The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5480 advisory.

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking     configuration (redirecting egress packets to ingress using TC action mirred) a local unprivileged user     could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a     retransmission, resulting in a denial of service condition. (CVE-2022-4269)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur     when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading     to a denial of service. (CVE-2023-1380)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper     locking when performing operations on an object. An attacker can leverage this in conjunction with other     vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.
    (CVE-2023-2007)

  - A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation. (CVE-2023-21255)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel.
    This flaw allows a local privileged user to cause a denial of service problem. (CVE-2023-2898)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue     could allow a remote user to crash the system. (CVE-2023-3338)

  - A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a     hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for     5.15 stable). (CVE-2023-3389)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

  - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before     6.4.10. There is a use-after-free because the children of an sk are mishandled. (CVE-2023-40283)

  - A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

  - A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition. (CVE-2023-4132)

  - A use-after-free flaw was found in the Linux kernel's Netfilter functionality when adding a rule with     NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
    (CVE-2023-4147)

  - A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

  - A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

  - XSA-432 xen: Buffer overrun in netback due to unusual packet [fedora-all] (CVE-2023-34319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6338-1 advisory.

    Zi Fan Tan discovered that the binder IPC implementation in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-21255)

    It was discovered that a race condition existed in the f2fs file system in the Linux kernel, leading to a     null pointer dereference vulnerability. An attacker could use this to construct a malicious f2fs image     that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-2898)

    It was discovered that the DVB Core driver in the Linux kernel did not properly handle locking events in     certain situations. A local attacker could use this to cause a denial of service (kernel deadlock).
    (CVE-2023-31084)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly handle     session setup requests. A remote attacker could possibly use this to cause a denial of service (memory     exhaustion). (CVE-2023-32247)

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel     when handling sessions operations. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

    It was discovered that a race condition existed in the KSMBD implementation in the Linux kernel when     handling session connections, leading to a use- after-free vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32258)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes     in certain operations, leading to an out-of- bounds read vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38426,     CVE-2023-38428)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly calculate the size of     certain buffers. A remote attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-38429)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6344-1 advisory.

    Zi Fan Tan discovered that the binder IPC implementation in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-21255)

    It was discovered that a race condition existed in the f2fs file system in the Linux kernel, leading to a     null pointer dereference vulnerability. An attacker could use this to construct a malicious f2fs image     that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-2898)

    It was discovered that the DVB Core driver in the Linux kernel did not properly handle locking events in     certain situations. A local attacker could use this to cause a denial of service (kernel deadlock).
    (CVE-2023-31084)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly handle     session setup requests. A remote attacker could possibly use this to cause a denial of service (memory     exhaustion). (CVE-2023-32247)

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel     when handling sessions operations. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

    It was discovered that a race condition existed in the KSMBD implementation in the Linux kernel when     handling session connections, leading to a use- after-free vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32258)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes     in certain operations, leading to an out-of- bounds read vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38426,     CVE-2023-38428)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly calculate the size of     certain buffers. A remote attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-38429)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6338-2 advisory.

    Zi Fan Tan discovered that the binder IPC implementation in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-21255)

    It was discovered that a race condition existed in the f2fs file system in the Linux kernel, leading to a     null pointer dereference vulnerability. An attacker could use this to construct a malicious f2fs image     that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-2898)

    It was discovered that the DVB Core driver in the Linux kernel did not properly handle locking events in     certain situations. A local attacker could use this to cause a denial of service (kernel deadlock).
    (CVE-2023-31084)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly handle     session setup requests. A remote attacker could possibly use this to cause a denial of service (memory     exhaustion). (CVE-2023-32247)

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel     when handling sessions operations. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

    It was discovered that a race condition existed in the KSMBD implementation in the Linux kernel when     handling session connections, leading to a use- after-free vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32258)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes     in certain operations, leading to an out-of- bounds read vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38426,     CVE-2023-38428)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly calculate the size of     certain buffers. A remote attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-38429)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5492 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2023-1206 It was discovered that the networking stack permits     attackers to force hash collisions in the IPv6 connection lookup table, which may result in denial of     service (significant increase in the cost of lookups, increased CPU utilization). CVE-2023-1989 Zheng Wang     reported a race condition in the btsdio Bluetooth adapter driver that can lead to a use-after-free. An     attacker able to insert and remove SDIO devices can use this to cause a denial of service (crash or memory     corruption) or possibly to run arbitrary code in the kernel. CVE-2023-2430 Xingyuan Mo discovered that the     io_uring subsystem did not properly handle locking when the target ring is configured with IOPOLL, which     may result in denial of service. CVE-2023-2898 It was discovered that missing sanitising in the f2fs file     system may result in denial of service if a malformed file system is accessed. CVE-2023-3611 It was     discovered that an out-of-bounds write in the traffic control subsystem for the Quick Fair Queueing     scheduler (QFQ) may result in denial of service or privilege escalation. CVE-2023-3772 Lin Ma discovered a     NULL pointer dereference flaw in the XFRM subsystem which may result in denial of service. CVE-2023-3773     Lin Ma discovered a flaw in the XFRM subsystem, which may result in denial of service for a user with the     CAP_NET_ADMIN capability in any user or network namespace. CVE-2023-3776, CVE-2023-4128, CVE-2023-4206,     CVE-2023-4207, CVE-2023-4208 It was discovered that a use-after-free in the cls_fw, cls_u32 and cls_route     network classifiers may result in denial of service or potential local privilege escalation. CVE-2023-3777     Kevin Rich discovered a use-after-free in Netfilter when flushing table rules, which may result in local     privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.
    CVE-2023-3863 It was discovered that a use-after-free in the NFC implementation may result in denial of     service, an information leak or potential local privilege escalation. CVE-2023-4004 It was discovered that     a use-after-free in Netfilter's implementation of PIPAPO (PIle PAcket POlicies) may result in denial of     service or potential local privilege escalation for a user with the CAP_NET_ADMIN capability in any user     or network namespace. CVE-2023-4015 Kevin Rich discovered a use-after-free in Netfilter when handling     bound chain deactivation in certain circumstances, may result in denial of service or potential local     privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.
    CVE-2023-4132 A use-after-free in the driver for Siano SMS1xxx based MDTV receivers may result in local     denial of service. CVE-2023-4147 Kevin Rich discovered a use-after-free in Netfilter when adding a rule     with NFTA_RULE_CHAIN_ID, which may result in local privilege escalation for a user with the CAP_NET_ADMIN     capability in any user or network namespace. CVE-2023-4155 Andy Nguyen discovered a flaw in the KVM     subsystem allowing a KVM guest using EV-ES or SEV-SNP to cause a denial of service. CVE-2023-4194 A type     confusion in the implementation of TUN/TAP network devices may allow a local user to bypass network     filters. CVE-2023-4273 Maxim Suhanov discovered a stack overflow in the exFAT driver, which may result in     local denial of service via a malformed file system. CVE-2023-4569 lonial con discovered flaw in the     Netfilter subsystem, which may allow a local attacker to cause a double-deactivations of catchall     elements, which results in a memory leak. CVE-2023-4622 Bing-Jhong Billy Jheng discovered a use-after-free     within the Unix domain sockets component, which may result in local privilege escalation. CVE-2023-20588     Jana Hofmann, Emanuele Vannacci, Cedric Fournet, Boris Koepf and Oleksii Oleksenko discovered that on some     AMD CPUs with the Zen1 micro architecture an integer division by zero may leave stale quotient data from a     previous division, resulting in a potential leak of sensitive data. CVE-2023-34319 Ross Lagerwall     discovered a buffer overrun in Xen's netback driver which may allow a Xen guest to cause denial of service     to the virtualisation host my sending malformed packets. CVE-2023-40283 A use-after-free was discovered in     Bluetooth L2CAP socket handling. For the stable distribution (bookworm), these problems have been fixed in     version 6.1.52-1. This update is released without armel builds. Changes in the new stable series import     cause a substantial increase of the compressed image for marvell flavour. This issue will be addressed in     a future linux update. We recommend that you upgrade your linux packages. For the detailed security status     of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程 Debian 12 主机上安装的多个程序包受到 dsa-5492 公告中提及的多个漏洞影响。

  - 当用户进行新类型的 SYN 洪流攻击时，在 Linux 内核的 IPv6 功能的 IPv6 连接查找表中发现一个哈希冲突缺陷。位于本地网络或具有高带宽连接的用户可将接受 IPV6 连接的服务器的 CPU 使用率提高到 95%。(CVE-2023-1206)

  - 在 Linux 内核中 drivers\bluetooth\btsdio.c 的 btsdio_remove 中发现了一个释放后使用缺陷。在此缺陷中，若使用未完成的作业调用 btsdio_remove，可能会造成争用问题，从而在 hdev 设备上导致 UAF。(CVE-2023-1989)

  - 某些 AMD 处理器上的“除以零”错误可能会返回推测数据，进而导致机密泄露。(CVE-2023-20588)

  - 发现一个漏洞，原因是 Linux 内核中 io_uring.c 的 io_cqring_event_overflow() 中的 IOPOLL 缺陷造成缺少锁定。具有用户权限的本地攻击者可利用此缺陷触发拒绝服务威胁。(CVE-2023-2430)

  - 在 Linux 内核的 fs/f2fs/data.c 中，发现 f2fs_write_end_io 中存在空指针取消引用缺陷。
    本地特权用户可利用此缺陷造成拒绝服务问题。(CVE-2023-2898)

  - Linux 内核的 net/sched: sch_qfq 组件中存在越界写入漏洞，攻击者可利用此漏洞提升本地特权。net/sched/sch_qfq.c 中的 qfq_change_agg() 函数允许越界写入，这是因为 lmax 会根据数据包大小在无边界检查的情况下更新。建议升级过去的 commit 3e337087c3b5805fe0b8a46ba622a962880b5d64。(CVE-2023-3611)

  - 在 Linux 内核的用于转换数据包的 IP 框架（XFRM 子系统）中发现一个缺陷。此问题可能允许具有 CAP_NET_ADMIN 权限的恶意用户直接取消引用 xfrm_update_ae_params() 中的空指针，从而可能导致内核崩溃和拒绝服务。(CVE-2023-3772)

  - 在 Linux 内核的用于转换数据包的 IP 框架（XFRM 子系统）中发现一个缺陷。此问题可能允许具有 CAP_NET_ADMIN 权限的恶意用户在解析 netlink 属性时造成 XFRMA_MTIMER_THRESH 的 4 字节越界读取，从而导致敏感堆数据可能泄漏到用户空间。(CVE-2023-3773)

  - Linux 内核的  net/sched 中存在释放后使用漏洞：cls_fw 组件中存在释放后使用漏洞，攻击者可利用此漏洞提升本地特权。如果 tcf_change_indev() 失败，fw_set_parms() 将在增加或减少 tcf_bind_filter() 中的引用计数器之后立即返回错误。如果攻击者可以控制引用计数器并将其设置为零，则可导致引用被释放，从而造成释放后使用漏洞。建议升级过去的 commit 0323bce598eea038714f941ce2b22541c46d488f。
    (CVE-2023-3776)

  - Linux 内核的 netfilter 中存在释放后使用漏洞：可利用 nf_tables 组件实现本地权限升级。当 nf_tables_delrule() 刷新表规则时，未检查是否绑定链，并且链的所有者规则在某些情况下也可以释放对象。我们建议升级过去的提交 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8。
    (CVE-2023-3777)

  - 在 Linux 内核的 NFC 中，发现 net/nfc/llcp_core.c 的 nfc_llcp_find_local 中存在释放后使用缺陷。
    具有特殊特权的本地用户可利用此缺陷造成内核信息泄漏问题。
    (CVE-2023-3863)

  - 在用户触发包含元素（无 NFT_SET_EXT_KEY_END）的 nft_pipapo_remove 函数的方式中，发现 Linux 内核的 netfilter 中存在释放后使用缺陷。本地用户可以利用此问题造成系统崩溃，或可能提升其在系统中的权限。(CVE-2023-4004)

  - Linux 内核的 netfilter 中存在释放后使用漏洞：可利用 nf_tables 组件实现本地权限升级。在构建 nftables 规则出错时，停用 nft_immediate_deactivate() 中的立即表达式可导致解除绑定链，而对象遭停用后又被使用。建议升级过去的提交 0a771f7b266b02d262900c75f1e175c7fe76fec2。(CVE-2023-4015)

  - 在 6.4.10 之前版本 Linux 内核 net/bluetooth/l2cap_sock.c 内的 l2cap_sock_release 中发现问题。由于 sk 的子项目处理不当，导致存在释放后使用问题。(CVE-2023-40283)

  - 在 Linux 内核的分类器（cls_fw、cls_u32 和 cls_route）中的  net/sched/cls_fw.c 中发现释放后使用缺陷。由于未正确处理现有过滤器，导致本地攻击者可利用此缺陷执行本地权限升级，从而造成内核信息泄漏问题。 (CVE-2023-4128)

  - 在 Linux 内核的 siano smsusb 模块中发现释放后使用漏洞。插入 siano 设备时，设备初始化期间会发生此缺陷。本地用户可利用此缺陷导致系统崩溃，从而造成拒绝服务情况。(CVE-2023-4132)

  - 添加含有 NFTA_RULE_CHAIN_ID 的规则时，在 Linux 内核的 Netfilter  功能中发现释放后使用缺陷。本地用户可利用此缺陷导致系统崩溃或升级其系统权限。
    (CVE-2023-4147)

  - Linux 内核的 TUN/TAP 功能中发现缺陷。本地用户可以利用此问题绕过绕过网络过滤器，并获取某些资源未经授权的访问权限。修复 CVE-2023-1076 的原始修补程序并不正确或并不完整。问题在于下列上游提交 - a096ccca6e50 (tun：tun_chr_open()：正确初始化套接字 UID）、66b2c338adce（tap：tap_open()：
    正确初始化套接字 UID），在将 inode->i_uid 作为最后一个参数传递至  sock_init_data_uid() 时发现结果并非准确无误。(CVE-2023-4194)

  - Linux 内核的  net/sched 中存在释放后使用漏洞：攻击者可利用 cls_route 组件中的漏洞提升本地特权。当在现有过滤器中调用 route4_change() 时，整个 tcf_result 结构会一律复制到过滤器的新实例中。更新绑定到类的过滤器时会引发一个问题，因为 tcf_unbind_filter() 一律会在成功路径中的旧实例上调用，从而减少仍在引用的类的 filter_cnt 并允许用户将其删除，造成释放后使用情形。我们建议升级过去的提交 b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8。
    (CVE-2023-4206)

  - Linux 内核的  net/sched 中存在释放后使用漏洞：cls_fw 组件中存在释放后使用漏洞，攻击者可利用此漏洞提升本地特权。当在现有过滤器中调用 fw_change() 时，整个 tcf_result 结构会一律复制到过滤器的新实例中。更新绑定到类的过滤器时会引发一个问题，因为 tcf_unbind_filter() 一律会在成功路径中的旧实例上调用，从而减少仍在引用的类的 filter_cnt 并允许用户将其删除，造成释放后使用情形。我们建议升级过去的提交 76e42ae831991c828cffa8c37736ebfb831ad5ec。(CVE-2023-4207)

  - Linux 内核的  net/sched 中存在释放后使用漏洞：cls_u32 组件中存在释放后使用漏洞，攻击者可利用此漏洞提升本地特权。当在现有过滤器中调用 u32_change() 时，整个 tcf_result 结构会一律复制到过滤器的新实例中。更新绑定到类的过滤器时会引发一个问题，因为 tcf_unbind_filter() 一律会在成功路径中的旧实例上调用，从而减少仍在引用的类的 filter_cnt 并允许用户将其删除，造成释放后使用情形。我们建议升级过去的提交 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81。
    (CVE-2023-4208)

  - 在 Linux 内核的 exFAT 驱动程序中发现一个缺陷。文件名重建函数的实现中存在一个漏洞，该函数负责从目录索引中读取文件名条目，并将属于一个文件的文件名部分合并为一个长文件名。由于文件名字符会复制到堆栈变量中，因此本地特权攻击者可利用此缺陷使内核堆栈溢出。(CVE-2023-4273)

  - 在 Linux 内核 net/netfilter/nf_tables_api.c 的  nft_set_catchall_flush 中发现内存泄露缺陷。本地攻击者可利用此问题造成 catchall 元素双重停用，从而导致内存泄漏。(CVE-2023-4569)

  - Linux 内核 af_unix 组件中存在一个释放后使用漏洞，攻击者可利用此漏洞以实现本地特权提升。在未锁定队列的情况下，unix_stream_sendpage() 函数尝试将数据添加至对等机 recv 队列中最后一个 skb 中。因此，在存在争用条件时，unix_stream_sendpage() 可在未锁定队列的情况下访问通过垃圾回收而释放的 skb，从而造成释放后使用情形。我们建议升级过去的提交 790c2f9d15b594350ae9bca7b236f2b1859de02c。(CVE-2023-4622)

  - 某些 AMD 处理器上的“除以零”错误可能会返回推测数据，进而导致机密泄露。(CVE-2023-20588) (CVE-2023-34319)

  - KVM：SEV-ES/SEV-SNP VMGEXIT 双重提取漏洞 [fedora-all] (CVE-2023-4155)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Debian 11 主机上安装的多个程序包受到 dsa-5480 公告中提及的多个漏洞影响。

  - 在版本低于 5.18.17 的 Linux 内核中的 x86 KVM 子系统中发现问题。非特权客户机用户可危害客户机内核，因为在某些 KVM_VCPU_PREEMPTED 情况下未正确处理 TLB 刷新操作。 (CVE-2022-39189)

  - 在 Linux 内核流量控制 (TC) 子系统中发现缺陷。使用特定网络配置（使用 TC 操作镜像将出口数据包重定向到入口）时，本地非特权用户可在使用中的传输协议（TCP 或 SCTP）进行重新传输时触发 CPU 软锁定（ABBA 死锁），从而导致拒绝服务条件。(CVE-2022-4269)

  - 当用户进行新类型的 SYN 洪流攻击时，在 Linux 内核的 IPv6 功能的 IPv6 连接查找表中发现一个哈希冲突缺陷。位于本地网络或具有高带宽连接的用户可将接受 IPV6 连接的服务器的 CPU 使用率提高到 95%。(CVE-2023-1206)

  - 在 Linux 内核的 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 的 brcmf_get_assoc_ies 中发现越界读取问题。当 assoc_info->req_len 数据大于定义为 WL_EXTRA_BUF_MAX 的缓冲区大小时，可能会发生此问题，从而导致拒绝服务。(CVE-2023-1380)

  - 在 HCI 套接字实现中发现一个漏洞，出现此漏洞的原因是 Linux 内核的 net/bluetooth/hci_sock.c 中缺少功能检查。此缺陷让攻击者可以在未经授权的情况下执行管理命令，从而危害蓝牙通信的机密性、完整性和可用性。(CVE-2023-2002)

  - DPT I2O 控制器驱动程序中存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞以及其他漏洞在内核环境中提升权限并执行任意代码。
    (CVE-2023-2007)

  - 某些 AMD 处理器上的“除以零”错误可能会返回推测数据，进而导致机密泄露。(CVE-2023-20588)

  - 在用户使用脏日志失败后还原 XFS 映像的方式中，在 Linux 内核的 XFS 文件系统中发现一个越界内存访问缺陷。本地用户可利用此缺陷导致系统崩溃或可能升级其系统权限。(CVE-2023-2124)

  - binder.c 的多个函数中可能存在因释放后使用而可能导致的内存损坏问题。这可能会导致本地权限提升，且无需其他执行权限。无需用户交互即可利用漏洞。(CVE-2023-21255)

  - io_uring.c 的多个函数中可能存在因不当锁定而可能导致的内核内存损坏问题。
    这可能会导致内核中本地权限的提升，并需要系统执行权限。
    无需用户交互即可利用漏洞。(CVE-2023-21400)

  - 发现可能因为存在递归锁定情形而产生的拒绝服务问题，导致 Linux 内核 Device Mapper Multipathing 子组件中 drivers/md/dm-ioctl.c 的 table_clear 发生死锁。(CVE-2023-2269)

  - 在 Linux 内核的 fs/f2fs/data.c 中，发现 f2fs_write_end_io 中存在空指针取消引用缺陷。
    本地特权用户可利用此缺陷造成拒绝服务问题。(CVE-2023-2898)

  - 可以利用 Linux 内核 ipvlan 网络驱动程序中的堆越界写入漏洞实现本地特权提升。出现越界写入的原因是 ipvlan 网络驱动程序中缺少 skb->cb 初始化。如果启用了 CONFIG_IPVLAN，则可利用此漏洞。我们建议升级过去的提交 90cbed5247439a966b645b34eb0a2e037836ea8e。(CVE-2023-3090)

  - 在 Linux 内核 6.2 的 drivers/media/dvb-core/dvb_frontend.c 中发现一个问题。当任务处于 !TASK_RUNNING 状态时，会发生阻止操作。在 dvb_frontend_get_event 中，调用 wait_event_interruptible；条件为 dvb_frontend_test_event(fepriv,events)。在 dvb_frontend_test_event 中，调用 down(&fepriv->sem)。但是，wait_event_interruptible 会使进程进入休眠状态，而 down(&fepriv->sem) 可能会阻断进程。(CVE-2023-31084)

  - 在 Linux 内核的 btrfs 内，在 fs/btrfs/relocation.c 中的 prepare_to_relocate 内发现一个释放后使用漏洞。通过在调用 btrfs_ioctl_defrag() 之前调用 btrfs_ioctl_balance()，可触发此潜在缺陷。(CVE-2023-3111)

  在 Linux 内核的 gfs2 文件系统中发现一个空指针取消引用问题。如果 evict 代码尝试在日志描述符结构被释放并被设置为 NULL 后引用该结构，损坏的 gfs2 文件系统上便会出现此问题。本地特权用户可利用此缺陷导致内核错误。
    (CVE-2023-3212)

  - 在 Linux 内核的中继文件中，在 kernel/relay.c 的 relay_file_read_start_pos 中发现一个越界 (OOB) 内存访问缺陷。此缺陷允许本地攻击者造成系统崩溃或泄露内核内部信息。(CVE-2023-3268)

  - 在 Linux 内核的 DECnet 网络中发现一个空指针取消引用缺陷。远程用户可以利用此问题造成系统崩溃。(CVE-2023-3338)

  - Linux 内核的 io_uring 子系统中存在释放后使用漏洞，攻击者可利用此漏洞实现本地特权提升。io_uring 取消轮询请求与链接的超时争用可导致 hrtimer 中发生 UAF。我们建议升级过去的提交 ef7dfac51d8ed961b742218f526bd589f3900a59（5.10 稳定版为 4716c73b188566865bdd79c3a6709696a224ac04，5.15 稳定版为 0e388fce7aec40992eadee654193cad345d62663）。(CVE-2023-3389)

  - 在 6.3.7 之前的 Linux 内核中发现 net/sched/cls_flower.c 内的 fl_set_geneve_opt 存在问题。
    借助 TCA_FLOWER_KEY_ENC_OPTS_GENEVE 数据包，此问题可造成花卉分类器代码出现越界写入。
    这可能导致拒绝服务或权限升级。(CVE-2023-35788)

  - Linux 内核的 net/sched: cls_u32 组件中存在释放后使用漏洞，攻击者可利用此漏洞提升本地特权。如果 tcf_change_indev() 失败，u32_set_parms() 将在增加或减少 tcf_bind_filter() 中的引用计数器之后立即返回错误。如果攻击者可以控制引用计数器并将其设置为零，则可导致引用被释放，从而造成释放后使用漏洞。建议升级过去的 commit 04c55383fa5689357bcdd2c8036725a55ed632bc。
    (CVE-2023-3609)

  - Linux 内核的 net/sched: sch_qfq 组件中存在越界写入漏洞，攻击者可利用此漏洞提升本地特权。net/sched/sch_qfq.c 中的 qfq_change_agg() 函数允许越界写入，这是因为 lmax 会根据数据包大小在无边界检查的情况下更新。建议升级过去的 commit 3e337087c3b5805fe0b8a46ba622a962880b5d64。(CVE-2023-3611)

  - Linux 内核的 net/sched: cls_fw 组件中存在释放后使用漏洞，攻击者可利用此漏洞提升本地特权。如果 tcf_change_indev() 失败，fw_set_parms() 将在增加或减少 tcf_bind_filter() 中的引用计数器之后立即返回错误。如果攻击者可以控制引用计数器并将其设置为零，则可导致引用被释放，从而造成释放后使用漏洞。建议升级过去的 commit 0323bce598eea038714f941ce2b22541c46d488f。
    (CVE-2023-3776)

  - 在 Linux 内核的 NFC 中，发现 net/nfc/llcp_core.c 的 nfc_llcp_find_local 中存在释放后使用缺陷。
    具有特殊特权的本地用户可利用此缺陷造成内核信息泄漏问题。
    (CVE-2023-3863)

  - 在用户触发包含元素（无 NFT_SET_EXT_KEY_END）的 nft_pipapo_remove 函数的方式中，发现 Linux 内核的 netfilter 中存在释放后使用缺陷。本地用户可以利用此问题造成系统崩溃，或可能提升其在系统中的权限。(CVE-2023-4004)

  - 在 6.4.10 之前版本 Linux 内核 net/bluetooth/l2cap_sock.c 内的 l2cap_sock_release 中发现问题。由于 sk 的子项目处理不当，导致存在释放后使用问题。(CVE-2023-40283)

  - 在 Linux 内核的分类器（cls_fw、cls_u32 和 cls_route）中的 net/sched/cls_fw.c 中发现释放后使用缺陷。由于未正确处理现有过滤器，导致本地攻击者可利用此缺陷执行本地权限升级，从而造成内核信息泄漏问题。 (CVE-2023-4128)

  - 在 Linux 内核的 siano smsusb 模块中发现释放后使用漏洞。插入 siano 设备时，设备初始化期间会发生此缺陷。本地用户可利用此缺陷导致系统崩溃，从而造成拒绝服务情况。(CVE-2023-4132)

  - 添加含有 NFTA_RULE_CHAIN_ID 的规则时，在 Linux 内核的 Netfilter  功能中发现释放后使用缺陷。本地用户可利用此缺陷导致系统崩溃或升级其系统权限。
    (CVE-2023-4147)

  - Linux 内核的 TUN/TAP 功能中发现缺陷。本地用户可以利用此问题绕过绕过网络过滤器，并获取某些资源未经授权的访问权限。修复 CVE-2023-1076 的原始修补程序并不正确或并不完整。问题在于下列上游提交 - a096ccca6e50 (tun：tun_chr_open()：正确初始化套接字 UID）、66b2c338adce（tap：tap_open()：
    正确初始化套接字 UID），在将 inode->i_uid 作为最后一个参数传递至 sock_init_data_uid() 时发现结果并非准确无误。(CVE-2023-4194)

  - 在 Linux 内核的 exFAT 驱动程序中发现一个缺陷。文件名重建函数的实现中存在一个漏洞，该函数负责从目录索引中读取文件名条目，并将属于一个文件的文件名部分合并为一个长文件名。由于文件名字符会复制到堆栈变量中，因此本地特权攻击者可利用此缺陷使内核堆栈溢出。(CVE-2023-4273)

  - XSA-432 xen：由于数据包 [fedora-all] 异常，导致 netback 中发生缓冲区溢出 (CVE-2023-34319)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 22.04 LTS / 23.04 主机上安装的程序包受到 USN-6338-1 公告中提及的多个漏洞的影响。

  - binder.c 的多个函数中可能存在因释放后使用而可能导致的内存损坏问题。这可能会导致本地权限提升，且无需其他执行权限。无需用户交互即可利用漏洞。(CVE-2023-21255)

  - 在 Linux 内核的 fs/f2fs/data.c 中，发现 f2fs_write_end_io 中存在空指针取消引用缺陷。
    本地特权用户可利用此缺陷造成拒绝服务问题。(CVE-2023-2898)

  - 在 Linux 内核 6.2 的 drivers/media/dvb-core/dvb_frontend.c 中发现一个问题。当任务处于 !TASK_RUNNING 状态时，会发生阻止操作。在 dvb_frontend_get_event 中，调用 wait_event_interruptible；条件为 dvb_frontend_test_event(fepriv,events)。在 dvb_frontend_test_event 中，调用 down(&fepriv->sem)。但是，wait_event_interruptible 会使进程进入休眠状态，而 down(&fepriv->sem) 可能会阻断进程。(CVE-2023-31084)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 命令时存在特定缺陷。导致此问题的原因是对资源消耗缺少控制。攻击者可利用此漏洞在系统中造成拒绝服务情况。(CVE-2023-32247)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32250)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_LOGOFF 命令时存在特定缺陷。出现此问题的原因是在访问指针之前缺少正确的验证。攻击者可利用此漏洞在系统中造成拒绝服务情况。(CVE-2023-32252)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 和 SMB2_LOGOFF 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32257)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_LOGOFF 和 SMB2_CLOSE 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32258)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。当 create_context 的 name_len 大于标签长度时，ksmbd 的 smb2_find_context_vals 中存在越界读取漏洞。(CVE-2023-38426)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。ksmbd 中的 fs/ksmbd/smb2pdu.c 未正确检查 UserName 的值，这是因为它未考虑安全缓冲区的地址，从而导致越界读取漏洞。(CVE-2023-38428)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。ksmbd 中的 fs/ksmbd/connection.c 的内存分配中存在一个可能导致越界访问的差一错误（由于 ksmbd_smb2_check_message）。
    (CVE-2023-38429)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 23.04 主机上安装的程序包受到 USN-6344-1 公告中提及的多个漏洞的影响。

  - binder.c 的多个函数中可能存在因释放后使用而可能导致的内存损坏问题。这可能会导致本地权限提升，且无需其他执行权限。无需用户交互即可利用漏洞。(CVE-2023-21255)

  - 在 Linux 内核的 fs/f2fs/data.c 中，发现 f2fs_write_end_io 中存在空指针取消引用缺陷。
    本地特权用户可利用此缺陷造成拒绝服务问题。(CVE-2023-2898)

  - 在 Linux 内核 6.2 的 drivers/media/dvb-core/dvb_frontend.c 中发现一个问题。当任务处于 !TASK_RUNNING 状态时，会发生阻止操作。在 dvb_frontend_get_event 中，调用 wait_event_interruptible；条件为 dvb_frontend_test_event(fepriv,events)。在 dvb_frontend_test_event 中，调用 down(&fepriv->sem)。但是，wait_event_interruptible 会使进程进入休眠状态，而 down(&fepriv->sem) 可能会阻断进程。(CVE-2023-31084)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 命令时存在特定缺陷。导致此问题的原因是对资源消耗缺少控制。攻击者可利用此漏洞在系统中造成拒绝服务情况。(CVE-2023-32247)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32250)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_LOGOFF 命令时存在特定缺陷。出现此问题的原因是在访问指针之前缺少正确的验证。攻击者可利用此漏洞在系统中造成拒绝服务情况。(CVE-2023-32252)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 和 SMB2_LOGOFF 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32257)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_LOGOFF 和 SMB2_CLOSE 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32258)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。当 create_context 的 name_len 大于标签长度时，ksmbd 的 smb2_find_context_vals 中存在越界读取漏洞。(CVE-2023-38426)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。ksmbd 中的 fs/ksmbd/smb2pdu.c 未正确检查 UserName 的值，这是因为它未考虑安全缓冲区的地址，从而导致越界读取漏洞。(CVE-2023-38428)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。ksmbd 中的 fs/ksmbd/connection.c 的内存分配中存在一个可能导致越界访问的差一错误（由于 ksmbd_smb2_check_message）。
    (CVE-2023-38429)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 22.04 LTS / 23.04 主机上安装的程序包受到 USN-6338-2 公告中提及的多个漏洞的影响。

  - binder.c 的多个函数中可能存在因释放后使用而可能导致的内存损坏问题。这可能会导致本地权限提升，且无需其他执行权限。无需用户交互即可利用漏洞。(CVE-2023-21255)

  - 在 Linux 内核的 fs/f2fs/data.c 中，发现 f2fs_write_end_io 中存在空指针取消引用缺陷。
    本地特权用户可利用此缺陷造成拒绝服务问题。(CVE-2023-2898)

  - 在 Linux 内核 6.2 的 drivers/media/dvb-core/dvb_frontend.c 中发现一个问题。当任务处于 !TASK_RUNNING 状态时，会发生阻止操作。在 dvb_frontend_get_event 中，调用 wait_event_interruptible；条件为 dvb_frontend_test_event(fepriv,events)。在 dvb_frontend_test_event 中，调用 down(&fepriv->sem)。但是，wait_event_interruptible 会使进程进入休眠状态，而 down(&fepriv->sem) 可能会阻断进程。(CVE-2023-31084)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 命令时存在特定缺陷。导致此问题的原因是对资源消耗缺少控制。攻击者可利用此漏洞在系统中造成拒绝服务情况。(CVE-2023-32247)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32250)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_LOGOFF 命令时存在特定缺陷。出现此问题的原因是在访问指针之前缺少正确的验证。攻击者可利用此漏洞在系统中造成拒绝服务情况。(CVE-2023-32252)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_SESSION_SETUP 和 SMB2_LOGOFF 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32257)

  - 在 Linux 内核的高性能内核内 SMB 服务器 ksmbd 中发现一个缺陷。处理 SMB2_LOGOFF 和 SMB2_CLOSE 命令时存在特定缺陷。出现该问题的原因在于对对象执行操作时缺少正确的锁定。攻击者可利用此漏洞在内核环境中执行代码。(CVE-2023-32258)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。当 create_context 的 name_len 大于标签长度时，ksmbd 的 smb2_find_context_vals 中存在越界读取漏洞。(CVE-2023-38426)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。ksmbd 中的 fs/ksmbd/smb2pdu.c 未正确检查 UserName 的值，这是因为它未考虑安全缓冲区的地址，从而导致越界读取漏洞。(CVE-2023-38428)

  - 在 6.3.4 之前的 Linux 内核中发现一个问题。ksmbd 中的 fs/ksmbd/connection.c 的内存分配中存在一个可能导致越界访问的差一错误（由于 ksmbd_smb2_check_message）。
    (CVE-2023-38429)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
180016	Debian DSA-5480-1 : linux - security update	Nessus	Debian Local Security Checks	2023/8/22	2024/3/27	high
180511	Ubuntu 22.04 LTS / 23.04 : Linux kernel vulnerabilities (USN-6338-1)	Nessus	Ubuntu Local Security Checks	2023/9/5	2024/8/27	critical
180558	Ubuntu 23.04 : Linux kernel (Azure) vulnerabilities (USN-6344-1)	Nessus	Ubuntu Local Security Checks	2023/9/6	2024/8/27	critical
181189	Ubuntu 22.04 LTS / 23.04 : Linux kernel vulnerabilities (USN-6338-2)	Nessus	Ubuntu Local Security Checks	2023/9/9	2024/8/27	critical
181209	Debian DSA-5492-1 : linux - security update	Nessus	Debian Local Security Checks	2023/9/10	2025/1/27	critical
181209	Debian DSA-5492-1：linux - 安全更新	Nessus	Debian Local Security Checks	2023/9/10	2025/1/27	critical
180016	Debian DSA-5480-1：linux - 安全更新	Nessus	Debian Local Security Checks	2023/8/22	2024/3/27	high
180511	Ubuntu 22.04 LTS / 23.04：Linux 内核漏洞 (USN-6338-1)	Nessus	Ubuntu Local Security Checks	2023/9/5	2024/8/27	critical
180558	Ubuntu 23.04：Linux 内核 (Azure) 漏洞 (USN-6344-1)	Nessus	Ubuntu Local Security Checks	2023/9/6	2024/8/27	critical
181189	Ubuntu 22.04 LTS / 23.04：Linux 内核漏洞 (USN-6338-2)	Nessus	Ubuntu Local Security Checks	2023/9/9	2024/8/27	critical

检测

插件搜索

high

critical

critical

critical

critical

critical

high

critical

critical

critical