The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6014-1 advisory.

    Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux     kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of     service (connection termination) or inject forged data. (CVE-2020-36516)

    Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira     Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient     in some situations. A local attacker could possibly use this to expose sensitive information.
    (CVE-2021-26401)

    Jrgen Gro discovered that the Xen subsystem within the Linux kernel did not adequately limit the     number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a     driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28711,     CVE-2021-28712, CVE-2021-28713)

    Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an     integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious     ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

    It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly     handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private     clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

    It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs     in some situations. A remote attacker could possibly use this to cause a denial of service (connection     disassociation). (CVE-2021-3772)

    It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle     locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel     deadlock). (CVE-2021-4149)

    Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when     handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2021-4203)

    It was discovered that the file system quotas implementation in the Linux kernel did not properly validate     the quota block number. An attacker could use this to construct a malicious file system image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

    Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device     removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-0487)

    It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in     some situations. A privileged local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-0494)

    It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference     a null pointer in some situations. An attacker could use this to construct a malicious UDF image that,     when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

    David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some     situations. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2022-1016)

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the tty subsystem in the Linux kernel contained a race condition in certain     situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to     cause a denial of service (system crash) or expose sensitive information. (CVE-2022-1462)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-     free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-1974)

    Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context     switches from occurring during certain atomic context operations. A privileged local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1975)

    It was discovered that the HID subsystem in the Linux kernel did not properly validate inputs in certain     conditions. A local attacker with physical access could plug in a specially crafted USB device to expose     sensitive information. (CVE-2022-20132)

    It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly     verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20572, CVE-2022-2503)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel     incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this     to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

    Lucas Leong discovered that the LightNVM subsystem in the Linux kernel did not properly handle data     lengths in certain situations. A privileged attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-2991)

    It was discovered that the Intel 740 frame buffer driver in the Linux kernel contained a divide by zero     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-3061)

    Jiasheng Jiang discovered that the wm8350 charger driver in the Linux kernel did not properly deallocate     memory, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash). (CVE-2022-3111)

    It was discovered that the sound subsystem in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. An attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2022-3646)

    It was discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a     reference counting error. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36879)

    It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A     local attacker with physical access could plug in a specially crafted USB device to cause a denial of     service (memory exhaustion). (CVE-2022-3903)

    Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain     situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-39188)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset     events. A local attacker with physical access could plug in a specially crafted USB device to cause a     denial of service (kernel deadlock). (CVE-2022-4662)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data     structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a     denial of service (system crash). (CVE-2023-1095)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
    (CVE-2023-26607)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1031 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.

    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2024-0565:
    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.



    CVE-2023-6610:
    An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6606:
    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6121:
    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

    CVE-2023-52600:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix uaf in jfs_evict_inode

    When the execution of diMount(ipimap) fails, the object ipimap that has been     released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs     when rcu_core() calls jfs_free_node().

    Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as     ipimap.

    CVE-2023-52599:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix array-index-out-of-bounds in diNewExt

    [Syz report]     UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2     index -878706688 is out of range for type 'struct iagctl[128]'     CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106      ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348      diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360      diAllocExt fs/jfs/jfs_imap.c:1949 [inline]      diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666      diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587      ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56      jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225      vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106      do_mkdirat+0x264/0x3a0 fs/namei.c:4129
     __do_sys_mkdir fs/namei.c:4149 [inline]
     __se_sys_mkdir fs/namei.c:4147 [inline]
     __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147      do_syscall_x64 arch/x86/entry/common.c:51 [inline]      do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82      entry_SYSCALL_64_after_hwframe+0x63/0x6b     RIP: 0033:0x7fcb7e6a0b57     Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053     RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57     RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140     RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

    [Analysis]     When the agstart is too large, it can cause agno overflow.

    [Fix]     After obtaining agno, if the value is invalid, exit the subsequent process.


    Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next     report by kernel test robot (Dan Carpenter).

    CVE-2023-52591:
    In the Linux kernel, the following vulnerability has been resolved:

    reiserfs: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change reiserfs rename code to avoid touching renamed directory     if its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52590:
    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change ocfs2 rename code to avoid touching renamed directory if     its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52583:
    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix deadlock or deadcode of misusing dget()

    The lock order is incorrect between denty and its parent, we should     always make sure that the parent get the lock first.

    But since this deadcode is never used and the parent dir will always     be set from the callers, let's just remove it.

    CVE-2023-26607:
    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

    CVE-2023-1611:
    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea

    CVE-2022-45919:
    An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

    CVE-2022-45886:
    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.

    CVE-2022-42329:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2022-3606:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.

    CVE-2022-20423:
    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel

    CVE-2022-0480:
    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks.

    CVE-2021-46972:
    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry

    Since commit 6815f479ca90 (ovl: use only uppermetacopy state in     ovl_lookup()), overlayfs doesn't put temporary dentry when there is a     metacopy error, which leads to dentry leaks when shutting down the related     superblock:

    overlayfs: refusing to follow metacopy origin for (/file0)     ...
    BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]     ...
    WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d     CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1     ...
    RIP: 0010:umount_check.cold+0x107/0x14d     ...
    Call Trace:
     d_walk+0x28c/0x950      ? dentry_lru_isolate+0x2b0/0x2b0      ? __kasan_slab_free+0x12/0x20      do_one_tree+0x33/0x60      shrink_dcache_for_umount+0x78/0x1d0      generic_shutdown_super+0x70/0x440      kill_anon_super+0x3e/0x70      deactivate_locked_super+0xc4/0x160      deactivate_super+0xfa/0x140      cleanup_mnt+0x22e/0x370
     __cleanup_mnt+0x1a/0x30      task_work_run+0x139/0x210      do_exit+0xb0c/0x2820      ? __kasan_check_read+0x1d/0x30      ? find_held_lock+0x35/0x160      ? lock_release+0x1b6/0x660      ? mm_update_next_owner+0xa20/0xa20      ? reacquire_held_locks+0x3f0/0x3f0      ? __sanitizer_cov_trace_const_cmp4+0x22/0x30      do_group_exit+0x135/0x380
     __do_sys_exit_group.isra.0+0x20/0x20
     __x64_sys_exit_group+0x3c/0x50      do_syscall_64+0x45/0x70      entry_SYSCALL_64_after_hwframe+0x44/0xae     ...
    VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

    This fix has been tested with a syzkaller reproducer.

    CVE-2021-4083:
    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4.

    CVE-2021-3739:
    A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the     Linux Kernel, where triggering the bug requires CAP_SYS_ADMIN. This flaw allows a local attacker to     crash the system or leak kernel internal information. The highest threat from this vulnerability is to     system availability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1026 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.

    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2024-0565:
    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.



    CVE-2023-6610:
    An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6606:
    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6121:
    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

    CVE-2023-52600:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix uaf in jfs_evict_inode

    When the execution of diMount(ipimap) fails, the object ipimap that has been     released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs     when rcu_core() calls jfs_free_node().

    Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as     ipimap.

    CVE-2023-52599:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix array-index-out-of-bounds in diNewExt

    [Syz report]     UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2     index -878706688 is out of range for type 'struct iagctl[128]'     CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106      ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348      diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360      diAllocExt fs/jfs/jfs_imap.c:1949 [inline]      diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666      diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587      ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56      jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225      vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106      do_mkdirat+0x264/0x3a0 fs/namei.c:4129
     __do_sys_mkdir fs/namei.c:4149 [inline]
     __se_sys_mkdir fs/namei.c:4147 [inline]
     __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147      do_syscall_x64 arch/x86/entry/common.c:51 [inline]      do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82      entry_SYSCALL_64_after_hwframe+0x63/0x6b     RIP: 0033:0x7fcb7e6a0b57     Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053     RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57     RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140     RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

    [Analysis]     When the agstart is too large, it can cause agno overflow.

    [Fix]     After obtaining agno, if the value is invalid, exit the subsequent process.


    Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next     report by kernel test robot (Dan Carpenter).

    CVE-2023-52591:
    In the Linux kernel, the following vulnerability has been resolved:

    reiserfs: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change reiserfs rename code to avoid touching renamed directory     if its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52590:
    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change ocfs2 rename code to avoid touching renamed directory if     its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52583:
    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix deadlock or deadcode of misusing dget()

    The lock order is incorrect between denty and its parent, we should     always make sure that the parent get the lock first.

    But since this deadcode is never used and the parent dir will always     be set from the callers, let's just remove it.

    CVE-2023-26607:
    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

    CVE-2023-1611:
    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea

    CVE-2022-45919:
    An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

    CVE-2022-45886:
    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.

    CVE-2022-42329:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2022-3606:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.

    CVE-2022-20423:
    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel

    CVE-2022-0480:
    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks.

    CVE-2021-46972:
    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry

    Since commit 6815f479ca90 (ovl: use only uppermetacopy state in     ovl_lookup()), overlayfs doesn't put temporary dentry when there is a     metacopy error, which leads to dentry leaks when shutting down the related     superblock:

    overlayfs: refusing to follow metacopy origin for (/file0)     ...
    BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]     ...
    WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d     CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1     ...
    RIP: 0010:umount_check.cold+0x107/0x14d     ...
    Call Trace:
     d_walk+0x28c/0x950      ? dentry_lru_isolate+0x2b0/0x2b0      ? __kasan_slab_free+0x12/0x20      do_one_tree+0x33/0x60      shrink_dcache_for_umount+0x78/0x1d0      generic_shutdown_super+0x70/0x440      kill_anon_super+0x3e/0x70      deactivate_locked_super+0xc4/0x160      deactivate_super+0xfa/0x140      cleanup_mnt+0x22e/0x370
     __cleanup_mnt+0x1a/0x30      task_work_run+0x139/0x210      do_exit+0xb0c/0x2820      ? __kasan_check_read+0x1d/0x30      ? find_held_lock+0x35/0x160      ? lock_release+0x1b6/0x660      ? mm_update_next_owner+0xa20/0xa20      ? reacquire_held_locks+0x3f0/0x3f0      ? __sanitizer_cov_trace_const_cmp4+0x22/0x30      do_group_exit+0x135/0x380
     __do_sys_exit_group.isra.0+0x20/0x20
     __x64_sys_exit_group+0x3c/0x50      do_syscall_64+0x45/0x70      entry_SYSCALL_64_after_hwframe+0x44/0xae     ...
    VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

    This fix has been tested with a syzkaller reproducer.

    CVE-2021-4083:
    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4.

    CVE-2021-3739:
    A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the     Linux Kernel, where triggering the bug requires CAP_SYS_ADMIN. This flaw allows a local attacker to     crash the system or leak kernel internal information. The highest threat from this vulnerability is to     system availability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.301-224.520. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1903 advisory.

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

    A use-after-free flaw was found in the Linux kernel's implementation of logical link control and     adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_connect and l2cap_le_connect_req     functions. An attacker with physical access within the range of standard Bluetooth transmission could     execute code leaking kernel memory via Bluetooth if within proximity of the victim. (CVE-2022-42896)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (CVE-2022-49002)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (CVE-2022-49007)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hsr: Fix potential use-after-free (CVE-2022-49015)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: fix null-ptr-deref while probe() failed (CVE-2022-49021)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (CVE-2022-49033)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: check overflow when iterating ATTR_RECORDs (CVE-2022-49762)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: fix use-after-free in ntfs_attr_find() (CVE-2022-49763)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Check sb_bsize_shift after reading superblock (CVE-2022-49769)

    In the Linux kernel, the following vulnerability has been resolved:

    dm ioctl: fix misbehavior if list_versions races with module loading (CVE-2022-49771)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: enforce a consistent minimal mtu (CVE-2022-49776)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (CVE-2022-49787)

    In the Linux kernel, the following vulnerability has been resolved:

    misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix null pointer dereference in ftrace_add_mod() (CVE-2022-49802)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: use after free in drbd_create_device() (CVE-2022-49811)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: close race conditions on sk_receive_queue (CVE-2022-49814)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (CVE-2022-49832)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free bug of ns_writer on remount (CVE-2022-49834)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (CVE-2022-49840)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: core: Fix use-after-free in snd_soc_exit() (CVE-2022-49842)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix deadlock in nilfs_count_free_blocks() (CVE-2022-49850)

    In the Linux kernel, the following vulnerability has been resolved:

    net: macvlan: fix memory leaks of macvlan_common_newlink (CVE-2022-49853)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (CVE-2022-49862)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (CVE-2022-49865)

    In the Linux kernel, the following vulnerability has been resolved:

    capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (CVE-2022-49870)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gso: fix panic on frag_list with mixed head alloc types (CVE-2022-49872)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hyperv: fix possible memory leak in mousevsc_probe() (CVE-2022-49874)

    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
    (CVE-2023-26607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
174228	Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-6014-1)	Nessus	Ubuntu Local Security Checks	2023/4/13	2024/8/27	high
244143	Linux Distros Unpatched Vulnerability : CVE-2023-26607	Nessus	Misc.	2025/8/6	2026/1/15	high
240010	TencentOS Server 2: kernel (TSSA-2024:1031)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/23	high
276182	TencentOS Server 3: kernel (TSSA-2024:1026)	Nessus	Tencent Local Security Checks	2025/11/20	2026/3/11	high
168676	Amazon Linux 2 : kernel (ALAS-2022-1903)	Nessus	Amazon Linux Local Security Checks	2022/12/13	2026/2/24	high

检测

插件搜索

high

high

high

high

high