The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7156-1 advisory.

    Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the     device to be enabled before writing. A local attacker could possibly use this to cause a denial of     service. (CVE-2024-25741)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - PA-RISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Android drivers;

    - Serial ATA and Parallel ATA drivers;

    - ATM drivers;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Cdrom driver;

    - Character device driver;

    - Clock framework and drivers;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Buffer Sharing and Synchronization framework;

    - DMA engine subsystem;

    - Cirrus firmware drivers;

    - Qualcomm firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Miscellaneous) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - ISDN/mISDN subsystem;

    - LED subsystem;

    - Mailbox framework;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - VMware VMCI Driver;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Near Field Communication (NFC) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - Device tree and open firmware driver;

    - Parport drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - Remote Processor subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - QCOM SoC drivers;

    - SPI subsystem;

    - Direct Digital Synthesis drivers;

    - Thermal drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - UFS subsystem;

    - Userspace I/O drivers;

    - USB DSL drivers;

    - USB core drivers;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB Serial drivers;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Xen hypervisor drivers;

    - File systems infrastructure;

    - BTRFS file system;

    - Ext4 file system;

    - F2FS file system;

    - GFS2 file system;

    - JFFS2 file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - Proc file system;

    - SMB network file system;

    - Tracing file system;

    - Bitmap API;

    - BPF subsystem;

    - Syscall compatibility layer;

    - Memory Management;

    - Memory management;

    - Objagg library;

    - Perf events;

    - Syscall interfaces;

    - Virtio network driver;

    - VMware vSockets driver;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - Netfilter;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Control group (cgroup);

    - DMA mapping infrastructure;

    - Locking primitives;

    - Padata parallel execution mechanism;

    - Scheduler infrastructure;

    - Closures library;

    - Radix Tree data structure library;

    - Kernel userspace event delivery library;

    - KUnit for arithmetic overflow checks;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - Ethtool driver;

    - IPv4 networking;

    - IPv6 networking;

    - IUCV driver;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Network traffic control;

    - SCTP protocol;

    - Sun RPC protocol;

    - TIPC protocol;

    - Wireless networking;

    - AppArmor security module;

    - Landlock security;

    - SELinux security module;

    - Simplified Mandatory Access Control Kernel framework;

    - FireWire sound drivers;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - SoC Audio for Freescale CPUs drivers;

    - Intel ASoC drivers;

    - MediaTek ASoC drivers;

    - Amlogic Meson SoC drivers;

    - SoC audio core drivers;

    - SOF drivers;

    - Sound sequencer drivers;

    - USB sound devices;

    - Real-Time Linux Analysis tools; (CVE-2024-43911, CVE-2024-46762, CVE-2024-46794, CVE-2024-43843,     CVE-2024-42229, CVE-2024-43888, CVE-2024-44978, CVE-2024-46693, CVE-2024-46695, CVE-2024-42290,     CVE-2024-42067, CVE-2024-45012, CVE-2024-42316, CVE-2024-47665, CVE-2024-41052, CVE-2024-42074,     CVE-2024-41058, CVE-2024-44975, CVE-2024-46709, CVE-2024-46871, CVE-2024-42090, CVE-2024-42296,     CVE-2024-42096, CVE-2024-42146, CVE-2024-46855, CVE-2024-39487, CVE-2024-43825, CVE-2024-42066,     CVE-2024-42126, CVE-2024-41022, CVE-2024-41025, CVE-2023-52888, CVE-2024-46702, CVE-2024-42269,     CVE-2024-41082, CVE-2024-42284, CVE-2024-42227, CVE-2024-41017, CVE-2024-42250, CVE-2024-46778,     CVE-2024-47661, CVE-2024-46727, CVE-2024-46845, CVE-2024-44953, CVE-2024-47659, CVE-2024-42137,     CVE-2024-42245, CVE-2024-41096, CVE-2024-46829, CVE-2024-41053, CVE-2024-46782, CVE-2024-44972,     CVE-2024-41095, CVE-2024-42239, CVE-2024-42127, CVE-2024-42292, CVE-2024-46752, CVE-2024-46679,     CVE-2024-41076, CVE-2024-46784, CVE-2024-46786, CVE-2024-46678, CVE-2024-44957, CVE-2024-46755,     CVE-2024-47660, CVE-2024-41067, CVE-2024-46838, CVE-2024-43879, CVE-2024-45007, CVE-2024-45025,     CVE-2024-45001, CVE-2024-41009, CVE-2024-41051, CVE-2024-46836, CVE-2024-49984, CVE-2024-45028,     CVE-2024-43871, CVE-2024-46783, CVE-2024-42272, CVE-2024-42087, CVE-2024-46785, CVE-2024-42276,     CVE-2024-47658, CVE-2024-46761, CVE-2024-46715, CVE-2024-46676, CVE-2024-43824, CVE-2024-42100,     CVE-2024-46745, CVE-2024-41084, CVE-2024-41086, CVE-2024-45015, CVE-2024-46797, CVE-2024-42160,     CVE-2024-46706, CVE-2024-46803, CVE-2024-46708, CVE-2024-47669, CVE-2024-45009, CVE-2024-41021,     CVE-2024-42159, CVE-2024-42321, CVE-2024-46868, CVE-2024-41078, CVE-2024-42303, CVE-2024-45027,     CVE-2024-42309, CVE-2024-43849, CVE-2024-43907, CVE-2024-43899, CVE-2024-43823, CVE-2024-42232,     CVE-2024-44937, CVE-2024-41046, CVE-2024-42237, CVE-2024-42063, CVE-2024-42065, CVE-2024-42154,     CVE-2024-42259, CVE-2024-46698, CVE-2024-46741, CVE-2024-45020, CVE-2024-42151, CVE-2024-41073,     CVE-2024-46719, CVE-2024-42295, CVE-2024-46859, CVE-2024-41035, CVE-2024-46751, CVE-2024-47667,     CVE-2024-46728, CVE-2024-46824, CVE-2024-42121, CVE-2024-46776, CVE-2024-46768, CVE-2024-43908,     CVE-2024-43900, CVE-2024-46707, CVE-2024-44934, CVE-2024-41062, CVE-2024-42304, CVE-2024-42312,     CVE-2024-42157, CVE-2024-41092, CVE-2024-41041, CVE-2024-43832, CVE-2024-41039, CVE-2024-44962,     CVE-2024-46858, CVE-2024-43856, CVE-2024-41060, CVE-2024-45010, CVE-2024-41044, CVE-2024-44942,     CVE-2024-42307, CVE-2024-44984, CVE-2024-41075, CVE-2024-43817, CVE-2024-46791, CVE-2024-46853,     CVE-2024-42301, CVE-2024-44993, CVE-2024-41094, CVE-2024-27022, CVE-2024-41088, CVE-2024-43883,     CVE-2024-41087, CVE-2024-46780, CVE-2024-42070, CVE-2024-44965, CVE-2024-46823, CVE-2024-46737,     CVE-2024-44982, CVE-2024-46697, CVE-2024-45021, CVE-2024-44987, CVE-2024-41072, CVE-2024-41063,     CVE-2024-46757, CVE-2024-46831, CVE-2024-44966, CVE-2024-42322, CVE-2024-42231, CVE-2024-46717,     CVE-2024-41065, CVE-2024-44969, CVE-2023-52887, CVE-2024-42105, CVE-2024-44971, CVE-2024-46798,     CVE-2024-42262, CVE-2024-44938, CVE-2024-42088, CVE-2024-44970, CVE-2024-43876, CVE-2024-46800,     CVE-2024-42086, CVE-2024-43826, CVE-2024-46729, CVE-2024-46747, CVE-2024-46691, CVE-2024-46723,     CVE-2024-41018, CVE-2024-42258, CVE-2024-41081, CVE-2024-41049, CVE-2024-43837, CVE-2024-45008,     CVE-2024-41047, CVE-2024-41019, CVE-2024-42152, CVE-2024-41090, CVE-2024-46716, CVE-2024-42104,     CVE-2024-46804, CVE-2024-43852, CVE-2024-42129, CVE-2024-46870, CVE-2024-41093, CVE-2024-45011,     CVE-2024-41064, CVE-2024-46722, CVE-2024-42286, CVE-2024-45026, CVE-2024-46818, CVE-2024-42281,     CVE-2024-43854, CVE-2024-41037, CVE-2024-44946, CVE-2024-41012, CVE-2024-41098, CVE-2024-42263,     CVE-2024-42095, CVE-2024-46756, CVE-2024-43913, CVE-2024-46822, CVE-2024-44944, CVE-2024-42156,     CVE-2024-42073, CVE-2024-42093, CVE-2024-44931, CVE-2024-42223, CVE-2024-42264, CVE-2024-42278,     CVE-2024-46759, CVE-2024-46826, CVE-2024-43828, CVE-2024-42318, CVE-2024-42240, CVE-2024-45000,     CVE-2024-43909, CVE-2024-46792, CVE-2024-42109, CVE-2024-43867, CVE-2024-42130, CVE-2024-42244,     CVE-2024-44977, CVE-2024-46774, CVE-2024-41030, CVE-2024-42310, CVE-2024-42138, CVE-2024-42317,     CVE-2024-42224, CVE-2024-46694, CVE-2024-46815, CVE-2024-46677, CVE-2024-46763, CVE-2024-46860,     CVE-2024-46767, CVE-2024-42111, CVE-2024-41020, CVE-2024-46726, CVE-2024-42117, CVE-2024-43831,     CVE-2024-42285, CVE-2024-46842, CVE-2024-43857, CVE-2024-41031, CVE-2024-43834, CVE-2024-42135,     CVE-2024-42241, CVE-2024-46846, CVE-2024-44988, CVE-2024-43892, CVE-2024-44991, CVE-2024-46806,     CVE-2024-41015, CVE-2024-43906, CVE-2024-42238, CVE-2024-46779, CVE-2024-41010, CVE-2024-41068,     CVE-2024-46730, CVE-2024-46827, CVE-2024-42120, CVE-2024-41059, CVE-2024-46850, CVE-2023-52889,     CVE-2024-45017, CVE-2024-45003, CVE-2024-46844, CVE-2024-46816, CVE-2024-46811, CVE-2024-41023,     CVE-2024-44948, CVE-2024-46753, CVE-2024-45002, CVE-2024-42251, CVE-2024-46713, CVE-2024-42273,     CVE-2024-46733, CVE-2024-46739, CVE-2024-42108, CVE-2024-41085, CVE-2024-41033, CVE-2024-42298,     CVE-2024-46835, CVE-2024-39472, CVE-2024-47663, CVE-2024-43859, CVE-2024-43820, CVE-2024-42118,     CVE-2024-41036, CVE-2024-47683, CVE-2024-42161, CVE-2024-42235, CVE-2024-43861, CVE-2024-43863,     CVE-2024-47668, CVE-2024-46685, CVE-2024-43864, CVE-2024-46749, CVE-2024-44983, CVE-2024-46841,     CVE-2024-42082, CVE-2024-43818, CVE-2024-41071, CVE-2024-45006, CVE-2024-42080, CVE-2024-46825,     CVE-2024-46687, CVE-2024-44959, CVE-2024-43835, CVE-2024-43891, CVE-2024-46851, CVE-2024-42248,     CVE-2024-42103, CVE-2024-42079, CVE-2024-42068, CVE-2024-47664, CVE-2024-46854, CVE-2024-44973,     CVE-2024-42077, CVE-2024-46821, CVE-2024-43886, CVE-2024-41089, CVE-2024-43850, CVE-2024-44995,     CVE-2024-46809, CVE-2024-42084, CVE-2024-46758, CVE-2024-47662, CVE-2024-43839, CVE-2024-46738,     CVE-2024-41034, CVE-2024-42228, CVE-2024-42147, CVE-2024-43855, CVE-2024-41032, CVE-2024-46819,     CVE-2024-44989, CVE-2024-42265, CVE-2024-42110, CVE-2024-42155, CVE-2024-45005, CVE-2024-45016,     CVE-2024-42141, CVE-2024-43821, CVE-2024-42299, CVE-2024-44950, CVE-2024-42279, CVE-2024-44943,     CVE-2024-43904, CVE-2024-42268, CVE-2024-42089, CVE-2024-46807, CVE-2024-44996, CVE-2024-42069,     CVE-2024-46672, CVE-2024-44940, CVE-2024-42270, CVE-2024-46735, CVE-2024-42319, CVE-2024-46754,     CVE-2024-46861, CVE-2024-42277, CVE-2024-41054, CVE-2024-42131, CVE-2024-41056, CVE-2024-44963,     CVE-2024-42267, CVE-2024-42283, CVE-2024-42320, CVE-2024-46740, CVE-2024-46787, CVE-2024-43895,     CVE-2024-43881, CVE-2024-44961, CVE-2024-43910, CVE-2024-43875, CVE-2024-42289, CVE-2024-43853,     CVE-2024-42315, CVE-2024-43884, CVE-2024-46867, CVE-2024-43912, CVE-2024-41007, CVE-2024-46743,     CVE-2024-46675, CVE-2024-43877, CVE-2024-39486, CVE-2024-41050, CVE-2024-43858, CVE-2024-45018,     CVE-2024-46744, CVE-2024-46750, CVE-2024-46840, CVE-2024-42150, CVE-2024-41028, CVE-2024-42091,     CVE-2024-43894, CVE-2024-43869, CVE-2024-42132, CVE-2024-46777, CVE-2024-42106, CVE-2024-46848,     CVE-2024-41038, CVE-2024-46711, CVE-2024-43833, CVE-2024-46710, CVE-2024-46812, CVE-2024-42311,     CVE-2024-46701, CVE-2024-46683, CVE-2024-45029, CVE-2024-46830, CVE-2024-46857, CVE-2024-44979,     CVE-2024-44999, CVE-2024-44985, CVE-2024-46773, CVE-2024-45022, CVE-2024-46772, CVE-2024-44960,     CVE-2024-42243, CVE-2024-42158, CVE-2024-43819, CVE-2024-45030, CVE-2024-42085, CVE-2024-42274,     CVE-2024-44986, CVE-2024-41048, CVE-2024-42098, CVE-2024-46680, CVE-2023-52918, CVE-2024-46673,     CVE-2024-46834, CVE-2024-42288, CVE-2024-44998, CVE-2024-42113, CVE-2024-42094, CVE-2024-42225,     CVE-2024-42112, CVE-2024-42153, CVE-2024-43880, CVE-2024-43905, CVE-2024-43902, CVE-2024-46681,     CVE-2024-42236, CVE-2024-42294, CVE-2024-46793, CVE-2024-43882, CVE-2024-44947, CVE-2024-46849,     CVE-2024-44954, CVE-2024-46852, CVE-2024-41070, CVE-2024-41069, CVE-2024-46864, CVE-2024-46703,     CVE-2024-43829, CVE-2024-46802, CVE-2024-42101, CVE-2024-44990, CVE-2024-43830, CVE-2024-41029,     CVE-2024-43866, CVE-2024-43889, CVE-2024-42230, CVE-2024-46692, CVE-2024-42133, CVE-2024-45013,     CVE-2024-42076, CVE-2024-46810, CVE-2024-42128, CVE-2024-46718, CVE-2024-46814, CVE-2024-43841,     CVE-2024-43873, CVE-2024-42092, CVE-2024-41074, CVE-2024-41083, CVE-2024-46731, CVE-2024-43842,     CVE-2024-41077, CVE-2024-46720, CVE-2024-46795, CVE-2024-46813, CVE-2024-46805, CVE-2024-42142,     CVE-2024-42291, CVE-2024-43846, CVE-2024-41057, CVE-2024-43870, CVE-2024-44980, CVE-2024-46866,     CVE-2024-43827, CVE-2024-43840, CVE-2024-42280, CVE-2024-42261, CVE-2024-42246, CVE-2024-42115,     CVE-2024-46686, CVE-2024-43860, CVE-2024-46808, CVE-2024-42149, CVE-2024-46828, CVE-2024-44935,     CVE-2024-43847, CVE-2024-44967, CVE-2024-46817, CVE-2024-46721, CVE-2024-42305, CVE-2024-46766,     CVE-2024-43914, CVE-2024-46760, CVE-2024-41061, CVE-2024-41091, CVE-2024-43890, CVE-2024-42314,     CVE-2024-42064, CVE-2024-42302, CVE-2024-43887, CVE-2024-46832, CVE-2024-46765, CVE-2024-46770,     CVE-2024-41080, CVE-2024-42253, CVE-2024-44941, CVE-2024-42306, CVE-2024-41027, CVE-2024-46689,     CVE-2024-46781, CVE-2024-42247, CVE-2024-41066, CVE-2024-42287, CVE-2024-41097, CVE-2024-44939,     CVE-2024-45019, CVE-2024-47674, CVE-2024-46705, CVE-2024-42119, CVE-2024-46725, CVE-2024-46746,     CVE-2024-46732, CVE-2024-41042, CVE-2024-44958, CVE-2024-42114, CVE-2024-43893, CVE-2024-47666,     CVE-2024-46843, CVE-2024-42252, CVE-2024-42102, CVE-2024-42136, CVE-2024-41045, CVE-2024-42260,     CVE-2024-46771, CVE-2024-42124, CVE-2024-42297, CVE-2024-42271, CVE-2024-43845, CVE-2024-46775,     CVE-2024-41079, CVE-2024-43868, CVE-2024-42140, CVE-2024-42313, CVE-2024-42145, CVE-2024-46724,     CVE-2024-46788, CVE-2024-42234, CVE-2024-42144, CVE-2024-44974, CVE-2024-42097, CVE-2024-46714,     CVE-2024-41055, CVE-2024-44956)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect     labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects     to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets     are incorrectly labeled ('foo' instead of 'bar') 2) 'bar' can write to 'foo' without being authorized to     write. Here is a scenario how to see this: * Take two machines, let's call them C and S, with active Smack     in the default state (no settings, no rules, no labeled hosts, only builtin labels) * At S, add Smack rule     'foo bar w' (labels 'foo' and 'bar' are instantiated at S at this moment) * At S, at label 'bar', launch a     program that listens for incoming tcp/ipv4 connections * From C, at label 'foo', connect to the listener     at S. (label 'foo' is instantiated at C at this moment) Connection succeedes and works. * Send some data     in both directions. * Collect network traffic of this connection. All packets in both directions are     labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to 'foo' without being authorized,     and even without ever being known at C. If anybody cares: exactly the same happens with DCCP. This     behavior 1st manifested in release 2.6.29.4 (see Fixes below) and it looks unintentional. At least, no     explanation was provided. I changed returned packes label into the 'bar', to bring it into line with the     Smack documentation claims. (CVE-2024-47659)

  - In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix kernel crash     on receiver USB disconnect hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races     when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on     probe() and if a device-connected packet is received by the hw when the thread running     hidpp_connect_event() from probe() is waiting on the hw, then a second thread running     hidpp_connect_event() will be started from the workqueue. This opens the following races (note the below     code is simplified): 1. Retrieving + printing the protocol (harmless race): if (!hidpp->protocol_major) {     hidpp_root_get_protocol_version() hidpp->protocol_major = response.rap.params[0]; } We can actually see     this race hit in the dmesg in the abrt output attached to rhbz#2227968: [ 3064.624215] logitech-hidpp-     device 0003:046D:4071.0049: HID++ 4.5 device connected. [ 3064.658184] logitech-hidpp-device     0003:046D:4071.0049: HID++ 4.5 device connected. Testing with extra logging added has shown that after     this the 2 threads take turn grabbing the hw access mutex (send_mutex) so they ping-pong through all the     other TOCTOU cases managing to hit all of them: 2. Updating the name to the HIDPP name (harmless race): if     (hidpp->name == hdev->name) { ... hidpp->name = new_name; } 3. Initializing the power_supply class for the     battery (problematic!): hidpp_initialize_battery() { if (hidpp->battery.ps) return 0; probe_battery(); /*     Blocks, threads take turns executing this */ hidpp->battery.desc.properties = devm_kmemdup(dev,     hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps =     devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); } 4. Creating delayed     input_device (potentially problematic): if (hidpp->delayed_input) return; hidpp->delayed_input =     hidpp_allocate_input(hdev); The really big problem here is 3. Hitting the race leads to the following     sequence: hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);
    hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); ...
    hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);
    hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); So now we     have registered 2 power supplies for the same battery, which looks a bit weird from userspace's pov but     this is not even the really big problem. Notice how: 1. This is all devm-maganaged 2. The     hidpp->battery.desc struct is shared between the 2 power supplies 3. hidpp->battery.desc.properties points     to the result from the second devm_kmemdup() This causes a use after free scenario on USB disconnect of     the receiver: 1. The last registered power supply class device gets unregistered 2. The memory from the     last devm_kmemdup() call gets freed, hidpp->battery.desc.properties now points to freed memory 3. The     first registered power supply class device gets unregistered, this involves sending a remove uevent to     userspace which invokes power_supply_uevent() to fill the uevent data 4. power_supply_uevent() uses     hidpp->battery.desc.properties which now points to freed memory leading to backtraces like this one: Sep     22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08 ... Sep 22     20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event Sep 22 20:01:35 eric kernel: RIP:
    0010:power_supply_uevent+0xee/0x1d0 ... Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30 Sep 22     20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0 Sep 22 20:01:35 eric kernel: ?     power_supply_uevent+0x10d/0x1d0 Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0 Sep 22 20:01:35 eric     kernel: kobject_uevent_env+0x291/0x680 Sep 22 20:01:35 eric kernel: ---truncated--- (CVE-2023-52478)

  - In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX     during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast     majority of cases, now and then it causes instability. This leads to system crashes and other undefined     behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't     observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.
    (CVE-2023-52882)

  - In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error     handling for tightly received RTS messages in xtp_rx_rts_session_new This patch enhances error handling in     scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative     WARN_ON_ONCE backtraces with a new error handling method. This provides clearer error messages and allows     for the early termination of problematic sessions. Previously, sessions were only released at the end of     j1939_xtp_rx_rts(). Potentially this could be reproduced with something like: testj1939 -r vcan0:0x80 &     while true; do # send first RTS cansend vcan0 18EC8090#1014000303002301; # send second RTS cansend vcan0     18EC8090#1014000303002301; # send abort cansend vcan0 18EC8090#ff00000000002301; done (CVE-2023-52887)

  - In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Only free     buffer VA that is not NULL In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly called     only when the buffer to free exists, there are some instances that didn't do the check and triggered     warnings in practice. We believe those checks were forgotten unintentionally. Add the checks back to fix     the warnings. (CVE-2023-52888)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6997 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)

    * kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739)

    * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947)

    * kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931)

    * kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930)

    * kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929)

    * kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022)

    * kernel: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes (CVE-2024-26991)

    * kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895)

    * kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)

    * kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899)

    * kernel: cpufreq: exit() callback is optional (CVE-2024-38615)

    * kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601)

    * kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573)

    * kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570)

    * kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562)

    * kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884)

    * kernel: ACPICA: Revert ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.
    (CVE-2024-40984)

    * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071)

    * kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225)

    * kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27022 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma     is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork     hugetlbfs_fallocate dup_mmap hugetlbfs_punch_hole i_mmap_lock_write(mapping);
    vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. i_mmap_unlock_write(mapping);
    hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem! i_mmap_lock_write(mapping);
    hugetlb_vmdelete_list vma_interval_tree_foreach hugetlb_vma_trylock_write -- Vma_lock is cleared.
    tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! hugetlb_vma_unlock_write -- Vma_lock is     assigned!!! i_mmap_unlock_write(mapping); hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called     outside i_mmap_rwsem lock while vma lock can be used in the same time. Fix this by deferring linking file     vma until vma is fully initialized. Those vmas should be initialized first before they can be used.
    (CVE-2024-27022)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-695 advisory.

    In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling     ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of     Qualcomm PCIe controllers as reported by lockdep (CVE-2024-26605)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/vma: Fix UAF on destroy     against retire race Object debugging tools were sporadically reporting illegal attempts to free a still     active i915 VMA object when parking a GT believed to be idle. (CVE-2024-26939)

    In the Linux kernel, the following vulnerability has been resolved:

    bootconfig: use memblock_free_late to free xbc memory to buddy (CVE-2024-26983)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled (CVE-2024-26987)

    In the Linux kernel, the following vulnerability has been resolved:

    init/main.c: Fix potential static_command_line memory overflow (CVE-2024-26988)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: hibernate: Fix level3 translation fault in swsusp_save() (CVE-2024-26989)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/pmu: Disable support for adaptive PEBS (CVE-2024-26992)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: mxs-auart: add spinlock around changing cts state (CVE-2024-27000)

    In the Linux kernel, the following vulnerability has been resolved:

    clk: Get runtime PM before walking tree for clk_summary (CVE-2024-27003)

    In the Linux kernel, the following vulnerability has been resolved:

    clk: Get runtime PM before walking tree during disable_unused (CVE-2024-27004)

    In the Linux kernel, the following vulnerability has been resolved:

    tun: limit printing rate when illegal packet received by tun dev (CVE-2024-27013)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: incorrect pppoe tuple (CVE-2024-27015)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: validate pppoe header (CVE-2024-27016)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: br_netfilter: skip conntrack input hook for promisc packets (CVE-2024-27018)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020)

    In the Linux kernel, the following vulnerability has been resolved:

    fork: defer linking file vma until vma is fully initialized (CVE-2024-27022)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Fix Use-After-Free in ovs_ct_exit (CVE-2024-27395)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3-its: Prevent double free on error (CVE-2024-35847)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (CVE-2024-35849)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Do not send RSS key if it is not supported (CVE-2024-35981)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: smbus: fix NULL function pointer dereference (CVE-2024-35984)

    In the Linux kernel, the following vulnerability has been resolved:

    dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (CVE-2024-35989)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Use access_width over bit_width for system memory accesses (CVE-2024-35995)

    In the Linux kernel, the following vulnerability has been resolved:

    cpu: Re-enable CPU mitigations by default for !X86 architectures (CVE-2024-35996)

    In the Linux kernel, the following vulnerability has been resolved:

    smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (CVE-2024-35998)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: check for NULL idev in ip_route_use_hint() (CVE-2024-36008)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2135-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).
    - CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
    - CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
    - CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
    - CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
    - CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
    - CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
    - CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
    - CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
    - CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
    - CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
    - CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
    - CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
    - CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
    - CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()     (bsc#1222613).
    - CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
    - CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).
    - CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).
    - CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
    - CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
    - CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
    - CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
    - CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
    - CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).
    - CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
    - CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found()     (bsc#1222618).
    - CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).
    - CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel     (bsc#1222557).
    - CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
    - CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
    - CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
    - CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
    - CVE-2024-36030: Fix the double free in rvu_npc_freemem() (bsc#1225712)
    - CVE-2023-52698: Fix memory leak in netlbl_calipso_add_pass() (bsc#1224621)
    - CVE-2024-26860: Fix a memory leak when rechecking the data (bsc#1223077).
    - CVE-2023-52772: Fix use-after-free in unix_stream_read_actor() (bsc#1224989).
    - CVE-2024-27431: Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
    - CVE-2024-35860: Support deferring bpf_link dealloc to after RCU grace period BPF link for some program     types (bsc#1224531).
    - CVE-2024-35964: Fix not validating setsockopt user input Check user input length before copying data     (bsc#1224581).
    - CVE-2023-0160: Prevent lock inversion deadlock in map delete elem  (bsc#1209657).
    - CVE-2024-35903: Fix IP after emitting call depth accounting Adjust the IP passed to `emit_patch` so it     calculates the correct offset for the CALL instruction if `x86_call_depth_emit_accounting` emits code     (bsc#1224493).
    - CVE-2024-35931: Skip do PCI error slot reset during RAS recovery (bsc#1224652).
    - CVE-2024-35877: Fix VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35969: Fix race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580)
    - CVE-2024-35852: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a     delay if the number of credits at end of the work is not negative as supposedly it means that the     migration ended (bsc#1224502).
    - CVE-2024-36006: Fix incorrect list API usage (bsc#1224541).
    - CVE-2024-36007: Fix warning during rehash (bsc#1224543).
    - CVE-2024-35872: Fix GUP-fast succeeding on secretmem folios (bsc#1224530).
    - CVE-2024-35956: Fix qgroup prealloc rsv leak in subvolume operations (bsc#1224674)
    - CVE-2023-52771: Fix delete_endpoint() vs parent unregistration race  (bsc#1225007).
    - CVE-2024-27408: Add sync read before starting the  DMA transfer in remote setup (bsc#1224430).
    - CVE-2024-35943: Add a null pointer check to the omap_prm_domain_init devm_kasprintf()returns a pointer     to dynamically allocated memory which can be NULL upon failure (bsc#1224649).
    - CVE-2024-35921: Fix oops when HEVC init fails (bsc#1224477).
    - CVE-2023-52860: Use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process     (bsc#1224936).
    - CVE-2024-35991: kABI workaround for struct idxd_evl (bsc#1224553).
    - CVE-2024-35854: Fix possible use-after-free during rehash (bsc#1224636).
    - CVE-2024-27418: Take ownership of skb in mctp_local_output (bsc#1224720)
    - CVE-2024-27417: Fix potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721).
    - CVE-2024-35905: Protect against int overflow for stack access size (bsc#1224488).
    - CVE-2024-35917: Fix bpf_plt pointer arithmetic (bsc#1224481).
    - CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() to nsure the value passed to     scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside     scarlett2_mixer_values[] (bsc#1224727).
    - CVE-2023-52680: Add missing error checks to *_ctl_get() because the *_ctl_get() functions which call     scarlett2_update_*() were not checking the return value (bsc#1224608).
    - CVE-2023-52692: Add missing error check to scarlett2_usb_set_config() scarlett2_usb_set_config() calls     scarlett2_usb_get() but was not checking the result (bsc#1224628).
    - CVE-2024-35944: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in     dg_dispatch_as_host' bug (bsc#1224648).
    - CVE-2024-26923: Suppress false-positive lockdep splat for spin_lock()  in __unix_gc() (bsc#1223384).
    - CVE-2023-52659: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (bsc#1224442).
    - CVE-2024-21823: Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for     some Intel(R) 4th or 5th generation Xeon(R) processors may have allowed an authorized user to potentially     enable denial of service via local access (bsc#1223625).
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-27395: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu (bsc#1224098).
    - CVE-2023-52483: Perform route lookups under a RCU read-side lock (bsc#1220738).
    - CVE-2024-27396: Fix Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-26632: Fix iterating over an empty bio with  bio_for_each_folio_all (bsc#1221635).
    - CVE-2024-27401: Ensure that packet_buffer_get respects the user_length provided. (bsc#1224181).
    - CVE-2024-26775: Avoid potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fix UAF in direct writes (bsc#1223653).
    - CVE-2024-26643: Mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc     runs asynchronously, a race allowed it to collect elements from anonymous sets with timeouts while it is     being released from the commit path. (bsc#1221829).
    - CVE-2023-52618: Check for unlikely string overflow (bsc#1221615).
    - CVE-2023-6238: Only privileged user could specify a small meta buffer and let the device perform larger     Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random     kernel crashes and memory corruption (bsc#1217384).
    - CVE-2024-26946: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address     with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used before checking     the address is in text or not (bsc#1223669).
    - CVE-2024-26945: Fix nr_cpus nr_iaa case If nr_cpus nr_iaa, the calculated cpus_per_iaa will be 0, which     causes a divide-by-0 in rebalance_wq_table() (bsc#1223732).
    - CVE-2024-26679: Read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding     the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN     warning (bsc#1222385).
    - CVE-2024-26791: Properly validate device names (bsc#1222793)
    - CVE-2023-52641: Add NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)
    - CVE-2024-26726: Do not drop extent_map for free space inode on write error (bsc#1222532)
    - CVE-2024-27022: Defer linking file vma until vma is fully initialized (bsc#1223774).
    - CVE-2024-26899: Fix deadlock between bd_link_disk_holder and partition scan (bsc#1223045).
    - CVE-2024-26638: Always initialize struct msghdr completely (bsc#1221649).
    - CVE-2024-26909: Fix drm bridge use-after-free A recent DRM series purporting to simplify support     (bsc#1223143).
    - CVE-2024-26674: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups (bsc#1222378).
    - CVE-2024-26832: Fix missing folio cleanup in writeback race path (bsc#1223007).
    - CVE-2024-26844: Fix WARNING in _copy_from_iter (bsc#1223015).
    - CVE-2024-26774: Avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt     (bsc#1222622).
    - CVE-2024-26815: Properly check TCA_TAPRIO_TC_ENTRY_INDEX (bsc#1222635).
    - cve-2024-267600: Fix bio_put() for error case (bsc#1222596).
    - CVE-2024-26731: Fix NULL pointer dereference in sk_psock_verdict_data_ready() (bsc#1222371).
    - CVE-2024-26740: Use the backlog for mirred ingress (bsc#1222563).
    - CVE-2023-52640: Fix oob in ntfs_listxattr The length of name cannot exceed the space occupied by ea     (bsc#1222301).
    - CVE-2023-52631: Fix a NULL dereference bug (bsc#1222264).
    - CVE-2023-52458: Add check that partition length needs to be aligned  with block size (bsc#1220428).
    - CVE-2023-6270: Fix the potential use-after-free problem in aoecmd_cfg_pkts  (bsc#1218562).
    - CVE-2024-26805: Fix kernel-infoleak-after-free in __skb_datagram_iter (bsc#1222630).
    - CVE-2024-26991: Do not overflow lpage_info when checking attributes (bsc#1223695).

    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).
    - CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts()  (bsc#1220148).
    - CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
    - CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).
    - CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).
    - CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).
    - CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).
    - CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
    - CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated     (bsc#1222464).
    - CVE-2024-27036: Fixed writeback data corruption (bsc#1223810).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6997 advisory.

    - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CKI Backport Bot)     [RHEL-42783] {CVE-2024-26947}
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-40517 RHEL-39354]     {CVE-2024-36016}
    - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-41275 RHEL-26233] {CVE-2023-52439}
    - gpiolib: cdev: Fix use after free in lineinfo_changed_notify (Steve Best) [RHEL-43192 RHEL-39849]     {CVE-2024-36899}
    - wifi: mac80211: Avoid address calculations via out of bounds array indexing (CKI Backport Bot)     [RHEL-51287 RHEL-51285] {CVE-2024-41071}
    - Input: cyapa - add missing input core locking to suspend/resume functions (cki-backport-bot)     [RHEL-44455] {CVE-2023-52884}
    - bpf, sockmap: Prevent lock inversion deadlock in map delete elem (Felix Maurer) [RHEL-41479 RHEL-30107]     {CVE-2024-35895}
    - scsi: qla2xxx: Fix double free of fcport (Nilesh Javali) [RHEL-39547 RHEL-40034 RHEL-25184 RHEL-35020]     {CVE-2024-26929}
    - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Nilesh Javali) [RHEL-39547 RHEL-41325     RHEL-25184 RHEL-35016] {CVE-2024-26930}
    - scsi: qla2xxx: Fix command flush on cable pull (Nilesh Javali) [RHEL-39547 RHEL-40029 RHEL-25184     RHEL-35012] {CVE-2024-26931}
    - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (Benjamin Coddington)     [RHEL-53708 RHEL-53004] {CVE-2024-42246}
    - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52368] {CVE-2024-42225}
    - cppc_cpufreq: Fix possible null pointer dereference (cki-backport-bot) [RHEL-44145] {CVE-2024-38573}
    - ring-buffer: Fix a race between readers and resize checks (cki-backport-bot) [RHEL-43920]     {CVE-2024-38601}
    - fork: defer linking file vma until vma is fully initialized (Rafael Aquini) [RHEL-35617 RHEL-35022]     {CVE-2024-27022}
    - ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.' (CKI Backport Bot)     [RHEL-48393 RHEL-48391] {CVE-2024-40984}
    - KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes (Maxim Levitsky) [RHEL-41345     RHEL-32430] {CVE-2024-26991}
    - net/sched: act_mirred: don't override retval if we already lost the skb (Davide Caratti) [RHEL-42644     RHEL-31724] {CVE-2024-26739}
    - cpufreq: exit() callback is optional (cki-backport-bot) [RHEL-43848] {CVE-2024-38615}
    - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44157 RHEL-44155]     {CVE-2024-38570}
    - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44157 RHEL-44155]     {CVE-2024-38570}
    - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44157 RHEL-44155] {CVE-2024-38570}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5680 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5680-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 06, 2024                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-26605 CVE-2024-26817 CVE-2024-26922 CVE-2024-26923                      CVE-2024-26924 CVE-2024-26925 CVE-2024-26926 CVE-2024-26936                      CVE-2024-26939 CVE-2024-26980 CVE-2024-26981 CVE-2024-26983                      CVE-2024-26984 CVE-2024-26987 CVE-2024-26988 CVE-2024-26989                      CVE-2024-26992 CVE-2024-26993 CVE-2024-26994 CVE-2024-26996                      CVE-2024-26997 CVE-2024-26999 CVE-2024-27000 CVE-2024-27001                      CVE-2024-27002 CVE-2024-27003 CVE-2024-27004 CVE-2024-27008                      CVE-2024-27009 CVE-2024-27013 CVE-2024-27014 CVE-2024-27015                      CVE-2024-27016 CVE-2024-27018 CVE-2024-27019 CVE-2024-27020                      CVE-2024-27022

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (bookworm), these problems have been fixed in     version 6.1.90-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8865:31 advisory.

    * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
      * kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739)
      * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947)
      * kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931)
      * kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930)
      * kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929)
      * kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022)
      * kernel: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes (CVE-2024-26991)
      * kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895)
      * kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)
      * kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899)
      * kernel: cpufreq: exit() callback is optional (CVE-2024-38615)
      * kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601)
      * kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573)
      * kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570)
      * kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562)
      * kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884)
      * kernel: ACPICA: Revert ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.
    (CVE-2024-40984)
      * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071)
      * kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225)
      * kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6918-1 advisory.

    It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when     modifying certain settings values through debugfs. A privileged local attacker could use this to cause a     denial of service.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Compute Acceleration Framework;

    - Accessibility subsystem;

    - Android drivers;

    - Drivers core;

    - Bluetooth drivers;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Cryptographic API;

    - Buffer Sharing and Synchronization framework;

    - GPU drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - VMware VMCI Driver;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Device tree and open firmware driver;

    - Chrome hardware platform drivers;

    - i.MX PM domains;

    - TI SCI PM domains driver;

    - S/390 drivers;

    - SCSI drivers;

    - SPI subsystem;

    - Thermal drivers;

    - TTY drivers;

    - USB subsystem;

    - Framebuffer layer;

    - BTRFS file system;

    - Network file system server daemon;

    - NILFS2 file system;

    - File systems infrastructure;

    - Pstore file system;

    - SMB network file system;

    - BPF subsystem;

    - Bluetooth subsystem;

    - Netfilter;

    - io_uring subsystem;

    - Core kernel;

    - Extra boot config (XBC);

    - Memory management;

    - Amateur Radio drivers;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - NFC subsystem;

    - RDS protocol;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - Wireless networking;

    - eXpress Data Path;

    - SELinux security module; (CVE-2024-26988, CVE-2024-36023, CVE-2024-35869, CVE-2024-35938,     CVE-2024-27000, CVE-2024-35880, CVE-2024-35915, CVE-2024-35959, CVE-2024-35883, CVE-2024-35886,     CVE-2024-35976, CVE-2024-35903, CVE-2024-35980, CVE-2024-27020, CVE-2024-35955, CVE-2024-35964,     CVE-2024-26980, CVE-2024-35882, CVE-2024-35927, CVE-2024-35884, CVE-2024-35914, CVE-2024-35905,     CVE-2024-26925, CVE-2024-35885, CVE-2024-26990, CVE-2024-27012, CVE-2024-35969, CVE-2024-35862,     CVE-2024-35956, CVE-2024-35971, CVE-2024-27022, CVE-2024-35935, CVE-2024-26992, CVE-2024-27010,     CVE-2024-35892, CVE-2024-26999, CVE-2024-26989, CVE-2024-35963, CVE-2024-35981, CVE-2024-26997,     CVE-2024-35920, CVE-2024-35918, CVE-2024-35933, CVE-2024-35867, CVE-2024-35904, CVE-2024-35890,     CVE-2024-35968, CVE-2024-35917, CVE-2024-35897, CVE-2024-26922, CVE-2024-36026, CVE-2024-27013,     CVE-2024-26991, CVE-2024-26996, CVE-2024-35873, CVE-2024-26987, CVE-2024-35895, CVE-2024-36027,     CVE-2024-35896, CVE-2024-35894, CVE-2024-26983, CVE-2024-35966, CVE-2024-35967, CVE-2024-35945,     CVE-2024-27003, CVE-2024-35939, CVE-2024-35861, CVE-2024-26985, CVE-2024-27015, CVE-2024-35982,     CVE-2024-35912, CVE-2024-35979, CVE-2024-35879, CVE-2024-26982, CVE-2024-35891, CVE-2024-35925,     CVE-2024-35870, CVE-2024-27021, CVE-2024-35866, CVE-2024-27014, CVE-2024-27001, CVE-2024-27004,     CVE-2024-35953, CVE-2024-36021, CVE-2024-35931, CVE-2024-27007, CVE-2024-35922, CVE-2024-35872,     CVE-2024-35926, CVE-2024-27016, CVE-2024-26984, CVE-2024-35919, CVE-2024-35911, CVE-2024-26923,     CVE-2024-35929, CVE-2024-35887, CVE-2024-35893, CVE-2024-35898, CVE-2024-35930, CVE-2024-35934,     CVE-2024-35916, CVE-2024-35877, CVE-2024-26926, CVE-2024-35974, CVE-2024-36018, CVE-2024-27002,     CVE-2024-35975, CVE-2024-35864, CVE-2024-35958, CVE-2024-35944, CVE-2024-35985, CVE-2024-35940,     CVE-2024-35900, CVE-2024-27018, CVE-2024-26936, CVE-2024-36024, CVE-2024-26998, CVE-2024-35954,     CVE-2024-35878, CVE-2024-26928, CVE-2024-35952, CVE-2024-36020, CVE-2024-26986, CVE-2024-35950,     CVE-2024-35957, CVE-2024-35909, CVE-2024-27005, CVE-2024-35978, CVE-2024-35875, CVE-2024-35943,     CVE-2024-35970, CVE-2024-35863, CVE-2024-26993, CVE-2024-35865, CVE-2024-26995, CVE-2024-35888,     CVE-2024-35899, CVE-2024-35868, CVE-2023-52699, CVE-2024-26994, CVE-2024-26817, CVE-2024-35902,     CVE-2024-35977, CVE-2024-35961, CVE-2024-36025, CVE-2024-35936, CVE-2024-35913, CVE-2024-27017,     CVE-2024-35889, CVE-2024-35972, CVE-2024-35901, CVE-2024-26921, CVE-2024-26924, CVE-2024-35951,     CVE-2024-35860, CVE-2024-35907, CVE-2024-35910, CVE-2024-36022, CVE-2024-27019, CVE-2024-27009,     CVE-2024-26981, CVE-2024-35973, CVE-2024-35965, CVE-2024-36019, CVE-2024-35871, CVE-2024-27008,     CVE-2024-26811, CVE-2024-35908, CVE-2024-35921, CVE-2024-35942, CVE-2024-35946, CVE-2024-35924,     CVE-2024-27011, CVE-2024-35960, CVE-2024-27006, CVE-2024-35937, CVE-2024-35932)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
212721	Ubuntu 24.04 LTS : Linux kernel (GKE) vulnerabilities (USN-7156-1)	Nessus	Ubuntu Local Security Checks	2024/12/12	2026/2/3	high
242830	NewStart CGSL MAIN 7.02 : kernel Multiple Vulnerabilities (NS-SA-2025-0118)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2026/1/6	high
207694	RHEL 9 : kernel (RHSA-2024:6997)	Nessus	Red Hat Local Security Checks	2024/9/24	2025/9/24	high
295750	Azure Linux 3.0 Security Update: kernel (CVE-2024-27022)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	high
205098	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-695)	Nessus	Amazon Linux Local Security Checks	2024/8/6	2026/2/24	high
204159	Photon OS 5.0: Linux PHSA-2024-5.0-0274	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/12/10	high
200853	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2135-1)	Nessus	SuSE Local Security Checks	2024/6/22	2025/9/24	high
207776	Oracle Linux 9 : kernel (ELSA-2024-6997)	Nessus	Oracle Linux Local Security Checks	2024/9/26	2026/2/9	high
195024	Debian dsa-5680 : affs-modules-6.1.0-21-4kc-malta-di - security update	Nessus	Debian Local Security Checks	2024/5/6	2024/7/10	high
292775	MiracleLinux 9 : kernel-5.14.0-427.37.1.el9_4 (AXSA:2024-8865:31)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
204795	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-6918-1)	Nessus	Ubuntu Local Security Checks	2024/7/26	2025/9/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high