [SPR][EMR][FHF] ACPI: Fix system hang during S3 wakeup (BZ#2218026)

    * [Dell 9.2 BUG] Monitor lost after replug WD19TBS to SUT port wiith VGA/DVI to type-C dongle (BZ#2219463)

    * rtmutex: Incorrect waiter woken when requeueing in rt_mutex_adjust_prio_chain() (BZ#2222121)

    * RHEL AWS ARM Instability During Microshift e2e tests (BZ#2223310)

    * RHEL 9.x updates for SEV-SNP guest support (BZ#2224587)

    * Lock state corruption from nested rtmutex blocking in blk_flush_plug() (BZ#2225623)

    * bpf_jit_limit hit again - copy_seccomp() fix (BZ#2226945)

    * libceph: harden msgr2.1 frame segment length checks (BZ#2227070)

    * Temporary values used for the FIPS integrity test should be zeroized after use (BZ#2227768)

    * Important iavf bug fixes July 2023 (BZ#2228156)

    * [i40e/ice] error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0:
    Resource temporarily unavailable (BZ#2228158)

    * lvconvert --splitcache, --uncache operations getting hung (BZ#2228481)

    * perf: EMR core and uncore PMU support (BZ#2230175)

    * NVIDIA - Grace: Backport i2c: tegra: Set ACPI node as primary fwnode (BZ#2230483)

    * NVIDIA - Grace: Backport i2c: tegra: Fix PEC support for SMBUS block read (BZ#2230488)

    * [Hyper-V][RHEL 9]incomplete fc_transport implementation in storvsc causes null dereference in     fc_timed_out() (BZ#2230747)

    * Kernel config option CONFIG_CRYPTO_STATS should be disabled until it is enhanced (BZ#2231850)

    * [RHEL 9][Hyper-V]Excessive hv_storvsc driver logging with srb_status  SRB_STATUS_INTERNAL_ERROR  (0x30)     (BZ#2231990)

    * RHEL-9: WARNING: bad unlock balance detected! (BZ#2232213)

    * NVIDIA - Grace: Backport drm/ast patch expected for kernel 6.4 (BZ#2232302)

    * [Lenovo 9.1 bug]   RHEL 9 will hang when echo c > /proc/sysrq-trigger. (BZ#2232700)

    * [RHEL-9] bz2022169 in /kernel/general/process/reg-suit fails on aarch64  (/proc/[pid]/wchan broken)     (BZ#2233928)

    Enhancement(s):

    * [Intel 9.3 FEAT] cpufreq: intel_pstate: Enable HWP IO boost for all servers (BZ#2210270)

    * [Dell 9.3 FEAT] - New MB with AMP Codec Change on Maya Bay (audio driver) (BZ#2218960)

    * [Lenovo 9.3 FEAT] MDRAID - Update to the latest upstream (BZ#2221170)

    * [Intel 9.3 FEAT] [EMR] Add EMR support to uncore-frequency driver (BZ#2230169)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5069 advisory.

  - A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to     a logic error in the code. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-260821414References: Upstream kernel (CVE-2023-21102)

  - Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in     the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend     upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. (CVE-2023-3610)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

  - A use-after-free flaw was found in the Linux kernel's Netfilter functionality when adding a rule with     NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
    (CVE-2023-4147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:5091 advisory.

  - A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to     a logic error in the code. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-260821414References: Upstream kernel (CVE-2023-21102)

  - Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in     the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend     upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. (CVE-2023-3610)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

  - A use-after-free flaw was found in the Linux kernel's Netfilter functionality when adding a rule with     NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
    (CVE-2023-4147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2820-1 advisory.

  - In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON     condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a     type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing     memory corruption. (CVE-2023-1077)

  - A use-after-free flaw was found in the Linux kernel's core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 (coredump: Use the vma snapshot in fill_files_note) not     applied yet, then kernel could be affected. (CVE-2023-1249)

  - A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
    We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

  - In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to     a logic error in the code. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-260821414References: Upstream kernel (CVE-2023-21102)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

  - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

  - A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and     font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds     occurs leading to undefined behavior and possible denial of service. (CVE-2023-3161)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw     allows a local user to crash the system. (CVE-2023-3357)

  - A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue     could allow a local user to crash the system. (CVE-2023-3358)

  - A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a     hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for     5.15 stable). (CVE-2023-3389)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c. (CVE-2023-35823)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in     renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. (CVE-2023-35828)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in     drivers/staging/media/rkvdec/rkvdec.c. (CVE-2023-35829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6096-1 advisory.

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer     dereference in some situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-4842)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could     use this to cause a denial of service (system crash). (CVE-2022-48423)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer     lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a     denial of service (system crash). (CVE-2023-0210)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in     some situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2023-1652)

    It was discovered that the ARM64 EFI runtime services implementation in the Linux kernel did not properly     manage concurrency calls. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-21102)

    It was discovered that a race condition existed in Adreno GPU DRM driver in the Linux kernel, leading to a     double-free vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-21106)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained     a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23454)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     the size of attributes when parsing MFT. A local attacker could possibly use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-26544)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6134-1 advisory.

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel did not     properly perform filter deactivation in some situations. A local attacker could possibly use this to gain     elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier     has been removed. (CVE-2023-1829)

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2023-1281)

    It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up     operation in some conditions. A local attacker could possibly use this to gain elevated privileges.
    (CVE-2023-0386)

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer     dereference in some situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-4842)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in     some situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2023-1652)

    It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-1872)

    It was discovered that the Android Binder IPC subsystem in the Linux kernel did not properly validate     inputs in some situations, leading to a use- after-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-20938)

    It was discovered that the ARM64 EFI runtime services implementation in the Linux kernel did not properly     manage concurrency calls. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-21102)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
178321	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2831-1)	Nessus	SuSE Local Security Checks	2023/7/15	2023/7/15	high
292628	MiracleLinux 9 : kernel-5.14.0-284.30.1.el9_2 (AXSA:2023-6421:25)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/5	high
175914	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6079-1)	Nessus	Ubuntu Local Security Checks	2023/5/17	2024/8/27	high
176089	Ubuntu 22.10 : Linux kernel vulnerabilities (USN-6091-1)	Nessus	Ubuntu Local Security Checks	2023/5/18	2024/8/28	high
178179	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2809-1)	Nessus	SuSE Local Security Checks	2023/7/12	2025/9/25	high
284579	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001730)	Nessus	Unity Linux Local Security Checks	2026/1/14	2026/1/14	high
181283	RHEL 9 : kernel-rt (RHSA-2023:5091)	Nessus	Red Hat Local Security Checks	2023/9/12	2025/3/31	critical
181279	RHEL 9 : kernel (RHSA-2023:5069)	Nessus	Red Hat Local Security Checks	2023/9/12	2025/3/31	critical
181428	AlmaLinux 9 : kernel (ALSA-2023:5069)	Nessus	Alma Linux Local Security Checks	2023/9/14	2025/3/31	high
181630	Rocky Linux 9 : kernel-rt (RLSA-2023:5091)	Nessus	Rocky Linux Local Security Checks	2023/9/19	2025/3/31	high
178303	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2820-1)	Nessus	SuSE Local Security Checks	2023/7/14	2023/7/14	high
176226	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6096-1)	Nessus	Ubuntu Local Security Checks	2023/5/23	2024/8/27	high
176616	Ubuntu 20.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6134-1)	Nessus	Ubuntu Local Security Checks	2023/6/2	2025/7/4	high

检测

插件搜索

high

high

high

high

high

high

critical

critical

high

high

high

high

high