It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-185 advisory.

    A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg     callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause     a kernel oops condition on the host, resulting in a denial of service. (CVE-2022-1789)

    A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    No description is available for this CVE. (CVE-2022-1972)

    A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal.
    This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
    (CVE-2022-1973)

    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505)

    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-23816)

    A flaw was found in hw. Aliases in the branch predictor may cause some AMD processors to predict the wrong     branch type, potentially leading to information disclosure. (CVE-2022-23825)

    A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user     creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2022-2585)

    A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in     the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the     time of table deletion, possibly leading to local privilege escalation. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365)

    A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation     (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most     recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction.
    (CVE-2022-26373)

    A firewall flaw that can bypass the Linux kernel's Netfilter functionality was found in how a user handles     unencrypted IRC with nf_conntrack_irc configured. This flaw allows a remote user to gain unauthorized     access to the system. (CVE-2022-2663)

    A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some     Intel(R) Processors may allow an authorized user to enable information disclosure via local access.
    (CVE-2022-28693)

    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-29900)

    A flaw was found in hw. Non-transparent sharing of branch predictor targets between contexts in some     Intel(R) processors may potentially allow an authorized user to enable information disclosure via local     access. (CVE-2022-29901)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition. (CVE-2022-3303)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33740)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33741)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33742)

    network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

    rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a     double free. (CVE-2022-34494)

    rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
    (CVE-2022-34495)

    A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides     incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2022-34918)

    A memory access flaw was found in the Linux kernel's XEN hypervisor for the virtual machine. This flaw     allows a local user to crash the system or potentially escalate their privileges on the system.
    (CVE-2022-36123)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    A flaw was found in the x86 KVM subsystem in kvm_steal_time_set_preempted in arch/x86/kvm/x86.c in the     Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are     mishandled in certain KVM_VCPU_PREEMPTED situations. (CVE-2022-39189)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

    An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. (CVE-2022-39842)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9602 advisory.

    [5.15.0-0.30.20.1]
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug:
      34386636]  {CVE-2022-21505}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of kernel installed on the remote host is prior to 5.15.59-33.133. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-007 advisory.

    An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

    A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix uninit-value in mpol_rebind_policy() (CVE-2022-49567)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't null dereference ops->destroy (CVE-2022-49568)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_max_reordering. (CVE-2022-49571)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. (CVE-2022-49572)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_early_retrans. (CVE-2022-49573)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_recovery. (CVE-2022-49574)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. (CVE-2022-49575)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix data-races around sysctl_fib_multipath_hash_fields. (CVE-2022-49576)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: Fix a data-race around sysctl_udp_l3mdev_accept. (CVE-2022-49577)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: Fix data-races around sysctl_ip_prot_sock. (CVE-2022-49578)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. (CVE-2022-49579)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. (CVE-2022-49580)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. (CVE-2022-49585)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_fastopen. (CVE-2022-49586)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_notsent_lowat. (CVE-2022-49587)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_migrate_req. (CVE-2022-49588)

    In the Linux kernel, the following vulnerability has been resolved:

    igmp: Fix data-races around sysctl_igmp_qrv. (CVE-2022-49589)

    In the Linux kernel, the following vulnerability has been resolved:

    igmp: Fix data-races around sysctl_igmp_llm_reports. (CVE-2022-49590)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_probe_interval. (CVE-2022-49593)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. (CVE-2022-49594)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_probe_threshold. (CVE-2022-49595)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_min_snd_mss. (CVE-2022-49596)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_base_mss. (CVE-2022-49597)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_mtu_probing. (CVE-2022-49598)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_l3mdev_accept. (CVE-2022-49599)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: Fix a data-race around sysctl_ip_autobind_reuse. (CVE-2022-49600)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (CVE-2022-49601)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: Fix a data-race around sysctl_fwmark_reflect. (CVE-2022-49602)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: Fix data-races around sysctl_ip_fwd_update_priority. (CVE-2022-49603)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: Fix data-races around sysctl_ip_fwd_use_pmtu. (CVE-2022-49604)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() (CVE-2022-49607)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: ralink: Check for null return of devm_kcalloc (CVE-2022-49608)

    A NULL pointer dereference issue was found in the SCTP network protocol in net/sctp/stream_sched.c in the     Linux kernel. If stream_in allocation fails, stream_out is freed, which would be accessed further. This     flaw allows a local user to crash the system or potentially cause a denial of service. (CVE-2023-2177)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2722-1 advisory.

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505) (CVE-2022-21505)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9612 advisory.

    [5.4.17-2136.309.5]
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug:
      34386637]  {CVE-2022-21505}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.135-122.509. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-019 advisory.

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505) (CVE-2022-21505, CVE-2022-28693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9710 advisory.

    - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug:
    34480880]  {CVE-2022-2588}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Paolo Bonzini)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Thadeu Lima de Souza Cascardo)  [Orabug:
    34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt (Alexandre Chartre)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Disable RRSBA behavior (Pawan Gupta)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/exec: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM/VMX: Use TEST %REG,%REG instead of CMP     /u03/ksharma/errata_processing/work/el7uek6/db_7uek6.ELSA-2022-9710,%REG in vmenter.S (Uros Bizjak)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw (Uros Bizjak)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - kbuild/objtool: Add objtool-vmlinux.o pass (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra     (Intel))  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vmlinux: Use INT3 instead of NOP for linker fill bytes (Kees Cook)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/realmode: build with __DISABLE_EXPORTS (Ankur Arora)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bpf: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: elide references to .discard.* from .return_sites (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Support not-feature (Juergen Gross)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/features: Move RETPOLINE flags to word 11 (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Classify symbols (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Create reloc sections implicitly (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add elf_create_reloc() helper (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rework the elf_rebuild_reloc_section() logic (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Handle per arch retpoline naming (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Correctly handle retpoline thunk calls (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Support retpoline jump detection for vmlinux.o (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add 'alt_group' struct (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Clean up elf_write() condition (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add support for relocations without addends (Matt Helsley)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Rename rela to reloc (Matt Helsley)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: optimize add_dead_ends for split sections (Sami Tolvanen)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Move the IRET hack into the arch decoder (Miroslav Benes)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename elf_read() to elf_open_read() (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Constify 'struct elf *' parameters (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize !vmlinux.o again (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Better handle IRET (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/unwind_hints: define unwind_hint_save, unwind_hint_restore (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add abstraction for destination offsets (Raphael Gault)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Fix off-by-one in symbol_by_offset() (Julien Thierry)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_rela_by_dest_range() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize read_sections() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename find_containing_func() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_*() and read_symbols() (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_section_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_section_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add a statistics mode (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn_all() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Introduce validate_return() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Improve call destination function detection (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Fix clang switch table edge case (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add relocation check for alternative sections (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add is_static_jump() helper (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug: 34400675]     {CVE-2022-21505}
    - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly     Kuznetsov)  [Orabug: 34323859]  {CVE-2022-2153}
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug:
    34323859]  {CVE-2022-2153}
    - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323859]     {CVE-2022-2153}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.209-116.363. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-034 advisory.

    An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver     functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data. This flaw allows a     local user to crash or potentially escalate their privileges on the system. (CVE-2021-33655)

    A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505)

    A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides     incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2022-34918)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix race condition between ext4_write and ext4_convert_inline_data (CVE-2022-49414)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/mempolicy: fix uninit-value in mpol_rebind_policy() (CVE-2022-49567)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_max_reordering. (CVE-2022-49571)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. (CVE-2022-49572)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_early_retrans. (CVE-2022-49573)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_recovery. (CVE-2022-49574)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. (CVE-2022-49575)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: Fix a data-race around sysctl_udp_l3mdev_accept. (CVE-2022-49577)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. (CVE-2022-49580)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix handling of dummy receive descriptors (CVE-2022-49583)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero (CVE-2022-49584)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_fastopen. (CVE-2022-49586)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_notsent_lowat. (CVE-2022-49587)

    In the Linux kernel, the following vulnerability has been resolved:

    igmp: Fix data-races around sysctl_igmp_qrv. (CVE-2022-49589)

    In the Linux kernel, the following vulnerability has been resolved:

    igmp: Fix data-races around sysctl_igmp_llm_reports. (CVE-2022-49590)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_probe_interval. (CVE-2022-49593)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. (CVE-2022-49594)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix a data-race around sysctl_tcp_probe_threshold. (CVE-2022-49595)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_min_snd_mss. (CVE-2022-49596)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_base_mss. (CVE-2022-49597)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Fix data-races around sysctl_tcp_mtu_probing. (CVE-2022-49598)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (CVE-2022-49601)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: Fix a data-race around sysctl_fwmark_reflect. (CVE-2022-49602)

    In the Linux kernel, the following vulnerability has been resolved:

    ip: Fix data-races around sysctl_ip_fwd_use_pmtu. (CVE-2022-49604)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() (CVE-2022-49607)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: ralink: Check for null return of devm_kcalloc (CVE-2022-49608)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tipc: fix possible refcount leak in tipc_sk_create() (CVE-2022-49620)

    In the Linux kernel, the following vulnerability has been resolved:

    raw: Fix a data-race around sysctl_raw_l3mdev_accept. (CVE-2022-49631)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix a data-race around sysctl_fib_sync_mem. (CVE-2022-49637)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp: Fix data-races around sysctl. (CVE-2022-49638)

    In the Linux kernel, the following vulnerability has been resolved:

    cipso: Fix data-races around sysctl. (CVE-2022-49639)

    In the Linux kernel, the following vulnerability has been resolved:

    ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup: Use separate src/dst nodes when preloading css_sets for migration (CVE-2022-49647)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue (CVE-2022-49649)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: fix memory leak in error case (CVE-2022-49657)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slub: add missing TID updates on slab deactivation (CVE-2022-49700)

    A NULL pointer dereference issue was found in the SCTP network protocol in net/sctp/stream_sched.c in the     Linux kernel. If stream_in allocation fails, stream_out is freed, which would be accessed further. This     flaw allows a local user to crash the system or potentially cause a denial of service. (CVE-2023-2177)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0158 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-33655:
    When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds.

    CVE-2021-33656:
    When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.

    CVE-2022-0494:
    A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality.

    CVE-2022-0500:
    A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernels BPF subsystem due to the way a user loads BTF. This flaw allows a     local user to crash or escalate their privileges on the system.

    CVE-2022-1012:
    A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem.

    CVE-2022-1184:
    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernels filesystem     sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.

    CVE-2022-1462:
    An out-of-bounds read flaw was found in the Linux kernels TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory.

    CVE-2022-1652:
    Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system.

    CVE-2022-1729:
    A use-after-free flaw was found in the Linux kernels performance events functionality. A user triggers     a race condition in setting up performance monitoring between the leading PERF_TYPE_TRACEPOINT and sub     PERF_EVENT_HARDWARE plus the PERF_EVENT_SOFTWARE using the perf_event_open() function with these three     types. This flaw allows a local user to crash the system.

    CVE-2022-1734:
    A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.

    CVE-2022-1786:
    A use-after-free flaw was found in the Linux kernels io_uring subsystem in the way a user sets up a     ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw     allows a local user to crash or escalate their privileges on the system.

    CVE-2022-1789:
    With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.

    CVE-2022-1836:
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-33981. Reason: This candidate is a     reservation duplicate of CVE-2022-33981. Notes: All CVE users should reference CVE-2022-33981 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.

    CVE-2022-1966:
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a     duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.

    CVE-2022-1972:
    CVE-2022-1972 is duplicate of CVE-2022-2078, so please consider CVE-2022-2078 instead.

    CVE-2022-1974:
    A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information.

    CVE-2022-1975:
    No description is available for this CVE.

    CVE-2022-2078:
    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code.

    CVE-2022-21123:
    Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access.

    CVE-2022-21125:
    Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access.

    CVE-2022-21166:
    Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access.

    CVE-2022-21499:
    KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and     Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

    CVE-2022-21505:
    A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled

    CVE-2022-2153:
    A flaw was found in the Linux kernels KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service.

    CVE-2022-2318:
    There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges.

    CVE-2022-23816:
    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions.

    CVE-2022-2503:
    Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates.

    CVE-2022-2586:
    A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in     the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the     time of table deletion, possibly leading to local privilege escalation.

    CVE-2022-2588:
    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem.

    CVE-2022-26365:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-2639:
    An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system.

    CVE-2022-28893:
    The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets     are in the intended state.

    CVE-2022-29581:
    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions.

    CVE-2022-2959:
    A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring().
    The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper     locking when performing operations on an object. This flaw allows a local user to crash the system or     escalate their privileges on the system.

    CVE-2022-2978:
    A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function     security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use     this flaw to crash the system or potentially escalate their privileges on the system.

    CVE-2022-29900:
    Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions.

    CVE-2022-29901:
    Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions.

    CVE-2022-32250:
    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free.

    CVE-2022-32296:
    The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used.

    CVE-2022-32981:
    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers.

    CVE-2022-33740:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33741:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33742:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33743:
    network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed.

    CVE-2022-33744:
    Linux disk/nic frontends data leaks [This CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742).

    CVE-2022-33981:
    drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.

    CVE-2022-34918:
    An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c.

    CVE-2022-36123:
    The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges.

    CVE-2022-36879:
    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

    CVE-2022-36946:
    nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167017	Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-185)	Nessus	Amazon Linux Local Security Checks	2022/11/5	2026/2/24	high
163277	Oracle Linux 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9602)	Nessus	Oracle Linux Local Security Checks	2022/7/19	2026/2/9	medium
203284	Photon OS 4.0: Linux PHSA-2022-4.0-0214	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
165100	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-007)	Nessus	Amazon Linux Local Security Checks	2022/9/15	2026/2/26	medium
163995	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2722-1)	Nessus	SuSE Local Security Checks	2022/8/10	2023/7/14	high
187326	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2025/9/25	high
163286	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9612)	Nessus	Oracle Linux Local Security Checks	2022/7/20	2026/2/9	medium
164359	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-019)	Nessus	Amazon Linux Local Security Checks	2022/8/23	2024/1/16	high
164136	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9710)	Nessus	Oracle Linux Local Security Checks	2022/8/16	2026/2/9	high
164357	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-034)	Nessus	Amazon Linux Local Security Checks	2022/8/23	2026/2/26	high
236488	Alibaba Cloud Linux 3 : 0158: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2022:0158)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/9/24	high

检测

插件搜索

high

medium

medium

medium

high

high

medium

high

high

high

high