An update of the linux package has been released.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References:
    Upstream kernel (CVE-2021-0941)

  - A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
    (CVE-2021-20321)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

  - A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with     root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.
    (CVE-2021-3635)

  - A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in     drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption).
    This vulnerability is similar with the older CVE-2019-18808. (CVE-2021-3744)

  - net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in     any net namespace because these changes are leaked into all other net namespaces. This is related to the     NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. (CVE-2021-38209)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows     unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds     write. (CVE-2021-41864)

  - A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user     calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or     escalate privileges on the system. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-42739)

  - An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in     the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. (CVE-2021-43389)

  - In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a     crafted device) to trigger an out-of-bounds write via a crafted length value. (CVE-2021-43975)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5278-1 advisory.

    It was discovered that the rlimit tracking for user namespaces in the Linux kernel did not properly     perform reference counting, leading to a use-after- free vulnerability. A local attacker could use this to     cause a denial of service or possibly execute arbitrary code. (CVE-2022-24122)

    It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in     certain situations. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-23222)

    Jeremy Cline discovered a use-after-free in the nouveau graphics driver of the Linux kernel during device     removal. A privileged or physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2020-27820)

    It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-     free vulnerability. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2021-22600)

    Jrgen Gro discovered that the Xen subsystem within the Linux kernel did not adequately limit the     number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a     driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28713)

    Jrgen Gro discovered that the Xen network backend driver in the Linux kernel did not adequately limit     the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to     cause a denial of service (excessive kernel memory consumption) in the network backend domain.
    (CVE-2021-28714, CVE-2021-28715)

    Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the     size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2021-39685)

    It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-     only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

    Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that     could result in a read-after-free. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2021-4083)

    It was discovered that the simulated networking device driver for the Linux kernel did not properly     initialize memory in certain situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2021-4135)

    Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size     correctly when pre-allocating space in some situations. A local attacker could use this to expose     sensitive information. (CVE-2021-4155)

    Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not     perform permission checks correctly in some situations. A local attacker could possibly use this to gain     administrative privileges. (CVE-2021-4197)

    Brendan Dolan-Gavitt discovered that the aQuantia AQtion Ethernet device driver in the Linux kernel did     not properly validate meta-data coming from the device. A local attacker who can control an emulated     device can use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2021-43975)

    It was discovered that the ARM Trusted Execution Environment (TEE) subsystem in the Linux kernel contained     a race condition leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2021-44733)

    It was discovered that the Phone Network protocol (PhoNet) implementation in the Linux kernel did not     properly perform reference counting in some error conditions. A local attacker could possibly use this to     cause a denial of service (memory exhaustion). (CVE-2021-45095)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel did     not properly deallocate memory in some error conditions. A local attacker could possibly use this to cause     a denial of service (memory exhaustion). (CVE-2021-45480)

    It was discovered that the BPF subsystem in the Linux kernel did not properly track pointer types on     atomic fetch operations in some situations. A local attacker could use this to expose sensitive     information (kernel pointer addresses). (CVE-2022-0264)

    Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform     a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or     possibly execute arbitrary code. (CVE-2022-0330)

    It was discovered that the TIPC Protocol implementation in the Linux kernel did not properly initialize     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-0382)

    It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain     failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this     to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0056-1 advisory.

  - Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version     1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
    (CVE-2020-24504)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the     ability to run PV backends in regular unprivileged guests, typically referred to as driver domains.
    Running PV backends in driver domains has one primary security advantage: if a driver domain gets     compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain     could try to attack other guests via sending events at a high frequency leading to a Denial of Service in     the guest due to trying to service interrupts for elongated amounts of time. There are three affected     backends: * blkfront patch 1, CVE-2021-28711 * netfront patch 2, CVE-2021-28712 * hvc_xen (console) patch     3, CVE-2021-28713 (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

  - Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]     Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in     its RX queue ring page and the next package would require more than one free slot, which may be the case     when using GSO, XDP, or software hashing. (CVE-2021-28714) (CVE-2021-28714, CVE-2021-28715)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640) (CVE-2021-4002)

  - In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a     crafted device) to trigger an out-of-bounds write via a crafted length value. (CVE-2021-43975)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0131-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated

    - Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have     happened in the past (jsc#SLE-22573)       You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
    (kernel.unprivileged_bpf_disabled = 0)

    The following security bugs were fixed:

    - CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source     addresses. (bsc#1194094)
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c.
    (bnc#1194087).
    - CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages.  (bsc#1193442)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter     drivers that may have allowed an authenticated user to potentially enable denial of service via local     access. (bnc#1182404)
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bnc#1179599)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0181-1 advisory.

    The SUSE MicroOS 5.0 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
    - CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening blkfront against event channel storms. (bsc#1193440)
    - CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening netfront against event channel storms. (bsc#1193440)
    - CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by     hardening hvc_xen against event channel storms. (bsc#1193440)
    - CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by fixing rx queue stall detection. (bsc#1193442)
    - CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of     kernel memory by do not queueing unlimited number of packages.  (bsc#1193442)
    - CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that could allow     an authenticate user to cause a denial of service (bnc#1192877).
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0367-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization     subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could     use this flaw to crash the system (bnc#1186207).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could     have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object (bnc#1193767).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
    - CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
    - CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
    - CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
    - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket     file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race     condition (bnc#1193727).
    - CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
    - CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c     (bnc#1194087).
    - CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).
    - CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).
    - CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392)     (bsc#1193442).
    - CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
    - CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free.
    This could lead to local escalation of privilege with System execution privileges needed. User interaction     is not needed for exploitation (bnc#1192032).
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device (bsc#1179599).
    - CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
    - CVE-2021-43975: hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c     allowed an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted     length value (bnc#1192845).
    - CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version     3.17.3 may have allowed an authenticated user to potentially enable denial of service via local access     (bnc#1192877).
    - CVE-2021-43976: mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allowed an attacker (who     can connect a crafted USB device) to cause a denial of service (skb_over_panic) (bnc#1192847).
    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k' (bsc#1167162).
    - CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0371-1 advisory.

    The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195254).
    - CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
    - CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
    - CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table     (bnc#1194087).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
    - CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could     have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object (bnc#1193767).
    - CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to     cause a denial of service. (bnc#1192847)
    - CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce     a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
    - CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
    - CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
    - CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).
    - CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
    - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket     file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race     condition (bnc#1193727).
    - CVE-2021-4002: Fixed a missing TLB flush that could lead to leak or corruption of data in hugetlbfs.
    (bsc#1192946)
    - CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler     of ufshcd.c. This could lead to local information disclosure with System execution privileges needed     (bnc#1193864).
    - CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in     gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System     execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
    - CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization     subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could     use this flaw to crash the system (bnc#1186207).
    - CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper     input validation. (bsc#1192877)
    - CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392)     (bsc#1193442).
    - CVE-2021-28714: Fixed issue with xen/netback to add rx queue stall detection (XSA-392) (bsc#1193442).
    - CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391)     (bsc#1193440).
    - CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free.
    This could lead to local escalation of privilege with System execution privileges needed. User interaction     is not needed for exploitation (bnc#1192032).
    - CVE-2021-0920: Fixed use after free bug due to a race condition in unix_scm_to_skb of af_unix.c. This     could have led to local escalation of privilege with System execution privileges needed (bnc#1193731).
    - CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could     happen if removing device. (bsc#1179599)
    - CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices     aka 'Kr00k'. (bsc#1167162)
    - CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an     instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43975 advisory.

  - In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a     crafted device) to trigger an out-of-bounds write via a crafted length value. (CVE-2021-43975)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7077 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206,     CVE-2023-4207, CVE-2023-4208)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)

    * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)

    * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)

    * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)

    * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)

    * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)

    * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)

    * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

    * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)

    * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)

    * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

    * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)

    * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

    * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)

    * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)

    * kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)

    * Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)

    * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)

    * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)

    * kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)

    * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free bug in r592_remove (CVE-2023-3141)

    * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6901 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tun: double free in tun_free_netdev (CVE-2022-4744)

    * kernel: net/sched: cls_u32 component reference counter leak (CVE-2023-3609)

    * kernel: net/sched: sch_qfq vulnerability (CVE-2023-3611)

    * kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: use-after-free and info leak in l2cap_conn_del and l2cap_parse_conf_req (CVE-2022-3640,     CVE-2022-42895)

    * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)

    * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)

    * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)

    * kernel: speculative pointer dereference in do_prlimit in kernel/sys.c (CVE-2023-0458)

    * kernel: use-after-free in qdisc_graft (CVE-2023-0590)

    * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

    * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)

    * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)

    * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

    * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: Use after free bug in btsdio_remove (CVE-2023-1989)

    * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

    * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)

    * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)

    * kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages     getting invalid opcode BUG in include/linux/swapops.h (CVE-2023-4732)

    * Kernel: denial of service in atm_tc_enqueue (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)

    * kernel: saa7134: race condition in saa7134_finidev (CVE-2023-35823)

    * kernel: dm1105: race condition in dm1105_remove.c (CVE-2023-35824)

    * kernel: r592: race condition in r592_remove (CVE-2023-35825)

    * kernel: net/tls: tls_is_tx_ready checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free in r592_remove (CVE-2023-3141)

    * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

    For more details about the security issue(s), refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1404 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (CVE-2021-43975)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * The kernel is still getting hung up even after converting kernfs_mutex to kernfs_rwsem with massive     concurrent kernfs access (open & lookup) performed by kubelet/node_exporter threads. (JIRA:RHEL-17149)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (JIRA:RHEL-18810)

    * kernel: tun: avoid double free in tun_free_netdev (JIRA:RHEL-18813)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (JIRA:RHEL-18850)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19461)

    * ipoib mcast lockup fix (JIRA:RHEL-19698)

    * kernel: denial of service in tipc_conn_close (JIRA:RHEL-18824)

    * Rhel-8.6 crash at  qed_get_current_link+0x11 during tx_timeout recovery  (JIRA:RHEL-20923)

    * kernel: use-after-free in sch_qfq network scheduler (JIRA:RHEL-14402)

    * RHEL8.6 - s390/qeth: NET2016 - fix use-after-free in HSCI (JIRA:RHEL-15849)

    * RHEL8.6 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17883)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-18582)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (JIRA:RHEL-18799)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (JIRA:RHEL-18814)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-18998)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19110)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19327)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19451)

    * [RHEL8] I/O blocked during fio background with IO schedule switch, cpu offline/online, pci nvme     rescan/reset (JIRA:RHEL-20231)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20298)

    * kernel: inactive elements in nft_pipapo_walk (JIRA:RHEL-20697)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (JIRA:RHEL-21661)

    * kernel NULL pointer at RIP: 0010:kyber_has_work+0x1c/0x60 (JIRA:RHEL-21784)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22090)

    * backport timerlat user-space support (JIRA:RHEL-20361)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	2021/7/22	2026/9/15	high
159861	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2022-1402)	Nessus	Huawei Local Security Checks	2022/4/18	2023/4/25	high
203383	Photon OS 4.0: Linux PHSA-2022-4.0-0146	Nessus	PhotonOS Local Security Checks	2024/7/23	2025/1/9	high
157463	Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5278-1)	Nessus	Ubuntu Local Security Checks	2022/2/9	2024/8/27	high
156648	openSUSE 15 Security Update : kernel (openSUSE-SU-2022:0056-1)	Nessus	SuSE Local Security Checks	2022/1/12	2023/11/21	high
156883	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0131-1)	Nessus	SuSE Local Security Checks	2022/1/20	2026/6/26	high
157076	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:0181-1)	Nessus	SuSE Local Security Checks	2022/1/26	2026/6/26	medium
157895	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0367-1)	Nessus	SuSE Local Security Checks	2022/2/11	2026/6/26	high
157939	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:0371-1)	Nessus	SuSE Local Security Checks	2022/2/12	2026/6/26	high
172820	CBL Mariner 2.0 Security Update: kernel (CVE-2021-43975)	Nessus	MarinerOS Local Security Checks	2023/3/20	2025/2/10	medium
185679	RHEL 8 : kernel (RHSA-2023:7077)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/9/10	high
185666	RHEL 8 : kernel-rt (RHSA-2023:6901)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/9/10	high
192277	RHEL 8 : kernel (RHSA-2024:1404)	Nessus	Red Hat Local Security Checks	2024/3/19	2025/8/18	high

检测

插件搜索

high

high

high

high

high

high

medium

high

high

medium

high

high

high