The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3173 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3173-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     November 1, 2022                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.149-2~deb10u1     CVE ID         : CVE-2021-4037 CVE-2022-0171 CVE-2022-1184 CVE-2022-1679                      CVE-2022-2153 CVE-2022-2602 CVE-2022-2663 CVE-2022-2905                      CVE-2022-3028 CVE-2022-3061 CVE-2022-3176 CVE-2022-3303                      CVE-2022-3586 CVE-2022-3621 CVE-2022-3625 CVE-2022-3629                      CVE-2022-3633 CVE-2022-3635 CVE-2022-3646 CVE-2022-3649                      CVE-2022-20421 CVE-2022-20422 CVE-2022-39188 CVE-2022-39190                      CVE-2022-39842 CVE-2022-40307 CVE-2022-41222 CVE-2022-41674                      CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722                      CVE-2022-43750     Debian Bug     : 1017425 1019248

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2021-4037

        Christian Brauner reported that the inode_init_owner function for         the XFS filesystem in the Linux kernel allows local users to         create files with an unintended group ownership allowing attackers         to escalate privileges by making a plain file executable and SGID.

    CVE-2022-0171

        Mingwei Zhang reported that a cache incoherence issue in the SEV         API in the KVM subsystem may result in denial of service.

    CVE-2022-1184

        A flaw was discovered in the ext4 filesystem driver which can lead         to a use-after-free. A local user permitted to mount arbitrary         filesystems could exploit this to cause a denial of service (crash         or memory corruption) or possibly for privilege escalation.

    CVE-2022-1679

        The syzbot tool found a race condition in the ath9k_htc driver         which can lead to a use-after-free.  This might be exploitable to         cause a denial service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2022-2153

        kangel reported a flaw in the KVM implementation for x86         processors which could lead to a null pointer dereference. A local         user permitted to access /dev/kvm could exploit this to cause a         denial of service (crash).

    CVE-2022-2602

        A race between handling an io_uring request and the Unix socket         garbage collector was discovered. An attacker can take advantage         of this flaw for local privilege escalation.

    CVE-2022-2663

        David Leadbeater reported flaws in the nf_conntrack_irc         connection-tracking protocol module. When this module is enabled         on a firewall, an external user on the same IRC network as an         internal user could exploit its lax parsing to open arbitrary TCP         ports in the firewall, to reveal their public IP address, or to         block their IRC connection at the firewall.

    CVE-2022-2905

        Hsin-Wei Hung reported a flaw in the eBPF verifier which can lead         to an out-of-bounds read.  If unprivileged use of eBPF is enabled,         this could leak sensitive information.  This was already disabled         by default, which would fully mitigate the vulnerability.

    CVE-2022-3028

        Abhishek Shah reported a race condition in the AF_KEY subsystem,         which could lead to an out-of-bounds write or read.  A local user         could exploit this to cause a denial of service (crash or memory         corruption), to obtain sensitive information, or possibly for         privilege escalation.

    CVE-2022-3061

        A flaw was discovered in the i740 driver which may result in         denial of service.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-3176

        A use-after-free flaw was discovered in the io_uring subsystem         which may result in local privilege escalation to root.

    CVE-2022-3303

        A race condition in the snd_pcm_oss_sync function in the sound         subsystem in the Linux kernel due to improper locking may result         in denial of service.

    CVE-2022-3586 (ZDI-22-1452)

        The Zero Day Initiative reported a flaw in the sch_sfb network         scheduler, which may lead to a use-after-free and leak of         sensitive information from the kernel.

    CVE-2022-3621, CVE-2022-3646

        The syzbot tool found flaws in the nilfs2 filesystem driver which         can lead to a null pointer dereference or memory leak.  A user         permitted to mount arbitrary filesystem images could use these to         cause a denial of service (crash or resource exhaustion).

    CVE-2022-3625

        A flaw was discovered in the devlink subsystem which can lead to         a use-after-free.  The security impact of this is unclear.

    CVE-2022-3629

        The syzbot tool found a memory leak in the Virtual Socket Protocol         implementation.  A local user could exploit this to cause a denial         of service (resource exhaustion).

    CVE-2022-3633

        The Linux Verification Center found a memory leak in the SAE J1939         protocol implementation.  A local user could exploit this to cause         a denial of service (resource exhaustion).

    CVE-2022-3635

        Several race conditions were discovered in the idt77252 ATM         driver, which can lead to a use-after-free if the module is         removed.  The security impact of this is unclear.

    CVE-2022-3649

        The syzbot tool found flaws in the nilfs2 filesystem driver which         can lead to a use-after-free.  A user permitted to mount arbitrary         filesystem images could use these to cause a denial of service         (crash or memory corruption) or possibly for privilege escalation.

    CVE-2022-20421

        A use-after-free vulnerability was discovered in the         binder_inc_ref_for_node function in the Android binder driver. On         systems where the binder driver is loaded, a local user could         exploit this for privilege escalation.

    CVE-2022-20422

        A race condition was discovered in the instruction emulator for         64-bit Arm systems.  Concurrent changes to the sysctls that         control the emulator could result in a null pointer dereference.
        The security impact of this is unclear.

    CVE-2022-39188

        Jann Horn reported a race condition in the kernel's handling of         unmapping of certain memory ranges. When a driver created a memory         mapping with the VM_PFNMAP flag, which many GPU drivers do, the         memory mapping could be removed and freed before it was flushed         from the CPU TLBs. This could result in a page use-after-free. A         local user with access to such a device could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2022-39190

        Gwangun Jung reported a flaw in the nf_tables subsystem.  A local         user could exploit this to cause a denial of service (crash).

    CVE-2022-39842

        An integer overflow was discovered in the pxa3xx-gcu video driver         which could lead to a heap out-of-bounds write.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-40307

        A race condition was discovered in the EFI capsule-loader driver,         which could lead to use-after-free. A local user permitted to         access this device (/dev/efi_capsule_loader) could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation. However, this device is normally only         accessible by the root user.

    CVE-2022-41222

        A race condition was discovered in the memory management subsystem         that can lead to stale TLB entries.  A local user could exploit         this to cause a denial of service (memory corruption or crash),         information leak, or privilege escalation.

    CVE-2022-41674, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721,     CVE-2022-42722

        Soenke Huster discovered several vulnerabilities in the mac80211         subsystem triggered by WLAN frames which may result in denial of         service or the execution of arbitrary code.

    CVE-2022-43750

        The syzbot tool found that the USB monitor (usbmon) driver allowed         user-space programs to overwrite the driver's data structures.  A         local user permitted to access a USB monitor device could exploit         this to cause a denial of service (memory corruption or crash) or         possibly for privilege escalation.  However, by default only the         root user can access such devices.

    For Debian 10 buster, these problems have been fixed in version     5.10.149-2~deb10u1.  This update also fixes a regression for some     older 32-bit PCs (bug #1017425), and enables the i10nm_edac driver     (bug #1019248).  It additionally includes many more bug fixes from     stable updates 5.10.137-5.10.149 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

    --     Ben Hutchings - Debian developer, member of kernel, installer and LTS teams     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0854 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)

    * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

    * kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8-RT: Backport use of a dedicate thread for timer wakeups (BZ#2127204)

    * SNO Crashed twice - kernel BUG at lib/list_debug.c:28 (BZ#2132062)

    * Cannot trigger kernel dump using NMI on SNO node running PAO and RT kernel  [RT-8] (BZ#2139851)

    * scheduling while atomic in fpu_clone() -> fpu_inherit_perms() (BZ#2154469)

    * The latest RHEL 8.7.z2 kernel changes need to be merged into the RT source tree to keep source parity     between the two kernels. (BZ#2159806)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0832 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)

    * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

    * kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134586)

    * Hardware error: RIP: copy_user_enhanced_fast_string+0xe (BZ#2137592)

    * Cannot trigger kernel dump using NMI on SNO node running PAO and RT kernel (BZ#2139580)

    * MEI support for Alder Lake-S (BZ#2141783)

    * Host Pod -> Cluster IP Service traffic (Pod Backend - Different Node) Flow Iperf Cannot Connect     (BZ#2141959)

    * RHEL8.7: Xorg cannot display resolution higher than 1024x768 on system using ast graphics driver     (BZ#2149287)

    * Intel 8.7 Bug: OS doesn't boot when vmd and interrupt remapping are enabled (BZ#2149474)

    * i40e,iavf: SR-IOV VF devices send GARP with wrong MAC address (BZ#2149745)

    * RHEL8.4 - boot: Add secure boot trailer (BZ#2151530)

    * error 524 from seccomp(2) when trying to load filter (BZ#2152138)

    * Workqueue: WQ_MEM_RECLAIM iscsi_ctrl_1:98 __iscsi_unbind_session [scsi_transport_iscsi] (BZ#2152734)

    * Connectivity issue with vDPA driver (BZ#2152912)

    * High Load average due to cfs cpu throttling (BZ#2153108)

    * The kernel BUG at mm/usercopy.c:103! from BZ 2041529 is back on rhel-8.5 (BZ#2153230)

    * RHEL8: tick storm on nohz (isolated) CPU cores (BZ#2153653)

    * kernel BUG: scheduling while atomic: crio/7295/0x00000002 (BZ#2154460)

    * Azure RHEL 8 z-stream: Sometimes newly deployed VMs are not getting accelerated network during     provisioning (BZ#2155272)

    * Azure: VM Deployment Failures Patch Request (BZ#2155280)

    * Azure vPCI RHEL-8: add the support of multi-MSI (BZ#2155289)

    * MSFT MANA NET Patch RHEL-8: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155437)

    * GSS: OCP 4.10.30 node crash after ODF upgrade : unable to handle kernel NULL pointer dereference at     0000000000000000 : ceph_get_snap_realm+0x68/0xa0 [ceph] (BZ#2155797)

    * Error in /usr/src/kernels/4.18.0-423.el8.x86_64/scripts/kernel-doc script causing irdma build to fail     (BZ#2157905)

    * RHEL8.8: Backport upstream patches to reduce memory cgroup memory consumption and OOM problem     (BZ#2157922)

    * The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158813)

    * ethtool -m results in an out-of-bounds slab write in the be2net driver (BZ#2160182)

    * (Redhat OpenShift)Error downloading big ZIP files inside pod on power OCP and pod getting restarted     (BZ#2160221)

    * i40e/iavf: VF reset task fails Never saw reset with 5 second timeout per VF (BZ#2160460)

    * iavf: It takes long time to create multiple VF interfaces and the VF interface names are not consistent     (BZ#2163257)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0832 advisory.

  - An out-of-bounds memory access flaw was found in the Linux kernel Intel's iSMT SMBus host controller     driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input     data. This flaw allows a local user to crash the system. (CVE-2022-2873)

  - mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

  - The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer     overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send     buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer     to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC     message with garbage data is still correctly formed according to the specification and is passed forward     to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the     allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0832 advisory.

    - mm/mremap: hold the rmap lock in write mode when moving page table entries. (Waiman Long) [2140944]     {CVE-2022-41222}
    - mm/mremap: use pmd/pud_poplulate to update page table entries (Waiman Long) [2140944] {CVE-2022-41222}
    - mm/mremap: don't enable optimized PUD move if page table levels is 2 (Waiman Long) [2140944]     {CVE-2022-41222}
    - mm/mremap: convert huge PUD move to separate helper (Waiman Long) [2140944] {CVE-2022-41222}
    - mm/mremap: fix BUILD_BUG_ON() error in get_extent (Waiman Long) [2140944] {CVE-2022-41222}
    - mm/mremap.c: fix extent calculation (Waiman Long) [2140944] {CVE-2022-41222}
    - x86: mremap speedup - Enable HAVE_MOVE_PUD (Waiman Long) [2140944] {CVE-2022-41222}
    - mm: speedup mremap on 1GB or larger regions (Waiman Long) [2140944] {CVE-2022-41222}
    - mm/mremap: start addresses are properly aligned (Waiman Long) [2140944] {CVE-2022-41222}
    - mm/mremap: calculate extent in one place (Waiman Long) [2140944] {CVE-2022-41222}
    - mm/mremap: it is sure to have enough space when extent meets requirement (Waiman Long) [2140944]     {CVE-2022-41222}
    - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Prarit Bhargava) [2154388 2119066] {CVE-2022-2873}
    - NFSD: Protect against send buffer overflow in NFSv3 READ (Scott Mayhew) [2143172 2141774]     {CVE-2022-43945}
    - NFSD: Protect against send buffer overflow in NFSv2 READ (Scott Mayhew) [2143172 2141774]     {CVE-2022-43945}
    - NFSD: Protect against send buffer overflow in NFSv3 READDIR (Scott Mayhew) [2143172 2141774]     {CVE-2022-43945}
    - NFSD: Protect against send buffer overflow in NFSv2 READDIR (Scott Mayhew) [2143172 2141774]     {CVE-2022-43945}
    - SUNRPC: Fix svcxdr_init_encode's buflen calculation (Scott Mayhew) [2143172 2141774] {CVE-2022-43945}
    - SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation (Scott Mayhew) [2143172 2141774]     {CVE-2022-43945}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
166822	Debian dla-3173 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	2022/11/2	2025/1/22	high
171717	RHEL 8 : kernel-rt (RHSA-2023:0854)	Nessus	Red Hat Local Security Checks	2023/2/21	2024/11/7	high
171723	RHEL 8 : kernel (RHSA-2023:0832)	Nessus	Red Hat Local Security Checks	2023/2/21	2024/11/8	high
171738	AlmaLinux 8 : kernel (ALSA-2023:0832)	Nessus	Alma Linux Local Security Checks	2023/2/21	2023/2/22	high
171797	Oracle Linux 8 : kernel (ELSA-2023-0832)	Nessus	Oracle Linux Local Security Checks	2023/2/22	2026/2/9	high

检测

插件搜索

high

high

high

high

high